From 11cbc2fb7ffc264c3a30a187b30c792bb28c775f Mon Sep 17 00:00:00 2001
From: Steve Cliff <steve@devcloud.guru>
Date: Sun, 3 May 2026 22:15:57 +0100
Subject: [PATCH] store: tighten CHECK constraint on
 host_repo_stats.last_check_status

---
 .../store/migrations/0009_admin_creds_and_repo_stats.sql  | 2 +-
 internal/store/store_test.go                              | 8 ++++++++
 2 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/internal/store/migrations/0009_admin_creds_and_repo_stats.sql b/internal/store/migrations/0009_admin_creds_and_repo_stats.sql
index 4627940..59c8e91 100644
--- a/internal/store/migrations/0009_admin_creds_and_repo_stats.sql
+++ b/internal/store/migrations/0009_admin_creds_and_repo_stats.sql
@@ -50,7 +50,7 @@ CREATE TABLE host_repo_stats (
   unique_files            INTEGER,
   snapshot_count          INTEGER,
   last_check_at           TEXT,
-  last_check_status       TEXT, -- 'ok' | 'errors_found' | 'failed'
+  last_check_status       TEXT CHECK (last_check_status IS NULL OR last_check_status IN ('ok', 'errors_found', 'failed')),
   lock_present            INTEGER NOT NULL DEFAULT 0,
   last_prune_at           TEXT,
   last_prune_freed_bytes  INTEGER,
diff --git a/internal/store/store_test.go b/internal/store/store_test.go
index 6b15949..35eddb5 100644
--- a/internal/store/store_test.go
+++ b/internal/store/store_test.go
@@ -138,6 +138,14 @@ func TestMigration0009Schema(t *testing.T) {
 	if lockPresent != 0 {
 		t.Errorf("expected lock_present=0, got %d", lockPresent)
 	}
+
+	// CHECK (last_check_status IN ('ok','errors_found','failed')) must reject
+	// an invalid value.
+	if _, err := s.DB().ExecContext(ctx,
+		`UPDATE host_repo_stats SET last_check_status = ? WHERE host_id = ?`,
+		"wat", "h-0009"); err == nil {
+		t.Fatal("expected CHECK constraint violation on last_check_status='wat', got nil")
+	}
 }
 
 func TestForeignKeysEnforced(t *testing.T) {