🐛 Fix nil-safety issues found in review

- redis.go: Merge duplicate Internal struct into single definition
- network.go: Guard lb.SKU and fw.Properties/SKU nil dereferences
- iam.go: Skip nil permission entries in lazy-loaded permissions()

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: tas50

providers/azure/resources/iam.go

@@ -105,6 +105,9 @@ type mqlAzureSubscriptionAuthorizationServiceRoleDefinitionInternal struct {
 func (a *mqlAzureSubscriptionAuthorizationServiceRoleDefinition) permissions() ([]any, error) {
 	res := []any{}
 	for idx, p := range a.cachePermissions {
+		if p == nil {
+			continue
+		}
 		id := fmt.Sprintf("%s/azure.subscription.authorizationService.roleDefinition.permission/%d", a.Id.Data, idx)
 		permission, err := newMqlRolePermission(a.MqlRuntime, id, p)
 		if err != nil {

providers/azure/resources/network.go

@@ -387,14 +387,19 @@ func (a *mqlAzureSubscriptionNetworkService) loadBalancers() ([]any, error) {
 			if err != nil {
 				return nil, err
 			}
+			var lbSkuName, lbSkuTier *string
+			if lb.SKU != nil {
+				lbSkuName = (*string)(lb.SKU.Name)
+				lbSkuTier = (*string)(lb.SKU.Tier)
+			}
 			mqlAzure, err := CreateResource(a.MqlRuntime, "azure.subscription.networkService.loadBalancer",
 				map[string]*llx.RawData{
 					"id":         llx.StringDataPtr(lb.ID),
 					"name":       llx.StringDataPtr(lb.Name),
 					"location":   llx.StringDataPtr(lb.Location),
 					"etag":       llx.StringDataPtr(lb.Etag),
-					"sku":        llx.StringDataPtr((*string)(lb.SKU.Name)),
-					"skuTier":    llx.StringDataPtr((*string)(lb.SKU.Tier)),
+					"sku":        llx.StringDataPtr(lbSkuName),
+					"skuTier":    llx.StringDataPtr(lbSkuTier),
 					"tags":       llx.MapData(convert.PtrMapStrToInterface(lb.Tags), types.String),
 					"type":       llx.StringDataPtr(lb.Type),
 					"properties": llx.DictData(lbProps),
@@ -2277,6 +2282,15 @@ func azureFirewallToMql(runtime *plugin.Runtime, fw network.AzureFirewall) (*mql
 	if err != nil {
 		return nil, err
 	}
+	var fwSkuTier, fwSkuName, fwProvisioningState, fwThreatIntelMode *string
+	if fw.Properties != nil {
+		fwProvisioningState = (*string)(fw.Properties.ProvisioningState)
+		fwThreatIntelMode = (*string)(fw.Properties.ThreatIntelMode)
+		if fw.Properties.SKU != nil {
+			fwSkuTier = (*string)(fw.Properties.SKU.Tier)
+			fwSkuName = (*string)(fw.Properties.SKU.Name)
+		}
+	}
 	args := map[string]*llx.RawData{
 		"id":                llx.StringDataPtr(fw.ID),
 		"name":              llx.StringDataPtr(fw.Name),
@@ -2285,10 +2299,10 @@ func azureFirewallToMql(runtime *plugin.Runtime, fw network.AzureFirewall) (*mql
 		"tags":              llx.MapData(convert.PtrMapStrToInterface(fw.Tags), types.String),
 		"etag":              llx.StringDataPtr(fw.Etag),
 		"properties":        llx.DictData(props),
-		"skuTier":           llx.StringDataPtr((*string)(fw.Properties.SKU.Tier)),
-		"skuName":           llx.StringDataPtr((*string)(fw.Properties.SKU.Name)),
-		"provisioningState": llx.StringDataPtr((*string)(fw.Properties.ProvisioningState)),
-		"threatIntelMode":   llx.StringDataPtr((*string)(fw.Properties.ThreatIntelMode)),
+		"skuTier":           llx.StringDataPtr(fwSkuTier),
+		"skuName":           llx.StringDataPtr(fwSkuName),
+		"provisioningState": llx.StringDataPtr(fwProvisioningState),
+		"threatIntelMode":   llx.StringDataPtr(fwThreatIntelMode),
 	}
 	mqlFw, err := CreateResource(runtime, "azure.subscription.networkService.firewall", args)
 	if err != nil {

providers/azure/resources/redis.go

@@ -26,7 +26,8 @@ type mqlAzureSubscriptionCacheServiceRedisInstanceInternal struct {
 	// cacheEncryptionKeyURI stores the customer-managed key URI for encryption.
 	// Note: armredis/v3 does not expose encryption fields on Properties.
 	// This will be populated when the SDK adds support for CMK encryption configuration.
-	cacheEncryptionKeyURI string
+	cacheEncryptionKeyURI           string
+	cachePrivateEndpointConnections []*armredis.PrivateEndpointConnection
 }
 
 func (a *mqlAzureSubscriptionCacheServiceRedisInstance) id() (string, error) {
@@ -213,10 +214,6 @@ func createRedisInstanceRawData(runtime *plugin.Runtime, cache *armredis.Resourc
 	}, nil
 }
 
-type mqlAzureSubscriptionCacheServiceRedisInstanceInternal struct {
-	cachePrivateEndpointConnections []*armredis.PrivateEndpointConnection
-}
-
 func (a *mqlAzureSubscriptionCacheServiceRedisInstance) privateEndpointConnections() ([]any, error) {
 	res := []any{}
 	for _, pec := range a.cachePrivateEndpointConnections {