Repository navigation
Writer scan misses an idempotency_key assignment after a SQL comment #1853
Description
Summary
The idempotency_key single-writer scan in internal/purchase/idempotency_key_writers_test.go matches a SET assignment target only at the start of each depth-0 SET item (keyAssignmentTarget, ^"?idempotency_key"?\s*=). As a result, a SQL comment before the target hides the write. Before #1849, the scan counted any reference, so it caught this case (and over-counted predicates).
Steps to verify the gap
These fixtures pass the scan on main (cccc229), but should count 1 update each:
UPDATE purchase_executions SET /* k */ idempotency_key = $1 WHERE ...UPDATE purchase_executions SET status = $3, -- note\n idempotency_key = $1 WHERE ...
Found by claude-qa-ui-4 in review of #1849. #1849 merged with the limitation documented at idempotency_key_writers_test.go:151, since no SQL in the repo puts a comment in a SET today.
Expected behaviour
The scan never fails open: a comment, or an unparsed string form ($$...$$, E'...'), must not hide a write. Over-counting is acceptable.
Proposed fix
In setText/setItems, strip /*...*/ and -- comments outside literals before splitting. Treat $$ and E' as "cannot parse" and count a write when idempotency_key appears anywhere in that item, which fails closed. Add both fixtures above, plus an E'...' one.
References
Severity
Low: the guard is a test, and no SQL in the repo uses these forms today.
🤖 Generated with Claude Code
Activity