Files
pansy/internal/store/revisions.go
T
steveandClaude Opus 4.8 2dd9f2f04f
Build image / build-and-push (push) Successful in 5s
Address Gadfly review on revision history
Six real bugs, three of which would have broken the feature's central promise.

The worst was that a failed operation threw away the history for changes that
had already committed. WithChangeSet buffers HISTORY, not data — the store
writes inside fn commit as they go — so discarding the buffer on error left real
mutations with no change set and no way to undo them. That is exactly the
situation undo exists for: an agent turn that did half a thing and then failed.
Now the buffer is written, the summary says the operation failed partway, and
the error is still returned. RevertChangeSet does the same for a revert that
fails mid-loop. The partial state is still partial, but it is visible and
undoable instead of orphaned.

versionGuard falsely conflicted whenever one change set held more than one
revision for the same entity — an agent turn that moves a bed and then renames
it. Each inverse bumps the row's version, so from the second one on the
snapshot's version no longer matched the live row and the revert flagged its own
work as somebody else's edit. RevertChangeSet now tracks what it has written and
the guard compares against that.

ListChangeSets found "was this reverted?" with a LEFT JOIN, which emits one
duplicate row per revert once a change set has been reverted more than once
(undo, redo, undo again). Now a scalar subquery.

Reverting an object creation cascade-deleted anything planted in that bed since,
quietly. The plops were snapshotted so it was recoverable, but deleting
someone's plants as a side effect of an unrelated undo should be reported. It
now conflicts and leaves the bed alone.

ClearObject cleared by predicate and snapshotted by a separate read, so a plop
created between the two was removed with no revision to undo it by. It now
clears exactly the ids it read. It also returned an error when only the
post-clear re-read failed, which told the caller a clear had failed after it had
already applied — inviting a retry of an applied operation. That path now logs
the history gap and reports success, matching how record() treats its own write
failures.

RestoreObject/RestorePlanting could lose the race between the existence check
and the insert and surface a raw constraint error. The revert now re-checks and
reports ConflictExists, which is what that condition means.

RevertChangeSet takes a source, so an agent undoing its own work is
distinguishable from a person clicking undo — the whole point of the badge.

Refactoring: the three revert bodies repeated a load/guard/unsnapshot/update
skeleton (flagged by 3 of 5 models). They are now one generic revertEntity over
a small per-type op table, so the ordering, guards and conflict reporting cannot
drift apart. The API's view structs duplicated domain types that already carried
every field, against the package's direct-JSON convention — dropped. intQuery
moved next to the other request helpers. planRevert's comment said three passes
where the code runs five. A revert where every revision is already a no-op now
answers 200 rather than 201 with a null change set.

Six new tests, one per bug.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01H3zbym8Doka2d7D48maSgZ
2026-07-21 01:06:43 -04:00

