ARTEX-chixuweihu/db/finding_time_sort_test.go

package db

import (
	"context"
	"fmt"
	"reflect"
	"testing"
	"time"
)

func TestFindingGroupTimeSort(t *testing.T) {
	d, task, ids := timeSortFixture(t)
	other, err := d.CreateTask("newer low severity task", "goal", nil, 0, 0)
	if err != nil {
		t.Fatal(err)
	}
	t.Cleanup(func() { _, _ = d.Exec(`DELETE FROM findings WHERE task_id=$1`, other.ID); _ = d.DeleteTask(other.ID) })
	marker := fmt.Sprintf("time-sort-%d", time.Now().UnixNano())
	if _, err := d.Exec(`UPDATE findings SET vulnclass=$2 WHERE task_id=$1`, task.ID, marker); err != nil {
		t.Fatal(err)
	}
	latest, err := d.AddFinding(other.ID, 0, marker, "latest low", "low", "summary", "evidence", "worker", nil)
	if err != nil {
		t.Fatal(err)
	}
	if _, err := d.Exec(`UPDATE findings SET created_at='2026-10-28T12:00:00Z' WHERE id=$1`, latest); err != nil {
		t.Fatal(err)
	}
	for _, tc := range []struct {
		field, direction string
		want             int64
	}{
		{"time", "desc", other.ID},
		{"time", "asc", task.ID},
		{"severity", "desc", task.ID},
		{"severity", "asc", task.ID},
	} {
		groups, total, reports, err := d.ListFindingGroups(FindingFilter{VulnClass: marker, Sort: tc.field, TimeDirection: tc.direction}, 1, 1)
		if err != nil || total != 2 || reports != len(ids)+1 || len(groups) != 1 || groups[0].TaskID == nil || *groups[0].TaskID != tc.want {
			t.Fatalf("%s/%s groups=%+v total=%d reports=%d err=%v", tc.field, tc.direction, groups, total, reports, err)
		}
	}
}

func TestFindingTimeDirectionAllowlist(t *testing.T) {
	for _, raw := range []string{"", "desc", "invalid", "ASC", "asc; SELECT 1"} {
		if got := (FindingFilter{TimeDirection: raw}).timeOrder(); got != "DESC" {
			t.Fatalf("timeOrder(%q)=%q, want DESC", raw, got)
		}
	}
	if got := (FindingFilter{TimeDirection: "asc"}).timeOrder(); got != "ASC" {
		t.Fatalf("timeOrder(asc)=%q", got)
	}
}

// A newer low-severity record and an older high-severity record make time
// ordering observably different from severity ordering in both directions.
func timeSortFixture(t *testing.T) (*DB, *Task, []int64) {
	t.Helper()
	d, task, ids := caseTestDB(t)
	for i, day := range []int{25, 26, 27, 24} {
		if _, err := d.Exec(`UPDATE findings SET created_at=$2::timestamptz WHERE id=$1`, ids[i], fmt.Sprintf("2026-10-%dT12:00:00Z", day)); err != nil {
			t.Fatal(err)
		}
	}
	if _, err := d.Exec(`UPDATE findings SET severity='critical' WHERE id=$1`, ids[0]); err != nil {
		t.Fatal(err)
	}
	if _, err := d.Exec(`UPDATE findings SET severity='high' WHERE id=$1`, ids[1]); err != nil {
		t.Fatal(err)
	}
	return d, task, ids
}

