Refactor HTTP response handling and improve error management

- Updated various handlers to use the error return value from `json.NewEncoder(w).Encode(...)` for better error handling.
- Replaced direct calls to `json.NewEncoder(w).Encode(...)` with error checks to ensure proper logging and handling of potential write errors.
- Removed unused error handling functions related to API error responses to streamline the codebase.
- Improved TLS configuration in email service to enforce minimum TLS version.
- Refactored backend server status parsing for clarity and maintainability.
- Removed redundant functions for checking and counting non-hardware backends in the template helper.
- Enhanced rollback handling in plugin migration to ensure proper resource management.

Author: sarg3nt

gearbox-agent/internal/api/websocket.go

@@ -97,7 +97,7 @@ func (h *WSHandler) HandleEvents(w http.ResponseWriter, r *http.Request) {
 		h.logger.Error("WebSocket upgrade failed", "error", err)
 		return
 	}
-	defer conn.Close()
+	defer func() { _ = conn.Close() }()
 
 	// Subscribe to events
 	sub := h.eventBus.Subscribe()

gearbox-agent/internal/plugins/certs/plugin.go

@@ -194,7 +194,7 @@ func (p *Plugin) handleDownload(w http.ResponseWriter, r *http.Request) {
 				w.Header().Set("Content-Type", "application/x-pem-file")
 				w.Header().Set("Content-Disposition", fmt.Sprintf("attachment; filename=%q", filename))
 				w.Header().Set("Content-Length", fmt.Sprintf("%d", len(certData)))
-				w.Write(certData)
+				_, _ = w.Write(certData)
 				return
 			}
 		}
@@ -241,7 +241,7 @@ func (p *Plugin) handleDownload(w http.ResponseWriter, r *http.Request) {
 	w.Header().Set("Content-Type", "application/x-pem-file")
 	w.Header().Set("Content-Disposition", fmt.Sprintf("attachment; filename=%q", filename))
 	w.Header().Set("Content-Length", fmt.Sprintf("%d", len(certData)))
-	w.Write(certData)
+	_, _ = w.Write(certData)
 }
 
 // GetCollector returns the certificate collector for use by other components.

gearbox-agent/internal/plugins/haproxy/plugin.go

@@ -195,7 +195,7 @@ func (p *Plugin) handleStats(w http.ResponseWriter, r *http.Request) {
 	// Allow requesting raw CSV format
 	if r.URL.Query().Get("format") == "csv" {
 		w.Header().Set("Content-Type", "text/csv")
-		w.Write([]byte(csvData))
+		_, _ = w.Write([]byte(csvData))
 		return
 	}
 

gearbox/cmd/server/main.go

@@ -78,7 +78,7 @@ func main() {
 	if err != nil {
 		log.Fatalf("Failed to initialize database: %v", err)
 	}
-	defer db.Close()
+	defer func() { _ = db.Close() }()
 	logger.Info("database initialized",
 		"path", cfg.DatabasePath,
 		"retention_hours", cfg.DatabaseRetentionHours)
@@ -117,7 +117,7 @@ func main() {
 		if cfg.AdminPassword == "" {
 			// SECURITY: Write password to secure file with restrictive permissions
 			// File will be auto-deleted after first password change
-			credentialsFile := "data/admin-credentials.txt"
+			credentialsFile := "data/admin-credentials.txt" //#nosec G101 -- Not a credential; this is a file path constant
 			credentialsContent := fmt.Sprintf("ADMIN USER CREATED\n\nEmail: admin\nPassword: %s\n\nIMPORTANT: You will be forced to change this password on first login.\nThis file will be automatically deleted after you change your password.\n", adminPassword)
 
 			if err := os.WriteFile(credentialsFile, []byte(credentialsContent), 0600); err != nil {
@@ -367,7 +367,9 @@ func main() {
 	dataSourceRegistry := widget.NewDataSourceRegistry(logger)
 
 	// Register core widgets
-	widgets.RegisterCoreWidgets(widgetRegistry)
+	if err := widgets.RegisterCoreWidgets(widgetRegistry); err != nil {
+		log.Fatalf("Failed to register core widgets: %v", err)
+	}
 
