From 2516fcb13d293703d6e5326a5423186cbb681375 Mon Sep 17 00:00:00 2001 From: Hein Date: Thu, 1 Oct 2026 13:21:00 +0200 Subject: [PATCH] chore(security): apply golangci-lint fixes to lookup and security packages --- pkg/security/keystore.go | 1 + pkg/security/keystore_database.go | 8 -------- pkg/security/lookup/backends/routers.go | 2 +- pkg/security/lookup/conformance/conformance.go | 6 +++--- pkg/security/lookup/direct/base.go | 6 +++--- pkg/security/lookup/direct/passkey.go | 5 ++--- pkg/security/lookup/mode.go | 8 ++++---- pkg/security/lookup/procedure/flextime.go | 2 +- pkg/security/lookup/procedure/passkey.go | 2 +- pkg/security/lookup/schema.go | 2 +- pkg/security/providers/keystore_authenticator.go | 5 +++-- pkg/security/providers/keystore_config.go | 3 ++- pkg/security/totp/authenticator.go | 3 ++- pkg/security/totp/memory.go | 3 ++- pkg/security/totp/totp.go | 3 ++- pkg/security/totp_provider_database.go | 1 + 16 files changed, 29 insertions(+), 31 deletions(-) diff --git a/pkg/security/keystore.go b/pkg/security/keystore.go index be5fd8a..19510ec 100644 --- a/pkg/security/keystore.go +++ b/pkg/security/keystore.go @@ -2,6 +2,7 @@ package security import ( "context" + "github.com/bitechdev/ResolveSpec/pkg/security/sectypes" ) diff --git a/pkg/security/keystore_database.go b/pkg/security/keystore_database.go index d9b0848..a471940 100644 --- a/pkg/security/keystore_database.go +++ b/pkg/security/keystore_database.go @@ -159,11 +159,3 @@ func (ks *DatabaseKeyStore) validateKeyLoad(ctx context.Context, hash, cacheKey func keystoreCacheKey(hash string) string { return "keystore:validate:" + hash } - -// nullStringOr returns s.String if valid, otherwise the fallback. -func nullStringOr(s sql.NullString, fallback string) string { - if s.Valid && s.String != "" { - return s.String - } - return fallback -} diff --git a/pkg/security/lookup/backends/routers.go b/pkg/security/lookup/backends/routers.go index bdfd480..566e686 100644 --- a/pkg/security/lookup/backends/routers.go +++ b/pkg/security/lookup/backends/routers.go @@ -261,7 +261,7 @@ func (r *passkeyRouter) Store(ctx context.Context, rec lookup.PasskeyCredentialR return st.Store(ctx, rec) } -func (r *passkeyRouter) Get(ctx context.Context, credentialID string) (int, uint32, error) { +func (r *passkeyRouter) Get(ctx context.Context, credentialID string) (userID int, signCount uint32, err error) { st, err := pick[lookup.PasskeyStore](r.c, ctx, lookup.OpPasskeyGet, r.c.procs.PasskeyGetCredential, r.proc, r.direct) if err != nil { return 0, 0, err diff --git a/pkg/security/lookup/conformance/conformance.go b/pkg/security/lookup/conformance/conformance.go index 1e11815..006b34b 100644 --- a/pkg/security/lookup/conformance/conformance.go +++ b/pkg/security/lookup/conformance/conformance.go @@ -499,7 +499,7 @@ func (s *suite) seed(t *testing.T, table string, cols []string, vals ...any) { } args[i] = v } - q := fmt.Sprintf("INSERT INTO %s (%s) VALUES (%s)", table, strings.Join(cols, ", "), strings.Join(ph, ", ")) + q := fmt.Sprintf("INSERT INTO %s (%s) VALUES (%s)", table, strings.Join(cols, ", "), strings.Join(ph, ", ")) //nolint:gosec // test seeding with fixed table names if _, err := s.DB.ExecContext(ctx, q, args...); err != nil { t.Fatalf("seed %s: %v", table, err) } @@ -526,8 +526,8 @@ func (s *suite) policy(t *testing.T) { t.Fatalf("column rules (user + group, exact table, active only): %d %v %+v", len(rules), err, rules) } paths := map[string]bool{} - for _, r := range rules { - paths[strings.Join(r.Path, ".")] = true + for i := range rules { + paths[strings.Join(rules[i].Path, ".")] = true } if !paths["email"] || !paths["profile.ssn"] { t.Fatalf("paths: %v", paths) diff --git a/pkg/security/lookup/direct/base.go b/pkg/security/lookup/direct/base.go index 0f97395..06538e3 100644 --- a/pkg/security/lookup/direct/base.go +++ b/pkg/security/lookup/direct/base.go @@ -429,9 +429,9 @@ func (b *Base) Insert(e lookup.Entity) *Insert { return &Insert{b: b, e: e} } // Set adds assignments. func (i *Insert) Set(as ...Assignment) *Insert { i.sets = append(i.sets, as...); return i } -func (i *Insert) colsAndArgs() ([]string, []any) { - cols := make([]string, len(i.sets)) - args := make([]any, len(i.sets)) +func (i *Insert) colsAndArgs() (cols []string, args []any) { + cols = make([]string, len(i.sets)) + args = make([]any, len(i.sets)) for n, a := range i.sets { cols[n] = i.b.colName(a.Col) args[n] = i.b.arg(a.Val) diff --git a/pkg/security/lookup/direct/passkey.go b/pkg/security/lookup/direct/passkey.go index a8dbc01..da6de42 100644 --- a/pkg/security/lookup/direct/passkey.go +++ b/pkg/security/lookup/direct/passkey.go @@ -68,10 +68,9 @@ func (p *Passkey) Store(ctx context.Context, rec lookup.PasskeyCredentialRecord) } // Get implements lookup.PasskeyStore. -func (p *Passkey) Get(ctx context.Context, credentialID string) (int, uint32, error) { - var userID int +func (p *Passkey) Get(ctx context.Context, credentialID string) (userID int, signCount uint32, err error) { var count int64 - err := p.do(func(q Querier) error { + err = p.do(func(q Querier) error { return p.From(lookup.EntityUserPasskeyCredentials).Cols(lookup.PasskeyUserID, lookup.PasskeySignCount). Where(Eq(lookup.PasskeyCredentialID, credentialID)).QueryRow(ctx, q, &userID, &count) }) diff --git a/pkg/security/lookup/mode.go b/pkg/security/lookup/mode.go index 6214073..e73f528 100644 --- a/pkg/security/lookup/mode.go +++ b/pkg/security/lookup/mode.go @@ -44,7 +44,7 @@ const ( OpSession Op = "session" OpTouchSession Op = "touch_session" OpRefresh Op = "refresh" - OpLoginAPIKey Op = "login_api_key" + OpLoginAPIKey Op = "login_api_key" //nolint:gosec // operation name, not a credential OpJWTLogin Op = "jwt_login" OpJWTLogout Op = "jwt_logout" OpResetRequest Op = "reset_request" @@ -64,8 +64,8 @@ const ( OpOAuthGetOrCreateUser Op = "oauth_get_or_create_user" OpOAuthCreateSession Op = "oauth_create_session" - OpOAuthGetRefreshToken Op = "oauth_get_refresh_token" - OpOAuthUpdateRefreshToken Op = "oauth_update_refresh_token" + OpOAuthGetRefreshToken Op = "oauth_get_refresh_token" //nolint:gosec // operation name, not a credential + OpOAuthUpdateRefreshToken Op = "oauth_update_refresh_token" //nolint:gosec // operation name, not a credential OpOAuthGetUser Op = "oauth_get_user" OpPasskeyStore Op = "passkey_store" @@ -74,7 +74,7 @@ const ( OpPasskeyList Op = "passkey_list" OpPasskeyDelete Op = "passkey_delete" OpPasskeyRename Op = "passkey_rename" - OpPasskeyByUsername Op = "passkey_by_username" + OpPasskeyByUsername Op = "passkey_by_username" //nolint:gosec // operation name, not a credential OpPasskeyLogin Op = "passkey_login" OpTOTPEnable Op = "totp_enable" diff --git a/pkg/security/lookup/procedure/flextime.go b/pkg/security/lookup/procedure/flextime.go index 8dcfe2b..75500ed 100644 --- a/pkg/security/lookup/procedure/flextime.go +++ b/pkg/security/lookup/procedure/flextime.go @@ -38,7 +38,7 @@ func normalizeTimes(raw []byte) []byte { func fixTimes(m map[string]any) { for k, v := range m { s, ok := v.(string) - if !ok || !(strings.HasSuffix(k, "_at") || k == "expiry") { + if !ok || (!strings.HasSuffix(k, "_at") && k != "expiry") { continue } if _, err := time.Parse(time.RFC3339Nano, s); err == nil { diff --git a/pkg/security/lookup/procedure/passkey.go b/pkg/security/lookup/procedure/passkey.go index 089d32c..c17c0a0 100644 --- a/pkg/security/lookup/procedure/passkey.go +++ b/pkg/security/lookup/procedure/passkey.go @@ -68,7 +68,7 @@ func (p *Passkey) Store(ctx context.Context, rec lookup.PasskeyCredentialRecord) } // Get implements lookup.PasskeyStore. -func (p *Passkey) Get(ctx context.Context, credentialID