Linter fixes PR 3 (#4415)

* Linter fixes

* fix(bsr): update test to register TEST protocol once

---------

Co-authored-by: Damian Debkowski <damian.debkowski@hashicorp.com>

.golangci.yml

@@ -3,6 +3,9 @@ linters:
   enable:
     - staticcheck
     - stylecheck
+    - errcheck
+    - misspell
+    - bodyclose
 
 issues:
   exclude-rules:

api/accounts/option.gen.go

@@ -14,7 +14,7 @@ import (
 // to be used directly, but instead option arguments are built from the
 // functions in this package. WithX options set a value to that given in the
 // argument; DefaultX options indicate that the value should be set to its
-// default. When an API call is made options are processed in ther order they
+// default. When an API call is made options are processed in the order they
 // appear in the function call, so for a given argument X, a succession of WithX
 // or DefaultX calls will result in the last call taking effect.
 type Option func(*options)

api/authmethods/option.gen.go

@@ -15,7 +15,7 @@ import (
 // to be used directly, but instead option arguments are built from the
 // functions in this package. WithX options set a value to that given in the
 // argument; DefaultX options indicate that the value should be set to its
-// default. When an API call is made options are processed in ther order they
+// default. When an API call is made options are processed in the order they
 // appear in the function call, so for a given argument X, a succession of WithX
 // or DefaultX calls will result in the last call taking effect.
 type Option func(*options)

api/authtokens/option.gen.go

@@ -15,7 +15,7 @@ import (
 // to be used directly, but instead option arguments are built from the
 // functions in this package. WithX options set a value to that given in the
 // argument; DefaultX options indicate that the value should be set to its
-// default. When an API call is made options are processed in ther order they
+// default. When an API call is made options are processed in the order they
 // appear in the function call, so for a given argument X, a succession of WithX
 // or DefaultX calls will result in the last call taking effect.
 type Option func(*options)

api/credentiallibraries/option.gen.go

@@ -14,7 +14,7 @@ import (
 // to be used directly, but instead option arguments are built from the
 // functions in this package. WithX options set a value to that given in the
 // argument; DefaultX options indicate that the value should be set to its
-// default. When an API call is made options are processed in ther order they
+// default. When an API call is made options are processed in the order they
 // appear in the function call, so for a given argument X, a succession of WithX
 // or DefaultX calls will result in the last call taking effect.
 type Option func(*options)

api/credentials/option.gen.go

@@ -14,7 +14,7 @@ import (
 // to be used directly, but instead option arguments are built from the
 // functions in this package. WithX options set a value to that given in the
 // argument; DefaultX options indicate that the value should be set to its
-// default. When an API call is made options are processed in ther order they
+// default. When an API call is made options are processed in the order they
 // appear in the function call, so for a given argument X, a succession of WithX
 // or DefaultX calls will result in the last call taking effect.
 type Option func(*options)

api/credentialstores/option.gen.go

@@ -15,7 +15,7 @@ import (
 // to be used directly, but instead option arguments are built from the
 // functions in this package. WithX options set a value to that given in the
 // argument; DefaultX options indicate that the value should be set to its
-// default. When an API call is made options are processed in ther order they
+// default. When an API call is made options are processed in the order they
 // appear in the function call, so for a given argument X, a succession of WithX
 // or DefaultX calls will result in the last call taking effect.
 type Option func(*options)

api/groups/option.gen.go

@@ -15,7 +15,7 @@ import (
 // to be used directly, but instead option arguments are built from the
 // functions in this package. WithX options set a value to that given in the
 // argument; DefaultX options indicate that the value should be set to its
-// default. When an API call is made options are processed in ther order they
+// default. When an API call is made options are processed in the order they
 // appear in the function call, so for a given argument X, a succession of WithX
 // or DefaultX calls will result in the last call taking effect.
 type Option func(*options)

