From 5ad42a51df4dcc5ccc3aa6a6d902085ce2ee4239 Mon Sep 17 00:00:00 2001
From: historia <[not public]>
Date: Fri, 18 Sep 2026 18:08:01 -0400
Subject: fix: journal multi-file room/entity edits; simplify queued-position
 lookup

---
 internal/admin/room_txn_atomic_test.go | 115 +++++++++++++++++++++++++++++++++
 1 file changed, 115 insertions(+)
 create mode 100644 internal/admin/room_txn_atomic_test.go

(limited to 'internal/admin/room_txn_atomic_test.go')

diff --git a/internal/admin/room_txn_atomic_test.go b/internal/admin/room_txn_atomic_test.go
new file mode 100644
index 0000000..5f1e5bf
--- /dev/null
+++ b/internal/admin/room_txn_atomic_test.go
@@ -0,0 +1,115 @@
+package admin
+
+// Regression: multi-file room/entity edits must be journaled transactions so
+// a failure cannot half-apply them. These tests make the transaction journal
+// uncreatable (a regular file sits at the journal path), which fails Commit
+// before any operation is applied, and assert that no partial mutation
+// survived.
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"thehouseoficarus/internal/world"
+)
+
+// blockJournal makes the transaction journal path unusable by placing a
+// regular file where persistence.Transaction.Commit wants a directory.
+func blockJournal(t *testing.T, dataDir string) {
+	t.Helper()
+	if err := os.WriteFile(filepath.Join(dataDir, ".journal"), []byte("x"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+}
+
+func TestRoomMoveAtomicWhenJournalUnavailable(t *testing.T) {
+	s := newTestAdminServer(t, map[int]string{1: "id: 1\nname: Origin\n"})
+	if err := os.Mkdir(filepath.Join(s.dataDir, "rooms", "sub"), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	blockJournal(t, s.dataDir)
+
+	rec := httptest.NewRecorder()
+	s.handleRoomMove(rec, httptest.NewRequest(http.MethodPost, "/api/rooms/move",
+		strings.NewReader(`{"id":1,"dir":"sub"}`)))
+	if !strings.Contains(rec.Body.String(), "error") {
+		t.Fatalf("move should fail with an unusable journal; got %s", rec.Body.String())
+	}
+	if _, err := os.Stat(filepath.Join(s.dataDir, "rooms", "1.yaml")); err != nil {
+		t.Fatalf("source room disappeared after failed move: %v", err)
+	}
+	if _, err := os.Stat(filepath.Join(s.dataDir, "rooms", "sub", "1.yaml")); !os.IsNotExist(err) {
+		t.Fatalf("destination created after failed move (stat err=%v)", err)
+	}
+}
+
+func TestRoomUnlinkAtomicWhenJournalUnavailable(t *testing.T) {
+	s := newTestAdminServer(t, map[int]string{
+		1: "id: 1\nname: A\nexits:\n  north:\n    room: 2\n",
+		2: "id: 2\nname: B\nexits:\n  south:\n    room: 1\n",
+	})
+	blockJournal(t, s.dataDir)
+
+	rec := httptest.NewRecorder()
+	s.handleRoomLink(rec, httptest.NewRequest(http.MethodDelete, "/api/rooms/link",
+		strings.NewReader(`{"from":1,"to":2}`)))
+	if !strings.Contains(rec.Body.String(), "error") {
+		t.Fatalf("unlink should fail with an unusable journal; got %s", rec.Body.String())
+	}
+	if got := roomExitTarget(s, 1, world.North); got != 2 {
+		t.Fatalf("unlink half-applied: room 1 north now points at %d", got)
+	}
+	if got := roomExitTarget(s, 2, world.South); got != 1 {
+		t.Fatalf("unlink half-applied: room 2 south now points at %d", got)
+	}
+	if info := s.undoStack.Info(); info.StackSize != 0 {
+		t.Fatalf("failed unlink pushed an undo entry: %+v", info)
+	}
+}
+
+func TestEntityMoveAtomicWhenJournalUnavailable(t *testing.T) {
+	dir := t.TempDir()
+	if err := os.MkdirAll(filepath.Join(dir, "items", "a"), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(dir, "items", "a", "one.yaml"), []byte("name: One\n"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	blockJournal(t, dir)
+
+	if _, _, _, err := moveEntityFile(dir, "items", "one", ""); err == nil {
+		t.Fatal("move succeeded despite an unusable journal")
+	}
+	if _, err := os.Stat(filepath.Join(dir, "items", "a", "one.yaml")); err != nil {
+		t.Fatalf("source entity disappeared after failed move: %v", err)
+	}
+	if _, err := os.Stat(filepath.Join(dir, "items", "one.yaml")); !os.IsNotExist(err) {
+		t.Fatalf("destination created after failed move (stat err=%v)", err)
+	}
+}
+
+func TestDeleteEntityDirAtomicWhenJournalUnavailable(t *testing.T) {
+	dir := t.TempDir()
+	if err := os.MkdirAll(filepath.Join(dir, "items", "pack"), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	for _, name := range []string{"a.yaml", "b.yaml"} {
+		if err := os.WriteFile(filepath.Join(dir, "items", "pack", name), []byte("name: X\n"), 0o644); err != nil {
+			t.Fatal(err)
+		}
+	}
+	blockJournal(t, dir)
+
+	if _, err := deleteEntityDir(dir, "items", "pack"); err == nil {
+		t.Fatal("deleteEntityDir succeeded despite an unusable journal")
+	}
+	for _, name := range []string{"a.yaml", "b.yaml"} {
+		if _, err := os.Stat(filepath.Join(dir, "items", "pack", name)); err != nil {
+			t.Fatalf("file %s lost after failed dir move: %v", name, err)
+		}
+	}
+}
-- 
cgit v1.2.3