api: fix root query to be correctly specific (#75)

Author: worm-emoji

api/root.go

@@ -45,20 +45,28 @@ func (s *Server) GetRoot(w http.ResponseWriter, r *http.Request) {
 	const q = `
 		SELECT root
 		FROM trees
-		WHERE proofs_array(proofs) @> proofs_array($1)
-		LIMIT 1
+		WHERE proofs_array(proofs) <@ proofs_array($1);
 	`
-
 	rr := rootResp{}
-	err := s.db.QueryRow(ctx, q, dbQuery).Scan(
-		&rr.Root,
-	)
-	if errors.Is(err, pgx.ErrNoRows) {
-		s.sendJSONError(r, w, nil, http.StatusNotFound, "root not found for proofs")
-		return
-	} else if err != nil {
+
+	// should only return one row, using QueryFunc to verify
+	// that's the case and return an error if not (we've had
+	// issues with this in the past)
+	hasRow := false
+	_, err := s.db.QueryFunc(ctx, q, []interface{}{dbQuery}, []interface{}{&rr.Root}, func(qfr pgx.QueryFuncRow) error {
+		if hasRow {
+			return errors.New("multiple rows returned")
+		}
+		hasRow = true
+		return nil
+	})
+
+	if err != nil {
 		s.sendJSONError(r, w, err, http.StatusInternalServerError, "selecting root")
 		return
+	} else if len(rr.Root) == 0 { // db.QueryFunc doesn't return pgx.ErrNoRows
+		s.sendJSONError(r, w, nil, http.StatusNotFound, "root not found for proofs")
+		return
 	}
 
 	w.Header().Set("Cache-Control", "public, max-age=3600")