api/hostcatalogs/option.gen.go

@@ -16,7 +16,7 @@ import (
 // to be used directly, but instead option arguments are built from the
 // functions in this package. WithX options set a value to that given in the
 // argument; DefaultX options indicate that the value should be set to its
-// default. When an API call is made options are processed in ther order they
+// default. When an API call is made options are processed in the order they
 // appear in the function call, so for a given argument X, a succession of WithX
 // or DefaultX calls will result in the last call taking effect.
 type Option func(*options)

api/hosts/option.gen.go

@@ -14,7 +14,7 @@ import (
 // to be used directly, but instead option arguments are built from the
 // functions in this package. WithX options set a value to that given in the
 // argument; DefaultX options indicate that the value should be set to its
-// default. When an API call is made options are processed in ther order they
+// default. When an API call is made options are processed in the order they
 // appear in the function call, so for a given argument X, a succession of WithX
 // or DefaultX calls will result in the last call taking effect.
 type Option func(*options)

api/hostsets/option.gen.go

@@ -14,7 +14,7 @@ import (
 // to be used directly, but instead option arguments are built from the
 // functions in this package. WithX options set a value to that given in the
 // argument; DefaultX options indicate that the value should be set to its
-// default. When an API call is made options are processed in ther order they
+// default. When an API call is made options are processed in the order they
 // appear in the function call, so for a given argument X, a succession of WithX
 // or DefaultX calls will result in the last call taking effect.
 type Option func(*options)

api/managedgroups/option.gen.go

@@ -14,7 +14,7 @@ import (
 // to be used directly, but instead option arguments are built from the
 // functions in this package. WithX options set a value to that given in the
 // argument; DefaultX options indicate that the value should be set to its
-// default. When an API call is made options are processed in ther order they
+// default. When an API call is made options are processed in the order they
 // appear in the function call, so for a given argument X, a succession of WithX
 // or DefaultX calls will result in the last call taking effect.
 type Option func(*options)

api/policies/option.gen.go

@@ -15,7 +15,7 @@ import (
 // to be used directly, but instead option arguments are built from the
 // functions in this package. WithX options set a value to that given in the
 // argument; DefaultX options indicate that the value should be set to its
-// default. When an API call is made options are processed in ther order they
+// default. When an API call is made options are processed in the order they
 // appear in the function call, so for a given argument X, a succession of WithX
 // or DefaultX calls will result in the last call taking effect.
 type Option func(*options)

api/roles/option.gen.go

@@ -15,7 +15,7 @@ import (
 // to be used directly, but instead option arguments are built from the
 // functions in this package. WithX options set a value to that given in the
 // argument; DefaultX options indicate that the value should be set to its
-// default. When an API call is made options are processed in ther order they
+// default. When an API call is made options are processed in the order they
 // appear in the function call, so for a given argument X, a succession of WithX
 // or DefaultX calls will result in the last call taking effect.
 type Option func(*options)

api/scopes/option.gen.go

@@ -16,7 +16,7 @@ import (
 // to be used directly, but instead option arguments are built from the
 // functions in this package. WithX options set a value to that given in the
 // argument; DefaultX options indicate that the value should be set to its
-// default. When an API call is made options are processed in ther order they
+// default. When an API call is made options are processed in the order they
 // appear in the function call, so for a given argument X, a succession of WithX
 // or DefaultX calls will result in the last call taking effect.
 type Option func(*options)

api/sessionrecordings/option.gen.go

@@ -14,7 +14,7 @@ import (
 // to be used directly, but instead option arguments are built from the
 // functions in this package. WithX options set a value to that given in the
 // argument; DefaultX options indicate that the value should be set to its
-// default. When an API call is made options are processed in ther order they
+// default. When an API call is made options are processed in the order they
 // appear in the function call, so for a given argument X, a succession of WithX
 // or DefaultX calls will result in the last call taking effect.
 type Option func(*options)

