chore: enable gosec and goimports linters (#113)

.golangci.yml

@@ -12,10 +12,8 @@ linters:
     - gci
     - testpackage
     - nlreturn
-    - gosec
     - ireturn
     - varnamelen
     - perfsprint
-    - goimports
     - exhaustruct
     - funlen

server/pkg/safe/safe.go

@@ -0,0 +1,15 @@
+package safe
+
+import (
+	"fmt"
+	"math"
+)
+
+var errInt32OutOfRange = fmt.Errorf("value is out of range for int32")
+
+func IntToInt32(value int) (int32, error) {
+	if value < math.MinInt32 || value > math.MaxInt32 {
+		return 0, fmt.Errorf("%w: %d", errInt32OutOfRange, value)
+	}
+	return int32(value), nil
+}

server/rpc/module.go

@@ -2,8 +2,10 @@ package rpc
 
 import (
 	"context"
+	"crypto/tls"
 	"fmt"
 	"net/http"
+	"time"
 
 	"connectrpc.com/connect"
 	"go.uber.org/fx"
@@ -78,13 +80,27 @@ func registerHandlers(p Handlers, o []connect.HandlerOption, m *middlewares.Midd
 	return mux
 }
 
+const (
+	readTimeout  = 10 * time.Second
+	writeTimeout = 10 * time.Second
+	idleTimeout  = 120 * time.Second
+)
+
 func startServer(lc fx.Lifecycle, c *config.Config, mux *http.ServeMux) {
 	lc.Append(fx.Hook{
 		OnStart: func(_ context.Context) error {
 			go func() {
-				address := fmt.Sprintf(":%s", c.Server.Port)
-				err := http.ListenAndServeTLS(address, c.Server.CertPath, c.Server.KeyPath, h2c.NewHandler(mux, &http2.Server{}))
-				if err != nil {
+				server := &http.Server{
+					Addr:         fmt.Sprintf(":%s", c.Server.Port),
+					Handler:      h2c.NewHandler(mux, &http2.Server{}),
+					ReadTimeout:  readTimeout,
+					WriteTimeout: writeTimeout,
+					IdleTimeout:  idleTimeout,
+					TLSConfig: &tls.Config{
+						MinVersion: tls.VersionTLS12,
+					},
+				}
+				if err := server.ListenAndServeTLS(c.Server.CertPath, c.Server.KeyPath); err != nil {
 					panic(fmt.Errorf("listen and serve: %w", err))
 				}
 			}()

server/rpc/v1/exercise.go

@@ -239,7 +239,13 @@ func (h *exerciseHandler) GetPersonalBests(ctx context.Context, req *connect.Req
 		return nil, connect.NewError(connect.CodeInternal, nil)
 	}
 
+	pb, err := parsePersonalBestSliceToPB(personalBests, exercises)
+	if err != nil {
+		log.Error("failed to parse personal best slice to pb", zap.Error(err))
+		return nil, connect.NewError(connect.CodeInternal, nil)
+	}
+
 	return connect.NewResponse(&v1.GetPersonalBestsResponse{
-		PersonalBests: parsePersonalBestSliceToPB(personalBests, exercises),
+		PersonalBests: pb,
 	}), nil
 }

server/rpc/v1/feed.go

@@ -89,24 +89,18 @@ func (h *feedHandler) ListItems(ctx context.Context, req *connect.Request[v1.Lis
 		return nil, connect.NewError(connect.CodeInternal, nil)
 	}
 
+	feedItems, err := parseFeedItemsToPB(paginated.Items, users, exercises)
+	if err != nil {
+		log.Error("failed to parse feed items", zap.Error(err))
+		return nil, connect.NewError(connect.CodeInternal, nil)
+	}
+
 	return &connect.Response[v1.ListItemsResponse]{
 		Msg: &v1.ListItemsResponse{
-			Items: parseFeedItemsToPB(paginated.Items, users, exercises),
+			Items: feedItems,
 			Pagination: &v1.PaginationResponse{
 				NextPageToken: paginated.NextPageToken,
 			},
 		},
 	}, nil
 }
-
-func parseFeedItemsToPB(workouts orm.WorkoutSlice, users orm.UserSlice, exercises orm.ExerciseSlice) []*v1.FeedItem {
-	items := make([]*v1.FeedItem, 0, len(workouts))
-	for _, workout := range workouts {
-		items = append(items, &v1.FeedItem{
-			Type: &v1.FeedItem_Workout{
-				Workout: parseWorkoutToPB(workout, exercises, users),
-			},
-		})
-	}
-	return items
-}

