fix: add golangci config, restore CI timeouts, svelte-check warnings, RespondError helper

backend/.golangci.yml

@@ -0,0 +1,38 @@
+linters:
+  enable:
+    - errcheck
+    - gosimple
+    - govet
+    - ineffassign
+    - staticcheck
+    - unused
+    - gosec
+    - gocritic
+  disable:
+    - exhaustruct
+    - nlreturn
+    - wsl
+    - wrapcheck
+
+linters-settings:
+  errcheck:
+    exclude-functions:
+      - encoding/json.Encoder.Encode
+      - io.WriteString
+      - (io.Closer).Close
+
+issues:
+  exclude-rules:
+    - path: _test\.go
+      linters:
+        - errcheck
+        - gosec
+    - path: handlers/testutils/
+      linters:
+        - gosec
+    - path: internal/square/square_dev.go
+      linters:
+        - errcheck
+
+run:
+  timeout: 5m

backend/handlers/auth/local.go

@@ -86,7 +86,7 @@ func RegisterHandler(w http.ResponseWriter, r *http.Request) {
 
 	// Must accept terms
 	if !req.AgreedToPolicy {
-		http.Error(w, "must agree to terms", http.StatusBadRequest)
+		mw.RespondError(w, http.StatusBadRequest, "must agree to terms")
 		return
 	}
 
@@ -105,11 +105,11 @@ func RegisterHandler(w http.ResponseWriter, r *http.Request) {
 
 	// Password must not exceed bcrypt's 72-byte limit
 	if len(req.Password) > 72 {
-		http.Error(w, "password must be 72 characters or less", http.StatusBadRequest)
+		mw.RespondError(w, http.StatusBadRequest, "password must be 72 characters or less")
 		return
 	}
 	if len(req.Password) < 6 {
-		http.Error(w, "password must be at least 6 characters", http.StatusBadRequest)
+		mw.RespondError(w, http.StatusBadRequest, "password must be at least 6 characters")
 		return
 	}
 	// Server-side password strength check using the same @zxcvbn-ts/core as the frontend
@@ -353,13 +353,13 @@ func LoginHandler(w http.ResponseWriter, r *http.Request) {
 	loginStateMu.Lock()
 	if t, ok := loginInProgress[userID]; ok && time.Since(t) < 30*time.Second {
 		loginStateMu.Unlock()
-		http.Error(w, "login already in progress", http.StatusConflict) // 409
+		mw.RespondError(w, http.StatusConflict, "login already in progress")
 		return
 	}
 	// Cap the map size - drop new request if at capacity
 	if len(loginInProgress) >= maxLoginInProgress {
 		loginStateMu.Unlock()
-		http.Error(w, "server busy, try again later", http.StatusTooManyRequests)
+		mw.RespondError(w, http.StatusTooManyRequests, "server busy, try again later")
 		return
 	}
 	loginInProgress[userID] = clock.Now()
@@ -429,7 +429,7 @@ func LoginHandler(w http.ResponseWriter, r *http.Request) {
 	tx, err := db.Conn.Begin(r.Context())
 	if err != nil {
 		log.Printf("Failed to begin transaction: %v", err)
-		http.Error(w, "Internal server error", http.StatusInternalServerError)
+		mw.RespondError(w, http.StatusInternalServerError, "internal server error")
 		return
 	}
 	defer func() {
@@ -497,7 +497,7 @@ func RefreshTokenHandler(w http.ResponseWriter, r *http.Request) {
 	// Generate new token
 	newToken, jti, err := auth.GenerateToken(userID, currentRole)
 	if err != nil {
-		http.Error(w, "could not generate token", http.StatusInternalServerError)
+		mw.RespondError(w, http.StatusInternalServerError, "could not generate token")
 		return
 	}
 
@@ -518,7 +518,7 @@ func LogoutHandler(w http.ResponseWriter, r *http.Request) {
 	// Revoke the JTI — match the access token lifetime (1 hour)
 	if err := auth.RevokeJTI(r.Context(), jti, clock.Now().Add(1*time.Hour)); err != nil {
 		slog.Error("logout: failed to revoke JTI", "err", err)
-		http.Error(w, "Failed to revoke token. Please try again.", http.StatusInternalServerError)
+		mw.RespondError(w, http.StatusInternalServerError, "failed to revoke token. please try again.")
 		return
 	}
 

backend/mw/response.go

@@ -14,3 +14,11 @@ func RespondJSON(w http.ResponseWriter, status int, data any) {
 	_ = json.NewEncoder(w).Encode(data)
 }
 
+// RespondError sends a JSON error response with the given status code and message.
+// It preserves the application/json Content-Type set by middleware.
+func RespondError(w http.ResponseWriter, status int, msg string) {
+	w.Header().Set("Content-Type", "application/json")
+	w.WriteHeader(status)
+	_ = json.NewEncoder(w).Encode(map[string]string{"error": msg})
+}
+