fix: address GitHub security findings (CodeQL #38/#40, Dependabot #207) (#163)

* fix: address GitHub security findings

- ui_jobs.go: replace log.Printf with structured h.logger() calls for
  user-controlled jobID/eventID values to prevent log injection (CodeQL #40)
- middleware_csrf.go: set CSRF cookie Secure attribute to true unconditionally;
  app is always served over HTTPS in production (CodeQL #38)
- puppeteer-worker: add npm override to force uuid >= 11.1.1, fixing
  buffer bounds check vuln in transitive deps via @google-cloud/storage
  (Dependabot #207, CodeQL #43/#44)

* fix: golangci-lint failures

- ui_jobs.go: wrap long ErrorContext call to satisfy golines
- middleware_csrf.go: rename unused r param to _, remove now-unused
  isForwardedHTTPS helper (both became dead code after Secure: true change)

* fix: format ErrorContext call to satisfy golines (max-len 120)

Author: cawalch

services/merrymaker-go/internal/http/middleware_csrf.go

@@ -137,40 +137,21 @@ type csrfCookieParams struct {
 }
 
 // setCSRFCookie sets the CSRF token cookie.
-func setCSRFCookie(w http.ResponseWriter, r *http.Request, params csrfCookieParams) {
-	// Check if request is over HTTPS, accounting for proxies
-	isSecure := r.TLS != nil || isForwardedHTTPS(r)
-
+func setCSRFCookie(w http.ResponseWriter, _ *http.Request, params csrfCookieParams) {
+	// Secure is always true — the app is served over HTTPS (direct TLS or
+	// a proxy terminating TLS). SameSite=Strict provides additional protection.
 	http.SetCookie(w, &http.Cookie{
 		Name:     params.Name,
 		Value:    params.Token,
 		Path:     "/",
 		Domain:   params.Domain,
 		HttpOnly: false, // Must be readable by JavaScript for HTMX to include it
-		Secure:   isSecure,
+		Secure:   true,
 		SameSite: http.SameSiteStrictMode, // Strict for CSRF tokens
 		MaxAge:   3600 * 12,               // 12 hours
 	})
 }
 
-// isForwardedHTTPS checks if the request was forwarded over HTTPS.
-// Handles comma-separated values in X-Forwarded-Proto header.
-func isForwardedHTTPS(r *http.Request) bool {
-	xfProto := r.Header.Get("X-Forwarded-Proto")
-	if xfProto == "" {
-		return false
-	}
-
-	// Handle comma-separated values (e.g., "https,http")
-	for proto := range strings.SplitSeq(xfProto, ",") {
-		if strings.EqualFold(strings.TrimSpace(proto), "https") {
-			return true
-		}
-	}
-
-	return false
-}
-
 // validateCSRFToken validates the CSRF token from the request against the cookie value.
 // It checks both the X-Csrf-Token header (for HTMX/AJAX) and the csrf_token form field.
 // Uses constant-time comparison to prevent timing side-channel attacks.

services/merrymaker-go/internal/http/ui_jobs.go

@@ -1057,7 +1057,7 @@ func (h *UIHandlers) JobEvents(w http.ResponseWriter, r *http.Request) {
 
 	pageResp, err := h.fetchJobEvents(r.Context(), req.fetchParams)
 	if err != nil {
-		log.Printf("JobEvents: failed to list events for job %s: %v", jobID, err)
+		h.logger().ErrorContext(r.Context(), "JobEvents: failed to list events", "job_id", jobID, "error", err)
 		http.Error(w, "failed to load job events", http.StatusInternalServerError)
 		return
 	}
@@ -1097,7 +1097,10 @@ func (h *UIHandlers) JobEvents(w http.ResponseWriter, r *http.Request) {
 
 	w.Header().Set("Content-Type", "text/html; charset=utf-8")
 	if templateErr := h.T.t.ExecuteTemplate(w, "job-events-fragment", data); templateErr != nil {
-		log.Printf("JobEvents: template execution failed for job %s: %v", jobID, templateErr)
+		h.logger().ErrorContext(
+			r.Context(), "JobEvents: template execution failed",
+			"job_id", jobID, "error", templateErr,
+		)
 		http.Error(w, "failed to render job events", http.StatusInternalServerError)
 	}
 }
@@ -1113,7 +1116,10 @@ func (h *UIHandlers) JobEventDetails(w http.ResponseWriter, r *http.Request) {
 
 	events, err := h.EventSvc.GetByIDs(r.Context(), []string{eventID})
 	if err != nil {
-		log.Printf("JobEventDetails: failed to fetch event %s for job %s: %v", eventID, jobID, err)
+		h.logger().ErrorContext(
+			r.Context(), "JobEventDetails: failed to fetch event",
+			"event_id", eventID, "job_id", jobID, "error", err,
+		)
 		http.Error(w, "failed to load event", http.StatusInternalServerError)
 		return
 	}

services/puppeteer-worker/package-lock.json

@@ -34,6 +34,9 @@
 		"tsx": "^4.22.5",
 		"typescript": "^6.0.3"
 	},
+	"overrides": {
+		"uuid": "^11.1.1"
+	},
 	"dependencies": {
 		"@aws-sdk/client-s3": "^3.1079.0",
 		"@aws-sdk/s3-request-presigner": "^3.1079.0",