go-review-service

Go Review Service

Perform a comprehensive read-only audit of a GOB Go microservice, checking 17 conventions. Outputs a structured PASS/FAIL/WARNING report with line references.

Trigger Phrases

"review service", "audit service", "validar servico", "check service", "verificar servico", "checar servico"

Arguments

$ARGUMENTS should specify:

• Service name (e.g., gob-member-service) — required
• Focus area (optional) — e.g., "middleware", "routes", "repository" to narrow the audit

Pre-Flight

Determine the service root:

services/{service-name}/

Read these files first (in parallel where possible):

1. cmd/api/main.go — middleware order, wiring, shutdown
2. internal/factory/factory.go — repository factory
3. internal/repository/repository.go — interfaces
4. internal/handler/*.go — route registration
5. go.mod — module path, dependencies
6. migrations/ — list files for schema reference

Checks (17 total)

For each check, output one of:

• PASS — convention followed correctly
• FAIL — convention violated (include file:line reference and what's wrong)
• WARNING — partially followed or uncertain (include details)
• N/A — not applicable to this service

---

Check 1: Middleware Order in main.go

Expected order (top to bottom in main.go):

1. recover.New()
2. requestid.New()
3. apmfiber.Middleware(apmfiber.WithTracer(tracer)) — after requestid, before logging (unconditional/nil-safe; rollout-window dual-accept detailed in Check 3)
4. middleware.LoggingWithLogger(log) or middleware.Logging()
5. cors.New(...) — with AllowOrigins, AllowHeaders, AllowMethods, AllowCredentials
6. middleware.DryRun(...) — if service supports dry-run
7. middleware.DryRunFinalizer() — if dry-run present
8. middleware.AuditPublisher(...) — after cors/dryrun, before endpoints

Search: Look for app.Use( calls in main.go. Verify order matches.

Check 2: Audit Middleware

• Separate RabbitMQ connection (rabbitmq.NewFromURL)
• Uses middleware.AuditExchange constant
• Non-blocking: wrapped in if rmqURL != "" with warning on failure
• Placed AFTER cors and BEFORE health/ready/version endpoints
• defer auditRMQ.Close() present