Artifact [253e0e0672]

Artifact 253e0e0672a14c46e459c3db0a4131740d2edc3b16e485fc20320f560f0cb991:

• File internal/manifest/bounds_test.go — part of check-in [9a2697c556] at 2026-07-19 16:00:36 on branch trunk — fix: split repository enumeration from ancestry walking (#45) (#54)

  Repo.Timeline was an ancestry walk wearing an enumeration's name: it required a start rid, emitted that check-in, followed plink where isprim=1 to the primary parent, and repeated until the chain ended. It never touched the event table and never visited a second parent or a sibling branch head, so it silently omitted any check-in that wasn't a first-parent ancestor of the given start rid — on libfossil's own repository that was 577 of 3,761 check-ins, with no error and no warning. The limit option never bound because the (wrong) walk exhausted first.

  Split into two operations under honest names:

  - Repo.Timeline(TimelineOpts) enumerates the event table newest first, every kind by default or a single kind via Type. This matches canonical `fossil timeline`'s -t/--type default (a filter only applies when given and not 'a'). - Repo.Ancestry(LogOpts) keeps the original first-parent walk, unchanged in behavior, under a name that says what it does.

  Breaking change, no deprecated shim (pre-1.0, clean break): callers of the old Timeline(LogOpts) need to move to Ancestry(LogOpts) if they want the walk, or to Timeline(TimelineOpts) if they want the enumeration fossil's own timeline command performs. The only in-tree callers were the `repo timeline` CLI command and the two examples; all three are migrated to Timeline(TimelineOpts). See CHANGELOG.md.

  LogEntry gains a Kind field identifying which of event.type's six kinds (ci, e, f, g, t, w) an entry is; Parents is only populated for check-ins, since plink only relates check-in artifacts.

  Timeline's pagination cursor orders by (mtime DESC, rid DESC) instead of canonical fossil's bare mtime DESC with no tie-break — a deliberate improvement, not an oversight, since fossil's web cursor combines that missing tie-break with a one-second timestamp slop and can repeat or skip rows at a page boundary. Getting the composite cursor to actually round-trip losslessly required fixing a real bug along the way: JulianToTime truncated instead of rounded when converting a julian day back to milliseconds, so TimeToJulian(JulianToTime(m)) was not always equal to m even for exact-millisecond inputs — enough to misplace a row at a page boundary under exactly the same-mtime conditions this issue's acceptance criteria test for. Fixed to round to nearest. Because the same class of drift also appears in the ncruces/WASM sqlite driver's own internal REAL-to-time.Time conversion (independent of this library's code), the cursor comparison also carries a small explicit tolerance rather than relying on bit-exact equality across drivers.

  Both the ancestry walk's loop and the enumeration's row loop now carry an explicit, testable bound so a corrupt or cyclic plink table can't hang the process. (user: [email protected], size: 2604) [annotate] [blame] [check-ins using]

package manifest

import (
	"testing"
	"time"
)

// TestLogBoundedAgainstPlinkCycle covers the TigerStyle requirement that
// the ancestry walk's loop has an explicit, defensible bound: a corrupt or
// cyclic plink table must produce an error, not hang the process. The
// bound is shrunk for the duration of the test so this runs in
// milliseconds instead of walking maxAncestryDepth's real-world value.
func TestLogBoundedAgainstPlinkCycle(t *testing.T) {
	orig := maxAncestryDepth
	maxAncestryDepth = 3
	t.Cleanup(func() { maxAncestryDepth = orig })

	r := setupTestRepo(t)
	rid1, _, _ := Checkin(r, CheckinOpts{
		Files:   []File{{Name: "a.txt", Content: []byte("v1")}},
		Comment: "first", User: "testuser",
		Time: time.Date(2024, 1, 15, 10, 0, 0, 0, time.UTC),
	})
	rid2, _, _ := Checkin(r, CheckinOpts{
		Files:   []File{{Name: "a.txt", Content: []byte("v2")}},
		Comment: "second", User: "testuser", Parent: rid1,
		Time: time.Date(2024, 1, 15, 11, 0, 0, 0, time.UTC),
	})
	// Corrupt the plink table into a 2-cycle: rid1's primary parent becomes
	// rid2, while rid2's primary parent is already rid1 from the checkin
	// above. Following isprim=1 from rid2 now loops forever without a bound.
	if _, err := r.DB().Exec(
		"INSERT INTO plink(pid, cid, isprim, mtime) VALUES(?, ?, 1, 0)",
		rid2, rid1,
	); err != nil {
		t.Fatalf("corrupt plink: %v", err)
	}

	_, err := Log(r, LogOpts{Start: rid2})
	if err == nil {
		t.Fatal("Log did not error on a cyclic plink chain")
	}
}

// TestTimelineBoundedRowGuard covers the same requirement on the
// enumeration side: an unbounded (Limit <= 0) query against more rows
// than the configured guard allows must error rather than grow without
// limit.
func TestTimelineBoundedRowGuard(t *testing.T) {
	orig := maxTimelineRows
	maxTimelineRows = 2
	t.Cleanup(func() { maxTimelineRows = orig })

	r := setupTestRepo(t)
	rid1, _, _ := Checkin(r, CheckinOpts{
		Files:   []File{{Name: "a.txt", Content: []byte("v1")}},
		Comment: "one", User: "testuser",
		Time: time.Date(2024, 1, 15, 10, 0, 0, 0, time.UTC),
	})
	rid2, _, _ := Checkin(r, CheckinOpts{
		Files:   []File{{Name: "a.txt", Content: []byte("v2")}},
		Comment: "two", User: "testuser", Parent: rid1,
		Time: time.Date(2024, 1, 15, 11, 0, 0, 0, time.UTC),
	})
	Checkin(r, CheckinOpts{
		Files:   []File{{Name: "a.txt", Content: []byte("v3")}},
		Comment: "three", User: "testuser", Parent: rid2,
		Time: time.Date(2024, 1, 15, 12, 0, 0, 0, time.UTC),
	})

	_, err := Timeline(r, TimelineOpts{})
	if err == nil {
		t.Fatal("Timeline did not error when row count exceeded maxTimelineRows")
	}
}