{"record":{"id":"a1c9c73fc07b5050","repo":"gofr-dev/gofr","slug":"validate-func-is-empty","errorCode":null,"errorMessage":"validate func is empty","messagePattern":"validate func is empty","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/gofr/http/middleware/auth.go","lineNumber":30,"sourceCode":"\n// AuthMethod represents a custom type to define the different authentication methods supported.\ntype AuthMethod int\n\nconst (\n\tJWTClaim AuthMethod = iota // JWTClaim represents the key used to store JWT claims within the request context.\n\tUsername\n\tAPIKey\n\n\t// #nosec G101\n\theaderXAPIKey       = \"X-Api-Key\"\n\theaderAuthorization = \"Authorization\"\n\n\tdummyValue = \"dummy\"\n)\n\nvar (\n\terrContainerNil      = errors.New(\"container is nil\")\n\terrValidateFuncEmpty = errors.New(\"validate func is empty\")\n)\n\n// AuthHeaders returns the request header names GoFr's authentication middleware reads. It is the\n// single source of truth for callers that must forward a request's identity — e.g. the MCP server\n// re-dispatching a tool call through the router.\nfunc AuthHeaders() []string {\n\treturn []string{headerAuthorization, headerXAPIKey}\n}\n\ntype AuthProvider interface {\n\tGetAuthMethod() AuthMethod\n\tExtractAuthHeader(r *http.Request) (any, ErrorHTTP)\n}\n\n// AuthMiddleware creates a middleware function that enforces authentication based on the method provided.\nfunc AuthMiddleware(a AuthProvider) func(handler http.Handler) http.Handler {\n\treturn func(handler http.Handler) http.Handler {\n\t\treturn http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {","sourceCodeStart":12,"sourceCodeEnd":48,"githubUrl":"https://github.com/gofr-dev/gofr/blob/187eb24962502e91f1fee856230670958b66e89c/pkg/gofr/http/middleware/auth.go#L12-L48","documentation":"errValidateFuncEmpty is returned by NewAPIKeyAuthProviderWithValidateFunc and NewBasicAuthProviderWithValidateFunc when the provided validate callback is nil. Without a validation function the provider has no way to decide whether credentials are valid, so construction fails immediately. It is a programming/config error at setup time.","triggerScenarios":"Calling NewAPIKeyAuthProviderWithValidateFunc(c, nil) or NewBasicAuthProviderWithValidateFunc(c, nil), e.g. when the callback is conditionally assigned and ends up nil.","commonSituations":"Function variables resolved from config/flags that were never set, refactors that removed the assignment, or test scaffolding that forgot to inject a stub validator.","solutions":["Pass a non-nil validation function to the constructor","If the validator is dynamic, initialize a default implementation before wiring middleware","Assert the function is non-nil at startup; fail fast with a clear log message","Add a test covering the constructor with your real validator wiring"],"exampleFix":"// before\nvar validate func(c *container.Container, user, pass string) bool\nprovider, _ := middleware.NewBasicAuthProviderWithValidateFunc(c, validate) // errValidateFuncEmpty\n// after\nvalidate := func(c *container.Container, user, pass string) bool {\n    return c != nil && checkCredentials(user, pass)\n}\nprovider, err := middleware.NewBasicAuthProviderWithValidateFunc(c, validate)","handlingStrategy":"validation","validationCode":"if validateFunc == nil {\n    return errors.New(\"validate func must be provided to auth provider constructor\")\n}","typeGuard":"func hasValidator(fn func(*container.Container, string, string) bool) bool { return fn != nil }","tryCatchPattern":"provider, err := middleware.NewAPIKeyAuthProviderWithValidateFunc(c, fn)\nif err != nil {\n    if errors.Is(err, middleware.ErrValidateFuncEmpty) {\n        log.Fatal(\"no validate function wired for auth provider\")\n    }\n    return err\n}","preventionTips":["Always pass a concrete validator implementation; never a conditionally-nil variable","Define default validators as package constants so they can't be nil","Review function-typed config fields for nil defaults","Cover constructor wiring in unit tests"],"tags":["auth","validation","config","gofr"],"backgroundTag":"missing-validation-callback","analyzedSha":"187eb24962502e91f1fee856230670958b66e89c","analyzedAt":"2026-09-01T20:34:54.554Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}