修复日志持久化可靠性与数据库安全默认值

tests/deployment/compose_test.go

@@ -32,8 +32,16 @@ func TestComposeUsesSafeDeploymentDefaults(t *testing.T) {
 		t.Fatal("compose.yml is missing the thief_clickhouse service")
 	}
 	clickhouseService := compose[serviceStart:]
-	if strings.Contains(clickhouseService, "\n    ports:") {
-		t.Error("ClickHouse must not publish host ports by default")
+	for _, port := range []string{
+		`${CLICKHOUSE_LISTEN_IP:-127.0.0.1}:${CLICKHOUSE_HTTP_PORT:-8123}:8123`,
+		`${CLICKHOUSE_LISTEN_IP:-127.0.0.1}:${CLICKHOUSE_NATIVE_PORT:-9000}:9000`,
+	} {
+		if !strings.Contains(clickhouseService, port) {
+			t.Errorf("ClickHouse port must bind to loopback by default with %q", port)
+		}
+	}
+	if !strings.Contains(envExample, "CLICKHOUSE_LISTEN_IP=127.0.0.1\n") {
+		t.Error(".env.example must bind ClickHouse to loopback by default")
 	}
 
 	for _, emptySecret := range []string{"CLICKHOUSE_URL=\n", "CLICKHOUSE_PASSWORD=\n"} {

tests/logger/queue_test.go

@@ -381,6 +381,41 @@ func TestQueueSubmitOwnsEntrySnapshot(t *testing.T) {
 	}
 }
 
+func TestQueueRetainsBatchUntilBackendRecovers(t *testing.T) {
+	backend := newQueueBackend(func(context.Context, string) (logger.Batch, error) {
+		return &fakeBatch{}, nil
+	})
+	backend.healthy.Store(false)
+	q := logger.NewQueueWithBackend(backend, 1, 1, 1, 10*time.Millisecond)
+	q.Start(context.Background())
+	q.Submit(&logger.LogEntry{RequestID: "retained"})
+
+	time.Sleep(50 * time.Millisecond)
+	if calls := backend.calls.Load(); calls != 0 {
+		t.Fatalf("PrepareBatch calls=%d while unhealthy", calls)
+	}
+	if stats := q.Stats(); stats.Failed != 0 || stats.Bytes == 0 {
+		t.Fatalf("unhealthy stats=%+v want retained bytes and no failure", stats)
+	}
+
+	backend.healthy.Store(true)
+	deadline := time.Now().Add(time.Second)
+	for backend.calls.Load() == 0 && time.Now().Before(deadline) {
+		time.Sleep(10 * time.Millisecond)
+	}
+	ctx, cancel := context.WithTimeout(context.Background(), time.Second)
+	defer cancel()
+	if err := q.Stop(ctx); err != nil {
+		t.Fatalf("Stop: %v", err)
+	}
+	if calls := backend.calls.Load(); calls != 1 {
+		t.Fatalf("PrepareBatch calls=%d want 1", calls)
+	}
+	if stats := q.Stats(); stats.Failed != 0 || stats.Bytes != 0 {
+		t.Fatalf("recovered stats=%+v", stats)
+	}
+}
+
 func TestQueueByteBudgetTracksOwnedEntrySnapshot(t *testing.T) {
 	batch := &fakeBatch{}
 	backend := newQueueBackend(func(context.Context, string) (logger.Batch, error) {