Skip to content

fix(auth): harden error handling and CI linting #9

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Jonathan0823 merged 15 commits into from
Aug 3, 2026
Merged

fix(auth): harden error handling and CI linting #9

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
15 commits
Select commit Hold shift + click to select a range
45a0039
test(auth): expand service and HTTP flow coverage
Jonathan0823 Jul 31, 2026
ce2d191
test(storage): add PostgreSQL user repository integration coverage
Jonathan0823 Jul 31, 2026
030b5b7
test(ratelimit): cover limiter configuration and bootstrap paths
Jonathan0823 Jul 31, 2026
f2fa8f8
test(observability): cover metrics event and middleware paths
Jonathan0823 Jul 31, 2026
7330f9f
chore(sonar): exclude generated artifacts from analysis
Jonathan0823 Jul 31, 2026
61c01ea
fix(http): handle gin error returns consistently
Jonathan0823 Aug 3, 2026
af6064d
refactor(ratelimit): align limiter and token helper types
Jonathan0823 Aug 3, 2026
0bfb4c1
fix(platform): fail fast on server startup errors
Jonathan0823 Aug 3, 2026
2532a5e
ci(workflows): add golangci-lint job
Jonathan0823 Aug 3, 2026
12459e3
ci(workflows): fix golangci-lint version format
Jonathan0823 Aug 3, 2026
3a1f1cc
chore(sqlc): regenerate sqlc
Jonathan0823 Aug 3, 2026
6d202e6
ci(workflows): update golangci-lint to v2
Jonathan0823 Aug 3, 2026
9d1dc36
fix(ci): satisfy golangci-lint v2 checks
Jonathan0823 Aug 3, 2026
2c5d910
fix(gitguardian): ignore test files from the scan
Jonathan0823 Aug 3, 2026
19725a7
fix(gitguardian): use v2 test path exclusions
Jonathan0823 Aug 3, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 9 additions & 0 deletions .gitguardian.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,9 @@
# Required for ggshield v2 configuration.
version: 2

secret:
ignored_paths:
- '**/*_test.go'
- '**/testdata/**'
- '**/fixtures/**'
show_secrets: false
16 changes: 16 additions & 0 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -42,6 +42,22 @@ jobs:
- name: Vet
run: go vet ./...

lint:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4

@coderabbitai coderabbitai Bot Aug 3, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== repo files around workflows =="
git ls-files .github/workflows || true

echo "== ci.yml relevant content =="
if [ -f .github/workflows/ci.yml ]; then
  nl -ba .github/workflows/ci.yml | sed -n '1,140p'
else
  echo "missing .github/workflows/ci.yml"
fi

echo "== checkout uses with persist-credentials context =="
rg -n "actions/checkout|persist-credentials|permissions:" .github/workflows || true

Repository: Jonathan0823/auth-go

Length of output: 287

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== available tools =="
command -v cat || true
command -v sed || true
command -v grep || true

echo "== ci.yml relevant content =="
if [ -f .github/workflows/ci.yml ]; then
  cat -n .github/workflows/ci.yml | sed -n '1,140p'
else
  echo "missing .github/workflows/ci.yml"
fi

echo "== checkout and permissions matching =="
grep -nE "actions/checkout|persist-credentials|permissions:" .github/workflows/ci.yml || true

Repository: Jonathan0823/auth-go

Length of output: 4791

🌐 Web query:

actions/checkout v4 persist-credentials default true README

💡 Result:

The persist-credentials input for the actions/checkout GitHub Action has a default value of true [1][2][3]. This setting controls whether the action configures the provided GitHub token (or SSH key) within the local git configuration [1][4]. When enabled (the default), it allows your workflow steps to execute authenticated git commands (such as git fetch or git push) automatically without requiring additional manual configuration [5][4]. While persist-credentials: true remains the default, security implementations have evolved. In version 6.0.0 and later, the action was updated to store these credentials in a separate file under $RUNNER_TEMP rather than writing them directly into the .git/config file [4][3][6]. This change was designed to improve security by isolating the credentials [4][3]. If you wish to opt out of this behavior, you can explicitly set persist-credentials: false in your workflow step [5][4]. During post-job cleanup, the action automatically removes the persisted credentials [5][4].

Citations:

Do not persist the checkout credential.

actions/checkout persists GITHUB_TOKEN by default, and this lint job hands control to a third-party action afterward. The workflow already limits job permissions to contents: read, so add persist-credentials: false.

🧰 Tools
🪛 zizmor (1.28.0)

[warning] 48-48: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false

(artipacked)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/ci.yml at line 48, Update the actions/checkout@v4 step in
the lint job to set persist-credentials to false, while preserving the existing
read-only job permissions and subsequent third-party action flow.

