#13087 added a new lint, `lint-single-response`, which guarantees that web handlers don't proceed after making a terminating call (eg. `ctx.Error(...)`). #12512 introduced a new type with these terminating-style methods on the interface `forgejo.org/routers/api/v1/permissions.Context`. This PR adds the new methods to the list of terminating calls.
## Testing
In addition to automated tests which check the usage, I've manually altered codepaths in `routers/api/v1` and removed `return` statements (for example, removing [this line](1ab4c8d915/routers/api/v1/permissions/req_admin.go (L18))), and then running `make lint-single-response`:
```
$ make lint-single-response
.../go/pkg/mod/golang.org/toolchain@v0.0.1-go1.26.4.linux-amd64/bin/go run ./build/lint-single-response/cmd ./...
.../Dev/forgejo/routers/api/v1/permissions/req_admin.go:17:3: Invocation of forgejo.org/routers/api/v1/permissions.Context / NotFound, and control flow continues afterwards.
exit status 3
make: *** [Makefile:535: lint-single-response] Error 1
```
This testing was important because `permissions.Context` is the first interface to be involved in this new lint, where the other usages are all structs.
### Tests for Go changes
- I added test coverage for Go changes...
- [x] in their respective `*_test.go` for unit tests.
- [ ] in the `tests/integration` directory if it involves interactions with a live Forgejo server.
- I ran...
- [x] `make pr-go` before pushing
### Documentation
- [ ] I created a pull request [to the documentation](https://codeberg.org/forgejo/docs) to explain to Forgejo users how to use this change.
- [x] I did not document these changes and I do not expect someone else to do it.
### Release notes
- [ ] This change will be noticed by a Forgejo user or admin (feature, bug fix, performance, etc.). I suggest to include a release note for this change.
- [x] This change is not visible to a Forgejo user or admin (refactor, dependency upgrade, etc.). I think there is no need to add a release note for this change.
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/13234
Reviewed-by: limiting-factor <limiting-factor@noreply.codeberg.org>
This PR adds a new linter to the codebase and addresses all the problems that it identified (including a small number of false positives). The lint-single-response Go analyzer attempts to prevent a common problem in Forgejo where it is possible for a web handler to provide a response to a request, and then continue code execution unintentionally. For example:
```go
err := json.Unmarshal(data, &claims)
if err != nil {
ctx.Error(http.StatusInternalServerError, "Error in unmarshal", err)
// Oops, I forgot to `return` here...
}
// ... more work occurs ...
ctx.JSON(http.StatusOK, resp)
```
In order to detect these cases, lint-single-response contains a list of functions that deliver a web response. When any of those functions are used within a function, the control flow must not perform any work after the function is invoked -- it can only return and exit the function.
### Tests for Go changes
- I added test coverage for Go changes...
- [x] in their respective `*_test.go` for unit tests.
- [ ] in the `tests/integration` directory if it involves interactions with a live Forgejo server.
- I ran...
- [x] `make pr-go` before pushing
### Documentation
- [x] I created a pull request [to the documentation](https://codeberg.org/forgejo/docs) to explain to Forgejo users how to use this change.
- Documentation on the new linter is included inline, in `build/lint-single-response/README.md`.
- [ ] I did not document these changes and I do not expect someone else to do it.
### Release notes
- [ ] This change will be noticed by a Forgejo user or admin (feature, bug fix, performance, etc.). I suggest to include a release note for this change.
- [x] This change is not visible to a Forgejo user or admin (refactor, dependency upgrade, etc.). I think there is no need to add a release note for this change.
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/13087
Reviewed-by: Andreas Ahlenstorf <aahlenst@noreply.codeberg.org>
