From d2f33b8f7d37d3effdb28f7df0a53750c5b4b6ab Mon Sep 17 00:00:00 2001
From: Hein <hein.puth@gmail.com>
Date: Wed, 7 Oct 2026 23:41:28 +0200
Subject: [PATCH] fix(aiproxy): handle response body closure and inspect return
 types

---
 pkg/aiproxy/handler.go | 9 +++++----
 pkg/aiproxy/store.go   | 3 ++-
 2 files changed, 7 insertions(+), 5 deletions(-)

diff --git a/pkg/aiproxy/handler.go b/pkg/aiproxy/handler.go
index 0208c1f..a597bc2 100644
--- a/pkg/aiproxy/handler.go
+++ b/pkg/aiproxy/handler.go
@@ -15,9 +15,10 @@ import (
 	"sync"
 	"time"
 
+	"github.com/tidwall/gjson"
+
 	"github.com/bitechdev/ResolveSpec/pkg/logger"
 	"github.com/bitechdev/ResolveSpec/pkg/security"
-	"github.com/tidwall/gjson"
 )
 
 type ctxKey struct{}
@@ -198,7 +199,7 @@ func (p *Proxy) buildProxy(t *target) *httputil.ReverseProxy {
 			}
 			if resp.StatusCode == http.StatusUnauthorized {
 				logger.Warn("aiproxy: upstream %q rejected its credentials", t.up.Name)
-				resp.Body.Close()
+				_ = resp.Body.Close()
 				body, _ := json.Marshal(errorBody("bad_gateway", "upstream rejected the proxy credentials"))
 				resp.StatusCode, resp.Status = http.StatusBadGateway, "502 Bad Gateway"
 				resp.Body = io.NopCloser(bytes.NewReader(body))
@@ -226,7 +227,7 @@ func (p *Proxy) buildProxy(t *target) *httputil.ReverseProxy {
 
 // inspect reads JSON request bodies to extract/enforce model and tools.
 // It returns a non-zero status when the request must be rejected.
-func (p *Proxy) inspect(t *target, r *http.Request, hc *HookContext) (int, string, string) {
+func (p *Proxy) inspect(t *target, r *http.Request, hc *HookContext) (status int, errType, msg string) {
 	switch r.Method {
 	case http.MethodPost, http.MethodPut, http.MethodPatch:
 	default:
@@ -246,7 +247,7 @@ func (p *Proxy) inspect(t *target, r *http.Request, hc *HookContext) (int, strin
 	}
 
 	body, err := io.ReadAll(io.LimitReader(r.Body, p.cfg.MaxBodyBytes+1))
-	r.Body.Close()
+	_ = r.Body.Close()
 	if err != nil {
 		return http.StatusBadRequest, "invalid_request_error", "could not read request body"
 	}
diff --git a/pkg/aiproxy/store.go b/pkg/aiproxy/store.go
index f64aa5a..82df8af 100644
--- a/pkg/aiproxy/store.go
+++ b/pkg/aiproxy/store.go
@@ -38,7 +38,8 @@ func (p *Proxy) Reload(ctx context.Context, store UpstreamStore) error {
 	var retired []*target
 
 	p.mu.Lock()
-	for _, d := range defs {
+	for i := range defs {
+		d := defs[i]
 		name := d.Upstream.Name
 		if _, dup := next[name]; dup {
 			errs = append(errs, fmt.Errorf("aiproxy: duplicate stored upstream %q", name))