Skip to content

fix(FLEETMDM-002-2): CU-86akj32d7 3 review findings across 3 files #176

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
flamingo wants to merge 3 commits into
base: main
Choose a base branch
from
+10 −5
Draft

fix(FLEETMDM-002-2): CU-86akj32d7 3 review findings across 3 files #176

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
ad95c00
fix(FLEETMDM-002-2): 3 review findings across 3 files
flamingo[bot] Sep 14, 2026
54d0d76
fix(FLEETMDM-002-2): 3 review findings across 3 files
flamingo[bot] Sep 14, 2026
e6faa8c
fix(FLEETMDM-002-2): 3 review findings across 3 files
flamingo[bot] Sep 14, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions client/orbit_client.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -192,6 +192,8 @@ func (oc *OrbitClient) requestWithExternal(verb string, pathOrURL string, params
if machineId != "" {
request.Header.Add("x-machine-id", machineId)
}
} else {
log.Debug().Msg("machineIdProvider is nil, not adding x-machine-id header")
}
}
// <<< OPENFRAME(agent-openframe-mode)
Comment on lines 192 to 199

@flamingo flamingo Bot Sep 14, 2026

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🦩 🟠 machineId header injection swallows a nil machineIdProvider silently without any wrapped error or log context

In requestWithExternal (client/orbit_client.go), added an else branch to the if oc.machineIdProvider != nil check that logs log.Debug().Msg("machineIdProvider is nil, not adding x-machine-id header"), mirroring the existing Debug log used in the authToken-empty branch just above it. This gives log parity between the two header-injection paths without altering control flow, header behavior, or any other logic.

🤖 Prompt for AI agents 
In client/orbit_client.go around line 190, review and complete this code-review fix: machineId header injection swallows a nil machineIdProvider silently without any wrapped error or log context.
What the draft fix changed: In `requestWithExternal` (client/orbit_client.go), added an `else` branch to the `if oc.machineIdProvider != nil` check that logs `log.Debug().Msg("machineIdProvider is nil, not adding x-machine-id header")`, mirroring the existing Debug log used in the authToken-empty branch just above it. This gives log parity between the two header-injection paths without altering control flow, header behavior, or any other logic.
Verify the change is correct and complete; do not refactor unrelated code.

fix confidence: 🟢 92 high — react 👍/👎 to teach the reviewer

Expand Down
3 changes: 3 additions & 0 deletions server/service/client_debug.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,6 +20,9 @@ func (c *Client) getRawBody(endpoint string) ([]byte, error) {
if err == nil && len(body) > 0 {
return nil, fmt.Errorf("get %s received status %d: %s", endpoint, response.StatusCode, body)
}
if err != nil {
return nil, fmt.Errorf("get %s received status %d, read response body: %w", endpoint, response.StatusCode, err)
}
return nil, fmt.Errorf("get %s received status %d", endpoint, response.StatusCode)
}

Comment on lines 20 to 28

@flamingo flamingo Bot Sep 14, 2026

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🦩 🟠 getRawBody swallows the read error on non-200 responses instead of wrapping it

In getRawBody (server/service/client_debug.go), the non-200 branch now checks the io.ReadAll error separately: if err != nil, the error is wrapped with %w into a new error message that also includes the status code, instead of being silently discarded and replaced by a generic status-only message. The success path (empty body, no error) still falls through to the generic status-only message unchanged.

🤖 Prompt for AI agents 
In server/service/client_debug.go around line 18, review and complete this code-review fix: getRawBody swallows the read error on non-200 responses instead of wrapping it.
What the draft fix changed: In getRawBody (server/service/client_debug.go), the non-200 branch now checks the io.ReadAll error separately: if err != nil, the error is wrapped with %w into a new error message that also includes the status code, instead of being silently discarded and replaced by a generic status-only message. The success path (empty body, no error) still falls through to the generic status-only message unchanged.
Verify the change is correct and complete; do not refactor unrelated code.

fix confidence: 🟢 90 high — react 👍/👎 to teach the reviewer

Expand Down
10 changes: 5 additions & 5 deletions server/vulnerabilities/macoffice/sync.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,7 +32,7 @@ func sync(
) error {
remote, url, err := ghClient.MacOfficeReleaseNotes(ctx)

@flamingo flamingo Bot Sep 14, 2026

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🦩 🟠 sync() in macoffice/sync.go returns errors from ghClient/fsClient calls without wrapping context

In sync() (server/vulnerabilities/macoffice/sync.go), wrapped all four bare return err propagation points with contextual fmt.Errorf("...: %w", err) messages: "get remote release notes" for ghClient.MacOfficeReleaseNotes, "get local release notes" for fsClient.MacOfficeReleaseNotes, "download release notes" for both ghClient.Download call sites, and "delete out of date release notes" for fsClient.Delete. This preserves error unwrapping via %w while adding distinguishable context at each call boundary, addressing FLEETMDM-002-2 without altering control flow, style, or the top-level SyncFromGithub wrapping.

🤖 Prompt for AI agents 
In server/vulnerabilities/macoffice/sync.go around line 33, review and complete this code-review fix: sync() in macoffice/sync.go returns errors from ghClient/fsClient calls without wrapping context.
What the draft fix changed: In sync() (server/vulnerabilities/macoffice/sync.go), wrapped all four bare `return err` propagation points with contextual `fmt.Errorf("...: %w", err)` messages: "get remote release notes" for ghClient.MacOfficeReleaseNotes, "get local release notes" for fsClient.MacOfficeReleaseNotes, "download release notes" for both ghClient.Download call sites, and "delete out of date release notes" for fsClient.Delete. This preserves error unwrapping via %w while adding distinguishable context at each call boundary, addressing FLEETMDM-002-2 without altering control flow, style, or the top-level SyncFromGithub wrapping.
Verify the change is correct and complete; do not refactor unrelated code.

fix confidence: 🟢 90 high — react 👍/👎 to teach the reviewer

if err != nil {
return err
return fmt.Errorf("get remote release notes: %w", err)
}

// Nothing published yet on remote repo, so we do nothing.
Expand All @@ -42,12 +42,12 @@ func sync(

local, err := fsClient.MacOfficeReleaseNotes()
if err != nil {
return err
return fmt.Errorf("get local release notes: %w", err)
}

if len(local) == 0 {
if _, err := ghClient.Download(url); err != nil {
return err
return fmt.Errorf("download release notes: %w", err)
}
return nil
}
Expand All @@ -58,15 +58,15 @@ func sync(

if local[0].Before(remote) {
if _, err := ghClient.Download(url); err != nil {
return err
return fmt.Errorf("download release notes: %w", err)
}
}

// Clean up out of date files
for _, l := range local {
if l.Before(remote) {
if err := fsClient.Delete(l); err != nil {
return err
return fmt.Errorf("delete out of date release notes: %w", err)
}
}
}
Expand Down