fix: address 5 valid CodeRabbit round-9 findings

Aureliolo · Aureliolo · commit 73d2013dd35d · 2026-04-07T13:15:23.000+02:00
diff --git a/src/synthorg/persistence/sqlite/schema.sql b/src/synthorg/persistence/sqlite/schema.sql
@@ -579,3 +579,4 @@ CREATE TABLE IF NOT EXISTS ssrf_violations (
 CREATE INDEX IF NOT EXISTS idx_sv_status_timestamp
     ON ssrf_violations(status, timestamp DESC);
 CREATE INDEX IF NOT EXISTS idx_sv_timestamp ON ssrf_violations(timestamp);
+CREATE INDEX IF NOT EXISTS idx_sv_hostname ON ssrf_violations(hostname, port);
diff --git a/tests/unit/persistence/sqlite/test_migrations.py b/tests/unit/persistence/sqlite/test_migrations.py
@@ -111,6 +111,7 @@
     "idx_ro_active",
     "idx_sv_status_timestamp",
     "idx_sv_timestamp",
+    "idx_sv_hostname",
 }
 
 
diff --git a/tests/unit/security/test_ssrf_violation.py b/tests/unit/security/test_ssrf_violation.py
@@ -52,6 +52,7 @@ def test_allowed_violation(self) -> None:
         )
         assert v.status == SsrfViolationStatus.ALLOWED
         assert v.resolved_by == "user-1"
+        assert v.resolved_at == _NOW + timedelta(minutes=5)
 
     def test_denied_violation(self) -> None:
         v = SsrfViolation(
@@ -65,6 +66,8 @@ def test_denied_violation(self) -> None:
             resolved_at=_NOW + timedelta(minutes=5),
         )
         assert v.status == SsrfViolationStatus.DENIED
+        assert v.resolved_by == "admin-1"
+        assert v.resolved_at == _NOW + timedelta(minutes=5)
 
     def test_frozen(self) -> None:
         v = SsrfViolation(
@@ -89,6 +92,18 @@ def test_pending_with_resolved_by_rejected(self) -> None:
                 resolved_by="user-1",
             )
 
+    def test_pending_with_resolved_at_rejected(self) -> None:
+        with pytest.raises(ValidationError, match="resolved_at"):
+            SsrfViolation(
+                id="v-bad",
+                timestamp=_NOW,
+                url="http://example.com:80",
+                hostname="example.com",
+                port=80,
+                status=SsrfViolationStatus.PENDING,
+                resolved_at=_NOW + timedelta(minutes=5),
+            )
+
     def test_allowed_without_resolved_by_rejected(self) -> None:
         with pytest.raises(ValidationError, match="resolved_by"):
             SsrfViolation(
@@ -100,6 +115,17 @@ def test_allowed_without_resolved_by_rejected(self) -> None:
                 status=SsrfViolationStatus.ALLOWED,
             )
 
+    def test_denied_without_resolved_by_rejected(self) -> None:
+        with pytest.raises(ValidationError, match="resolved_by"):
+            SsrfViolation(
+                id="v-bad",
+                timestamp=_NOW,
+                url="http://example.com:80",
+                hostname="example.com",
+                port=80,
+                status=SsrfViolationStatus.DENIED,
+            )
+
     def test_port_bounds(self) -> None:
         with pytest.raises(ValidationError, match="port"):
             SsrfViolation(

Original file line number	Diff line number	Diff line change
`@@ -111,6 +111,7 @@`
`111`	`111`	`"idx_ro_active",`
`112`	`112`	`"idx_sv_status_timestamp",`
`113`	`113`	`"idx_sv_timestamp",`
	`114`	`+ "idx_sv_hostname",`
`114`	`115`	`}`
`115`	`116`
`116`	`117`