Skip to content

refactor(app): collapse *WithDeps injection pattern#51

Merged
s-b-e-n-s-o-n merged 8 commits into
mainfrom
refactor/collapse-deps-pattern
May 12, 2026
Merged

refactor(app): collapse *WithDeps injection pattern#51
s-b-e-n-s-o-n merged 8 commits into
mainfrom
refactor/collapse-deps-pattern

Conversation

@s-b-e-n-s-o-n
Copy link
Copy Markdown
Contributor

@s-b-e-n-s-o-n s-b-e-n-s-o-n commented May 12, 2026

Summary

  • Replaces five injection-struct families (ruleDeps, bundleDeps/certDeps/bundleWriteDeps/writePEMDeps, hijackDeps, aclDeps, ownerDeps) with package-level var <name>Hook = <realImpl> declarations (filter, testcert, proxy) or direct function parameters (clientacl, ownership, visibility).
  • Adds a shared internal/dockerclient package consolidating the unix-socket *http.Client construction that was previously duplicated in three middlewares.
  • Fixes a pre-existing bug where the release-next-version.test.mjs integration tests inherited GIT_DIR/GIT_WORK_TREE from the pre-push hook environment, causing git operations to corrupt the host repository instead of running in the isolated temp repos.

What changed

Package Before After
internal/filter ruleDeps struct + newRuleDeps() var regexpCompileHook = regexp.Compile
internal/testcert 4 dep structs + 4 constructors 12 var *Hook vars; restoreTestcertHooks(t) helper
internal/proxy hijackDeps struct + newHijackDeps() 5 var *Hook vars; restoreHijackHooks(t) helper
internal/clientacl aclDeps struct resolveClient func(...) direct param
internal/ownership ownerDeps struct inspectResource+inspectExec direct params
internal/visibility visibilityDeps struct dockerclient.New(...) inline

No public API change. All 20 packages pass go test ./....

Test plan

  • go test ./... passes (verified locally — all 20 packages)
  • golangci-lint run passes (verified locally — 0 issues)
  • GoReleaser snapshot builds successfully
  • All pre-push hook checks pass (goreleaser-snapshot, go-lint, go-test, go-fuzz, lockfile-dedupe, knip, biome, ts-test, build, clean-tree)

s-b-e-n-s-o-n and others added 8 commits May 12, 2026 10:31
@s-b-e-n-s-o-n
🔒 security(deps): regenerate lockfile to apply postcss ^8.5.14 override
251a063 
The `overrides.next.postcss` rule was correct, but the old lockfile
retained a nested `node_modules/next/node_modules/postcss@8.4.31`
because `npm install --package-lock-only` would not drop the cached
entry. A clean install hoists postcss to a single `8.5.14` and
removes the nested copy.

Fixes Scorecard alert #8 / GHSA-qx2v-qp2m-jg93 (PostCSS XSS via
unescaped </style> in CSS Stringify Output, <8.5.10).

Verified:
- npm audit: 0 vulnerabilities
- npm ls postcss: no nested copy under node_modules/next/
@s-b-e-n-s-o-n
📝 docs: drop GO-LIVE-CHECKLIST.md and scrub planning-doc references
459549c 
Audit prep for the public-repo flip:

- Remove `GO-LIVE-CHECKLIST.md` from the tree. The file is internal
  pre-launch working notes (phase plans, decision logs, audit findings
  with commit SHAs). The local copy is preserved under `.planning/`,
  which is already gitignored.
- Scrub two `CHANGELOG.md` lines that named "internal planning docs"
  and "internal vision doc" — those phrases advertise the existence of
  private artifacts the public repo doesn't contain.
- Tighten `CLAUDE.md` and `AGENTS.md` so the `.planning/` callout no
  longer enumerates its contents (was: "vision, roadmap, competitive
  analysis, threat model"). The directory is still flagged as
  gitignored-local-only so AI agents know not to commit anything there.

