Yeraze
diff --git a/‎.github/workflows/pr-tests.yml‎
Lines changed: 5 additions & 4 deletions b/‎.github/workflows/pr-tests.yml‎
Lines changed: 5 additions & 4 deletions
diff --git a/‎src/cli/test-postgres.ts‎
Lines changed: 7 additions & 6 deletions b/‎src/cli/test-postgres.ts‎
Lines changed: 7 additions & 6 deletions
diff --git a/‎src/db/repositories/base.ts‎
Lines changed: 29 additions & 7 deletions b/‎src/db/repositories/base.ts‎
Lines changed: 29 additions & 7 deletions
diff --git a/‎src/db/repositories/channels.test.ts‎
Lines changed: 15 additions & 14 deletions b/‎src/db/repositories/channels.test.ts‎
Lines changed: 15 additions & 14 deletions
diff --git a/‎src/db/repositories/channels.ts‎
Lines changed: 6 additions & 8 deletions b/‎src/db/repositories/channels.ts‎
Lines changed: 6 additions & 8 deletions
diff --git a/‎src/db/repositories/index.ts‎
Lines changed: 2 additions & 2 deletions b/‎src/db/repositories/index.ts‎
Lines changed: 2 additions & 2 deletions
diff --git a/‎src/db/repositories/messages.createdAt-ordering.test.ts‎
Lines changed: 6 additions & 5 deletions b/‎src/db/repositories/messages.createdAt-ordering.test.ts‎
Lines changed: 6 additions & 5 deletions
diff --git a/‎src/db/repositories/messages.exclude-portnums.test.ts‎
Lines changed: 8 additions & 7 deletions b/‎src/db/repositories/messages.exclude-portnums.test.ts‎
Lines changed: 8 additions & 7 deletions
@@ -22,10 +22,11 @@ jobs:
   quick-test:
     name: Quick Tests
     runs-on: ubuntu-latest
-    # The full unit suite (npm run test:run) now runs right at ~10 min on CI,
-    # so a 10-min cap intermittently cancels the job at the boundary even though
-    # every step passes. Give it headroom so the check stops flaking (#3385).
-    timeout-minutes: 15
+    # The full unit suite (npm run test:run) keeps growing: ~10 min when the
+    # cap was first raised (#3385), ~14 min by 2026-07 — so the 15-min cap
+    # started timing the job out at the boundary again (GitHub reports the
+    # timeout as "cancelled"). Keep real headroom above the observed runtime.
+    timeout-minutes: 25
 
     services:
       postgres:
 
@@ -12,6 +12,7 @@ import { createPostgresDriver } from '../db/drivers/postgres.js';
 import { SettingsRepository } from '../db/repositories/settings.js';
 import { NodesRepository } from '../db/repositories/nodes.js';
 import { MessagesRepository } from '../db/repositories/messages.js';
+import { ALL_SOURCES } from '../db/repositories/index.js';
 
 const POSTGRES_URL = process.env.DATABASE_URL || 'postgres://meshmonitor:meshmonitor_dev@localhost:5432/meshmonitor';
 
@@ -198,16 +199,16 @@ async function testNodes(nodesRepo: NodesRepository): Promise<boolean> {
     }
     console.log('  ✅ getNode works');
 
-    // Test getAllNodes
-    const allNodes = await nodesRepo.getAllNodes();
+    // Test getAllNodes (intentional cross-source: CLI test checks all sources)
+    const allNodes = await nodesRepo.getAllNodes(ALL_SOURCES);
     if (allNodes.length < 1) {
       console.error(`  ❌ getAllNodes returned ${allNodes.length} nodes, expected at least 1`);
       return false;
     }
     console.log('  ✅ getAllNodes works');
 
