test: Phase 3 — comprehensive test coverage for 6 untested packages

Add test coverage to all previously untested packages:

Repository tests (10 files, ~90 methods covered):
- records_test.go: Insert/BatchInsert/Get/Delete/Stats/TimeSeries/Iterate
- config_test.go: Get/Set/AdminDIDs/URLDefaults/InitializeDefaults
- actors_test.go: Upsert/BatchUpsert/GetByDID/GetByHandle/Exists
- lexicons_test.go: Upsert/GetByID/GetAll/Delete/Exists
- jetstream_activity_test.go: Log/UpdateStatus/Buckets/Cleanup
- labels_test.go: Insert/Negation/Takedown/Pagination
- label_definitions_test.go: CRUD + ValidateVisibility/ValidateSeverity
- reports_test.go: Insert/Resolve/Pagination + ValidateReasonType/Status
- oauth_test.go: Clients/AccessTokens/RefreshTokens/AuthCodes/DPoPJTI
- label_preferences_test.go: covered via labels_test.go

Other package tests (5 files):
- jetstream/event_test.go: ParseEvent, IsCommit/Create/Update/Delete, URI
- server/handlers_test.go: DPoPNonce, ClientMetadata, GraphiQL, ConnectDB
- graphql/types/types_test.go: Mapper primitives, ObjectBuilder, caching
- workers/workers_test.go: BackfillState lifecycle, ActivityCleanupWorker
- database/migrations/migrations_test.go: Run/Idempotent/Rollback

Infrastructure:
- internal/testutil/db.go: Shared SetupTestDB helper (in-memory SQLite)

Bug fix discovered via tests:
- labels.go: Fix negation query from timestamp comparison (cts > cts)
  to ID comparison (id > id) — SQLite second-precision timestamps
  caused negations within the same second to be invisible

Previously 6 packages had zero test files. Now only cmd/hypergoat
and graphql/query remain without tests (both are trivially simple).
All tests pass: go build ./... && go test ./...

Author: daviddao

internal/database/migrations/migrations_test.go

@@ -0,0 +1,121 @@
+package migrations_test
+
+import (
+	"context"
+	"testing"
+
+	"github.com/GainForest/hypergoat/internal/database/migrations"
+	"github.com/GainForest/hypergoat/internal/database/sqlite"
+)
+
+// newTestExecutor creates an in-memory SQLite executor for testing.
+func newTestExecutor(t *testing.T) *sqlite.Executor {
+	t.Helper()
+
+	exec, err := sqlite.NewExecutor("sqlite::memory:")
+	if err != nil {
+		t.Fatalf("failed to create SQLite executor: %v", err)
+	}
+	t.Cleanup(func() { exec.Close() })
+
+	return exec
+}
+
+func TestMigrations_Run(t *testing.T) {
+	exec := newTestExecutor(t)
+	ctx := context.Background()
+
+	if err := migrations.Run(ctx, exec); err != nil {
+		t.Fatalf("Run() returned error: %v", err)
+	}
+
+	// Verify key tables exist by querying sqlite_master.
+	expectedTables := []string{
+		"record",
+		"actor",
+		"config",
+		"lexicon",
+		"jetstream_activity",
+		"label",
+		"report",
+		"label_definition",
+		"actor_label_preference",
+	}
+
+	for _, table := range expectedTables {
+		var name string
+		err := exec.DB().QueryRowContext(ctx,
+			"SELECT name FROM sqlite_master WHERE type='table' AND name=?", table,
+		).Scan(&name)
+		if err != nil {
+			t.Errorf("expected table %q to exist, but got error: %v", table, err)
+		}
+	}
+}
+
+func TestMigrations_RunIdempotent(t *testing.T) {
+	exec := newTestExecutor(t)
+	ctx := context.Background()
+
+	if err := migrations.Run(ctx, exec); err != nil {
+		t.Fatalf("first Run() returned error: %v", err)
+	}
+
+	// Running a second time should be a no-op (all migrations already applied).
+	if err := migrations.Run(ctx, exec); err != nil {
+		t.Fatalf("second Run() returned error: %v", err)
+	}
+
+	// Verify tables still present after second run.
+	var count int
+	err := exec.DB().QueryRowContext(ctx,
+		"SELECT COUNT(*) FROM sqlite_master WHERE type='table' AND name='record'",
+	).Scan(&count)
+	if err != nil {
+		t.Fatalf("failed to query sqlite_master: %v", err)
+	}
+	if count != 1 {
+		t.Errorf("expected 1 record table, got %d", count)
+	}
+}
+
+func TestMigrations_Rollback(t *testing.T) {
+	exec := newTestExecutor(t)
+	ctx := context.Background()
+
+	// Apply all migrations first.
+	if err := migrations.Run(ctx, exec); err != nil {
+		t.Fatalf("Run() returned error: %v", err)
+	}
+
+	// Count applied migrations before rollback.
+	var countBefore int
+	err := exec.DB().QueryRowContext(ctx,
+		"SELECT COUNT(*) FROM schema_migrations",
+	).Scan(&countBefore)
+	if err != nil {
+		t.Fatalf("failed to count migrations: %v", err)
+	}
+
+	if countBefore == 0 {
+		t.Fatal("expected at least one applied migration before rollback")
+	}
+
+	// Rollback the last migration.
+	if err := migrations.Rollback(ctx, exec); err != nil {
+		t.Fatalf("Rollback() returned error: %v", err)
+	}
+
+	// Verify one fewer migration is recorded.
+	var countAfter int
+	err = exec.DB().QueryRowContext(ctx,
+		"SELECT COUNT(*) FROM schema_migrations",
+	).Scan(&countAfter)
+	if err != nil {
+		t.Fatalf("failed to count migrations after rollback: %v", err)
+	}
+
+	if countAfter != countBefore-1 {
+		t.Errorf("expected %d migrations after rollback, got %d", countBefore-1, countAfter)
+	}
+}

