fix(syncer): reject inaccessible guild targets

steipete · steipete · commit 84c0008fe3fa · 2026-05-17T06:13:13.000+01:00
diff --git a/internal/cli/admin_commands.go b/internal/cli/admin_commands.go
@@ -80,10 +80,15 @@ func (r *runtime) runInit(args []string) error {
 		return authErr(err)
 	}
 	cfg.GuildIDs = make([]string, 0, len(guilds))
+	discovered := make(map[string]struct{}, len(guilds))
 	for _, guild := range guilds {
 		cfg.GuildIDs = append(cfg.GuildIDs, guild.ID)
+		discovered[guild.ID] = struct{}{}
 	}
 	if *guildID != "" {
+		if _, ok := discovered[*guildID]; !ok {
+			return usageErr(fmt.Errorf("guild %s is not accessible", *guildID))
+		}
 		cfg.DefaultGuildID = *guildID
 	}
 	if cfg.DefaultGuildID == "" && len(cfg.GuildIDs) == 1 {
diff --git a/internal/cli/cli_test.go b/internal/cli/cli_test.go
@@ -2606,6 +2606,31 @@ func TestRunInitWritesDiscoveredGuildConfig(t *testing.T) {
 	require.Contains(t, rt.stdout.(*bytes.Buffer).String(), "g2")
 }
 
+func TestRunInitRejectsUnknownDefaultGuild(t *testing.T) {
+	ctx := context.Background()
+	dir := t.TempDir()
+	cfgPath := filepath.Join(dir, "config.toml")
+	dbPath := filepath.Join(dir, "discrawl.db")
+	t.Setenv(config.DefaultTokenEnv, "env-token")
+
+	fakeSync := &fakeSyncService{discovered: []*discordgo.UserGuild{{ID: "g1"}}}
+	rt := &runtime{
+		ctx:        ctx,
+		configPath: cfgPath,
+		stdout:     &bytes.Buffer{},
+		stderr:     &bytes.Buffer{},
+		logger:     discardLogger(),
+		newDiscord: func(config.Config) (discordClient, error) { return &fakeDiscordClient{}, nil },
+		newSyncer: func(syncer.Client, *store.Store, *slog.Logger) syncService {
+			return fakeSync
+		},
+	}
+
+	err := rt.runInit([]string{"--db", dbPath, "--guild", "missing"})
+	require.Equal(t, 2, ExitCode(err))
+	require.ErrorContains(t, err, "guild missing is not accessible")
+}
+
 func TestRunMembersShowUsesDefaultGuildForAmbiguousQuery(t *testing.T) {
 	t.Parallel()
 
diff --git a/internal/syncer/records.go b/internal/syncer/records.go
@@ -243,3 +243,31 @@ func selectGuilds(all []*discordgo.UserGuild, requested []string) []*discordgo.U
 	}
 	return out
 }
+
+func missingGuildIDs(all []*discordgo.UserGuild, requested []string) []string {
+	if len(requested) == 0 {
+		return nil
+	}
+	available := make(map[string]struct{}, len(all))
+	for _, guild := range all {
+		if guild != nil && guild.ID != "" {
+			available[guild.ID] = struct{}{}
+		}
+	}
+	seen := map[string]struct{}{}
+	var missing []string
+	for _, id := range requested {
+		id = strings.TrimSpace(id)
+		if id == "" {
+			continue
+		}
+		if _, ok := seen[id]; ok {
+			continue
+		}
+		seen[id] = struct{}{}
+		if _, ok := available[id]; !ok {
+			missing = append(missing, id)
+		}
+	}
+	return missing
+}
diff --git a/internal/syncer/syncer.go b/internal/syncer/syncer.go
@@ -98,6 +98,9 @@ func (s *Syncer) Sync(ctx context.Context, opts SyncOptions) (SyncStats, error)
 	if err != nil {
 		return SyncStats{}, fmt.Errorf("list guilds: %w", err)
 	}
+	if missing := missingGuildIDs(guilds, opts.GuildIDs); len(missing) > 0 {
+		return SyncStats{}, fmt.Errorf("requested guilds not accessible: %s", strings.Join(missing, ", "))
+	}
 	targets := selectGuilds(guilds, opts.GuildIDs)
 	stats := SyncStats{}
 	for _, guild := range targets {
diff --git a/internal/syncer/syncer_test.go b/internal/syncer/syncer_test.go
@@ -382,6 +382,27 @@ func TestSyncMemberRefreshTimeoutStillMarksSuccess(t *testing.T) {
 	require.NotEmpty(t, lastSync)
 }
 
+func TestSyncRejectsUnknownRequestedGuild(t *testing.T) {
+	t.Parallel()
+
+	ctx := context.Background()
+	s, err := store.Open(ctx, filepath.Join(t.TempDir(), "discrawl.db"))
+	require.NoError(t, err)
+	defer func() { _ = s.Close() }()
+
+	client := &fakeClient{
+		guilds: []*discordgo.UserGuild{{ID: "g1", Name: "Guild"}},
+	}
+	svc := New(client, s, nil)
+
+	stats, err := svc.Sync(ctx, SyncOptions{GuildIDs: []string{"missing"}})
+	require.ErrorContains(t, err, "requested guilds not accessible: missing")
+	require.Zero(t, stats)
+	lastSync, err := s.GetSyncState(ctx, "sync:last_success")
+	require.NoError(t, err)
+	require.Empty(t, lastSync)
+}
+
 func TestSyncSkipsMemberRefreshWhenExistingSnapshotPresent(t *testing.T) {
 	t.Parallel()
 

Original file line number	Diff line number	Diff line change
`@@ -80,10 +80,15 @@ func (r *runtime) runInit(args []string) error {`
`80`	`80`	`return authErr(err)`
`81`	`81`	`}`
`82`	`82`	`cfg.GuildIDs = make([]string, 0, len(guilds))`
	`83`	`+ discovered := make(map[string]struct{}, len(guilds))`
`83`	`84`	`for _, guild := range guilds {`
`84`	`85`	`cfg.GuildIDs = append(cfg.GuildIDs, guild.ID)`
	`86`	`+ discovered[guild.ID] = struct{}{}`
`85`	`87`	`}`
`86`	`88`	`if *guildID != "" {`
	`89`	`+ if _, ok := discovered[*guildID]; !ok {`
	`90`	`+ return usageErr(fmt.Errorf("guild %s is not accessible", *guildID))`
	`91`	`+ }`
`87`	`92`	`cfg.DefaultGuildID = *guildID`
`88`	`93`	`}`
`89`	`94`	`if cfg.DefaultGuildID == "" && len(cfg.GuildIDs) == 1 {`