fix(core): DSPX-4607 clear sloglint, goconst, nolintlint and SA1019 findings

service/authorization/authorization.go

@@ -605,6 +605,7 @@ func (as *AuthorizationService) getDecisions(ctx context.Context, dr *authorizat
 						Decision:      authorization.DecisionResponse_DECISION_DENY,
 						EntityChainId: ec.GetId(),
 						Action: &policy.Action{
+							//nolint:staticcheck // the v1 authorization API still returns the deprecated Action.Value oneof for clients that have not moved to Action.Name
 							Value: &policy.Action_Standard{
 								Standard: policy.Action_STANDARD_ACTION_TRANSMIT,
 							},
@@ -769,6 +770,7 @@ func (as *AuthorizationService) getDecisions(ctx context.Context, dr *authorizat
 				Decision:      decision,
 				EntityChainId: ec.GetId(),
 				Action: &policy.Action{
+					//nolint:staticcheck // the v1 authorization API still returns the deprecated Action.Value oneof for clients that have not moved to Action.Name
 					Value: &policy.Action_Standard{
 						Standard: policy.Action_STANDARD_ACTION_TRANSMIT,
 					},

service/entityresolution/keycloak/v2/entity_resolution.go

@@ -373,7 +373,7 @@ func expandGroup(ctx context.Context, groupID string, kcConnector *Connector, kc
 			logger.DebugContext(ctx,
 				"adding members",
 				slog.Int("amount", len(grpMembers)),
-				slog.String("from group", *grp.Name),
+				slog.String("from_group", *grp.Name),
 			)
 			for i := 0; i < len(grpMembers); i++ {
 				user := grpMembers[i]

service/entityresolution/multi-strategy/mapper.go

@@ -8,6 +8,15 @@ import (
 	"github.com/opentdf/platform/service/entityresolution/multi-strategy/types"
 )
 
+// Names of the value transformations shared by the mappers in this package.
+const (
+	transformationCSVToArray = "csv_to_array"
+	transformationArray      = "array"
+	transformationString     = "string"
+	transformationLowercase  = "lowercase"
+	transformationUppercase  = "uppercase"
+)
+
 // BaseMapper provides common functionality for all mapper implementations
 type BaseMapper struct {
 	providerType string
@@ -70,7 +79,7 @@ func (m *BaseMapper) ApplyTransformation(value interface{}, transformation strin
 	}
 
 	switch transformation {
-	case "csv_to_array":
+	case transformationCSVToArray:
 		if str, ok := value.(string); ok {
 			if str == "" {
 				return []string{}, nil
@@ -83,7 +92,7 @@ func (m *BaseMapper) ApplyTransformation(value interface{}, transformation strin
 		}
 		return nil, fmt.Errorf("csv_to_array transformation requires string input, got %T", value)
 
-	case "array":
+	case transformationArray:
 		// Ensure value is an array
 		if arr, ok := value.([]interface{}); ok {
 			return arr, nil
@@ -97,16 +106,16 @@ func (m *BaseMapper) ApplyTransformation(value interface{}, transformation strin
 		}
 		return []interface{}{value}, nil
 
-	case "string":
+	case transformationString:
 		return fmt.Sprintf("%v", value), nil
 
-	case "lowercase":
+	case transformationLowercase:
 		if str, ok := value.(string); ok {
 			return strings.ToLower(str), nil
 		}
 		return strings.ToLower(fmt.Sprintf("%v", value)), nil
 
-	case "uppercase":
+	case transformationUppercase:
 		if str, ok := value.(string); ok {
 			return strings.ToUpper(str), nil
 		}
@@ -120,10 +129,10 @@ func (m *BaseMapper) ApplyTransformation(value interface{}, transformation strin
 // GetCommonTransformations returns transformations supported by all mappers
 func (m *BaseMapper) GetCommonTransformations() []string {
 	return []string{
-		"csv_to_array",
-		"array",
-		"string",
-		"lowercase",
-		"uppercase",
+		transformationCSVToArray,
+		transformationArray,
+		transformationString,
+		transformationLowercase,
+		transformationUppercase,
 	}
 }

service/entityresolution/multi-strategy/output_mapper.go

@@ -141,19 +141,19 @@ func (om *OutputMapper) applyTransformation(value interface{}, transformation st
 	}
 
 	switch strings.ToLower(transformation) {
-	case "array":
+	case transformationArray:
 		return om.transformToArray(value)
 
-	case "csv_to_array":
+	case transformationCSVToArray:
 		return om.transformCSVToArray(value)
 
 	case "ldap_dn_to_cn_array":
 		return om.transformLDAPDNToCNArray(value)
 