internal/database/repositories/actors_test.go

@@ -0,0 +1,272 @@
+package repositories_test
+
+import (
+	"context"
+	"database/sql"
+	"errors"
+	"testing"
+
+	"github.com/GainForest/hypergoat/internal/database/repositories"
+	"github.com/GainForest/hypergoat/internal/testutil"
+)
+
+func setupActorsTest(t *testing.T) *repositories.ActorsRepository {
+	t.Helper()
+	db := testutil.SetupTestDB(t)
+	return db.Actors
+}
+
+func TestActorsRepository_Upsert(t *testing.T) {
+	repo := setupActorsTest(t)
+	ctx := context.Background()
+
+	// Insert new actor
+	err := repo.Upsert(ctx, "did:plc:testactor1", "alice.bsky.social")
+	if err != nil {
+		t.Fatalf("failed to insert actor: %v", err)
+	}
+
+	actor, err := repo.GetByDID(ctx, "did:plc:testactor1")
+	if err != nil {
+		t.Fatalf("failed to get actor after insert: %v", err)
+	}
+	if actor.DID != "did:plc:testactor1" {
+		t.Errorf("DID = %q, want %q", actor.DID, "did:plc:testactor1")
+	}
+	if actor.Handle != "alice.bsky.social" {
+		t.Errorf("Handle = %q, want %q", actor.Handle, "alice.bsky.social")
+	}
+
+	// Update handle via upsert
+	err = repo.Upsert(ctx, "did:plc:testactor1", "alice-new.bsky.social")
+	if err != nil {
+		t.Fatalf("failed to upsert actor: %v", err)
+	}
+
+	actor, err = repo.GetByDID(ctx, "did:plc:testactor1")
+	if err != nil {
+		t.Fatalf("failed to get actor after upsert: %v", err)
+	}
+	if actor.Handle != "alice-new.bsky.social" {
+		t.Errorf("Handle after upsert = %q, want %q", actor.Handle, "alice-new.bsky.social")
+	}
+}
+
+func TestActorsRepository_BatchUpsert(t *testing.T) {
+	tests := []struct {
+		name   string
+		actors []repositories.ActorData
+		want   int64
+	}{
+		{
+			name:   "empty slice",
+			actors: []repositories.ActorData{},
+			want:   0,
+		},
+		{
+			name: "single actor",
+			actors: []repositories.ActorData{
+				{DID: "did:plc:testactor1", Handle: "alice.bsky.social"},
+			},
+			want: 1,
+		},
+		{
+			name: "multiple actors",
+			actors: []repositories.ActorData{
+				{DID: "did:plc:testactor1", Handle: "alice.bsky.social"},
+				{DID: "did:plc:testactor2", Handle: "bob.bsky.social"},
+				{DID: "did:plc:testactor3", Handle: "carol.bsky.social"},
+			},
+			want: 3,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			repo := setupActorsTest(t)
+			ctx := context.Background()
+
+			err := repo.BatchUpsert(ctx, tt.actors)
+			if err != nil {
+				t.Fatalf("BatchUpsert() error = %v", err)
+			}
+
+			count, err := repo.GetCount(ctx)
+			if err != nil {
+				t.Fatalf("GetCount() error = %v", err)
+			}
+			if count != tt.want {
+				t.Errorf("GetCount() = %d, want %d", count, tt.want)
+			}
+		})
+	}
+}
+
+func TestActorsRepository_GetByDID(t *testing.T) {
+	repo := setupActorsTest(t)
+	ctx := context.Background()
+
+	// Setup: insert an actor
+	err := repo.Upsert(ctx, "did:plc:testactor1", "alice.bsky.social")
+	if err != nil {
+		t.Fatalf("failed to insert actor: %v", err)
+	}
+
+	t.Run("found", func(t *testing.T) {
+		actor, err := repo.GetByDID(ctx, "did:plc:testactor1")
+		if err != nil {
+			t.Fatalf("GetByDID() error = %v", err)
+		}
+		if actor.DID != "did:plc:testactor1" {
+			t.Errorf("DID = %q, want %q", actor.DID, "did:plc:testactor1")
+		}
+		if actor.Handle != "alice.bsky.social" {
+			t.Errorf("Handle = %q, want %q", actor.Handle, "alice.bsky.social")
+		}
+	})
+
+	t.Run("not found", func(t *testing.T) {
+		_, err := repo.GetByDID(ctx, "did:plc:nonexistent")
+		if err == nil {
+			t.Fatal("GetByDID() expected error for non-existing DID, got nil")
+		}
+		if !errors.Is(err, sql.ErrNoRows) {
