all: fix golangci-lint issues (#3064)

hscontrol/types/users.go

@@ -4,6 +4,7 @@ import (
 	"cmp"
 	"database/sql"
 	"encoding/json"
+	"errors"
 	"fmt"
 	"net/mail"
 	"net/url"
@@ -20,6 +21,9 @@ import (
 	"tailscale.com/tailcfg"
 )
 
+// ErrCannotParseBoolean is returned when a value cannot be parsed as boolean.
+var ErrCannotParseBoolean = errors.New("cannot parse value as boolean")
+
 type UserID uint64
 
 type Users []User
@@ -42,9 +46,11 @@ var TaggedDevices = User{
 func (u Users) String() string {
 	var sb strings.Builder
 	sb.WriteString("[ ")
+
 	for _, user := range u {
 		fmt.Fprintf(&sb, "%d: %s, ", user.ID, user.Name)
 	}
+
 	sb.WriteString(" ]")
 
 	return sb.String()
@@ -55,7 +61,8 @@ func (u Users) String() string {
 // At the end of the day, users in Tailscale are some kind of 'bubbles' or users
 // that contain our machines.
 type User struct {
-	gorm.Model
+	gorm.Model //nolint:embeddedstructfieldcheck
+
 	// The index `idx_name_provider_identifier` is to enforce uniqueness
 	// between Name and ProviderIdentifier. This ensures that
 	// you can have multiple users with the same name in OIDC,
@@ -91,6 +98,7 @@ func (u *User) StringID() string {
 	if u == nil {
 		return ""
 	}
+
 	return strconv.FormatUint(uint64(u.ID), 10)
 }
 
@@ -130,7 +138,7 @@ func (u *User) profilePicURL() string {
 
 func (u *User) TailscaleUser() tailcfg.User {
 	return tailcfg.User{
-		ID:            tailcfg.UserID(u.ID),
+		ID:            tailcfg.UserID(u.ID), //nolint:gosec // UserID is bounded
 		DisplayName:   u.Display(),
 		ProfilePicURL: u.profilePicURL(),
 		Created:       u.CreatedAt,
@@ -150,7 +158,7 @@ func (u UserView) ID() uint {
 
 func (u *User) TailscaleLogin() tailcfg.Login {
 	return tailcfg.Login{
-		ID:            tailcfg.LoginID(u.ID),
+		ID:            tailcfg.LoginID(u.ID), //nolint:gosec // safe conversion for user ID
 		Provider:      u.Provider,
 		LoginName:     u.Username(),
 		DisplayName:   u.Display(),
@@ -164,7 +172,7 @@ func (u UserView) TailscaleLogin() tailcfg.Login {
 
 func (u *User) TailscaleUserProfile() tailcfg.UserProfile {
 	return tailcfg.UserProfile{
-		ID:            tailcfg.UserID(u.ID),
+		ID:            tailcfg.UserID(u.ID), //nolint:gosec // UserID is bounded
 		LoginName:     u.Username(),
 		DisplayName:   u.Display(),
 		ProfilePicURL: u.profilePicURL(),
@@ -184,6 +192,7 @@ func (u *User) Proto() *v1.User {
 	if name == "" {
 		name = u.Username()
 	}
+
 	return &v1.User{
 		Id:            uint64(u.ID),
 		Name:          name,
@@ -220,7 +229,7 @@ func (u UserView) MarshalZerologObject(e *zerolog.Event) {
 	u.ж.MarshalZerologObject(e)
 }
 
-// JumpCloud returns a JSON where email_verified is returned as a
+// FlexibleBoolean handles JumpCloud's JSON where email_verified is returned as a
 // string "true" or "false" instead of a boolean.
 // This maps bool to a specific type with a custom unmarshaler to
 // ensure we can decode it from a string.
@@ -229,6 +238,7 @@ type FlexibleBoolean bool
 
 func (bit *FlexibleBoolean) UnmarshalJSON(data []byte) error {
 	var val any
+
 	err := json.Unmarshal(data, &val)
 	if err != nil {
 		return fmt.Errorf("unmarshalling data: %w", err)
@@ -242,10 +252,11 @@ func (bit *FlexibleBoolean) UnmarshalJSON(data []byte) error {
 		if err != nil {
 			return fmt.Errorf("parsing %s as boolean: %w", v, err)
 		}
+
 		*bit = FlexibleBoolean(pv)
 
 	default:
-		return fmt.Errorf("parsing %v as boolean", v)
+		return fmt.Errorf("%w: %v", ErrCannotParseBoolean, v)
 	}
 
 	return nil
@@ -279,9 +290,11 @@ func (c *OIDCClaims) Identifier() string {
 	if c.Iss == "" && c.Sub == "" {
 		return ""
 	}
+
 	if c.Iss == "" {
 		return CleanIdentifier(c.Sub)
 	}
+
 	if c.Sub == "" {
 		return CleanIdentifier(c.Iss)
 	}
@@ -292,9 +305,9 @@ func (c *OIDCClaims) Identifier() string {
 
 	var result string
 	// Try to parse as URL to handle URL joining correctly
-	if u, err := url.Parse(issuer); err == nil && u.Scheme != "" {
+	if u, err := url.Parse(issuer); err == nil && u.Scheme != "" { //nolint:noinlineerr
 		// For URLs, use proper URL path joining
-		if joined, err := url.JoinPath(issuer, subject); err == nil {
+		if joined, err := url.JoinPath(issuer, subject); err == nil { //nolint:noinlineerr
 			result = joined
 		}
 	}
@@ -366,6 +379,7 @@ func CleanIdentifier(identifier string) string {
 			cleanParts = append(cleanParts, trimmed)
 		}
 	}
+
 	if len(cleanParts) == 0 {
 		return ""
 	}
@@ -408,6 +422,7 @@ func (u *User) FromClaim(claims *OIDCClaims, emailVerifiedRequired bool) {
 	if claims.Iss == "" && !strings.HasPrefix(identifier, "/") {
 		identifier = "/" + identifier
 	}
+
 	u.ProviderIdentifier = sql.NullString{String: identifier, Valid: true}
 	u.DisplayName = claims.Name
 	u.ProfilePicURL = claims.ProfilePictureURL