string) (int, uint32, error) { +func (p *Passkey) Get(ctx context.Context, credentialID string) (userID int, signCount uint32, err error) { raw, err := decodeCredentialID(credentialID) if err != nil { return 0, 0, err diff --git a/pkg/security/lookup/schema.go b/pkg/security/lookup/schema.go index b7482c1..b2d0e17 100644 --- a/pkg/security/lookup/schema.go +++ b/pkg/security/lookup/schema.go @@ -22,7 +22,7 @@ const ( EntityUserSessions Entity = "user_sessions" EntityTokenBlacklist Entity = "token_blacklist" EntityUserTOTPBackupCodes Entity = "user_totp_backup_codes" - EntityUserPasskeyCredentials Entity = "user_passkey_credentials" + EntityUserPasskeyCredentials Entity = "user_passkey_credentials" //nolint:gosec // table name, not a credential EntityUserPasswordResets Entity = "user_password_resets" EntityOAuthClients Entity = "oauth_clients" EntityOAuthCodes Entity = "oauth_codes" diff --git a/pkg/security/providers/keystore_authenticator.go b/pkg/security/providers/keystore_authenticator.go index 0437f5e..c8c52a1 100644 --- a/pkg/security/providers/keystore_authenticator.go +++ b/pkg/security/providers/keystore_authenticator.go @@ -3,10 +3,11 @@ package providers import ( "context" "fmt" - "github.com/bitechdev/ResolveSpec/pkg/security" - "github.com/bitechdev/ResolveSpec/pkg/security/sectypes" "net/http" "strings" + + "github.com/bitechdev/ResolveSpec/pkg/security" + "github.com/bitechdev/ResolveSpec/pkg/security/sectypes" ) // KeyStoreAuthenticator implements the Authenticator interface using a KeyStore. diff --git a/pkg/security/providers/keystore_config.go b/pkg/security/providers/keystore_config.go index efed6e1..9ed9c34 100644 --- a/pkg/security/providers/keystore_config.go +++ b/pkg/security/providers/keystore_config.go @@ -7,10 +7,11 @@ import ( "encoding/base64" "encoding/hex" "fmt" - "github.com/bitechdev/ResolveSpec/pkg/security/sectypes" "sync" "sync/atomic" "time" + + "github.com/bitechdev/ResolveSpec/pkg/security/sectypes" ) // ConfigKeyStore is an in-memory keystore backed by a static slice of UserKey values. diff --git a/pkg/security/totp/authenticator.go b/pkg/security/totp/authenticator.go index a61dd5e..dcc19bc 100644 --- a/pkg/security/totp/authenticator.go +++ b/pkg/security/totp/authenticator.go @@ -3,8 +3,9 @@ package totp import ( "context" "fmt" - "github.com/bitechdev/ResolveSpec/pkg/security/sectypes" "net/http" + + "github.com/bitechdev/ResolveSpec/pkg/security/sectypes" ) // BaseAuthenticator is the subset of security.Authenticator that Authenticator wraps. diff --git a/pkg/security/totp/memory.go b/pkg/security/totp/memory.go index dbbb8ed..d997077 100644 --- a/pkg/security/totp/memory.go +++ b/pkg/security/totp/memory.go @@ -4,8 +4,9 @@ import ( "crypto/sha256" "encoding/hex" "fmt" - "github.com/bitechdev/ResolveSpec/pkg/security/sectypes" "sync" + + "github.com/bitechdev/ResolveSpec/pkg/security/sectypes" ) // MemoryProvider is an in-memory implementation of AuthProvider for testing/examples diff --git a/pkg/security/totp/totp.go b/pkg/security/totp/totp.go index 295cccd..1a0e0a4 100644 --- a/pkg/security/totp/totp.go +++ b/pkg/security/totp/totp.go @@ -9,12 +9,13 @@ import ( "encoding/base32" "encoding/binary" "fmt" - "github.com/bitechdev/ResolveSpec/pkg/security/sectypes" "hash" "math" "net/url" "strings" "time" + + "github.com/bitechdev/ResolveSpec/pkg/security/sectypes" ) // AuthProvider defines interface for 2FA operations diff --git a/pkg/security/totp_provider_database.go b/pkg/security/totp_provider_database.go index 2f1250c..bded4ca 100644 --- a/pkg/security/totp_provider_database.go +++ b/pkg/security/totp_provider_database.go @@ -6,6 +6,7 @@ import ( "database/sql" "encoding/hex" "fmt" + "github.com/bitechdev/ResolveSpec/pkg/security/lookup" "github.com/bitechdev/ResolveSpec/pkg/security/totp" )