func TestFindingTimeSortPages(t *testing.T) {
	d, task, ids := timeSortFixture(t)
	for _, tc := range []struct {
		name, field, direction string
		want                   []int64
	}{
		{"default newest first", "", "", []int64{ids[2], ids[1], ids[0], ids[3]}},
		{"time descending", "time", "desc", []int64{ids[2], ids[1], ids[0], ids[3]}},
		{"time ascending", "time", "asc", []int64{ids[3], ids[0], ids[1], ids[2]}},
		{"severity descending time", "severity", "desc", []int64{ids[0], ids[1], ids[3], ids[2]}},
		{"severity ascending time", "severity", "asc", []int64{ids[0], ids[3], ids[1], ids[2]}},
	} {
		t.Run(tc.name, func(t *testing.T) {
			filter := FindingFilter{TaskID: fmt.Sprint(task.ID), Sort: tc.field, TimeDirection: tc.direction}
			var got []int64
			for page := 1; page <= 2; page++ {
				rows, total, err := d.ListFindingsPage(filter, page, 2)
				if err != nil || total != 4 || len(rows) != 2 {
					t.Fatalf("page %d: rows=%d total=%d err=%v", page, len(rows), total, err)
				}
				for _, row := range rows {
					got = append(got, row.ID)
				}
			}
			if !reflect.DeepEqual(got, tc.want) {
				t.Fatalf("paged order=%v, want %v", got, tc.want)
			}
		})
	}
	if _, err := d.Exec(`UPDATE findings SET created_at='2026-10-27T12:00:00Z' WHERE task_id=$1`, task.ID); err != nil {
		t.Fatal(err)
	}
	for _, direction := range []string{"asc", "desc"} {
		rows, _, err := d.ListFindingsPage(FindingFilter{TaskID: fmt.Sprint(task.ID), Sort: "time", TimeDirection: direction}, 1, 4)
		if err != nil {
			t.Fatal(err)
		}
		for i, row := range rows {
			if row.ID != ids[len(ids)-1-i] {
				t.Fatalf("unstable timestamp tie: %+v", rows)
			}
		}
	}
}

func TestFindingCaseTimeSortPages(t *testing.T) {
	d, task, ids := timeSortFixture(t)
	caseID, err := d.MergeFindingCase(context.Background(), task.ID, []int64{ids[0], ids[2]}, "same defect", "shared handler", "human")
	if err != nil {
		t.Fatal(err)
	}
	latest, err := d.AddFinding(task.ID, 0, "other", "latest low", "low", "summary", "evidence", "worker", nil)
	if err != nil {
		t.Fatal(err)
	}
	if _, err := d.Exec(`UPDATE findings SET created_at='2026-10-28T12:00:00Z' WHERE id=$1`, latest); err != nil {
		t.Fatal(err)
	}
	f := func(id int64) string { return fmt.Sprintf("f:%d", id) }
	c := fmt.Sprintf("c:%d", caseID)
	for _, tc := range []struct {
		name, field, direction string
		want                   []string
	}{
		{"default newest first", "", "", []string{f(latest), c, f(ids[1]), f(ids[3])}},
		{"time descending", "time", "desc", []string{f(latest), c, f(ids[1]), f(ids[3])}},
		{"time ascending", "time", "asc", []string{f(ids[3]), f(ids[1]), c, f(latest)}},
		{"severity descending time", "severity", "desc", []string{c, f(ids[1]), f(ids[3]), f(latest)}},
		{"severity ascending time", "severity", "asc", []string{c, f(ids[3]), f(ids[1]), f(latest)}},
	} {
		t.Run(tc.name, func(t *testing.T) {
			filter := FindingFilter{TaskID: fmt.Sprint(task.ID), Sort: tc.field, TimeDirection: tc.direction}
			var got []string
			for page := 1; page <= 2; page++ {
				rows, total, err := d.ListFindingCases(filter, page, 2)
				if err != nil || total != 4 || len(rows) != 2 {
					t.Fatalf("page %d: rows=%d total=%d err=%v", page, len(rows), total, err)
				}
				for _, row := range rows {
					if row.Case != nil {
						got = append(got, fmt.Sprintf("c:%d", row.Case.ID))
					} else {
						got = append(got, f(row.FindingID))
					}
				}
			}
			if !reflect.DeepEqual(got, tc.want) {
				t.Fatalf("paged order=%v, want %v", got, tc.want)
			}
		})
	}
	// Filtering a folder uses its matching members' timestamps, not merge time.
	rows, total, err := d.ListFindingCases(FindingFilter{TaskID: fmt.Sprint(task.ID), Severity: "low", Sort: "time", TimeDirection: "asc"}, 1, 10)
	if err != nil || total != 2 || len(rows) != 2 || rows[0].Case == nil || rows[0].Case.ID != caseID || rows[1].FindingID != latest {
		t.Fatalf("filtered case order=%+v total=%d err=%v", rows, total, err)
	}
}