-	case "lowercase":
+	case transformationLowercase:
 		return om.transformToLowercase(value)
 
-	case "uppercase":
+	case transformationUppercase:
 		return om.transformToUppercase(value)
 
 	case "trim":

service/entityresolution/multi-strategy/providers/claims/claims_mapper.go

@@ -19,7 +19,7 @@ var _ types.Mapper = (*Mapper)(nil)
 // NewMapper creates a new Claims mapper
 func NewMapper() *Mapper {
 	return &Mapper{
-		providerType: "claims",
+		providerType: providerTypeClaims,
 	}
 }
 
@@ -115,10 +115,10 @@ func (m *Mapper) GetSupportedTransformations() []string {
 
 // ApplyTransformation applies Claims-specific transformations
 func (m *Mapper) ApplyTransformation(value interface{}, transformationName string) (interface{}, error) {
-	return transformation.DefaultRegistry.ApplyTransformation(value, transformationName, "claims")
+	return transformation.DefaultRegistry.ApplyTransformation(value, transformationName, providerTypeClaims)
 }
 
 // isTransformationSupported checks if a transformation is supported by Claims mapper
 func (m *Mapper) isTransformationSupported(transformationName string) bool {
-	return transformation.IsSupportedByProvider(transformationName, "claims")
+	return transformation.IsSupportedByProvider(transformationName, providerTypeClaims)
 }

service/entityresolution/multi-strategy/providers/claims/claims_provider.go

@@ -6,6 +6,9 @@ import (
 	"github.com/opentdf/platform/service/entityresolution/multi-strategy/types"
 )
 
+// providerTypeClaims is the registry name for this entity-resolution provider.
+const providerTypeClaims = "claims"
+
 // Provider implements the Provider interface for JWT claims
 type Provider struct {
 	name   string
@@ -29,7 +32,7 @@ func (p *Provider) Name() string {
 
 // Type returns the provider type
 func (p *Provider) Type() string {
-	return "claims"
+	return providerTypeClaims
 }
 
 // ResolveEntity extracts claims directly from JWT (passed via context)
@@ -55,7 +58,7 @@ func (p *Provider) ResolveEntity(ctx context.Context, strategy types.MappingStra
 	}
 
 	// Add metadata about the source
-	result.Metadata["provider_type"] = "claims"
+	result.Metadata["provider_type"] = providerTypeClaims
 	result.Metadata["provider_name"] = p.name
 	result.Metadata["source"] = "jwt_claims"
 	result.Metadata["claim_count"] = len(claims)

service/entityresolution/multi-strategy/providers/ldap/ldap_mapper.go

@@ -19,7 +19,7 @@ var _ types.Mapper = (*Mapper)(nil)
 // NewMapper creates a new LDAP mapper
 func NewMapper() *Mapper {
 	return &Mapper{
-		providerType: "ldap",
+		providerType: providerTypeLDAP,
 	}
 }
 
@@ -123,7 +123,7 @@ func (m *Mapper) GetSupportedTransformations() []string {
 
 // ApplyTransformation applies LDAP-specific transformations
 func (m *Mapper) ApplyTransformation(value interface{}, transformationName string) (interface{}, error) {
-	return transformation.DefaultRegistry.ApplyTransformation(value, transformationName, "ldap")
+	return transformation.DefaultRegistry.ApplyTransformation(value, transformationName, providerTypeLDAP)
 }
 
 // escapeLDAPFilter escapes special characters in LDAP filter values
@@ -177,7 +177,7 @@ func isValidLDAPAttribute(name string) bool {
 
 // isTransformationSupported checks if a transformation is supported by LDAP mapper
 func (m *Mapper) isTransformationSupported(transformationName string) bool {
-	return transformation.IsSupportedByProvider(transformationName, "ldap")
+	return transformation.IsSupportedByProvider(transformationName, providerTypeLDAP)
 }
 
 func isASCIIAlpha(char byte) bool {

service/entityresolution/multi-strategy/providers/ldap/ldap_provider.go

@@ -9,6 +9,9 @@ import (
 	"github.com/opentdf/platform/service/entityresolution/multi-strategy/types"
 )
 
+// providerTypeLDAP is the registry name for this entity-resolution provider.
+const providerTypeLDAP = "ldap"
+
 // Provider implements the Provider interface for LDAP directories
 type Provider struct {
 	name    string
@@ -61,7 +64,7 @@ func (p *Provider) Name() string {
 
 // Type returns the provider type
 func (p *Provider) Type() string {
-	return "ldap"
+	return providerTypeLDAP
 }
 