-    // Test getNodeCount
-    const count = await nodesRepo.getNodeCount();
+    // Test getNodeCount (intentional cross-source: CLI test checks all sources)
+    const count = await nodesRepo.getNodeCount(ALL_SOURCES);
     if (count < 1) {
       console.error(`  ❌ getNodeCount returned ${count}, expected at least 1`);
       return false;
@@ -258,8 +259,8 @@ async function testMessages(messagesRepo: MessagesRepository): Promise<boolean>
     }
     console.log('  ✅ getMessages works');
 
-    // Test getMessageCount
-    const count = await messagesRepo.getMessageCount();
+    // Test getMessageCount (intentional cross-source: CLI test checks all sources)
+    const count = await messagesRepo.getMessageCount(ALL_SOURCES);
     if (count < 1) {
       console.error(`  ❌ getMessageCount returned ${count}, expected at least 1`);
       return false;
 
@@ -20,6 +20,21 @@ export type MySQLDrizzle = MySql2Database<typeof schema>;
 // Union type for all database types
 export type DrizzleDatabase = SQLiteDrizzle | PostgresDrizzle | MySQLDrizzle;
 
+/**
+ * Explicit opt-in sentinel for the rare, intentional cross-source query.
+ * Passing this to withSourceScope (or any scoped repo method) means
+ * "I really do want rows from EVERY source" — e.g. system stats, global
+ * purge, process-wide cache warm-up, full backup export.
+ *
+ * A unique symbol (not a magic string) so it can never arrive off the wire /
+ * from JSON, can never collide with a real sourceId, and forces callers to
+ * import it explicitly.
+ */
+export const ALL_SOURCES: unique symbol = Symbol('ALL_SOURCES');
+
+/** A resolved source scope: a concrete sourceId, or the all-sources sentinel. */
+export type SourceScope = string | typeof ALL_SOURCES;
+
 /**
  * Base repository providing common functionality
  */
@@ -217,17 +232,24 @@ export abstract class BaseRepository {
   }
 
   /**
-   * Return a Drizzle WHERE condition that filters by sourceId.
+   * Return a Drizzle WHERE condition that scopes a query to one source.
    *
-   * Returns `undefined` when no sourceId is given — Drizzle's `and(...)` treats
-   * undefined entries as no-ops, so existing callers that omit sourceId continue
-   * to see all rows regardless of their source_id value.
+   * FAIL-CLOSED: a missing/empty sourceId THROWS — the #1 hard rule
+   * (per-source isolation) is now enforced at runtime, not by caller discipline.
+   * For an intentional cross-source query, pass the ALL_SOURCES sentinel, which
+   * returns `undefined` (no WHERE clause).
    *
-   * Usage:
    *   .where(and(eq(nodes.nodeNum, num), this.withSourceScope(nodes, sourceId)))
    */
-  protected withSourceScope(table: any, sourceId?: string): SQL | undefined {
-    if (!sourceId) return undefined;
+  protected withSourceScope(table: any, sourceId: SourceScope | undefined): SQL | undefined {
+    if (sourceId === ALL_SOURCES) return undefined;           // explicit opt-out
+    if (sourceId === undefined || sourceId === null || sourceId === '') {
+      throw new Error(
+        'withSourceScope: sourceId is required. Pass a concrete sourceId, or the ' +
+        'ALL_SOURCES sentinel for an intentional cross-source query. ' +
+        'Omitting sourceId used to silently return rows from every source (data leak).',
+      );
+    }
     return eq(table.sourceId, sourceId);
   }
 
 
@@ -11,6 +11,7 @@
 import { describe, it, expect, beforeEach, afterEach, afterAll, beforeAll } from 'vitest';
 import * as schema from '../schema/index.js';
 import { ChannelsRepository } from './channels.js';
+import { ALL_SOURCES } from './base.js';
 import {
   TestBackend,
   createPostgresBackend,
@@ -270,7 +271,7 @@ function runChannelsTests(getBackend: () => TestBackend) {
     await repo.upsertChannel({ id: 0, name: 'Primary', psk: 'p0', role: 1 });
     await repo.upsertChannel({ id: 1, name: 'One', psk: 'p1', role: 2 });
 