No behavior change; documentation hygiene only.
@s-b-e-n-s-o-n
📝 docs: switch docs-site branding refs from Nextra to Fumadocs
71274f4 
The `docs/` workspace migrated to Fumadocs (`fumadocs-core` / `fumadocs-mdx` /
`fumadocs-ui`) some time ago, but four committed files still advertised the
old framework:

- `README.md` "Built With" badge
- `CLAUDE.md` and `AGENTS.md` workspace blurb
- `.gitignore` comment explaining the static-export copy step
- `docs/globals.d.ts` ambient-CSS comment referencing `nextra-theme-docs`

CHANGELOG entries for past releases keep the "Nextra" wording because that
was true at the time and the changelog is a historical record. No behavior
change.
@s-b-e-n-s-o-n
🔧 chore(demo): drop asciinema artifacts in favor of CliDemo React com…
afab8c1 
…ponent

The asciinema-based hero demo was superseded by `website/src/components/cli-demo.tsx`,
an animated React component that simulates the same CLI output. Removing the now-orphaned
script + cast + preview page so nothing in the build references them.

- delete `scripts/asciinema-demo.sh` (recording helper for the cast)
- delete `website/public/sockguard-demo.cast` (the recorded asciinema cast)
- delete `website/public/asciinema-preview.html` (preview surface for the cast)
- rephrase the lingering asciinema comment in `cli-demo.tsx`
@s-b-e-n-s-o-n
🔄 refactor(app): collapse *WithDeps injection pattern across five pac…
bda9407 
…kages

Replace four injection-struct families with package-level var hooks (filter,
testcert, proxy) or direct function parameters (clientacl, ownership):

- filter: var regexpCompileHook = regexp.Compile; tests swap via t.Cleanup
- testcert: 12 var *Hook vars replacing bundleDeps/certDeps/bundleWriteDeps/writePEMDeps; restoreTestcertHooks(t) helper
- proxy/hijack: 5 var *Hook vars + restoreHijackHooks(t) helper
- clientacl: middlewareWithDeps takes resolveClient func directly (no struct)
- ownership: middlewareWithDeps/allowOwnershipRequest/checkOwnedResource take inspectResource+inspectExec funcs directly
- visibility: inline dockerclient call replaces newVisibilityDeps() struct

No public API change. All 20 packages pass.
@s-b-e-n-s-o-n
🔄 refactor(app): add shared dockerclient package for socket side-chan…
3fbb54e 
…nels

Extract the unix-socket http.Client construction (previously duplicated in
ownership, clientacl, and visibility) into internal/dockerclient. Used by the
preceding refactor commit that collapsed the *WithDeps pattern.
@s-b-e-n-s-o-n
🐛 fix(test): clear GIT_DIR/GIT_WORK_TREE in release-next-version temp…
87f2a8e 
… git repos

When the pre-push hook runs npm test, git commands in the release-next-version
integration tests inherit the hook's GIT_DIR env var, causing them to operate
on the main repository instead of the isolated temp git repos. This corrupts
repository-local config (user.name, user.email) and appends test commits to
the current branch.

Fix by clearing GIT_DIR and GIT_WORK_TREE from the environment before each
git call in the test helper.
@s-b-e-n-s-o-n
🐛 fix(test): strip GIT_DIR/GIT_WORK_TREE from all child processes in …
dd6b1a4 
…release test

Extend the isolation fix to cover spawnSync calls (the script-under-test) in
addition to the git() helper. Also switch from delete-after-copy to a filter
approach so the env object never contains the stripped keys.
@vercel
Copy link
Copy Markdown

vercel Bot commented May 12, 2026

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
sockguard-website Ready Ready Preview, Comment May 12, 2026 4:25pm

biggest-littlest
biggest-littlest approved these changes May 12, 2026
View reviewed changes
Copy link
Copy Markdown
Member

@biggest-littlest biggest-littlest left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm — batch-merging release-process fix + refactors

@s-b-e-n-s-o-n s-b-e-n-s-o-n merged commit 0301db8 into main May 12, 2026
22 checks passed
@s-b-e-n-s-o-n s-b-e-n-s-o-n deleted the refactor/collapse-deps-pattern branch May 12, 2026 17:33
This was referenced May 12, 2026
Merged
Closed
Closed
Closed
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@biggest-littlest biggest-littlest biggest-littlest approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@s-b-e-n-s-o-n @biggest-littlest