test(watchdog): 整轮巡检测试覆盖集群告警保持、dry-run、主机 relay 密码、按配置检查与状态存不下，收件人查询移入 watchdog 并加 pgint 契约

internal/pgint/watchdog_test.go

@@ -0,0 +1,54 @@
+//go:build pgint
+
+package pgint
+
+import (
+	"context"
+	"slices"
+	"strings"
+	"testing"
+
+	"felis.lolicon.best/internal/watchdog"
+)
+
+// TestWatchdogOwnerEmails: the watchdog mails the verified address of every enabled
+// owner account, in order, and no other account's.
+func TestWatchdogOwnerEmails(t *testing.T) {
+	ctx := context.Background()
+	tag := suffix(t)
+	addr := func(who string) string { return who + "-" + tag + "@example.com" }
+	for _, u := range []struct {
+		who, role, email string
+		verified, off    bool
+		deleted          bool
+	}{
+		{who: "zoe", role: "owner", email: addr("zoe"), verified: true},
+		{who: "amy", role: "owner", email: addr("amy"), verified: true},
+		{who: "unverified", role: "owner", email: addr("unverified")},
+		{who: "disabled", role: "owner", email: addr("disabled"), verified: true, off: true},
+		{who: "deleted", role: "owner", email: addr("deleted"), verified: true, deleted: true},
+		{who: "admin", role: "admin", email: addr("admin"), verified: true},
+		{who: "user", role: "user", email: addr("user"), verified: true},
+		{who: "no-address", role: "owner", verified: true},
+	} {
+		var email any
+		if u.email != "" {
+			email = u.email
+		}
+		if _, err := db.ExecContext(ctx,
+			`INSERT INTO users (id, username, role, email, email_verified, disabled, deleted_at)
+			 VALUES ($1, $1, $2, $3, $4, $5, CASE WHEN $6 THEN now() END)`,
+			"pgint-"+u.who+"-"+tag, u.role, email, u.verified, u.off, u.deleted); err != nil {
+			t.Fatalf("insert %s: %v", u.who, err)
+		}
+	}
+	got, err := watchdog.OwnerEmails(ctx, db)
+	if err != nil {
+		t.Fatal(err)
+	}
+	// Other suites share the schema; their accounts carry other tags.
+	mine := slices.DeleteFunc(got, func(e string) bool { return !strings.Contains(e, tag) })
+	if want := []string{addr("amy"), addr("zoe")}; !slices.Equal(mine, want) {
+		t.Fatalf("OwnerEmails = %q, want %q", mine, want)
+	}
+}

internal/watchdog/owners.go

@@ -0,0 +1,30 @@
+package watchdog
+
+import (
+	"context"
+	"database/sql"
+)
+
+// OwnerEmails returns the verified addresses of the enabled owner accounts, the
+// people who can act on an alert, in order. internal/pgint holds its contract
+// against the real schema.
+func OwnerEmails(ctx context.Context, db *sql.DB) ([]string, error) {
+	rows, err := db.QueryContext(ctx,
+		`SELECT email FROM users
+		 WHERE role = 'owner' AND email_verified AND COALESCE(email, '') <> ''
+		   AND NOT disabled AND deleted_at IS NULL
+		 ORDER BY email`)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	var out []string
+	for rows.Next() {
+		var email string
+		if err := rows.Scan(&email); err != nil {
+			return nil, err
+		}
+		out = append(out, email)
+	}
+	return out, rows.Err()
+}