-    const channels = await repo.getAllChannels();
+    const channels = await repo.getAllChannels(ALL_SOURCES);
     expect(channels.length).toBe(3);
     expect(channels[0].id).toBe(0);
     expect(channels[1].id).toBe(1);
@@ -337,7 +338,7 @@ function runChannelsTests(getBackend: () => TestBackend) {
     expect(repo.getChannelCountSync('src-a')).toBe(2);
     expect(repo.getChannelCountSync('src-b')).toBe(1);
     // Unscoped sees everything (legacy behaviour).
-    expect(repo.getChannelCountSync()).toBe(3);
+    expect(repo.getChannelCountSync(ALL_SOURCES)).toBe(3);
   });
 
   it('getChannelCount - returns correct count', async () => {
@@ -347,13 +348,13 @@ function runChannelsTests(getBackend: () => TestBackend) {
       return;
     }
 
-    expect(await repo.getChannelCount()).toBe(0);
+    expect(await repo.getChannelCount(ALL_SOURCES)).toBe(0);
 
     await repo.upsertChannel({ id: 0, name: 'Primary', psk: 'p0', role: 1 });
-    expect(await repo.getChannelCount()).toBe(1);
+    expect(await repo.getChannelCount(ALL_SOURCES)).toBe(1);
 
     await repo.upsertChannel({ id: 1, name: 'Secondary', psk: 'p1', role: 2 });
-    expect(await repo.getChannelCount()).toBe(2);
+    expect(await repo.getChannelCount(ALL_SOURCES)).toBe(2);
   });
 
   it('deleteChannel - removes a channel by ID', async () => {
@@ -370,7 +371,7 @@ function runChannelsTests(getBackend: () => TestBackend) {
 
     expect(await repo.getChannelById(1)).toBeNull();
     expect(await repo.getChannelById(0)).not.toBeNull();
-    expect(await repo.getChannelCount()).toBe(1);
+    expect(await repo.getChannelCount(ALL_SOURCES)).toBe(1);
   });
 
   it('deleteChannel - no-op for non-existent channel', async () => {
@@ -382,7 +383,7 @@ function runChannelsTests(getBackend: () => TestBackend) {
 
     await repo.upsertChannel({ id: 0, name: 'Primary', psk: 'p0', role: 1 });
     await repo.deleteChannel(99);
-    expect(await repo.getChannelCount()).toBe(1);
+    expect(await repo.getChannelCount(ALL_SOURCES)).toBe(1);
   });
 
   it('cleanupInvalidChannels - removes channels outside 0-7 range', async () => {
@@ -403,11 +404,11 @@ function runChannelsTests(getBackend: () => TestBackend) {
     await backend2.exec(`INSERT INTO channels (id, name, psk, role, ${cat}, ${uat}) VALUES (8, 'Invalid8', 'psk', 2, 0, 0)`);
     await backend2.exec(`INSERT INTO channels (id, name, psk, role, ${cat}, ${uat}) VALUES (100, 'Invalid100', 'psk', 2, 0, 0)`);
 
-    expect(await repo.getChannelCount()).toBe(5);
+    expect(await repo.getChannelCount(ALL_SOURCES)).toBe(5);
 
     const deleted = await repo.cleanupInvalidChannels();
     expect(deleted).toBe(2);
-    expect(await repo.getChannelCount()).toBe(3);
+    expect(await repo.getChannelCount(ALL_SOURCES)).toBe(3);
     expect(await repo.getChannelById(8)).toBeNull();
     expect(await repo.getChannelById(100)).toBeNull();
   });
@@ -424,7 +425,7 @@ function runChannelsTests(getBackend: () => TestBackend) {
 
