lukaszraczylo/graphql-monitoring-proxy
1
0
Fork 0
mirror of https://github.com/lukaszraczylo/graphql-monitoring-proxy.git synced 2026-10-19 06:27:38 +00:00
Code Issues Packages Projects Releases Wiki Activity

chore(security,refactor): extract sanitization and improve code quality (#41)

Browse Source 
* chore(security,refactor): extract sanitization and improve code quality

- [x] Extract sanitization functions to dedicated sanitization.go module
- [x] Add comprehensive golangci-lint v2 configuration with security rules
- [x] Replace interface{} with any type throughout codebase
- [x] Add admin API authentication security warning
- [x] Extract WebSocket and stats streaming constants
- [x] Add best-effort error handling comments for resource cleanup
- [x] Expand sensitive field patterns for improved PII redaction
- [x] Simplify safety checks and remove redundant nil validations
- [x] Improve test coverage for password field redaction patterns

* refactor: replace interface{} with any type alias

- [x] Replace all `map[string]interface{}` with `map[string]any`
- [x] Replace all `interface{}` with `any` in function signatures and type definitions
- [x] Update sync.Pool New function returns from `interface{}` to `any`
- [x] Add package documentation comments to 8 package files
- [x] Update type assertions and casts to work with `any` type
This commit is contained in:
lukaszraczylo
2026-01-17 00:04:12 +00:00
committed by GitHub
parent caeae62236
commit 3aa83d4480
42 changed files with 815 additions and 618 deletions
Download Patch File Download Diff File Expand all files Collapse all files
api_auth_security_test.go
+15 -15
View File
@@ -87,7 +87,7 @@ func (suite *APIAuthSecurityTestSuite) TestOptionalAuthentication() {
os.Unsetenv("ADMIN_API_KEY")
tests := []struct {
body map[string]interface{}
body map[string]any
name string
endpoint string
method string
@@ -131,7 +131,7 @@ func (suite *APIAuthSecurityTestSuite) TestAPIAuthentication() {
os.Setenv("GMP_ADMIN_API_KEY", suite.validAPIKey)
defer os.Unsetenv("GMP_ADMIN_API_KEY")
tests := []struct {
body map[string]interface{}
body map[string]any
name string
apiKey string
endpoint string
@@ -144,7 +144,7 @@ func (suite *APIAuthSecurityTestSuite) TestAPIAuthentication() {
apiKey: "",
endpoint: "/api/user-ban",
method: "POST",
body: map[string]interface{}{"user_id": "test-user", "reason": "test reason"},
body: map[string]any{"user_id": "test-user", "reason": "test reason"},
expectedStatus: 401,
description: "Should reject requests without API key",
},
@@ -153,7 +153,7 @@ func (suite *APIAuthSecurityTestSuite) TestAPIAuthentication() {
apiKey: "wrong-key",
endpoint: "/api/user-ban",
method: "POST",
body: map[string]interface{}{"user_id": "test-user", "reason": "test reason"},
body: map[string]any{"user_id": "test-user", "reason": "test reason"},
expectedStatus: 401,
description: "Should reject requests with invalid API key",
},
@@ -162,7 +162,7 @@ func (suite *APIAuthSecurityTestSuite) TestAPIAuthentication() {
apiKey: "' OR '1'='1",
endpoint: "/api/user-ban",
method: "POST",
body: map[string]interface{}{"user_id": "test-user", "reason": "test reason"},
body: map[string]any{"user_id": "test-user", "reason": "test reason"},
expectedStatus: 401,
description: "Should reject SQL injection attempts in API key",
},
@@ -171,7 +171,7 @@ func (suite *APIAuthSecurityTestSuite) TestAPIAuthentication() {
apiKey: "<script>alert('xss')</script>",
endpoint: "/api/user-ban",
method: "POST",