api/sessions/option.gen.go

@@ -16,7 +16,7 @@ import (
 // to be used directly, but instead option arguments are built from the
 // functions in this package. WithX options set a value to that given in the
 // argument; DefaultX options indicate that the value should be set to its
-// default. When an API call is made options are processed in ther order they
+// default. When an API call is made options are processed in the order they
 // appear in the function call, so for a given argument X, a succession of WithX
 // or DefaultX calls will result in the last call taking effect.
 type Option func(*options)

api/storagebuckets/option.gen.go

@@ -16,7 +16,7 @@ import (
 // to be used directly, but instead option arguments are built from the
 // functions in this package. WithX options set a value to that given in the
 // argument; DefaultX options indicate that the value should be set to its
-// default. When an API call is made options are processed in ther order they
+// default. When an API call is made options are processed in the order they
 // appear in the function call, so for a given argument X, a succession of WithX
 // or DefaultX calls will result in the last call taking effect.
 type Option func(*options)

api/targets/option.gen.go

@@ -15,7 +15,7 @@ import (
 // to be used directly, but instead option arguments are built from the
 // functions in this package. WithX options set a value to that given in the
 // argument; DefaultX options indicate that the value should be set to its
-// default. When an API call is made options are processed in ther order they
+// default. When an API call is made options are processed in the order they
 // appear in the function call, so for a given argument X, a succession of WithX
 // or DefaultX calls will result in the last call taking effect.
 type Option func(*options)

api/users/option.gen.go

@@ -15,7 +15,7 @@ import (
 // to be used directly, but instead option arguments are built from the
 // functions in this package. WithX options set a value to that given in the
 // argument; DefaultX options indicate that the value should be set to its
-// default. When an API call is made options are processed in ther order they
+// default. When an API call is made options are processed in the order they
 // appear in the function call, so for a given argument X, a succession of WithX
 // or DefaultX calls will result in the last call taking effect.
 type Option func(*options)

api/workers/option.gen.go

@@ -15,7 +15,7 @@ import (
 // to be used directly, but instead option arguments are built from the
 // functions in this package. WithX options set a value to that given in the
 // argument; DefaultX options indicate that the value should be set to its
-// default. When an API call is made options are processed in ther order they
+// default. When an API call is made options are processed in the order they
 // appear in the function call, so for a given argument X, a succession of WithX
 // or DefaultX calls will result in the last call taking effect.
 type Option func(*options)

internal/api/genapi/templates.go

@@ -831,7 +831,7 @@ import (
 // to be used directly, but instead option arguments are built from the
 // functions in this package. WithX options set a value to that given in the
 // argument; DefaultX options indicate that the value should be set to its
-// default. When an API call is made options are processed in ther order they
+// default. When an API call is made options are processed in the order they
 // appear in the function call, so for a given argument X, a succession of WithX
 // or DefaultX calls will result in the last call taking effect.
 type Option func(*options)

internal/auth/ldap/service_list_managed_groups_ext_test.go

@@ -532,11 +532,11 @@ func TestService_ListManagedGroups(t *testing.T) {
 		mg2 := ldap.TestManagedGroup(t, conn, authMethod, testGrpNames)
 		mg3 := ldap.TestManagedGroup(t, conn, authMethod, testGrpNames)
 		t.Cleanup(func() {
-			repo.DeleteManagedGroup(ctx, org.GetPublicId(), mg1.GetPublicId())
+			_, err = repo.DeleteManagedGroup(ctx, org.GetPublicId(), mg1.GetPublicId())
 			require.NoError(t, err)
-			repo.DeleteManagedGroup(ctx, org.GetPublicId(), mg2.GetPublicId())
+			_, err = repo.DeleteManagedGroup(ctx, org.GetPublicId(), mg2.GetPublicId())
 			require.NoError(t, err)
-			repo.DeleteManagedGroup(ctx, org.GetPublicId(), mg3.GetPublicId())
+			_, err = repo.DeleteManagedGroup(ctx, org.GetPublicId(), mg3.GetPublicId())
 			require.NoError(t, err)
 			// Run analyze to update count estimate
 			_, err = sqlDb.ExecContext(ctx, "analyze")