197 lines
6.3 KiB
Go

package store
import (
"context"
"database/sql"
"errors"
"fmt"
"gitea.stevedudenhoeffer.com/steve/pansy/internal/domain"
)
// changeSetColumns lists change_sets columns in the order scanChangeSet expects.
const changeSetColumns = `id, garden_id, actor_id, source, summary, agent_run_id, reverts_id, created_at`
func scanChangeSet(s scanner) (*domain.ChangeSet, error) {
var cs domain.ChangeSet
if err := s.Scan(
&cs.ID, &cs.GardenID, &cs.ActorID, &cs.Source, &cs.Summary,
&cs.AgentRunID, &cs.RevertsID, &cs.CreatedAt,
); err != nil {
return nil, err
}
return &cs, nil
}
// revisionColumns lists revisions columns in the order scanRevision expects.
const revisionColumns = `id, change_set_id, seq, entity_type, entity_id, op, before, after`
func scanRevision(s scanner) (*domain.Revision, error) {
var r domain.Revision
if err := s.Scan(
&r.ID, &r.ChangeSetID, &r.Seq, &r.EntityType, &r.EntityID, &r.Op, &r.Before, &r.After,
); err != nil {
return nil, err
}
return &r, nil
}
// WriteChangeSet inserts a change set and all of its revisions in one
// transaction, so history never records half an operation. The service buffers
// revisions while the operation runs and calls this once it has succeeded —
// which is also why an operation that fails partway leaves no change set behind.
// seq is assigned from the slice order. Returns the stored change set.
func (d *DB) WriteChangeSet(ctx context.Context, cs *domain.ChangeSet, revs []domain.Revision) (*domain.ChangeSet, error) {
tx, err := d.sql.BeginTx(ctx, nil)
if err != nil {
return nil, fmt.Errorf("store: begin change set: %w", err)
}
defer func() { _ = tx.Rollback() }()
created, err := scanChangeSet(tx.QueryRowContext(ctx,
`INSERT INTO change_sets (garden_id, actor_id, source, summary, agent_run_id, reverts_id)
VALUES (?, ?, ?, ?, ?, ?)
RETURNING `+changeSetColumns,
cs.GardenID, cs.ActorID, cs.Source, cs.Summary, cs.AgentRunID, cs.RevertsID))
if err != nil {
return nil, fmt.Errorf("store: insert change set: %w", err)
}
for i := range revs {
r := &revs[i]
if _, err := tx.ExecContext(ctx,
`INSERT INTO revisions (change_set_id, seq, entity_type, entity_id, op, before, after)
VALUES (?, ?, ?, ?, ?, ?, ?)`,
created.ID, int64(i+1), r.EntityType, r.EntityID, r.Op, r.Before, r.After,
); err != nil {
return nil, fmt.Errorf("store: insert revision: %w", err)
}
}
if err := tx.Commit(); err != nil {
return nil, fmt.Errorf("store: commit change set: %w", err)
}
return created, nil
}
// ListChangeSets returns a garden's change sets newest-first, one page at a time.
// Each carries its actor's display name, the id of the change set that reverted
// it (if any), and per-(entity,op) counts — everything the history list renders,
// without a second round-trip per row. Always a non-nil slice.
func (d *DB) ListChangeSets(ctx context.Context, gardenID int64, limit, offset int) ([]domain.ChangeSet, error) {
// The "was this reverted?" lookup is a scalar subquery, NOT a LEFT JOIN: a
// change set can be reverted more than once (undo, redo, undo again), and a
// join would then emit one duplicate row per revert and silently corrupt the
// page. MIN(id) names the first revert, which is the one worth showing.
rows, err := d.sql.QueryContext(ctx,
`SELECT `+qualifyColumns("cs", changeSetColumns)+`, u.display_name,
(SELECT MIN(r.id) FROM change_sets r WHERE r.reverts_id = cs.id)
FROM change_sets cs
JOIN users u ON u.id = cs.actor_id
WHERE cs.garden_id = ?
ORDER BY cs.id DESC
LIMIT ? OFFSET ?`,
gardenID, limit, offset)
if err != nil {
return nil, fmt.Errorf("store: list change sets: %w", err)
}
defer rows.Close()
sets := []domain.ChangeSet{}
ids := []any{}
byID := map[int64]int{}
for rows.Next() {
var cs domain.ChangeSet
if err := rows.Scan(
&cs.ID, &cs.GardenID, &cs.ActorID, &cs.Source, &cs.Summary,
&cs.AgentRunID, &cs.RevertsID, &cs.CreatedAt, &cs.ActorName, &cs.RevertedByID,
); err != nil {
return nil, fmt.Errorf("store: scan change set: %w", err)
}
byID[cs.ID] = len(sets)
ids = append(ids, cs.ID)
sets = append(sets, cs)
}
if err := rows.Err(); err != nil {
return nil, fmt.Errorf("store: iterate change sets: %w", err)
}
if len(sets) == 0 {
return sets, nil
}
// One grouped query for the whole page rather than N per-row counts.
countRows, err := d.sql.QueryContext(ctx,
`SELECT change_set_id, entity_type, op, COUNT(*)
FROM revisions
WHERE change_set_id IN (`+placeholders(len(ids))+`)
GROUP BY change_set_id, entity_type, op
ORDER BY change_set_id, entity_type, op`,
ids...)
if err != nil {
return nil, fmt.Errorf("store: count revisions: %w", err)
}
defer countRows.Close()
for countRows.Next() {
var csID int64
var c domain.ChangeCount
if err := countRows.Scan(&csID, &c.EntityType, &c.Op, &c.N); err != nil {
return nil, fmt.Errorf("store: scan revision count: %w", err)
}
if i, ok := byID[csID]; ok {
sets[i].Counts = append(sets[i].Counts, c)
}
}
if err := countRows.Err(); err != nil {
return nil, fmt.Errorf("store: iterate revision counts: %w", err)
}
return sets, nil
}
// GetChangeSet returns one change set with its revisions loaded in seq order, or
// domain.ErrNotFound.
func (d *DB) GetChangeSet(ctx context.Context, id int64) (*domain.ChangeSet, error) {
cs, err := scanChangeSet(d.sql.QueryRowContext(ctx,
`SELECT `+changeSetColumns+` FROM change_sets WHERE id = ?`, id))
if errors.Is(err, sql.ErrNoRows) {
return nil, domain.ErrNotFound
}
if err != nil {
return nil, fmt.Errorf("store: get change set: %w", err)
}
rows, err := d.sql.QueryContext(ctx,
`SELECT `+revisionColumns+` FROM revisions WHERE change_set_id = ? ORDER BY seq`, id)
if err != nil {
return nil, fmt.Errorf("store: list revisions: %w", err)
}
defer rows.Close()
cs.Revisions = []domain.Revision{}
for rows.Next() {
r, err := scanRevision(rows)
if err != nil {
return nil, fmt.Errorf("store: scan revision: %w", err)
}
cs.Revisions = append(cs.Revisions, *r)
}
if err := rows.Err(); err != nil {
return nil, fmt.Errorf("store: iterate revisions: %w", err)
}
return cs, nil
}
// placeholders returns "?, ?, …" for an IN clause of n values.
func placeholders(n int) string {
if n <= 0 {
return "NULL"
}
b := make([]byte, 0, n*3)
for i := 0; i < n; i++ {
if i > 0 {
b = append(b, ',', ' ')
}
b = append(b, '?')
}
return string(b)
}