body: map[string]interface{}{"user_id": "test-user", "reason": "test reason"},
body: map[string]any{"user_id": "test-user", "reason": "test reason"},
expectedStatus: 401,
description: "Should reject XSS attempts in API key",
},
@@ -180,7 +180,7 @@ func (suite *APIAuthSecurityTestSuite) TestAPIAuthentication() {
apiKey: "key; rm -rf /",
endpoint: "/api/user-ban",
method: "POST",
body: map[string]interface{}{"user_id": "test-user", "reason": "test reason"},
body: map[string]any{"user_id": "test-user", "reason": "test reason"},
expectedStatus: 401,
description: "Should reject command injection attempts in API key",
},
@@ -189,7 +189,7 @@ func (suite *APIAuthSecurityTestSuite) TestAPIAuthentication() {
apiKey: suite.validAPIKey,
endpoint: "/api/user-ban",
method: "POST",
body: map[string]interface{}{"user_id": "test-user", "reason": "test reason"},
body: map[string]any{"user_id": "test-user", "reason": "test reason"},
expectedStatus: 200,
description: "Should accept valid API key for user-ban endpoint",
},
@@ -198,7 +198,7 @@ func (suite *APIAuthSecurityTestSuite) TestAPIAuthentication() {
apiKey: suite.validAPIKey,
endpoint: "/api/user-unban",
method: "POST",
body: map[string]interface{}{"user_id": "test-user", "reason": "test unban"},
body: map[string]any{"user_id": "test-user", "reason": "test unban"},
expectedStatus: 200,
description: "Should accept valid API key for user-unban endpoint",
},
@@ -225,7 +225,7 @@ func (suite *APIAuthSecurityTestSuite) TestAPIAuthentication() {
apiKey: strings.ToUpper(suite.validAPIKey),
endpoint: "/api/user-ban",
method: "POST",
body: map[string]interface{}{"user_id": "test-user", "reason": "test reason"},
body: map[string]any{"user_id": "test-user", "reason": "test reason"},
expectedStatus: 401,
description: "Should reject case-modified API key (case sensitive)",
},
@@ -234,7 +234,7 @@ func (suite *APIAuthSecurityTestSuite) TestAPIAuthentication() {
apiKey: suite.validAPIKey + "extra",
endpoint: "/api/user-ban",
method: "POST",
body: map[string]interface{}{"user_id": "test-user", "reason": "test reason"},
body: map[string]any{"user_id": "test-user", "reason": "test reason"},
expectedStatus: 401,
description: "Should reject API key with extra characters",
},
@@ -243,7 +243,7 @@ func (suite *APIAuthSecurityTestSuite) TestAPIAuthentication() {
apiKey: suite.validAPIKey[5:],
endpoint: "/api/user-ban",
method: "POST",
body: map[string]interface{}{"user_id": "test-user", "reason": "test reason"},
body: map[string]any{"user_id": "test-user", "reason": "test reason"},
expectedStatus: 401,
description: "Should reject partial API key",
},
@@ -262,7 +262,7 @@ func (suite *APIAuthSecurityTestSuite) TestAPIAuthentication() {
apiKey: suite.validAPIKey + "тест",
endpoint: "/api/user-ban",
method: "POST",
body: map[string]interface{}{"user_id": "test-user", "reason": "test reason"},
body: map[string]any{"user_id": "test-user", "reason": "test reason"},
expectedStatus: 401,
description: "Should reject API key with unicode characters",
},
@@ -298,7 +298,7 @@ func (suite *APIAuthSecurityTestSuite) TestAPIAuthentication() {
body, err := io.ReadAll(resp.Body)
suite.NoError(err)
var response map[string]interface{}
var response map[string]any
err = json.Unmarshal(body, &response)
suite.NoError(err)
@@ -559,7 +559,7 @@ func (suite *APIAuthSecurityTestSuite) TestAPIAuthenticationErrorMessages() {
body, err := io.ReadAll(resp.Body)
suite.NoError(err)
var response map[string]interface{}
var response map[string]any
err = json.Unmarshal(body, &response)
suite.NoError(err)