fix: retain action safety warnings in HTML reports

internal/report/guard_controls_test.go

@@ -0,0 +1,51 @@
+package report
+
+import (
+	"html"
+	"strings"
+	"testing"
+
+	"github.com/pgrundev/pgbot/internal/model"
+)
+
+func TestReportGuardsPreserveProhibitionsAndEscaping(t *testing.T) {
+	verify := `confirm <replica> & "owner"`
+	text := `guard <strong>marker</strong> & evidence`
+	for _, suppressed := range []bool{false, true} {
+		c := &model.Context{Findings: []model.Finding{{
+			ID: "synthetic_guard", Severity: model.SeverityWarn, Title: "guard fixture",
+			Suppressed: suppressed,
+			Safety: &model.Safety{BlockingCaveats: []model.SafetyGuard{
+				{ID: "precondition", Kind: model.GuardPrecondition, Action: model.ActionDropIndex, Text: text, Verify: &verify},
+				{ID: "prohibition", Kind: model.GuardProhibition, Action: model.ActionVacuumFull, Text: "preserve corruption evidence"},
+			}},
+		}}}
+		out := Render(c, 50, "test")
+		for _, want := range []string{"Caution before DROP INDEX", "Do not run VACUUM FULL", html.EscapeString(text), html.EscapeString(verify), "preserve corruption evidence"} {
+			if !strings.Contains(out, want) {
+				t.Errorf("suppressed=%v: missing %q", suppressed, want)
+			}
+		}
+		if strings.Contains(out, text) || strings.Contains(out, verify) {
+			t.Fatal("guard content was not HTML-escaped")
+		}
+		if strings.Count(out, `class="guard"`) != 2 {
+			t.Fatal("every blocking caveat must be rendered once")
+		}
+	}
+}
+
+func TestReportWithoutSafetyDoesNotInventGuards(t *testing.T) {
+	for _, safety := range []*model.Safety{nil, {}} {
+		c := &model.Context{Findings: []model.Finding{{
+			ID: "fixture", Severity: model.SeverityInfo, Title: "ordinary finding", Safety: safety,
+		}}}
+		out := Render(c, 100, "test")
+		if strings.Contains(out, `class="guard"`) {
+			t.Fatal("unexpected guard for an unguarded finding")
+		}
+		if !strings.Contains(out, "ordinary finding") {
+			t.Fatal("ordinary finding disappeared")
+		}
+	}
+}

internal/report/html.go

@@ -91,6 +91,19 @@ func Render(c *model.Context, score int, version string) string {
 			if f.Remediation != "" {
 				body.w(`<p class="fix">Fix: %s</p>`, esc(f.Remediation))
 			}
+			if f.Safety != nil {
+				for _, guard := range f.Safety.BlockingCaveats {
+					label := "Caution before"
+					if guard.Kind == model.GuardProhibition {
+						label = "Do not run"
+					}
+					body.w(`<p class="guard"><b>%s %s:</b> %s`, label, esc(guard.Action), esc(guard.Text))
+					if guard.Verify != nil {
+						body.w(` <b>Only after:</b> %s`, esc(*guard.Verify))
+					}
+					body.raw(`</p>`)
+				}
+			}
 			for _, cv := range f.Caveats {
 				body.w(`<p class="caveat">but: %s</p>`, esc(cv))
 			}
@@ -253,7 +266,7 @@ func Render(c *model.Context, score int, version string) string {
   .finding.info .sev{color:var(--muted)} .finding.suppressed{opacity:.55}
   .fbody p{margin:.3rem 0;color:var(--muted)} .fbody b{color:var(--fg)}
   .evi{color:var(--muted);font-size:.82rem;padding-left:.8rem}
-  .fix{color:var(--green)} .caveat{color:var(--orange);font-size:.82rem}
+  .fix{color:var(--green)} .guard,.caveat{color:var(--orange);font-size:.82rem}
   footer{padding:1rem 2rem;color:var(--dim);border-top:1px solid var(--line);font-size:.8rem}
 </style></head><body>
 <header><span class="score">` + fmt.Sprintf("%d", score) + `<span style="font-size:.9rem;color:var(--dim)">/100</span></span>

internal/report/html_test.go

@@ -86,3 +86,34 @@ func TestRenderReportSparse(t *testing.T) {
 		t.Error("header must still carry the database")
 	}
 }
+
+func TestRenderReportCarriesDestructiveSafetyGuards(t *testing.T) {
+	verify := "confirm the index is unused on every replica"
+	c := &model.Context{
+		Server: model.ServerInfo{Database: "shop"},
+		Findings: []model.Finding{{
+			ID:          "unused_indexes",
+			Severity:    model.SeverityWarn,
+			Title:       "an index appears unused",
+			Remediation: "DROP INDEX CONCURRENTLY after verification",
+			Safety: &model.Safety{BlockingCaveats: []model.SafetyGuard{{
+				ID:     "unused_index.per_node",
+				Kind:   model.GuardPrecondition,
+				Action: model.ActionDropIndex,
+				Text:   "zero scans on this node do not prove cluster-wide disuse",
+				Verify: &verify,
+			}}},
+		}},
+	}
+
+	out := Render(c, 80, "test")
+	for _, want := range []string{
+		model.ActionDropIndex,
+		"zero scans on this node do not prove cluster-wide disuse",
+		verify,
+	} {
+		if !strings.Contains(out, want) {
+			t.Errorf("HTML report dropped destructive-action guard %q", want)
+		}
+	}
+}