From 466c779b32700b28b1a5423d708fee54e68aea41 Mon Sep 17 00:00:00 2001
From: biast12 <53872542+biast12@users.noreply.github.com>
Date: Sun, 13 Sep 2026 15:01:38 +0200
Subject: [PATCH] Handle row iteration errors in panel ACL reads

Add `rows.Err()` checks after iterating in `GetAll` and `GetAllForGuild` so database iteration failures are returned instead of silently ignored. Also add a clarifying comment on `ErrNoRuleMatched` to document that it conflates "no rules" and "no matching rules," and that callers should use `GetAll` when they need to distinguish those cases.
---
 panelaccesscontrolrules.go | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/panelaccesscontrolrules.go b/panelaccesscontrolrules.go
index 985ef49..6f71810 100644
--- a/panelaccesscontrolrules.go
+++ b/panelaccesscontrolrules.go
@@ -75,7 +75,11 @@ func (p *PanelAccessControlRules) GetAll(ctx context.Context, panelId int) ([]Pa
 		rules = append(rules, rule)
 	}
 
-	return rules[:], nil
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+
+	return rules, nil
 }
 
 // GetAllForGuild returns a map[panel_id][]rules
@@ -98,9 +102,15 @@ func (p *PanelAccessControlRules) GetAllForGuild(ctx context.Context, guildId ui
 		rules[panelId] = append(rules[panelId], rule)
 	}
 
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+
 	return rules, nil
 }
 
+// ErrNoRuleMatched covers both "panel has no rules" and "rules exist, none match" -- opposite
+// meanings. Callers needing to distinguish them must use GetAll and evaluate the whole set.
 func (p *PanelAccessControlRules) GetFirstMatched(ctx context.Context, panelId int, userRoles []uint64) (uint64, AccessControlAction, error) {
 	idArray := &pgtype.Int8Array{}
 	if err := idArray.Set(userRoles); err != nil {