 // ResolveEntity executes LDAP search to resolve entity information
@@ -194,7 +197,7 @@ func (p *Provider) ResolveEntity(ctx context.Context, strategy types.MappingStra
 	}
 
 	// Add metadata
-	result.Metadata["provider_type"] = "ldap"
+	result.Metadata["provider_type"] = providerTypeLDAP
 	result.Metadata["provider_name"] = p.name
 	result.Metadata["base_dn"] = strategy.LDAPSearch.BaseDN
 	result.Metadata["search_filter"] = searchFilter

service/entityresolution/multi-strategy/providers/sql/sql_mapper.go

@@ -20,7 +20,7 @@ var _ types.Mapper = (*Mapper)(nil)
 // NewMapper creates a new SQL mapper
 func NewMapper() *Mapper {
 	return &Mapper{
-		providerType: "sql",
+		providerType: providerTypeSQL,
 	}
 }
 
@@ -135,7 +135,7 @@ func (m *Mapper) GetSupportedTransformations() []string {
 
 // ApplyTransformation applies SQL-specific transformations
 func (m *Mapper) ApplyTransformation(value interface{}, transformationName string) (interface{}, error) {
-	return transformation.DefaultRegistry.ApplyTransformation(value, transformationName, "sql")
+	return transformation.DefaultRegistry.ApplyTransformation(value, transformationName, providerTypeSQL)
 }
 
 // sanitizeParameterValue ensures parameter values are safe for SQL queries
@@ -172,5 +172,5 @@ func isValidSQLIdentifier(name string) bool {
 
 // isTransformationSupported checks if a transformation is supported by SQL mapper
 func (m *Mapper) isTransformationSupported(transformationName string) bool {
-	return transformation.IsSupportedByProvider(transformationName, "sql")
+	return transformation.IsSupportedByProvider(transformationName, providerTypeSQL)
 }

service/entityresolution/multi-strategy/providers/sql/sql_provider.go

@@ -11,6 +11,9 @@ import (
 	"github.com/opentdf/platform/service/entityresolution/multi-strategy/types"
 )
 
+// providerTypeSQL is the registry name for this entity-resolution provider.
+const providerTypeSQL = "sql"
+
 func normalizeDriverName(driver string) string {
 	driver = strings.ToLower(strings.TrimSpace(driver))
 	switch driver {
@@ -104,7 +107,7 @@ func (p *Provider) Name() string {
 
 // Type returns the provider type
 func (p *Provider) Type() string {
-	return "sql"
+	return providerTypeSQL
 }
 
 // ResolveEntity executes SQL query to resolve entity information
@@ -199,7 +202,7 @@ func (p *Provider) ResolveEntity(ctx context.Context, strategy types.MappingStra
 	}
 
 	// Add metadata
-	result.Metadata["provider_type"] = "sql"
+	result.Metadata["provider_type"] = providerTypeSQL
 	result.Metadata["provider_name"] = p.name
 	result.Metadata["query"] = strategy.Query
 	result.Metadata["column_count"] = len(columns)

service/integration/keymanagement_test.go

@@ -140,6 +140,7 @@ func (s *KeyManagementSuite) Test_GetProviderConfig_WithId_DeprecatedManager_Suc
 		Identifier: &keymanagement.GetProviderConfigRequest_Id{
 			Id: pc.GetId(),
 		},
+		//nolint:staticcheck // exercises the deprecated Manager field, which must keep validating until it is removed
 		Manager: pc.GetManager(),
 	})
 	s.Require().NoError(err)
@@ -160,6 +161,7 @@ func (s *KeyManagementSuite) Test_GetProviderConfig_WithNameOnlyIdentifier_Fails
 
 	_, err := s.db.PolicyClient.GetProviderConfig(s.ctx, &keymanagement.GetProviderConfigRequest{
 		Identifier: &keymanagement.GetProviderConfigRequest_Name{
+			//nolint:staticcheck // exercises the deprecated Name identifier, which must keep validating until it is removed
 			Name: s.testProvider,
 		},
 	})
@@ -169,6 +171,7 @@ func (s *KeyManagementSuite) Test_GetProviderConfig_WithNameOnlyIdentifier_Fails
 
 func (s *KeyManagementSuite) Test_GetProviderConfig_WithManagerOnly_Fails() {
 	_, err := s.db.PolicyClient.GetProviderConfig(s.ctx, &keymanagement.GetProviderConfigRequest{
+		//nolint:staticcheck // exercises the deprecated Manager field, which must keep validating until it is removed
 		Manager: basicManager,
 	})
 	s.Require().Error(err)

service/integration/main_test.go

@@ -97,7 +97,6 @@ func TestMain(m *testing.M) {
 		Started: true,
 	}
 
-	//nolint:sloglint // emoji
 	slog.Info("📀 starting postgres container")
 	postgres, err := tc.GenericContainer(context.Background(), req)
 	if err != nil {
@@ -125,7 +124,6 @@ func TestMain(m *testing.M) {
 
 	conf.DB.Port = int(port.Num())
 
