feat: persist participant-scoped proposal recovery

server/store/proposal_recovery_sql.go

@@ -0,0 +1,77 @@
+package store
+
+import (
+	"context"
+	"database/sql"
+	"fmt"
+	"time"
+
+	"github.com/cosmic-clash/cosmic-clash/server/domain"
+)
+
+const ProposalExpireSQL = `UPDATE proposals
+SET state = 'EXPIRED', revision = revision + 1
+WHERE proposal_id = $1 AND state = 'OPEN' AND expires_at <= $2`
+
+const ProposalParticipantExpireSQL = `UPDATE proposal_participants
+SET response = 'TIMED_OUT', responded_at = $2
+WHERE proposal_id = $1 AND response = 'PENDING'`
+
+const ProposalRecoverySelectSQL = `SELECT proposal_id, playlist, state, revision, expires_at
+FROM proposals
+WHERE proposal_id = $1
+  AND EXISTS (SELECT 1 FROM proposal_participants WHERE proposal_id = proposals.proposal_id AND player_id = $2)`
+
+const ProposalParticipantsSelectSQL = `SELECT player_id, response
+FROM proposal_participants
+WHERE proposal_id = $1
+ORDER BY player_id`
+
+// GetProposal recovers the full proposal only after proving the caller is a
+// participant. Expiry is advanced in the same transaction as the read so a
+// missed event cannot leave a durable proposal indefinitely OPEN.
+func GetProposal(ctx context.Context, db *sql.DB, playerID, proposalID string, now time.Time) (domain.Proposal, error) {
+	if db == nil || playerID == "" || proposalID == "" || now.IsZero() {
+		return domain.Proposal{}, fmt.Errorf("invalid proposal recovery arguments")
+	}
+	tx, err := db.BeginTx(ctx, nil)
+	if err != nil {
+		return domain.Proposal{}, err
+	}
+	defer tx.Rollback()
+	if _, err := tx.ExecContext(ctx, ProposalExpireSQL, proposalID, now); err != nil {
+		return domain.Proposal{}, err
+	}
+	if _, err := tx.ExecContext(ctx, ProposalParticipantExpireSQL, proposalID, now); err != nil {
+		return domain.Proposal{}, err
+	}
+	var proposal domain.Proposal
+	var playlist, state string
+	if err := tx.QueryRowContext(ctx, ProposalRecoverySelectSQL, proposalID, playerID).Scan(&proposal.ProposalID, &playlist, &state, &proposal.Revision, &proposal.ExpiresAt); err != nil {
+		return domain.Proposal{}, err
+	}
+	proposal.Playlist = domain.Playlist(playlist)
+	proposal.State = domain.State(state)
+	rows, err := tx.QueryContext(ctx, ProposalParticipantsSelectSQL, proposalID)
+	if err != nil {
+		return domain.Proposal{}, err
+	}
+	defer rows.Close()
+	for rows.Next() {
+		var participant domain.ProposalParticipant
+		if err := rows.Scan(&participant.PlayerID, &participant.Response); err != nil {
+			return domain.Proposal{}, err
+		}
+		proposal.Participants = append(proposal.Participants, participant)
+	}
+	if err := rows.Err(); err != nil {
+		return domain.Proposal{}, err
+	}
+	if len(proposal.Participants) == 0 {
+		return domain.Proposal{}, fmt.Errorf("proposal has no participants")
+	}
+	if err := tx.Commit(); err != nil {
+		return domain.Proposal{}, err
+	}
+	return proposal, nil
+}

server/store/proposal_recovery_sql_test.go

@@ -0,0 +1,30 @@
+package store
+
+import (
+	"testing"
+	"time"
+)
+
+func TestProposalRecoverySQLBindsParticipantAndExpiresAtReadBoundary(t *testing.T) {
+	for query, fragments := range map[string][]string{
+		ProposalExpireSQL:             {"state = 'OPEN'", "expires_at <= $2", "revision = revision + 1"},
+		ProposalParticipantExpireSQL:  {"response = 'PENDING'", "response = 'TIMED_OUT'"},
+		ProposalRecoverySelectSQL:     {"proposal_id = $1", "player_id = $2", "EXISTS"},
+		ProposalParticipantsSelectSQL: {"proposal_id = $1", "ORDER BY player_id"},
+	} {
+		for _, fragment := range fragments {
+			if !contains(query, fragment) {
+				t.Fatalf("query %q missing %q", query, fragment)
+			}
+		}
+	}
+}
+
+func TestProposalRecoveryRejectsMissingAuthorityInputs(t *testing.T) {
+	if _, err := GetProposal(nil, nil, "player-1", "proposal-1", time.Unix(1000, 0)); err == nil {
+		t.Fatal("nil database accepted")
+	}
+	if _, err := GetProposal(nil, nil, "", "proposal-1", time.Unix(1000, 0)); err == nil {
+		t.Fatal("empty player accepted")
+	}
+}