internal/auth/oidc/account_test.go

@@ -53,11 +53,11 @@ func TestAccount_Create(t *testing.T) {
 			args: args{
 				authMethodId: testAuthMethod.PublicId,
 				subject:      "alice",
-				opts:         []Option{WithIssuer(TestConvertToUrls(t, "https://alice.com")[0]), WithEmail("alice@alice.com"), WithFullName("Alice Eve Smith"), WithName("alice's restuarant"), WithDescription("A good place to eat")},
+				opts:         []Option{WithIssuer(TestConvertToUrls(t, "https://alice.com")[0]), WithEmail("alice@alice.com"), WithFullName("Alice Eve Smith"), WithName("alice's restaurant"), WithDescription("A good place to eat")},
 			},
 			create: true,
 			want: func() *Account {
-				want, err := NewAccount(ctx, testAuthMethod.PublicId, "alice", WithIssuer(TestConvertToUrls(t, "https://alice.com")[0]), WithEmail("alice@alice.com"), WithFullName("Alice Eve Smith"), WithName("alice's restuarant"), WithDescription("A good place to eat"))
+				want, err := NewAccount(ctx, testAuthMethod.PublicId, "alice", WithIssuer(TestConvertToUrls(t, "https://alice.com")[0]), WithEmail("alice@alice.com"), WithFullName("Alice Eve Smith"), WithName("alice's restaurant"), WithDescription("A good place to eat"))
 				require.NoError(t, err)
 				return want
 			}(),
@@ -67,11 +67,11 @@ func TestAccount_Create(t *testing.T) {
 			args: args{
 				authMethodId: testAuthMethod.PublicId,
 				subject:      "alice",
-				opts:         []Option{WithIssuer(TestConvertToUrls(t, "https://alice.com")[0]), WithEmail("alice@alice.com"), WithFullName("Alice Eve Smith"), WithName("alice's restuarant"), WithDescription("A good place to eat")},
+				opts:         []Option{WithIssuer(TestConvertToUrls(t, "https://alice.com")[0]), WithEmail("alice@alice.com"), WithFullName("Alice Eve Smith"), WithName("alice's restaurant"), WithDescription("A good place to eat")},
 			},
 			create: true,
 			want: func() *Account {
-				want, err := NewAccount(ctx, testAuthMethod.PublicId, "alice", WithIssuer(TestConvertToUrls(t, "https://alice.com")[0]), WithEmail("alice@alice.com"), WithFullName("Alice Eve Smith"), WithName("alice's restuarant"), WithDescription("A good place to eat"))
+				want, err := NewAccount(ctx, testAuthMethod.PublicId, "alice", WithIssuer(TestConvertToUrls(t, "https://alice.com")[0]), WithEmail("alice@alice.com"), WithFullName("Alice Eve Smith"), WithName("alice's restaurant"), WithDescription("A good place to eat"))
 				require.NoError(t, err)
 				return want
 			}(),

internal/auth/oidc/repository_auth_method_operational_state.go

@@ -13,7 +13,7 @@ import (
 	"github.com/hashicorp/boundary/internal/oplog"
 )
 
-// MakeInactive will transision an OIDC auth method from either the
+// MakeInactive will transition an OIDC auth method from either the
 // ActivePrivateState or the ActivePublicState to the InactiveState.
 // No options are supported.
 func (r *Repository) MakeInactive(ctx context.Context, authMethodId string, version uint32, _ ...Option) (*AuthMethod, error) {
@@ -25,7 +25,7 @@ func (r *Repository) MakeInactive(ctx context.Context, authMethodId string, vers
 	return updated, nil
 }
 
-// MakePrivate will transision an OIDC auth method from either the
+// MakePrivate will transition an OIDC auth method from either the
 // InactiveState or the ActivePublicState to the ActivePrivateState.  If
 // transitioning from the InactiveState, the transition will only succeed if
 // the auth method is complete and the oidc.ValidateAuthMethod(...) succeeds.
@@ -40,7 +40,7 @@ func (r *Repository) MakePrivate(ctx context.Context, authMethodId string, versi
 	return updated, nil
 }
 
