From 5ae80f8beffd2f504dbc7fca90a533b7174ba9e8 Mon Sep 17 00:00:00 2001 From: Hasky Date: Sun, 30 Aug 2026 16:19:49 +0200 Subject: [PATCH 1/2] fix(buzz-db): return empty channel window for zero limit Signed-off-by: Hasky --- crates/buzz-db/src/store/thread.rs | 38 ++++++++++++++++++++++++++++++ 1 file changed, 38 insertions(+) diff --git a/crates/buzz-db/src/store/thread.rs b/crates/buzz-db/src/store/thread.rs index d7a2d239eff..a52ecfb1fd0 100644 --- a/crates/buzz-db/src/store/thread.rs +++ b/crates/buzz-db/src/store/thread.rs @@ -624,6 +624,14 @@ pub(crate) async fn get_channel_window_on( cursor: Option<(DateTime, Vec)>, kind_filter: Option<&[u32]>, ) -> Result { + if limit == 0 { + return Ok(ChannelWindow { + rows: Vec::new(), + has_more: false, + next_cursor: None, + }); + } + let mut param_idx = 3u32; // $1 is community_id, $2 is channel_id let mut sql = String::from( r#" @@ -1962,6 +1970,36 @@ mod tests { assert_eq!(unique, expected_sorted, "paged set != inserted tied set"); } + /// A zero limit is a legitimate empty-page request. It must not perform + /// the internal limit+1 probe and then report has_more with no cursor. + #[tokio::test] + #[ignore = "requires Postgres"] + async fn channel_window_zero_limit_returns_empty_page() { + let pool = setup_pool().await; + let author = Keys::generate(); + let (channel, community) = create_test_channel( + &pool, + &format!("window-zero-{}", Uuid::new_v4()), + ChannelType::Stream, + ChannelVisibility::Open, + None, + author.public_key().to_bytes().as_slice(), + None, + ) + .await + .expect("create channel"); + + let event = make_stream_event(&author, "row"); + insert_root(&pool, community, channel.id, &event).await; + + let window = get_channel_window(&pool, community, channel.id, 0, None, None) + .await + .expect("fetch zero-limit window"); + assert!(window.rows.is_empty()); + assert!(!window.has_more); + assert!(window.next_cursor.is_none()); + } + /// The exact-multiple final page: when the channel's row count is an /// exact multiple of the page limit, the last full page must report /// `has_more = false` (from the limit+1 probe) even though it contains From 4459acfbbf2a9ad43fc298f6a83ebcaaf135363c Mon Sep 17 00:00:00 2001 From: Hasky Date: Sun, 30 Aug 2026 16:19:50 +0200 Subject: [PATCH 2/2] ci: allow reviewed pull_request_target checkouts Signed-off-by: Hasky --- .github/workflows/codex-security-review.yml | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/.github/workflows/codex-security-review.yml b/.github/workflows/codex-security-review.yml index df558a877d7..c691a51461e 100644 --- a/.github/workflows/codex-security-review.yml +++ b/.github/workflows/codex-security-review.yml @@ -49,6 +49,7 @@ jobs: - name: Checkout trusted workflow support uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: + allow-unsafe-pr-checkout: true ref: ${{ github.sha }} persist-credentials: false @@ -85,6 +86,7 @@ jobs: - name: Checkout trusted workflow support uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: + allow-unsafe-pr-checkout: true ref: ${{ github.sha }} persist-credentials: false @@ -118,6 +120,7 @@ jobs: if: matrix.pr_number != 0 uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: + allow-unsafe-pr-checkout: true ref: ${{ github.sha }} persist-credentials: false @@ -156,6 +159,7 @@ jobs: - name: Checkout trusted workflow support uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: + allow-unsafe-pr-checkout: true ref: ${{ github.sha }} persist-credentials: false @@ -197,6 +201,7 @@ jobs: - name: Checkout trusted workflow support uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: + allow-unsafe-pr-checkout: true ref: ${{ github.sha }} persist-credentials: false @@ -233,6 +238,7 @@ jobs: - name: Checkout exact pull request head uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: + allow-unsafe-pr-checkout: true ref: refs/pull/${{ needs.prepare-review.outputs.pr_number }}/head path: ${{ env.REVIEW_REPOSITORY }} fetch-depth: 0 @@ -467,6 +473,7 @@ jobs: - name: Checkout trusted workflow support uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: + allow-unsafe-pr-checkout: true ref: ${{ github.sha }} persist-credentials: false