From d49376f71dd8defebf80f901ecb60ab99f0f4906 Mon Sep 17 00:00:00 2001
From: Paul Buetow <paul@buetow.org>
Date: Tue, 14 Apr 2026 10:40:44 +0300
Subject: n3: validate SQLite with PingContext after Open

Call db.PingContext in storage.Open and authkeys.OpenStore; close DB and
return wrapped errors on failure. Add tests for canceled context and
invalid directory path.

Made-with: Cursor
---
 internal/authkeys/store.go      |  4 ++++
 internal/authkeys/store_test.go | 14 ++++++++++++++
 internal/storage/db.go          |  8 ++++++--
 internal/storage/db_test.go     | 34 ++++++++++++++++++++++++++++++++++
 4 files changed, 58 insertions(+), 2 deletions(-)
 create mode 100644 internal/storage/db_test.go

diff --git a/internal/authkeys/store.go b/internal/authkeys/store.go
index 9f0a8b2..7848ef8 100644
--- a/internal/authkeys/store.go
+++ b/internal/authkeys/store.go
@@ -38,6 +38,10 @@ func OpenStore(ctx context.Context, path string) (*Store, error) {
 	if err != nil {
 		return nil, fmt.Errorf("open auth db: %w", err)
 	}
+	if err := db.PingContext(ctx); err != nil {
+		db.Close()
+		return nil, fmt.Errorf("ping auth db: %w", err)
+	}
 	if _, err := db.ExecContext(ctx, "PRAGMA foreign_keys = OFF"); err != nil {
 		db.Close()
 		return nil, fmt.Errorf("pragma: %w", err)
diff --git a/internal/authkeys/store_test.go b/internal/authkeys/store_test.go
index b8da623..797b683 100644
--- a/internal/authkeys/store_test.go
+++ b/internal/authkeys/store_test.go
@@ -2,11 +2,25 @@ package authkeys
 
 import (
 	"context"
+	"errors"
 	"path/filepath"
 	"strings"
 	"testing"
 )
 
+func TestOpenStore_ContextCanceled(t *testing.T) {
+	ctx, cancel := context.WithCancel(context.Background())
+	cancel()
+	path := filepath.Join(t.TempDir(), "auth.db")
+	_, err := OpenStore(ctx, path)
+	if err == nil {
+		t.Fatal("expected error")
+	}
+	if !errors.Is(err, context.Canceled) {
+		t.Fatalf("expected context.Canceled, got %v", err)
+	}
+}
+
 func TestCreateVerifyReplace(t *testing.T) {
 	ctx := context.Background()
 	path := filepath.Join(t.TempDir(), "auth.db")
diff --git a/internal/storage/db.go b/internal/storage/db.go
index 14d7050..7b577e7 100644
--- a/internal/storage/db.go
+++ b/internal/storage/db.go
@@ -40,11 +40,15 @@ type Record struct {
 func Open(ctx context.Context, path string) (*sql.DB, error) {
 	db, err := sql.Open("sqlite", path)
 	if err != nil {
-		return nil, err
+		return nil, fmt.Errorf("open sqlite: %w", err)
+	}
+	if err := db.PingContext(ctx); err != nil {
+		db.Close()
+		return nil, fmt.Errorf("ping sqlite: %w", err)
 	}
 	if _, err := db.ExecContext(ctx, "PRAGMA foreign_keys = OFF"); err != nil {
 		db.Close()
-		return nil, err
+		return nil, fmt.Errorf("pragma foreign_keys: %w", err)
 	}
 	return db, nil
 }
diff --git a/internal/storage/db_test.go b/internal/storage/db_test.go
new file mode 100644
index 0000000..5415235
--- /dev/null
+++ b/internal/storage/db_test.go
@@ -0,0 +1,34 @@
+package storage
+
+import (
+	"context"
+	"errors"
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+func TestOpen_ContextCanceled(t *testing.T) {
+	ctx, cancel := context.WithCancel(context.Background())
+	cancel()
+	path := filepath.Join(t.TempDir(), "records.db")
+	_, err := Open(ctx, path)
+	if err == nil {
+		t.Fatal("expected error")
+	}
+	if !errors.Is(err, context.Canceled) {
+		t.Fatalf("expected context.Canceled, got %v", err)
+	}
+}
+
+func TestOpen_PingFailsOnDirectoryPath(t *testing.T) {
+	ctx := context.Background()
+	dir := filepath.Join(t.TempDir(), "isdir")
+	if err := os.Mkdir(dir, 0o755); err != nil {
+		t.Fatal(err)
+	}
+	_, err := Open(ctx, dir)
+	if err == nil {
+		t.Fatal("expected error opening sqlite at directory path")
+	}
+}
-- 
cgit v1.2.3