From 571e2bd28af6c21fc13b5fbc55ec5ded1c15b0a8 Mon Sep 17 00:00:00 2001
From: weichen <weichen@home.local>
Date: Wed, 14 Oct 2026 03:42:57 +0000
Subject: [PATCH] Verify every maintenance entry refuses an absent database

Why: The safe open requirement covers user, apikey and identity verify, including default CLI paths.

Evidence: All three paths use private missing directories; previous full Go and PostgreSQL receipts cover the implementation, with a focused recheck before push.

Impact: Test coverage only; no runtime behavior or migration changes.

Refs: Backend PR #185; Dev PR #486
---
 internal/app/account_ops_existing_test.go | 32 ++++++++++++++++++-----
 1 file changed, 26 insertions(+), 6 deletions(-)

diff --git a/internal/app/account_ops_existing_test.go b/internal/app/account_ops_existing_test.go
index 00fba27..9580649 100644
--- a/internal/app/account_ops_existing_test.go
+++ b/internal/app/account_ops_existing_test.go
@@ -9,12 +9,32 @@ import (
 
 func TestAccountMaintenanceDefaultsToNonCreatingOpen(t *testing.T) {
 	t.Setenv("AGENT_SYSTEM_DSN", "")
-	dir := filepath.Join(t.TempDir(), "absent")
-	if _, _, err := CreateUserAccount("", dir, "ada", "Ada", "", false, false, false); err == nil {
-		t.Error("ordinary maintenance created a missing database")
-	}
-	if _, err := os.Stat(dir); !os.IsNotExist(err) {
-		t.Error("failed maintenance created a directory")
+	for _, tc := range []struct {
+		name string
+		run  func(string) error
+	}{
+		{"user", func(dir string) error {
+			_, _, err := CreateUserAccount("", dir, "ada", "Ada", "", false, false, false)
+			return err
+		}},
+		{"apikey", func(dir string) error {
+			_, err := CreateAPIKey("", dir, "ada", "test")
+			return err
+		}},
+		{"identity verify", func(dir string) error {
+			_, err := VerifySystemIdentity("", dir, "fixture", "sqlite")
+			return err
+		}},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			dir := filepath.Join(t.TempDir(), "absent")
+			if err := tc.run(dir); err == nil {
+				t.Error("maintenance created a missing database")
+			}
+			if _, err := os.Stat(dir); !os.IsNotExist(err) {
+				t.Error("failed maintenance created a directory")
+			}
+		})
 	}
 }
 func TestAccountMaintenanceCannotImplicitlyMigrate(t *testing.T) {