     const deleted = await repo.cleanupInvalidChannels();
     expect(deleted).toBe(0);
-    expect(await repo.getChannelCount()).toBe(2);
+    expect(await repo.getChannelCount(ALL_SOURCES)).toBe(2);
   });
 
   it('cleanupInvalidChannels - preserves out-of-range channels owned by a MeshCore source', async () => {
@@ -455,7 +456,7 @@ function runChannelsTests(getBackend: () => TestBackend) {
     // A legacy NULL-sourceId channel at idx 9 (implicitly Meshtastic; should be removed).
     await backend.exec(`INSERT INTO channels (id, name, psk, ${cat}, ${uat}) VALUES (9, 'Legacy-Nine', 'aGVsbG8=', 0, 0)`);
 
-    expect(await repo.getChannelCount()).toBe(3);
+    expect(await repo.getChannelCount(ALL_SOURCES)).toBe(3);
 
     const deleted = await repo.cleanupInvalidChannels();
     expect(deleted).toBe(2);
@@ -492,11 +493,11 @@ function runChannelsTests(getBackend: () => TestBackend) {
     await backend2.exec(`INSERT INTO channels (id, name, psk, role, ${cat}, ${uat}) VALUES (3, 'Empty3', NULL, NULL, 0, 0)`);
     await backend2.exec(`INSERT INTO channels (id, name, psk, role, ${cat}, ${uat}) VALUES (4, 'Empty4', NULL, NULL, 0, 0)`);
 
-    expect(await repo.getChannelCount()).toBe(5);
+    expect(await repo.getChannelCount(ALL_SOURCES)).toBe(5);
 
     const deleted = await repo.cleanupEmptyChannels();
     expect(deleted).toBe(2);
-    expect(await repo.getChannelCount()).toBe(3);
+    expect(await repo.getChannelCount(ALL_SOURCES)).toBe(3);
     expect(await repo.getChannelById(3)).toBeNull();
     expect(await repo.getChannelById(4)).toBeNull();
     // Protected channels still exist
@@ -521,7 +522,7 @@ function runChannelsTests(getBackend: () => TestBackend) {
 
     const deleted = await repo.cleanupEmptyChannels();
     expect(deleted).toBe(0);
-    expect(await repo.getChannelCount()).toBe(2);
+    expect(await repo.getChannelCount(ALL_SOURCES)).toBe(2);
   });
 
   it('cleanupEmptyChannels - returns 0 when no empty channels', async () => {
 
@@ -5,7 +5,7 @@
  * Supports SQLite, PostgreSQL, and MySQL through Drizzle ORM.
  */
 import { eq, and, gt, isNull, or, lt, count, notInArray } from 'drizzle-orm';
-import { BaseRepository, DrizzleDatabase } from './base.js';
+import { BaseRepository, DrizzleDatabase, SourceScope } from './base.js';
 import { DatabaseType, DbChannel } from '../types.js';
 import { logger } from '../../utils/logger.js';
 
@@ -64,7 +64,7 @@ export class ChannelsRepository extends BaseRepository {
   /**
    * Get all channels ordered by ID, optionally scoped to a source.
    */
-  async getAllChannels(sourceId?: string): Promise<DbChannel[]> {
+  async getAllChannels(sourceId: SourceScope): Promise<DbChannel[]> {
     const { channels } = this.tables;
     const result = await this.db
       .select()
@@ -78,7 +78,7 @@ export class ChannelsRepository extends BaseRepository {
   /**
    * Get the total number of channels, optionally scoped to a source.
    */
-  async getChannelCount(sourceId?: string): Promise<number> {
+  async getChannelCount(sourceId: SourceScope): Promise<number> {
     const { channels } = this.tables;
     const whereClause = this.withSourceScope(channels, sourceId);
     const result = whereClause
@@ -339,7 +339,7 @@ export class ChannelsRepository extends BaseRepository {
    * Synchronously get all channels (SQLite only), optionally scoped to a
    * source (#3712).
    */
-  getAllChannelsSync(sourceId?: string): DbChannel[] {
+  getAllChannelsSync(sourceId?: SourceScope): DbChannel[] {
     const db = this.getSqliteDb();
     const { channels } = this.tables;
     const rows = db
@@ -355,13 +355,11 @@ export class ChannelsRepository extends BaseRepository {
    * Synchronously count channels (SQLite only), optionally scoped to a
    * source (#3712).
    */
-  getChannelCountSync(sourceId?: string): number {
+  getChannelCountSync(sourceId?: SourceScope): number {
     const db = this.getSqliteDb();
     const { channels } = this.tables;
     const whereClause = this.withSourceScope(channels, sourceId);
-    const rows = whereClause
-      ? db.select({ count: count() }).from(channels).where(whereClause).all()
-      : db.select({ count: count() }).from(channels).all();
+    const rows = db.select({ count: count() }).from(channels).where(whereClause).all();
     return Number((rows[0] as any).count);
   }
 