-// MakePublic will transision an OIDC auth method from either the
+// MakePublic will transition an OIDC auth method from either the
 // InactiveState or the ActivePrivateState to the ActivePublicState.  If
 // transitioning from the InactiveState, the transition will only succeed if
 // the auth method is complete and the oidc.ValidateAuthMethod(...) succeeds.

internal/auth/oidc/repository_auth_method_update.go

@@ -804,5 +804,8 @@ func pingEndpoint(ctx context.Context, client HTTPClient, endpointType, method,
 	if err != nil {
 		return 0, errors.New(ctx, errors.Unknown, op, fmt.Sprintf("request to %s endpoint failed", endpointType), errors.WithWrap(err))
 	}
+	if resp.Body != nil {
+		resp.Body.Close()
+	}
 	return resp.StatusCode, nil
 }

internal/auth/oidc/repository_managed_group_members_test.go

@@ -86,7 +86,7 @@ func Test_ManagedGroupMemberships(t *testing.T) {
 
 	tests := []struct {
 		name string
-		// If true, we will auto populate necesary values into the function
+		// If true, we will auto populate necessary values into the function
 		validPrereqs bool
 
 		// Else these can be used for testing

internal/auth/oidc/service_list_accounts_ext_test.go

@@ -453,9 +453,9 @@ func TestService_ListAccounts(t *testing.T) {
 		account1 := oidc.TestAccount(t, conn, authMethod, "new-success")
 		account2 := oidc.TestAccount(t, conn, authMethod, "new-success2")
 		t.Cleanup(func() {
-			repo.DeleteAccount(ctx, org.GetPublicId(), account1.GetPublicId())
+			_, err = repo.DeleteAccount(ctx, org.GetPublicId(), account1.GetPublicId())
 			require.NoError(t, err)
-			repo.DeleteAccount(ctx, org.GetPublicId(), account2.GetPublicId())
+			_, err = repo.DeleteAccount(ctx, org.GetPublicId(), account2.GetPublicId())
 			require.NoError(t, err)
 			// Run analyze to update count estimate
 			_, err = sqlDb.ExecContext(ctx, "analyze")
@@ -535,11 +535,11 @@ func TestService_ListAccounts(t *testing.T) {
 		account2 := oidc.TestAccount(t, conn, authMethod, "new-success2")
 		account3 := oidc.TestAccount(t, conn, authMethod, "new-success3")
 		t.Cleanup(func() {
-			repo.DeleteAccount(ctx, org.GetPublicId(), account1.GetPublicId())
+			_, err = repo.DeleteAccount(ctx, org.GetPublicId(), account1.GetPublicId())
 			require.NoError(t, err)
-			repo.DeleteAccount(ctx, org.GetPublicId(), account2.GetPublicId())
+			_, err = repo.DeleteAccount(ctx, org.GetPublicId(), account2.GetPublicId())
 			require.NoError(t, err)
-			repo.DeleteAccount(ctx, org.GetPublicId(), account3.GetPublicId())
+			_, err = repo.DeleteAccount(ctx, org.GetPublicId(), account3.GetPublicId())
 			require.NoError(t, err)
 			// Run analyze to update count estimate
 			_, err = sqlDb.ExecContext(ctx, "analyze")

internal/auth/oidc/service_list_managed_groups_ext_test.go

@@ -456,9 +456,9 @@ func TestService_ListManagedGroups(t *testing.T) {
 		mg1 := oidc.TestManagedGroup(t, conn, authMethod, oidc.TestFakeManagedGroupFilter)
 		mg2 := oidc.TestManagedGroup(t, conn, authMethod, oidc.TestFakeManagedGroupFilter)
 		t.Cleanup(func() {
-			repo.DeleteManagedGroup(ctx, org.GetPublicId(), mg1.GetPublicId())
+			_, err := repo.DeleteManagedGroup(ctx, org.GetPublicId(), mg1.GetPublicId())
 			require.NoError(t, err)
-			repo.DeleteManagedGroup(ctx, org.GetPublicId(), mg2.GetPublicId())
+			_, err = repo.DeleteManagedGroup(ctx, org.GetPublicId(), mg2.GetPublicId())
 			require.NoError(t, err)
 			// Run analyze to update count estimate
 			_, err = sqlDb.ExecContext(ctx, "analyze")

internal/auth/options.go

@@ -9,7 +9,7 @@ import (
 	"github.com/hashicorp/boundary/internal/pagination"
 )
 