server/rpc/v1/parser.go

@@ -8,6 +8,7 @@ import (
 	"github.com/crlssn/getstronger/server/pkg/orm"
 	apiv1 "github.com/crlssn/getstronger/server/pkg/pb/api/v1"
 	"github.com/crlssn/getstronger/server/pkg/repo"
+	"github.com/crlssn/getstronger/server/pkg/safe"
 )
 
 func parseExerciseSliceToPB(exercises orm.ExerciseSlice) []*apiv1.Exercise {
@@ -49,16 +50,21 @@ func parseRoutineToPB(routine *orm.Routine) *apiv1.Routine {
 	}
 }
 
-func parseWorkoutSliceToPB(workoutSlice orm.WorkoutSlice, exerciseSlice orm.ExerciseSlice, userSlice orm.UserSlice) []*apiv1.Workout {
+func parseWorkoutSliceToPB(workoutSlice orm.WorkoutSlice, exerciseSlice orm.ExerciseSlice, userSlice orm.UserSlice) ([]*apiv1.Workout, error) {
 	workouts := make([]*apiv1.Workout, 0, len(workoutSlice))
 	for _, workout := range workoutSlice {
-		workouts = append(workouts, parseWorkoutToPB(workout, exerciseSlice, userSlice))
+		w, err := parseWorkoutToPB(workout, exerciseSlice, userSlice)
+		if err != nil {
+			return nil, fmt.Errorf("failed to parse workout: %w", err)
+		}
+
+		workouts = append(workouts, w)
 	}
 
-	return workouts
+	return workouts, nil
 }
 
-func parseWorkoutToPB(workout *orm.Workout, exercises orm.ExerciseSlice, users orm.UserSlice) *apiv1.Workout {
+func parseWorkoutToPB(workout *orm.Workout, exercises orm.ExerciseSlice, users orm.UserSlice) (*apiv1.Workout, error) {
 	var exerciseOrder []string
 	mapExerciseSets := make(map[string][]*apiv1.Set)
 
@@ -68,9 +74,14 @@ func parseWorkoutToPB(workout *orm.Workout, exercises orm.ExerciseSlice, users o
 				exerciseOrder = append(exerciseOrder, set.ExerciseID)
 			}
 
+			reps, err := safe.IntToInt32(set.Reps)
+			if err != nil {
+				return nil, fmt.Errorf("failed to parse reps: %w", err)
+			}
+
 			mapExerciseSets[set.ExerciseID] = append(mapExerciseSets[set.ExerciseID], &apiv1.Set{
 				Weight: float64(set.Weight),
-				Reps:   int32(set.Reps),
+				Reps:   reps,
 			})
 		}
 	}
@@ -103,7 +114,7 @@ func parseWorkoutToPB(workout *orm.Workout, exercises orm.ExerciseSlice, users o
 		ExerciseSets: exerciseSets,
 		Comments:     parseWorkoutCommentSliceToPB(workout.R.WorkoutComments, users),
 		FinishedAt:   timestamppb.New(workout.FinishedAt),
-	}
+	}, nil
 }
 
 func parseWorkoutCommentSliceToPB(commentSlice orm.WorkoutCommentSlice, users orm.UserSlice) []*apiv1.WorkoutComment {
@@ -177,9 +188,14 @@ func parseSetSliceToExerciseSetsPB(setSlice orm.SetSlice, exerciseSlice orm.Exer
 			mapExerciseSets[exerciseKey] = make([]*apiv1.Set, 0)
 		}
 
+		reps, err := safe.IntToInt32(set.Reps)
+		if err != nil {
+			return nil, fmt.Errorf("failed to parse reps: %w", err)
+		}
+
 		mapExerciseSets[exerciseKey] = append(mapExerciseSets[exerciseKey], &apiv1.Set{
 			Weight: float64(set.Weight),
-			Reps:   int32(set.Reps),
+			Reps:   reps,
 		})
 	}
 