 	// Register HAProxy-specific widgets
 	if err := dashboardPlugin.RegisterHAProxyWidgets(widgetRegistry); err != nil {
@@ -464,7 +466,7 @@ func main() {
 			http.Error(w, "Not Found", http.StatusNotFound)
 			return
 		}
-		w.Write(data)
+		_, _ = w.Write(data)
 	})
 	r.Get("/favicon.svg", func(w http.ResponseWriter, r *http.Request) {
 		w.Header().Set("Content-Type", "image/svg+xml")
@@ -474,7 +476,7 @@ func main() {
 			http.Error(w, "Not Found", http.StatusNotFound)
 			return
 		}
-		w.Write(data)
+		_, _ = w.Write(data)
 	})
 
 	// Static file server for CSS, JavaScript, and other assets

gearbox/internal/framework/agent/client.go

@@ -73,7 +73,7 @@ func createTLSConfig() *tls.Config {
 		fmt.Fprintf(os.Stderr, "WARNING: TLS certificate verification is DISABLED (GEARBOX_INSECURE_TLS=true)\n")
 		fmt.Fprintf(os.Stderr, "WARNING: This is NOT recommended for production use\n")
 		return &tls.Config{
-			InsecureSkipVerify: true,
+			InsecureSkipVerify: true, //#nosec G402 -- User explicitly opted in via GEARBOX_INSECURE_TLS env var
 			MinVersion:         tls.VersionTLS12,
 		}
 	}
@@ -82,7 +82,7 @@ func createTLSConfig() *tls.Config {
 	caCertPath := os.Getenv("AGENT_CA_CERT_PATH")
 	if caCertPath != "" {
 		// Load CA certificate for validating agent certificates
-		caCertPEM, err := os.ReadFile(caCertPath)
+		caCertPEM, err := os.ReadFile(caCertPath) //#nosec G304 -- Path from trusted env var AGENT_CA_CERT_PATH
 		if err != nil {
 			fmt.Fprintf(os.Stderr, "ERROR: Failed to read CA certificate from %s: %v\n", caCertPath, err)
 			fmt.Fprintf(os.Stderr, "ERROR: Falling back to system certificate pool\n")
@@ -117,7 +117,7 @@ func createTLSConfig() *tls.Config {
 // doRequest performs an HTTP request with authentication.
 func (c *Client) doRequest(method, path string, query url.Values) ([]byte, error) {
 	fullURL := c.baseURL + path
-	if query != nil && len(query) > 0 {
+	if len(query) > 0 {
 		fullURL += "?" + query.Encode()
 	}
 
@@ -169,7 +169,7 @@ func (c *Client) doRequestWithBody(method, path string, reqBody interface{}) ([]
 // doRequestWithBodyAndQuery performs an HTTP request with a JSON body and query parameters.
 func (c *Client) doRequestWithBodyAndQuery(method, path string, reqBody interface{}, query url.Values) ([]byte, error) {
 	fullURL := c.baseURL + path
-	if query != nil && len(query) > 0 {
+	if len(query) > 0 {
 		fullURL += "?" + query.Encode()
 	}
 

gearbox/internal/framework/agent/websocket.go

@@ -154,7 +154,7 @@ func (w *WSClient) connectAndRead(ctx context.Context) error {
 		w.mu.Lock()
 		w.connected = false
 		if w.conn != nil {
-			w.conn.Close()
+			_ = w.conn.Close()
 			w.conn = nil
 		}
 		cb := w.connectionCallback

gearbox/internal/framework/collector/websocket_manager.go

@@ -257,39 +257,6 @@ func (m *WebSocketManager) triggerMetadataRefresh(serverID string) {
 	}()
 }
 
-// triggerStatsRefresh triggers an immediate stats refresh for a server.
-func (m *WebSocketManager) triggerStatsRefresh(serverID string) {
-	manager, exists := m.registry.GetCollector(serverID)
-	if !exists {
-		m.logger.Debug("cannot refresh stats: collector not found",
-			"server_id", serverID)
-		return
-	}
-
-	// Refresh stats synchronously so cache is updated before SSE event
-	if err := manager.RefreshStats(); err != nil {
-		m.logger.Debug("failed to refresh stats",
-			"server_id", serverID,
-			"error", err)
-	}
-}
-
-// triggerMetricsRefresh triggers an immediate metrics refresh for a server.
-func (m *WebSocketManager) triggerMetricsRefresh(serverID string) {
-	manager, exists := m.registry.GetCollector(serverID)
-	if !exists {
-		m.logger.Debug("cannot refresh metrics: collector not found",
-			"server_id", serverID)
-		return
-	}
-
-	// Refresh metrics synchronously so cache is updated before SSE event
-	if err := manager.RefreshMetrics(); err != nil {
-		m.logger.Debug("failed to refresh metrics",
-			"server_id", serverID,
-			"error", err)
-	}
-}
 
