feat(go): per-route auth detection + gopls auth-flow refinement - #242
Merged
Merged
Conversation
Brings Go auth analysis to parity with the JS/TS/Python/Java path.
Mapper (per-route, not file-level):
- has_auth_check is now decided per route — a router/group `.Use(authMw)`
guards its routes; every other route carries its handler body in
handler_source for the analyzer/LSP to judge. One guarded handler no longer
vouches for an unguarded neighbour in the same file.
- Fixed a real mis-mapping the redesign surfaced: `r.Header.Get("Authorization")`
and `c.Get("user")` were mapped as routes. A registration must pass a handler
after the path, which separates `r.GET("/p", h)` from `.Get("X")`.
Shared auth patterns extended with Go idioms:
- identity: Header.Get("Authorization"), RequireAuth/Authenticate/VerifyToken/
session.Get/c.Get("user"), r.Context().Value(...)
- enforcement: http.StatusUnauthorized/Forbidden, WriteHeader(401/403),
Gin AbortWithStatus, echo.NewHTTPError(401), Fiber status
- LSP terminals: the identity idioms above + jwt.Parse
Tracer Go strategy (auth_flow_tracer):
- New per-route Go path: router/group middleware -> inline identity+refusal ->
a cross-file auth helper resolved via gopls go-to-definition, whose body is
then checked for an auth terminal.
- Uses the RouteEntry's own content (Go does not depend on file_index), fixing
the tracer returning early when the index did not resolve the Go path.
Verified live end-to-end (real `isitsecure` scan of Go apps):
- unprotected route -> flagged missing-auth; inline-guarded route -> verified.
- auth enforced ONLY inside a cross-file helper: route_analyzer's regex
false-positives it, then the LSP follows the helper with gopls and
`LSP validation: 1 findings suppressed` — the JS-level refinement, for Go.
- Full suite: 2610 passed, 1 xfailed.
README marks Go Auth Detection as Yes; lsp-setup.md documents the three modes.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EZ4QoTqRoYWE25CNoV2Wfy
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Brings Go auth analysis to parity with the JS/TS/Python/Java path — the tracked follow-up to Go SAST+LSP support.
Mapper — per-route auth (was file-level)
has_auth_checkdecided per route: a router/group.Use(authMw)guards its routes; every other route carries its handler body inhandler_source. One guarded handler no longer vouches for an unguarded neighbour.r.Header.Get("Authorization")/c.Get("user")were mapped as routes. A registration must pass a handler after the path.Shared auth patterns — Go idioms
Identity (
Header.Get("Authorization"),RequireAuth,VerifyToken,session.Get,c.Get("user"),Context().Value), enforcement (http.StatusUnauthorized/Forbidden,WriteHeader(401/403), GinAbortWithStatus,echo.NewHTTPError(401), Fiber), LSP terminals (+jwt.Parse).Tracer — Go strategy
Per-route: group middleware → inline identity+refusal → cross-file auth helper resolved via gopls go-to-definition. Uses the RouteEntry's own content (fixes the tracer bailing early when
file_indexdidn't resolve the Go path).Verified live (real
isitsecurescans)LSP validation: 1 findings suppressed. JS-level refinement, for Go.README marks Go Auth Detection: Yes; lsp-setup.md documents the three tracing modes.
🤖 Generated with Claude Code
https://claude.ai/code/session_01EZ4QoTqRoYWE25CNoV2Wfy