From 09b56818d7dfa851df8636ebd2b83b251fd34bed Mon Sep 17 00:00:00 2001
From: npub1jmc9dt2lyvzu3h0kxlwxt5zg4fxp9476awyxw6gwxn72g6cw7exqs64whm
 <96f056ad5f2305c8ddf637dc65d048aa4c12d7daeb8867690e34fca46b0ef64c@sprout-oss.stage.blox.sqprod.co>
Date: Sat, 27 Jun 2026 00:37:55 -0400
Subject: [PATCH] test(buzz-db): pin communities_of_channels
 missing-channel-absent contract
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The relay-side read-row emitter relies on a load-bearing contract from
`Db::communities_of_channels`: a channel id with no row in the DB MUST
be absent from the returned map, never mapped to a default. The relay's
`MissingLookup → ImplBug{row_community_lookup_missing} → CoverageBreach`
fail-closed guard-rail goes blind if this helper ever started returning
a default/zero entry for unknown channels — and the relay-side
mutate-bite for that guard-rail wouldn't catch it (different layer).

This adds a PG-ignored test that pins both directions:
- (1) Existing channel → present with its true community.
- (2) Missing channel → ABSENT from the result map (load-bearing).
- (3) Map size equals the number of existing channels.

Mutate → red → restore verified against live Postgres:
  Mutant: post-loop `for ch in channel_ids { entry().or_insert(nil) }`
  Result: assertion (2) bites with explicit message
          "missing channel must be absent from the result map,
           got Some(CommunityId(00000000-…))"
  Restored: green.

Closes the read-seam fail-closed chain end-to-end (DB layer through
checker), making it non-vacuous across both layers.

Co-authored-by: Tyler Longwell <tlongwell@block.xyz>
Signed-off-by: Tyler Longwell <tlongwell@block.xyz>
---
 crates/buzz-db/src/lib.rs | 97 +++++++++++++++++++++++++++++++++++++++
 1 file changed, 97 insertions(+)

diff --git a/crates/buzz-db/src/lib.rs b/crates/buzz-db/src/lib.rs
index 499450807..fc9c5477e 100644
--- a/crates/buzz-db/src/lib.rs
+++ b/crates/buzz-db/src/lib.rs
@@ -2246,3 +2246,100 @@ fn parse_api_token_row(row: sqlx::postgres::PgRow) -> Result<ApiTokenRecord> {
         revoked_at: row.try_get("revoked_at")?,
     })
 }
+
+#[cfg(test)]
+mod tests {
+    //! Pin the load-bearing contract for `Db::communities_of_channels`:
+    //! a channel id that does NOT exist MUST be absent from the result
+    //! map, never mapped to a default. The relay-side read-row emitter
+    //! relies on this — a missing entry triggers `MissingLookup →
+    //! ImplBug{row_community_lookup_missing} → CoverageBreach`. If this
+    //! helper ever started returning a default/zero entry for unknown
+    //! channels, that fail-closed chain would go blind.
+    use super::*;
+    use buzz_core::CommunityId;
+    use sqlx::PgPool;
+    use uuid::Uuid;
+
+    const TEST_DB_URL: &str = "postgres://buzz:buzz_dev@localhost:5432/buzz";
+
+    async fn setup_db() -> Db {
+        let pool = PgPool::connect(TEST_DB_URL)
+            .await
+            .expect("connect to test DB");
+        Db { pool }
+    }
+
+    async fn make_community(pool: &PgPool) -> Uuid {
+        let id = Uuid::new_v4();
+        let host = format!("communities-of-channels-{}.example", id.simple());
+        sqlx::query("INSERT INTO communities (id, host) VALUES ($1, $2)")
+            .bind(id)
+            .bind(host)
+            .execute(pool)
+            .await
+            .expect("insert community");
+        id
+    }
+
+    async fn insert_channel(pool: &PgPool, community_id: Uuid, channel_id: Uuid) {
+        let creator: Vec<u8> = vec![0u8; 32];
+        sqlx::query(
+            r#"
+            INSERT INTO channels
+                (id, community_id, name, channel_type, visibility, created_by)
+            VALUES
+                ($1, $2, $3, 'stream'::channel_type, 'open'::channel_visibility, $4)
+            "#,
+        )
+        .bind(channel_id)
+        .bind(community_id)
+        .bind(format!("ch-{}", channel_id.simple()))
+        .bind(&creator)
+        .execute(pool)
+        .await
+        .expect("insert channel");
+    }
+
+    #[tokio::test]
+    #[ignore = "requires Postgres"]
+    async fn communities_of_channels_present_for_existing_absent_for_missing() {
+        let db = setup_db().await;
+        let community = make_community(&db.pool).await;
+        let existing = Uuid::new_v4();
+        insert_channel(&db.pool, community, existing).await;
+
+        // Channel that is NOT inserted — the load-bearing case.
+        let missing = Uuid::new_v4();
+
+        let result = db
+            .communities_of_channels(&[existing, missing])
+            .await
+            .expect("communities_of_channels");
+
+        // (1) Existing channel → present with its true community.
+        assert_eq!(
+            result.get(&existing).copied(),
+            Some(CommunityId::from_uuid(community)),
+            "existing channel must map to its true community",
+        );
+
+        // (2) Missing channel → ABSENT from the map (never defaulted).
+        // This is the contract the relay-side `MissingLookup → ImplBug`
+        // fail-closed guard-rail depends on. If this assertion ever
+        // weakens to `result.get(&missing) != Some(community)`, the
+        // mutate-bite below stops biting.
+        assert!(
+            !result.contains_key(&missing),
+            "missing channel must be absent from the result map, got {:?}",
+            result.get(&missing),
+        );
+
+        // (3) Map size matches: exactly one entry, the existing one.
+        assert_eq!(
+            result.len(),
+            1,
+            "result map must contain only existing channels"
+        );
+    }
+}