backend-review

name: backend-review
description: >
  Review Go backend code for convention violations. Use after modifying files
  under components/backend/. Checks for panic usage, service account misuse,
  type assertion safety, error handling, token security, and file size.
tools:
  - Read
  - Grep
  - Glob
  - Bash

Backend Review Agent

Review backend Go code against documented conventions.

Context

Load these files before running checks:

1. `specs/standards/backend/conventions.spec.md` 2. `specs/standards/backend/error-handling.spec.md` 3. `specs/standards/backend/k8s-client.spec.md`

Checks

B1: No panic() in production (Blocker)

grep -rn "panic(" components/backend/ --include="*.go" | grep -v "_test.go"

Any match is a Blocker. Production code must return `fmt.Errorf` with context.

B2: User-scoped clients for user operations (Blocker)

In `components/backend/handlers/`:

• `DynamicClient.Resource` or `K8sClient` used for List/Get operations should use `GetK8sClientsForRequest(c)` instead
• Acceptable uses: after RBAC validation for writes, token minting, cleanup

grep -rnE "DynamicClient\.|K8sClient\." components/backend/handlers/ --include="*.go" | grep -v "_test.go"

Cross-reference each match against the decision tree in `K8S_CLIENT_PATTERNS.md`.

B3: No direct type assertions on unstructured (Critical)

grep -rnE 'Object\["[^"]+"\]\.\(' components/backend/ --include="*.go" | grep -v "_test.go"

Must use `unstructured.NestedMap`, `unstructured.NestedString`, etc.

B4: No silent error handling (Critical)

Look for empty error handling blocks:

rg -nUP 'if err != nil \{\s*\n\s*\}' --type go --glob '!*_test.go' components/backend/

Also manually inspect `if err != nil` blocks for cases where the body only contains a comment (no actual handling).

B5: No internal error exposure in API responses (Major)

grep -rn 'gin.H{"error":.*fmt\.Sprintf\|gin.H{"error":.*err\.' components/backend/handlers/ --include="*.go" | grep -v "_test.go"

API responses should use generic messages. Detailed errors go to logs.

B6: No tokens in logs (Blocker)

grep -rn 'log.*[Tt]oken\b\|log.*[Ss]ecret\b' components/backend/ --include="*.go" | grep -v "len(token)\|_test.go"

Use `len(token)` for logging, never the token value itself.

B7: Error wrapping with %w (Major)

grep -rnP 'fmt.Errorf.*%v.*\berr\b' components/backend/ --include="*.go" | grep -v "_test.go"

Should use `%w` for error wrapping to preserve the error chain.

B8: Files under 400 lines (Minor)

find components/backend/handlers/ -name "*.go" -not -name "*_test.go" -print0 | xargs -0 wc -l | sort -rn

Flag files exceeding 400 lines. Note: `sessions.go` is a known exception.

Output Format

# Backend Review

## Summary
[1-2 sentence overview]

## Findings

### Blocker
[Must fix — or "None"]

### Critical
[Should fix — or "None"]

### Major
[Important — or "None"]

### Minor
[Nice-to-have — or "None"]

## Score
[X/8 checks passed]

Each finding includes: file:line, problem description, convention violated, suggested fix.