 // updateStatsFromEvent updates the cache with stats from a WebSocket event.
 // This avoids a redundant API call to the agent since it already sent the stats.

gearbox/internal/framework/dashboard/storage.go

@@ -25,7 +25,7 @@ func NewStorage(dataDir string, logger *slog.Logger) (*Storage, error) {
 
 	// Ensure the dashboards directory exists
 	dashboardDir := filepath.Join(dataDir, "dashboards")
-	if err := os.MkdirAll(dashboardDir, 0755); err != nil {
+	if err := os.MkdirAll(dashboardDir, 0750); err != nil {
 		return nil, fmt.Errorf("failed to create dashboards directory: %w", err)
 	}
 
@@ -47,7 +47,7 @@ func (s *Storage) Load(slug string) (*Dashboard, error) {
 // LoadFromPath loads a dashboard from a specific file path.
 func (s *Storage) LoadFromPath(filePath string) (*Dashboard, error) {
 	// Read the YAML file
-	data, err := os.ReadFile(filePath)
+	data, err := os.ReadFile(filePath) //#nosec G304 -- filePath is constructed from slug via filepath.Join, not direct user input
 	if err != nil {
 		if os.IsNotExist(err) {
 			return nil, fmt.Errorf("dashboard not found: %s", filePath)
@@ -113,7 +113,7 @@ func (s *Storage) Save(dashboard *Dashboard) error {
 	}
 
 	// Write to file
-	if err := os.WriteFile(filePath, data, 0644); err != nil {
+	if err := os.WriteFile(filePath, data, 0600); err != nil {
 		return fmt.Errorf("failed to write dashboard file: %w", err)
 	}
 

gearbox/internal/framework/database/alerts.go

@@ -175,7 +175,7 @@ func (d *DB) GetAlertRules(serverID string) ([]models.AlertRule, error) {
 	if err != nil {
 		return nil, err
 	}
-	defer rows.Close()
+	defer func() { _ = rows.Close() }()
 
 	var rules []models.AlertRule
 	for rows.Next() {
@@ -227,7 +227,7 @@ func (d *DB) GetEnabledAlertRules(serverID string) ([]models.AlertRule, error) {
 	if err != nil {
 		return nil, err
 	}
-	defer rows.Close()
+	defer func() { _ = rows.Close() }()
 
 	var rules []models.AlertRule
 	for rows.Next() {
@@ -348,7 +348,7 @@ func (d *DB) getAlertsByStatus(serverID, status string) ([]models.Alert, error)
 	if err != nil {
 		return nil, err
 	}
-	defer rows.Close()
+	defer func() { _ = rows.Close() }()
 
 	return d.scanAlertsWithEmails(rows)
 }
@@ -373,66 +373,11 @@ func (d *DB) GetRecentAlerts(serverID string, limit int) ([]models.Alert, error)
 	if err != nil {
 		return nil, err
 	}
-	defer rows.Close()
+	defer func() { _ = rows.Close() }()
 
 	return d.scanAlertsWithEmails(rows)
 }
 
-// scanAlerts scans alert rows into Alert structs (legacy, without user emails).
-func (d *DB) scanAlerts(rows *sql.Rows) ([]models.Alert, error) {
-	var alerts []models.Alert
-	for rows.Next() {
-		var a models.Alert
-		var ruleID, acknowledgedBy sql.NullInt64
-		var metric, affectedEntity, metadata sql.NullString
-		var metricValue, threshold sql.NullFloat64
-		var acknowledgedAt, resolvedAt, silencedUntil sql.NullTime
-
-		err := rows.Scan(
-			&a.ID, &ruleID, &a.BoxID, &a.Type, &a.Severity, &a.Status,
-			&a.Title, &a.Message, &metric, &metricValue, &threshold,
-			&affectedEntity, &a.TriggeredAt, &acknowledgedAt, &acknowledgedBy,
-			&resolvedAt, &silencedUntil, &a.NotifiedEmail, &a.NotifiedWebhook, &metadata,
-		)
-		if err != nil {
-			return nil, err
-		}
-
-		if ruleID.Valid {
-			a.RuleID = ruleID.Int64
-		}
-		if metric.Valid {
-			a.Metric = metric.String
-		}
-		if metricValue.Valid {
-			a.MetricValue = metricValue.Float64
-		}
-		if threshold.Valid {
-			a.Threshold = threshold.Float64
-		}
-		if affectedEntity.Valid {
-			a.AffectedEntity = affectedEntity.String
-		}
-		if acknowledgedAt.Valid {
-			a.AcknowledgedAt = &acknowledgedAt.Time
-		}
-		if acknowledgedBy.Valid {
-			a.AcknowledgedBy = &acknowledgedBy.Int64
-		}
-		if resolvedAt.Valid {
-			a.ResolvedAt = &resolvedAt.Time
-		}
-		if silencedUntil.Valid {
-			a.SilencedUntil = &silencedUntil.Time
-		}
-		if metadata.Valid {
-			a.Metadata = metadata.String
-		}
-
-		alerts = append(alerts, a)
-	}
-	return alerts, nil
-}
 