@@ -194,24 +210,29 @@ func parseSetSliceToExerciseSetsPB(setSlice orm.SetSlice, exerciseSlice orm.Exer
 	return exerciseSets, nil
 }
 
-func parsePersonalBestSliceToPB(personalBests orm.PersonalBestSlice, exercises orm.ExerciseSlice) []*apiv1.PersonalBest {
+func parsePersonalBestSliceToPB(personalBests orm.PersonalBestSlice, exercises orm.ExerciseSlice) ([]*apiv1.PersonalBest, error) {
 	mapExercises := make(map[string]*orm.Exercise, len(exercises))
 	for _, exercise := range exercises {
 		mapExercises[exercise.ID] = exercise
 	}
 
 	pbs := make([]*apiv1.PersonalBest, 0, len(personalBests))
 	for _, pb := range personalBests {
+		reps, err := safe.IntToInt32(pb.Reps.Int)
+		if err != nil {
+			return nil, fmt.Errorf("failed to parse reps: %w", err)
+		}
+
 		pbs = append(pbs, &apiv1.PersonalBest{
 			Exercise: parseExerciseToPB(mapExercises[pb.ExerciseID.String]),
 			Set: &apiv1.Set{
 				Weight: float64(pb.Weight.Float32),
-				Reps:   int32(pb.Reps.Int),
+				Reps:   reps,
 			},
 		})
 	}
 
-	return pbs
+	return pbs, nil
 }
 
 func parseUserSliceToPB(users orm.UserSlice) []*apiv1.User {
@@ -286,3 +307,20 @@ func parseNotificationToPB(n *orm.Notification, u *orm.User, w *orm.Workout) *ap
 		return nil
 	}
 }
+
+func parseFeedItemsToPB(workouts orm.WorkoutSlice, users orm.UserSlice, exercises orm.ExerciseSlice) ([]*apiv1.FeedItem, error) {
+	items := make([]*apiv1.FeedItem, 0, len(workouts))
+	for _, workout := range workouts {
+		w, err := parseWorkoutToPB(workout, exercises, users)
+		if err != nil {
+			return nil, fmt.Errorf("failed to parse workout: %w", err)
+		}
+
+		items = append(items, &apiv1.FeedItem{
+			Type: &apiv1.FeedItem_Workout{
+				Workout: w,
+			},
+		})
+	}
+	return items, nil
+}

server/rpc/v1/workout.go

@@ -109,10 +109,16 @@ func (h *workoutHandler) Get(ctx context.Context, req *connect.Request[v1.GetWor
 		return nil, connect.NewError(connect.CodeInternal, nil)
 	}
 
+	w, err := parseWorkoutToPB(workout, exercises, users)
+	if err != nil {
+		log.Error("failed to parse workout", zap.Error(err))
+		return nil, connect.NewError(connect.CodeInternal, nil)
+	}
+
 	log.Info("workout fetched")
 	return &connect.Response[v1.GetWorkoutResponse]{
 		Msg: &v1.GetWorkoutResponse{
-			Workout: parseWorkoutToPB(workout, exercises, users),
+			Workout: w,
 		},
 	}, nil
 }
@@ -164,10 +170,16 @@ func (h *workoutHandler) List(ctx context.Context, req *connect.Request[v1.ListW
 		return nil, connect.NewError(connect.CodeInternal, nil)
 	}
 
+	w, err := parseWorkoutSliceToPB(pagination.Items, exercises, users)
+	if err != nil {
+		log.Error("failed to parse workouts", zap.Error(err))
+		return nil, connect.NewError(connect.CodeInternal, nil)
+	}
+
 	log.Info("workouts listed")
 	return &connect.Response[v1.ListWorkoutsResponse]{
 		Msg: &v1.ListWorkoutsResponse{
-			Workouts:      parseWorkoutSliceToPB(pagination.Items, exercises, users),
+			Workouts:      w,
 			NextPageToken: pagination.NextPageToken,
 		},
 	}, nil