-	//nolint:sloglint // emoji
 	slog.Info("🏠 loading fixtures")
 	fixtures.LoadFixtureData("../internal/fixtures/policy_fixtures.yaml")
 

service/internal/access/v2/evaluate.go

@@ -415,11 +415,11 @@ func hierarchyRule(
 				if isRequestedActionMatch(ctx, l, action, requiredNamespaceFQN, entitledAction, namespacedPolicy) {
 					l.DebugContext(ctx, "hierarchy rule satisfied",
 						slog.Group("entitled_by_value",
-							slog.String("FQN", entitlementFQN),
+							slog.String("fqn", entitlementFQN),
 							slog.Int("index", idx),
 						),
 						slog.Group("resource_highest_hierarchy_value",
-							slog.String("FQN", attrValues[lowestValueFQNIndex].GetFqn()),
+							slog.String("fqn", attrValues[lowestValueFQNIndex].GetFqn()),
 							slog.Int("index", lowestValueFQNIndex),
 						),
 					)

service/internal/auth/authn.go

@@ -491,7 +491,9 @@ func (a Authentication) MuxHandler(handler http.Handler) http.Handler {
 			return
 		}
 
-		dp := r.Header.Values("Dpop")
+		// The proofs are attacker-controlled request headers, so only their count is
+		// ever logged; logging the values verbatim trips CodeQL go/clear-text-logging.
+		dp := r.Header.Values("DPoP")
 		log := a.logger
 
 		// Verify the token
@@ -536,7 +538,7 @@ func (a Authentication) MuxHandler(handler http.Handler) http.Handler {
 					ctxWithAuthX,
 					"unauthenticated",
 					slog.Any("error", err),
-					slog.Any("dpop", dp),
+					slog.Int("dpop_proof_count", len(dp)),
 				)
 				http.Error(w, "unauthenticated", http.StatusUnauthorized)
 				return
@@ -545,7 +547,7 @@ func (a Authentication) MuxHandler(handler http.Handler) http.Handler {
 				ctxWithAuthX,
 				"unauthenticated",
 				slog.Any("error", err),
-				slog.Any("dpop", dp),
+				slog.Int("dpop_proof_count", len(dp)),
 			)
 			http.Error(w, "unauthenticated", http.StatusUnauthorized)
 			return

service/internal/auth/authz/casbin/v1/authorizer.go

@@ -40,7 +40,7 @@ func NewAuthorizer(cfg authz.CasbinV1Config, log *logger.Logger) (*Authorizer, e
 	log.Info(
 		"casbin authorizer initialized",
 		slog.String("version", authorizer.Version()),
-		slog.Bool("supportsResourceAuth", authorizer.SupportsResourceAuthorization()),
+		slog.Bool("supports_resource_auth", authorizer.SupportsResourceAuthorization()),
 	)
 
 	return authorizer, nil

service/internal/auth/authz/casbin/v1/enforcer.go

@@ -106,10 +106,10 @@ func newCasbinEnforcer(c casbinConfig, logger *logger.Logger) (*Enforcer, error)
 	logger.Debug(
 		"creating casbin enforcer",
 		slog.Any("config", c),
-		slog.Bool("isDefaultModel", isDefaultModel),
-		slog.Bool("isBuiltinPolicy", isDefaultPolicy),
-		slog.Bool("isPolicyExtended", isPolicyExtended),
-		slog.Bool("isDefaultAdapter", isDefaultAdapter),
+		slog.Bool("is_default_model", isDefaultModel),
+		slog.Bool("is_builtin_policy", isDefaultPolicy),
+		slog.Bool("is_policy_extended", isPolicyExtended),
+		slog.Bool("is_default_adapter", isDefaultAdapter),
 	)
 
 	m, err := casbinModel.NewModelFromString(c.Model)

service/internal/auth/authz/casbin/v2/authorizer.go

@@ -98,7 +98,7 @@ func NewAuthorizer(cfg authz.CasbinV2Config, log *logger.Logger) (*Authorizer, e
 	log.Info(
 		"casbin authorizer initialized",
 		slog.String("version", authorizer.Version()),
-		slog.Bool("supportsResourceAuth", authorizer.SupportsResourceAuthorization()),
+		slog.Bool("supports_resource_auth", authorizer.SupportsResourceAuthorization()),
 	)
 
 	return authorizer, nil