payloadscan

Documentation

Overview

Package payloadscan type-checks event payload literals for internal identifiers.

The runtime rail in eventlog rejects a numeric id-shaped field when the payload is appended, which is exact — it inspects the finished value — but it only fires on a path some test actually drives. This package covers the other half: it reads every payload composite literal in a package and asks the type checker what each id-shaped field will hold, so a builder on a path no test exercises is still caught.

It resolves types rather than matching source text. A check that looked for `taskId: <something>.String()` would pass a commented-out call, and would flag `"taskId": in.TaskID` where TaskID is already a UUID string — a false positive that goes into an allowlist, and an allowlist that grows is where the real leak hides. Asking go/types whether the value is a string has neither failure mode.

Index

• func IsIDKey(key string) bool
• type Config
• type Finding
  • func Scan(cfg Config) ([]Finding, error)
  • func (f Finding) String() string

Functions

func IsIDKey

func IsIDKey(key string) bool

IsIDKey reports whether a payload key names an identifier. It mirrors the runtime rail's rule so the two cannot disagree about what counts.

Types

type Config

type Config struct {
	// Dir is the package directory to scan, relative to the module root
	// the scan runs from.
	Dir string
	// PayloadFields names the struct fields whose composite-literal
	// values carry an event payload. Defaults to "Payload" and
	// "ExtraPayload".
	PayloadFields []string
}

Config selects what a scan looks at.

type Finding

type Finding struct {
	// Pos is the "file:line:col" of the offending field.
	Pos string
	// Key is the payload key as written, e.g. "taskId".
	Key string
	// Type is what the type checker resolved the value to.
	Type string
}

Finding is one payload field whose value is not a string.

func Scan

func Scan(cfg Config) ([]Finding, error)

Scan type-checks the package in cfg.Dir and reports every id-shaped payload key whose value is not a string.

Only fields that reach an event payload are considered, so an id-shaped key in an unrelated map is not the scan's business.

func (Finding) String

func (f Finding) String() string