 
@@ -4,8 +4,8 @@
  * Central export point for all repository classes.
  */
 
-export { BaseRepository } from './base.js';
-export type { DrizzleDatabase, SQLiteDrizzle, PostgresDrizzle } from './base.js';
+export { BaseRepository, ALL_SOURCES } from './base.js';
+export type { DrizzleDatabase, SQLiteDrizzle, PostgresDrizzle, SourceScope } from './base.js';
 export { SettingsRepository } from './settings.js';
 export { ChannelsRepository, type ChannelInput } from './channels.js';
 export { NodesRepository, type NodesCacheHook } from './nodes.js';
 
@@ -10,6 +10,7 @@ import { describe, it, expect, beforeEach, afterEach } from 'vitest';
 import Database from 'better-sqlite3';
 import { BetterSQLite3Database } from 'drizzle-orm/better-sqlite3';
 import { MessagesRepository } from './messages.js';
+import { ALL_SOURCES } from './base.js';
 import * as schema from '../schema/index.js';
 import { createTestDb } from '../../server/test-helpers/testDb.js';
 
@@ -75,7 +76,7 @@ describe('MessagesRepository — createdAt ordering (#3122)', () => {
     insert('real-newer-1', { rxTime: 2000, createdAt: 2000 });
     insert('real-newer-2', { rxTime: 3000, createdAt: 3000 });
 
-    const rows = await repo.getMessages(10);
+    const rows = await repo.getMessages(10, 0, ALL_SOURCES);
     expect(rows.map((r: any) => r.id)).toEqual(['real-newer-2', 'real-newer-1', 'future-but-old']);
   });
 
@@ -84,7 +85,7 @@ describe('MessagesRepository — createdAt ordering (#3122)', () => {
     insert('actual-new', { channel: 0, rxTime: 500, createdAt: 200 });
     insert('other-channel', { channel: 5, rxTime: 999, createdAt: 999 });
 
-    const rows = await repo.getMessagesByChannel(0, 10);
+    const rows = await repo.getMessagesByChannel(0, 10, 0, ALL_SOURCES);
     expect(rows.map((r: any) => r.id)).toEqual(['actual-new', 'skewed']);
   });
 
@@ -98,23 +99,23 @@ describe('MessagesRepository — createdAt ordering (#3122)', () => {
     // Cursor "before" = 250 should pull rows whose createdAt < 250.
     // Under the old rxTime cursor 'skewed' would be excluded (rxTime > 250).
     // Under createdAt 'skewed' is included.
-    const rows = await repo.getMessagesBeforeInChannel(0, 250, 10);
+    const rows = await repo.getMessagesBeforeInChannel(0, 250, 10, ALL_SOURCES);
     expect(rows.map((r: any) => r.id)).toEqual(['b', 'skewed', 'a']);
   });
 
   it('getMessagesSqlite (sync variant) orders by createdAt', () => {
     insert('skewed', { rxTime: FAR_FUTURE, createdAt: 100 });
     insert('newer', { rxTime: 50, createdAt: 200 });
 