 // scanAlertsWithEmails scans alert rows with user email joins into Alert structs.
 func (d *DB) scanAlertsWithEmails(rows *sql.Rows) ([]models.Alert, error) {
@@ -562,7 +507,7 @@ func (d *DB) GetAlertSummary(serverID string) (*models.AlertSummary, error) {
 		var status string
 		var count int
 		if err := rows.Scan(&status, &count); err != nil {
-			rows.Close()
+			_ = rows.Close()
 			return nil, err
 		}
 		switch status {
@@ -574,7 +519,7 @@ func (d *DB) GetAlertSummary(serverID string) (*models.AlertSummary, error) {
 			summary.TotalResolved = count
 		}
 	}
-	rows.Close()
+	_ = rows.Close()
 
 	// Count by severity (active only)
 	rows, err = d.db.Query(`
@@ -588,12 +533,12 @@ func (d *DB) GetAlertSummary(serverID string) (*models.AlertSummary, error) {
 		var severity string
 		var count int
 		if err := rows.Scan(&severity, &count); err != nil {
-			rows.Close()
+			_ = rows.Close()
 			return nil, err
 		}
 		summary.BySeverity[severity] = count
 	}
-	rows.Close()
+	_ = rows.Close()
 
 	// Count by type (active only)
 	rows, err = d.db.Query(`
@@ -607,12 +552,12 @@ func (d *DB) GetAlertSummary(serverID string) (*models.AlertSummary, error) {
 		var alertType string
 		var count int
 		if err := rows.Scan(&alertType, &count); err != nil {
-			rows.Close()
+			_ = rows.Close()
 			return nil, err
 		}
 		summary.ByType[alertType] = count
 	}
-	rows.Close()
+	_ = rows.Close()
 
 	// Get recent alerts
 	summary.RecentAlerts, _ = d.GetRecentAlerts(serverID, 10)
@@ -762,7 +707,7 @@ func (m AlertMetadata) String() string {
 
 func ParseAlertMetadata(s string) AlertMetadata {
 	var m AlertMetadata
-	json.Unmarshal([]byte(s), &m)
+	_ = json.Unmarshal([]byte(s), &m)
 	return m
 }
 
@@ -802,7 +747,7 @@ func (d *DB) GetAlertNotes(alertID int64) ([]AlertNote, error) {
 	if err != nil {
 		return nil, err
 	}
-	defer rows.Close()
+	defer func() { _ = rows.Close() }()
 
 	var notes []AlertNote
 	for rows.Next() {
@@ -828,7 +773,7 @@ func (d *DB) AcknowledgeAlertWithNote(alertID int64, userID string, note string)
 	if err != nil {
 		return err
 	}
-	defer tx.Rollback()
+	defer func() { _ = tx.Rollback() }()
 
 	// Update alert status
 	_, err = tx.Exec(`
@@ -863,7 +808,7 @@ func (d *DB) ResolveAlertWithNote(alertID int64, userID string, note string) err
 	if err != nil {
 		return err
 	}
-	defer tx.Rollback()
+	defer func() { _ = tx.Rollback() }()
 
 	// Update alert status with resolved_by
 	_, err = tx.Exec(`
@@ -913,7 +858,7 @@ func (d *DB) GetUserAlertSubscriptions(userID int64) ([]UserAlertSubscription, e
 	if err != nil {
 		return nil, err
 	}
-	defer rows.Close()
+	defer func() { _ = rows.Close() }()
 
 	var subs []UserAlertSubscription
 	for rows.Next() {
@@ -972,7 +917,7 @@ func (d *DB) GetUsersToNotify(serverID, alertType, severity string) ([]int64, er
 	if err != nil {
 		return nil, err
 	}
-	defer rows.Close()
+	defer func() { _ = rows.Close() }()
 
 	var userIDs []int64
 	for rows.Next() {