version: "2"
run:
  go: "1.24"
  modules-download-mode: readonly
  tests: true
linters:
  enable:
    - bodyclose
    - dupl
    - goconst
    - gocritic
    - gocyclo
    - goprintffuncname
    - gosec
    - misspell
    - noctx
    - prealloc
    - revive
    - rowserrcheck
    - sqlclosecheck
    - unconvert
    - unparam
  disable:
    - exhaustive
    - funlen
    - gocognit
    - gocyclo           # Disabled: OAuth/OIDC flows are inherently complex
    - goprintffuncname  # Disabled: naming convention is project-specific
    - lll
    - mnd
    - testpackage
    - whitespace        # Disabled: style preference about newlines
    - wsl
  settings:
    dupl:
      threshold: 200  # Allow intentional duplication in provider patterns and token management
    errcheck:
      check-type-assertions: true
      check-blank: false  # Allow explicit blank assignments (_ = ...) to ignore errors
      exclude-functions:
        - (io.Closer).Close
        - (*database/sql.Rows).Close
        - (*database/sql.Stmt).Close
        - (io.Writer).Write
        - (*net/http.ResponseWriter).Write
        - fmt.Fprintf
        - fmt.Fprint
        - fmt.Fprintln
    goconst:
      min-len: 3
      min-occurrences: 15  # Increased to reduce noise for standard OAuth2/OIDC strings and common patterns like "true"
      ignore-tests: true
    gocritic:
      # Disable style-only checks that add noise
      disabled-checks:
        - ifElseChain      # Style preference, switch not always clearer
        - elseif           # Style preference
    gocyclo:
      min-complexity: 30  # OAuth/OIDC flows are inherently complex; set higher for Yaegi compatibility
    gosec:
      excludes:
        - G104
        - G404
      severity: medium
      confidence: medium
    govet:
      disable:
        - fieldalignment
        - shadow
      enable-all: true
    misspell:
      locale: US
      ignore-rules:
        - traefik
        - oidc
        - keycloak
    nolintlint:
      require-explanation: true
      require-specific: true
      allow-unused: false
    prealloc:
      simple: true
      range-loops: true
      for-loops: false
    revive:
      rules:
        - name: blank-imports
        - name: context-as-argument
        - name: context-keys-type
        - name: dot-imports
        - name: error-return
        - name: error-strings
        - name: error-naming
        # - name: exported  # Disabled: too noisy, not all exported functions need comments
        # - name: if-return  # Disabled: style preference
        - name: increment-decrement
        # - name: var-naming  # Disabled: too strict for legacy code (IP vs Ip)
        # - name: var-declaration  # Disabled: explicit zero values can be clearer
        # - name: package-comments  # Disabled: handled by other tools
        - name: range
        - name: receiver-naming
        - name: time-naming
        - name: unexported-return
        # - name: indent-error-flow  # Disabled: style preference
        - name: errorf
        # - name: empty-block  # Disabled: sometimes empty blocks are intentional
        - name: superfluous-else
        # - name: unused-parameter  # Disabled: test callbacks and interface implementations often have required unused params
        - name: unreachable-code
        # - name: redefines-builtin-id  # Disabled: min/max helpers are common before Go 1.21
    unparam:
      check-exported: false
    staticcheck:
      checks:
        - all
        - -QF1001  # De Morgan's law - style preference, may affect Yaegi
        - -QF1003  # Tagged switch - style preference, may affect Yaegi
        - -QF1007  # Merge conditional assignment - style preference
        - -QF1008  # Remove embedded field - may break Yaegi compatibility
        - -QF1011  # Omit type from declaration - style preference
        - -QF1012  # Use fmt.Fprintf - style preference
        - -SA9003  # Empty branch - sometimes intentional for future work
        - -ST1000  # Package comment format - not required for all packages
        - -ST1003  # Package name format - allowed for test packages
        - -ST1016  # Receiver name consistency - legacy code
        - -ST1020  # Comment format for methods - style preference
        - -ST1021  # Comment format for types - style preference
        - -ST1023  # Omit type from declaration - style preference
  exclusions:
    generated: lax
    rules:
      - linters:
          - bodyclose
          - dupl
          - errcheck
          - goconst
          - gocyclo
          - gosec
          - govet
          - ineffassign
          - noctx
          - prealloc
          - unparam
          - revive
          - gocritic
        path: _test\.go
      - linters:
          - dupl
          - gocyclo
          - govet
          - noctx
          - prealloc
          - unparam
          - revive
          - gocritic
        path: test.*\.go
      - linters:
          - gocritic
          - unused
          - errcheck
          - revive
        path: mocks.*\.go
      - linters:
          - errcheck
          - revive
          - gocritic
          - govet
          - unparam
        path: internal/testutil/
      - linters:
          - govet
          - unparam
          - noctx
          - prealloc
        path: integration/
      - linters:
          - gosec
        text: 'G404:'
      - linters:
          - all
        path: vendor/
      - linters:
          - goconst
        path: (.+)_test\.go
      - linters:
          - dupl
        path: internal/providers/(auth0|keycloak|okta|google|azure|github|gitlab|cognito|generic)\.go
      - linters:
          - dupl
        path: session\.go
      - linters:
          - dupl
        path: session_chunk_manager\.go
        text: "(extractJWTExpiration|extractJWTIssuedAt)"
    paths:
      - third_party$
      - builtin$
      - examples$
issues:
  max-issues-per-linter: 0
  max-same-issues: 0
  uniq-by-line: true
formatters:
  exclusions:
    generated: lax
    paths:
      - third_party$
      - builtin$
      - examples$