-    const rows = repo.getMessagesSqlite(10);
+    const rows = repo.getMessagesSqlite(10, 0, ALL_SOURCES);
     expect(rows.map((r: any) => r.id)).toEqual(['newer', 'skewed']);
   });
 
   it('getMessagesByChannelSqlite (sync variant) orders by createdAt', () => {
     insert('skewed', { channel: 2, rxTime: FAR_FUTURE, createdAt: 100 });
     insert('newer', { channel: 2, rxTime: 50, createdAt: 200 });
 
-    const rows = repo.getMessagesByChannelSqlite(2, 10);
+    const rows = repo.getMessagesByChannelSqlite(2, 10, 0, ALL_SOURCES);
     expect(rows.map((r: any) => r.id)).toEqual(['newer', 'skewed']);
   });
 });
@@ -11,6 +11,7 @@ import { describe, it, expect, beforeEach, afterEach } from 'vitest';
 import Database from 'better-sqlite3';
 import { BetterSQLite3Database } from 'drizzle-orm/better-sqlite3';
 import { MessagesRepository } from './messages.js';
+import { ALL_SOURCES } from './base.js';
 import * as schema from '../schema/index.js';
 import { createTestDb } from '../../server/test-helpers/testDb.js';
 
@@ -59,18 +60,18 @@ describe('MessagesRepository.getMessages excludePortnums', () => {
     insert('trace-1', 70, 2000);
     insert('text-2', 1, 3000);
 
-    const all = await repo.getMessages(100);
+    const all = await repo.getMessages(100, 0, ALL_SOURCES);
     expect(all).toHaveLength(3);
 
-    const filtered = await repo.getMessages(100, 0, undefined, [70]);
+    const filtered = await repo.getMessages(100, 0, ALL_SOURCES, [70]);
     expect(filtered.map(m => m.id).sort()).toEqual(['text-1', 'text-2']);
   });
 
   it('keeps rows whose portnum is NULL (legacy data predates the column)', async () => {
     insert('legacy', null, 1000);
     insert('trace', 70, 2000);
 
-    const filtered = await repo.getMessages(100, 0, undefined, [70]);
+    const filtered = await repo.getMessages(100, 0, ALL_SOURCES, [70]);
     expect(filtered.map(m => m.id)).toEqual(['legacy']);
   });
 
@@ -83,21 +84,21 @@ describe('MessagesRepository.getMessages excludePortnums', () => {
 
     // Without the filter, limit=3 returns the 3 newest — which now includes
     // the traceroute and drops dm-old. This is the bug.
-    const unfiltered = await repo.getMessages(3);
+    const unfiltered = await repo.getMessages(3, 0, ALL_SOURCES);
     expect(unfiltered.map(m => m.id)).toContain('trace');
     expect(unfiltered.map(m => m.id)).not.toContain('dm-old');
 
     // With the filter, all 3 DMs survive the same capped window.
-    const filtered = await repo.getMessages(3, 0, undefined, [70]);
+    const filtered = await repo.getMessages(3, 0, ALL_SOURCES, [70]);
     expect(filtered.map(m => m.id).sort()).toEqual(['dm-mid', 'dm-old', 'dm-recent']);
   });
 
   it('is a no-op when excludePortnums is empty or omitted', async () => {
     insert('a', 1, 1000);
     insert('b', 70, 2000);
 
-    const omitted = await repo.getMessages(100);
-    const empty = await repo.getMessages(100, 0, undefined, []);
+    const omitted = await repo.getMessages(100, 0, ALL_SOURCES);
+    const empty = await repo.getMessages(100, 0, ALL_SOURCES, []);
 
     expect(omitted.map(m => m.id).sort()).toEqual(['a', 'b']);
     expect(empty.map(m => m.id).sort()).toEqual(['a', 'b']);