Source: Linters/SAST tools


- uses: actions/setup-go@v6
with:
go-version-file: go.mod
cache: true
cache-dependency-path: go.sum

- name: Run golangci-lint
uses: golangci/golangci-lint-action@v7.0.1
with:
version: v2.12.2

sqlc:
runs-on: ubuntu-latest
steps:
Expand Down
20 changes: 10 additions & 10 deletions internal/adapter/inbound/http/auth_handler.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -101,7 +101,7 @@ func (h *Handler) Register(c *gin.Context) {
user := domain.User{Email: req.Email, Password: req.Password}
if err := h.Svc.Auth.Register(ctx, user); err != nil {
h.auditFailure(c, platform.EventUserRegister, "", err, 0)
c.Error(err)
_ = c.Error(err)
return
}
h.auditSuccess(c, platform.EventUserRegister, "", 0)
Expand Down Expand Up @@ -147,7 +147,7 @@ func (h *Handler) Login(c *gin.Context) {
accessToken, refreshToken, err := h.Svc.Auth.Login(ctx, user)
if err != nil {
h.auditFailure(c, platform.EventAuthLogin, "", err, 0)
c.Error(err)
_ = c.Error(err)
return
}

Expand Down Expand Up @@ -177,13 +177,13 @@ func (h *Handler) Logout(c *gin.Context) {
if err != nil || refreshToken == "" {
authErr := fmt.Errorf("refresh token not found: %w", domain.ErrUnauthenticated)
h.auditFailure(c, platform.EventAuthLogout, "", authErr, 0)
c.Error(authErr)
_ = c.Error(authErr)
return
}

if err := h.Svc.Auth.Logout(ctx, refreshToken); err != nil {
h.auditFailure(c, platform.EventAuthLogout, "", err, 0)
c.Error(err)
_ = c.Error(err)
return
}

Expand Down Expand Up @@ -215,7 +215,7 @@ func (h *Handler) Refresh(c *gin.Context) {
if err != nil || refreshToken == "" {
authErr := fmt.Errorf("refresh token not found: %w", domain.ErrUnauthenticated)
h.auditFailure(c, platform.EventAuthRefresh, "", authErr, 0)
c.Error(authErr)
_ = c.Error(authErr)
return
}

Expand All @@ -226,7 +226,7 @@ func (h *Handler) Refresh(c *gin.Context) {
} else {
h.auditFailure(c, platform.EventAuthRefresh, "", err, 0)
}
c.Error(err)
_ = c.Error(err)
return
}

Expand All @@ -251,7 +251,7 @@ func (h *Handler) VerifyEmail(c *gin.Context) {
defer cancel()
if err := h.Svc.Auth.VerifyEmail(ctx, c.Query("id")); err != nil {
h.auditFailure(c, platform.EventAuthEmailVerification, "", err, 0)
c.Error(err)
_ = c.Error(err)
return
}
h.auditSuccess(c, platform.EventAuthEmailVerification, "", 0)
Expand Down Expand Up @@ -285,7 +285,7 @@ func (h *Handler) ResendVerifyEmail(c *gin.Context) {
}
if err := h.Svc.Auth.CreateVerifyEmail(ctx, email); err != nil {
h.auditFailure(c, platform.EventAuthEmailVerification, "", err, 0)
c.Error(err)
_ = c.Error(err)
return
}
h.auditSuccess(c, platform.EventAuthEmailVerification, "", 0)
Expand Down Expand Up @@ -319,7 +319,7 @@ func (h *Handler) ForgotPassword(c *gin.Context) {
}
if err := h.Svc.Auth.ForgotPassword(ctx, req.Email); err != nil {
h.auditFailure(c, platform.EventAuthPasswordResetRequest, "", err, 0)
c.Error(err)
_ = c.Error(err)
return
}
h.auditSuccess(c, platform.EventAuthPasswordResetRequest, "", 0)
Expand Down Expand Up @@ -353,7 +353,7 @@ func (h *Handler) ResetPassword(c *gin.Context) {
}
if err := h.Svc.Auth.ResetPassword(ctx, req.ID, req.Password); err != nil {
h.auditFailure(c, platform.EventAuthPasswordReset, "", err, 0)
c.Error(err)
_ = c.Error(err)
return
}
h.auditSuccess(c, platform.EventAuthPasswordReset, "", 0)
Expand Down
31 changes: 31 additions & 0 deletions internal/adapter/inbound/http/dto/user_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,31 @@
package dto

import (
"testing"
"time"

"github.com/Jonathan0823/auth-go/internal/core/domain"
)

func TestUserResponseMappings(t *testing.T) {
now := time.Now()
user := &domain.User{
ID: 1,
OAuthID: "oauth-id",
Username: "user",
AvatarURL: "https://example.com/avatar.png",
Email: "user@example.com",
IsVerified: true,
Provider: "github",
CreatedAt: now,
UpdatedAt: now,
}
response := UserResponseFromDomain(user)
if response.ID != user.ID || response.Email != user.Email || response.Provider != user.Provider || !response.IsVerified {
t.Fatalf("response = %#v", response)
}
responses := UserResponsesFromDomain([]*domain.User{user})
if len(responses) != 1 || responses[0].ID != user.ID {
t.Fatalf("responses = %#v", responses)
}
}
Loading
Loading