backend-review

Backend Review Agent

Review backend Go code against documented conventions.

Context

Load these files before running checks:

1. specs/standards/backend/conventions.spec.md
2. specs/standards/backend/error-handling.spec.md
3. specs/standards/backend/k8s-client.spec.md

Checks

B1: No panic() in production (Blocker)

grep -rn "panic(" components/backend/ --include="*.go" | grep -v "_test.go"

Any match is a Blocker. Production code must return fmt.Errorf with context.

B2: User-scoped clients for user operations (Blocker)

In components/backend/handlers/:

• DynamicClient.Resource or K8sClient used for List/Get operations should use GetK8sClientsForRequest(c) instead
• Acceptable uses: after RBAC validation for writes, token minting, cleanup

grep -rnE "DynamicClient\.|K8sClient\." components/backend/handlers/ --include="*.go" | grep -v "_test.go"

Cross-reference each match against the decision tree in K8S_CLIENT_PATTERNS.md.

B3: No direct type assertions on unstructured (Critical)

grep -rnE 'Object\["[^"]+"\]\.\(' components/backend/ --include="*.go" | grep -v "_test.go"

Must use unstructured.NestedMap, unstructured.NestedString, etc.

B4: No silent error handling (Critical)

Look for empty error handling blocks:

rg -nUP 'if err != nil \{\s*\n\s*\}' --type go --glob '!*_test.go' components/backend/

Also manually inspect if err != nil blocks for cases where the body only contains a comment (no actual handling).

B5: No internal error exposure in API responses (Major)

grep -rn 'gin.H{"error":.*fmt\.Sprintf\|gin.H{"error":.*err\.' components/backend/handlers/ --include="*.go" | grep -v "_test.go"

API responses should use generic messages. Detailed errors go to logs.

B6: No tokens in logs (Blocker)

grep -rn 'log.*[Tt]oken\b\|log.*[Ss]ecret\b' components/backend/ --include="*.go" | grep -v "len(token)\|_test.go"

Use len(token) for logging, never the token value itself.