fix(db): count IP-space subscriptions with COUNT(*), not SELECT ips.*

list_ip_range_subscriptions_by_space_paginated built its count query as
'SELECT ips.* ...' and ran it via query_scalar().fetch_one(). For any IP
space with zero subscriptions that fetch_one hit an empty result set and
returned RowNotFound, surfacing as a spurious 404 from the admin
GET /ip_space/{id}/subscriptions endpoint (and a wrong count otherwise).
Use 'SELECT COUNT(*)' so fetch_one always returns exactly one row.

Also harden the e2e test: it previously read spaces.first() off the shared
list, which was None on a fresh DB (a vacuous pass that hid the bug) and a
TOCTOU race against other tests under parallel load. It now creates its own
198.51.100.0/24 space and queries that id. Full e2e suite: 115/115.

Author: v0l

lnvps_db/src/mysql.rs

@@ -2788,13 +2788,20 @@ impl LNVpsDbBase for LNVpsDbMysql {
             extra.push_str(" AND ips.is_active = ?");
         }
 
-        let base = "SELECT ips.* FROM ip_range_subscription ips \
+        // Shared FROM/JOIN/WHERE; the count selects COUNT(*) (NOT `ips.*`) so
+        // `fetch_one` always returns exactly one row — selecting `ips.*` and
+        // fetching one scalar yields `RowNotFound` (a spurious 404) whenever a
+        // space has zero subscriptions, and a wrong count otherwise.
+        let from = "FROM ip_range_subscription ips \
                     INNER JOIN subscription_line_item sli ON ips.subscription_line_item_id = sli.id \
                     INNER JOIN subscription s ON sli.subscription_id = s.id \
                     WHERE 1=1";
 
-        let count_sql = format!("{} {}", base, extra);
-        let data_sql = format!("{} {} ORDER BY ips.id DESC LIMIT ? OFFSET ?", base, extra);
+        let count_sql = format!("SELECT COUNT(*) {} {}", from, extra);
+        let data_sql = format!(
+            "SELECT ips.* {} {} ORDER BY ips.id DESC LIMIT ? OFFSET ?",
+            from, extra
+        );
 
         let mut count_q = sqlx::query_scalar(&count_sql).bind(available_ip_space_id);
         if let Some(u) = user_id {

lnvps_e2e/src/admin_api.rs

@@ -1015,31 +1015,52 @@ mod tests {
     #[tokio::test]
     async fn test_admin_get_ip_space_with_pricing_and_subscriptions() {
         let client = setup().await;
-        let resp = client.get_auth("/api/admin/v1/ip_space").await.unwrap();
+
+        // Create a dedicated IP space and query THAT id, rather than picking
+        // `spaces.first()` off the shared list: other tests create/delete IP
+        // spaces concurrently, so the first-listed id could be deleted between
+        // the sub-calls (a TOCTOU that made this test flaky under parallel
+        // load). A self-owned space with a unique CIDR is deterministic.
+        let resp = client.get_auth("/api/admin/v1/companies").await.unwrap();
         let body: Value = serde_json::from_str(&resp.text().await.unwrap()).unwrap();
-        if let Some(spaces) = body["data"].as_array() {
-            if let Some(s) = spaces.first() {
-                let s_id = s["id"].as_u64().unwrap();
+        let company_id = body["data"]
+            .as_array()
+            .and_then(|a| a.first())
+            .and_then(|c| c["id"].as_u64())
+            .unwrap_or(1);
 
-                let resp = client
-                    .get_auth(&format!("/api/admin/v1/ip_space/{s_id}"))
-                    .await
-                    .unwrap();
-                assert_eq!(resp.status(), StatusCode::OK);
+        let create_body = serde_json::json!({
+            "company_id": company_id,
+            "cidr": "198.51.100.0/24",
+            "min_prefix_size": 32,
+            "max_prefix_size": 24,
+            "registry": 1
+        });
+        let resp = client
+            .post_auth("/api/admin/v1/ip_space", &create_body)
+            .await
+            .unwrap();
+        assert_eq!(resp.status(), StatusCode::OK, "create IP space");
+        let body: Value = serde_json::from_str(&resp.text().await.unwrap()).unwrap();
+        let s_id = body["data"]["id"].as_u64().expect("created IP space id");
 
-                let resp = client
-                    .get_auth(&format!("/api/admin/v1/ip_space/{s_id}/pricing"))
-                    .await
-                    .unwrap();
-                assert_eq!(resp.status(), StatusCode::OK);
+        let resp = client
+            .get_auth(&format!("/api/admin/v1/ip_space/{s_id}"))
+            .await
+            .unwrap();
+        assert_eq!(resp.status(), StatusCode::OK);
 
-                let resp = client
-                    .get_auth(&format!("/api/admin/v1/ip_space/{s_id}/subscriptions"))
-                    .await
-                    .unwrap();
-                assert_eq!(resp.status(), StatusCode::OK);
-            }
-        }
+        let resp = client
+            .get_auth(&format!("/api/admin/v1/ip_space/{s_id}/pricing"))
+            .await
+            .unwrap();
+        assert_eq!(resp.status(), StatusCode::OK);
+
+        let resp = client
+            .get_auth(&format!("/api/admin/v1/ip_space/{s_id}/subscriptions"))
+            .await
+            .unwrap();
+        assert_eq!(resp.status(), StatusCode::OK);
     }
 
     // ========================================================================