fix(core): do not concat slashes directly in url/file paths

[jakedoublev]

Proposed Changes

• Run pathconcat custom linter on the codebase and fix findings

Checklist

• I have added or updated unit tests
• I have added or updated integration tests (if appropriate)
• I have added or updated documentation

Testing Instructions

Summary by CodeRabbit

• Bug Fixes
  • Improved path construction handling in code generation to properly manage path separators.
  • Enhanced authentication interceptor with proper path validation and error handling for invalid procedure paths.

[gemini-code-assist]

Summary of Changes

Hello, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request addresses potential issues related to manual path concatenation throughout the codebase. By adopting standard library functions for joining paths, the changes improve code robustness and ensure compliance with internal linting standards regarding path construction.

Highlights

• Path Concatenation Improvements: Replaced manual string concatenation of paths with safer alternatives like path.Join and url.JoinPath to prevent malformed path issues.
• Linter Compliance: Applied findings from the custom pathconcat linter across the codebase, adding necessary nolint annotations where manual concatenation was intentional for non-path strings.

🧠 New Feature in Public Preview: You can now enable Memory to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	/gemini review	Performs a code review for the current pull request in its current state.
Pull Request Summary	/gemini summary	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	/gemini help	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here.

---

Paths joined with care and with grace, / No slashes misplaced in the space. / With JoinPath we mend, / The bugs that we send, / And keep all the code in its place.

Footnotes

1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

[coderabbitai]

Warning

Rate limit exceeded

@jakedoublev has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 23 minutes and 12 seconds before requesting another review.

Your organization is not enrolled in usage-based pricing. Contact your admin to enable usage-based pricing to continue reviews beyond the rate limit, or try again in 23 minutes and 12 seconds.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: a4c7b39b-08c1-4c29-b802-418ee7ffcd8b

📥 Commits

Reviewing files that changed from the base of the PR and between 1e2c697 and bb60238.

📒 Files selected for processing (1)

• service/internal/auth/authn.go

📝 Walkthrough

Walkthrough

Path string construction methods are updated across two modules: code generation now uses path.Join() for package paths, and authentication interceptor uses url.JoinPath() with error handling for RPC resource paths, replacing earlier string concatenation approaches.

Changes

Cohort / File(s)	Summary
Path Construction Updates sdk/codegen/runner/generate.go, service/internal/auth/authn.go	Updated path construction from string concatenation: generator uses path.Join() for package paths; authentication interceptor uses url.JoinPath() with error handling for RPC resource paths, terminating with internal error on join failure.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~8 minutes

Poem

🐰 Paths now join with care and grace,
No more concat in their place,
Errors caught before they hide,
Clean construction, verified—hooray! ✨

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title directly matches the main changes: replacing direct slash concatenation with proper path-joining functions in both URL and file paths.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/pathconcat-findings

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[github-actions]

X-Test Failure Report

govulncheck-failure-4

[gemini-code-assist]

Code Review

This pull request replaces manual path concatenation with standard library functions like path.Join and url.JoinPath to improve path handling safety across the SDK and internal services. In service/internal/auth/authn.go, a potential runtime panic was identified where slice indices are accessed without length verification, and it was suggested to use path.Join instead of url.JoinPath to avoid unnecessary URL encoding.

[github-actions]

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	181.056358ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	94.713637ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	424.58743ms
Throughput	235.52 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	40.185884044s
Average Latency	400.19318ms
Throughput	124.42 requests/second

[github-actions]

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	204.566863ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	99.105028ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	385.944874ms
Throughput	259.10 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	41.908065414s
Average Latency	417.546509ms
Throughput	119.31 requests/second

[github-actions]

X-Test Failure Report

cukes-report
opentdfplatformJMU46I.dockerbuild
govulncheck-failure-0
govulncheck-failure-2
govulncheck-failure-7
govulncheck-failure-4
govulncheck-failure-1

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@service/internal/auth/authn.go`:
- Around line 352-355: The code dereferences p[1] and p[2] before ensuring the
split produced enough parts, which can panic for a malformed
req.Spec().Procedure; update the logic around url.JoinPath so you first check
the length of the slice (e.g., if len(p) < 3) and return a clear
connect.NewError(connect.CodeInvalidArgument, fmt.Errorf("invalid procedure
format")) (or similar) instead of indexing into p, then call url.JoinPath(p[1],
p[2]); reference the variables/expressions p, url.JoinPath and
req.Spec().Procedure to locate the change and keep the existing error-return
style.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: c47e08ce-a297-4d8a-b67f-3270a6a7b7fd

📥 Commits

Reviewing files that changed from the base of the PR and between 8c4b05e and 1e2c697.

📒 Files selected for processing (2)

• sdk/codegen/runner/generate.go
• service/internal/auth/authn.go

[github-actions]

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	211.493888ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	98.602287ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	405.106901ms
Throughput	246.85 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	40.188829124s
Average Latency	400.547271ms
Throughput	124.41 requests/second

[github-actions]

⚠️ Govulncheck found vulnerabilities ⚠️

The following modules have known vulnerabilities:

• examples
• sdk
• service
• lib/fixtures
• tests-bdd

See the workflow run for details.

[alkalescent]

lgtm

[github-actions]

X-Test Results

✅ go-pull-3290
✅ java-pull-3290
✅ go-v0.9.0
✅ js-pull-3290
✅ java-v0.9.0
✅ js-v0.9.0
cukes-report
opentdfplatformRWFM7Q.dockerbuild
govulncheck-failure-1
govulncheck-failure-7
govulncheck-failure-2
govulncheck-failure-0
govulncheck-failure-4