+			t.Errorf("GetByDID() error = %v, want sql.ErrNoRows", err)
+		}
+	})
+}
+
+func TestActorsRepository_GetByHandle(t *testing.T) {
+	repo := setupActorsTest(t)
+	ctx := context.Background()
+
+	// Setup: insert an actor
+	err := repo.Upsert(ctx, "did:plc:testactor1", "alice.bsky.social")
+	if err != nil {
+		t.Fatalf("failed to insert actor: %v", err)
+	}
+
+	t.Run("found", func(t *testing.T) {
+		actor, err := repo.GetByHandle(ctx, "alice.bsky.social")
+		if err != nil {
+			t.Fatalf("GetByHandle() error = %v", err)
+		}
+		if actor.DID != "did:plc:testactor1" {
+			t.Errorf("DID = %q, want %q", actor.DID, "did:plc:testactor1")
+		}
+		if actor.Handle != "alice.bsky.social" {
+			t.Errorf("Handle = %q, want %q", actor.Handle, "alice.bsky.social")
+		}
+	})
+
+	t.Run("not found", func(t *testing.T) {
+		_, err := repo.GetByHandle(ctx, "nobody.bsky.social")
+		if err == nil {
+			t.Fatal("GetByHandle() expected error for non-existing handle, got nil")
+		}
+		if !errors.Is(err, sql.ErrNoRows) {
+			t.Errorf("GetByHandle() error = %v, want sql.ErrNoRows", err)
+		}
+	})
+}
+
+func TestActorsRepository_GetCount(t *testing.T) {
+	repo := setupActorsTest(t)
+	ctx := context.Background()
+
+	// Empty database
+	count, err := repo.GetCount(ctx)
+	if err != nil {
+		t.Fatalf("GetCount() error = %v", err)
+	}
+	if count != 0 {
+		t.Errorf("GetCount() on empty db = %d, want 0", count)
+	}
+
+	// After inserts
+	err = repo.Upsert(ctx, "did:plc:testactor1", "alice.bsky.social")
+	if err != nil {
+		t.Fatalf("failed to insert actor: %v", err)
+	}
+	err = repo.Upsert(ctx, "did:plc:testactor2", "bob.bsky.social")
+	if err != nil {
+		t.Fatalf("failed to insert actor: %v", err)
+	}
+
+	count, err = repo.GetCount(ctx)
+	if err != nil {
+		t.Fatalf("GetCount() error = %v", err)
+	}
+	if count != 2 {
+		t.Errorf("GetCount() after 2 inserts = %d, want 2", count)
+	}
+}
+
+func TestActorsRepository_DeleteAll(t *testing.T) {
+	repo := setupActorsTest(t)
+	ctx := context.Background()
+
+	// Insert some actors
+	err := repo.BatchUpsert(ctx, []repositories.ActorData{
+		{DID: "did:plc:testactor1", Handle: "alice.bsky.social"},
+		{DID: "did:plc:testactor2", Handle: "bob.bsky.social"},
+	})
+	if err != nil {
+		t.Fatalf("BatchUpsert() error = %v", err)
+	}
+
+	// Verify they exist
+	count, err := repo.GetCount(ctx)
+	if err != nil {
+		t.Fatalf("GetCount() error = %v", err)
+	}
+	if count != 2 {
+		t.Fatalf("GetCount() = %d, want 2 before delete", count)
+	}
+
+	// Delete all
+	err = repo.DeleteAll(ctx)
+	if err != nil {
+		t.Fatalf("DeleteAll() error = %v", err)
+	}
+
+	// Verify empty
+	count, err = repo.GetCount(ctx)
+	if err != nil {
+		t.Fatalf("GetCount() error = %v", err)
+	}
+	if count != 0 {
+		t.Errorf("GetCount() after DeleteAll = %d, want 0", count)
+	}
+}
+
+func TestActorsRepository_Exists(t *testing.T) {
+	repo := setupActorsTest(t)
+	ctx := context.Background()
+
+	// Insert an actor
+	err := repo.Upsert(ctx, "did:plc:testactor1", "alice.bsky.social")
+	if err != nil {
+		t.Fatalf("failed to insert actor: %v", err)
+	}
+
+	t.Run("existing actor", func(t *testing.T) {
+		exists, err := repo.Exists(ctx, "did:plc:testactor1")
+		if err != nil {
+			t.Fatalf("Exists() error = %v", err)
+		}
+		if !exists {
+			t.Error("Exists() = false, want true for existing actor")
+		}
+	})
+
+	t.Run("non-existing actor", func(t *testing.T) {
+		exists, err := repo.Exists(ctx, "did:plc:nonexistent")
+		if err != nil {
+			t.Fatalf("Exists() error = %v", err)
+		}
+		if exists {
+			t.Error("Exists() = true, want false for non-existing actor")
+		}
+	})
+}