-// The option type is how options are passed as arugments
+// The option type is how options are passed as arguments
 type Option func(*Options) error
 
 // Options is a struct that contains all the possible auth options

internal/authtoken/authtoken_test.go

@@ -21,7 +21,7 @@ import (
 )
 
 // This file contains tests for methods defined in authtoken.go as well as tests which exercise the db
-// functionality directly without going through the respository.  Repository centric tests should be
+// functionality directly without going through the repository.  Repository centric tests should be
 // placed in repository_test.go
 
 func TestAuthToken_DbUpdate(t *testing.T) {

internal/bsr/bsr_open_test.go

@@ -79,27 +79,11 @@ func TestPopulateMeta(t *testing.T) {
 
 func TestOpenBSRMethods(t *testing.T) {
 	ctx := context.Background()
-
-	protocol := Protocol("TEST")
+	protocol := TestRegisterSummaryAllocFunc(t)
 
 	keys, err := kms.CreateKeys(ctx, kms.TestWrapper(t), "session")
 	require.NoError(t, err)
 
-	err = RegisterSummaryAllocFunc(protocol, ChannelContainer, func(ctx context.Context) Summary {
-		return &BaseChannelSummary{Id: "TEST_CHANNEL_ID", ConnectionRecordingId: "TEST_CONNECTION_RECORDING_ID"}
-	})
-	require.NoError(t, err)
-
-	err = RegisterSummaryAllocFunc(protocol, SessionContainer, func(ctx context.Context) Summary {
-		return &BaseSessionSummary{Id: "TEST_SESSION_ID", ConnectionCount: 1}
-	})
-	require.NoError(t, err)
-
-	err = RegisterSummaryAllocFunc(protocol, ConnectionContainer, func(ctx context.Context) Summary {
-		return &BaseConnectionSummary{Id: "TEST_CONNECTION_ID", ChannelCount: 1}
-	})
-	require.NoError(t, err)
-
 	f := &fstest.MemFS{}
 	sessionId := "s_01234567890"
 	srm := &SessionRecordingMeta{
@@ -473,7 +457,7 @@ func TestOpenBSRMethods_WithoutSummaryAllocFunc(t *testing.T) {
 func TestCloseBSRMethods(t *testing.T) {
 	ctx := context.Background()
 
-	protocol := Protocol("TEST_CLOSED_FILE")
+	protocol := TestRegisterSummaryAllocFunc(t)
 	sessionRecordingId := "sr_012344567890"
 	sessionId := "s_012344567890"
 	connectionId := "connection"
@@ -482,21 +466,6 @@ func TestCloseBSRMethods(t *testing.T) {
 	keys, err := kms.CreateKeys(ctx, kms.TestWrapper(t), "session")
 	require.NoError(t, err)
 
-	err = RegisterSummaryAllocFunc(protocol, ChannelContainer, func(ctx context.Context) Summary {
-		return &BaseChannelSummary{Id: channelId, ConnectionRecordingId: connectionId}
-	})
-	require.NoError(t, err)
-
-	err = RegisterSummaryAllocFunc(protocol, SessionContainer, func(ctx context.Context) Summary {
-		return &BaseSessionSummary{Id: sessionId, ConnectionCount: 1}
-	})
-	require.NoError(t, err)
-
-	err = RegisterSummaryAllocFunc(protocol, ConnectionContainer, func(ctx context.Context) Summary {
-		return &BaseConnectionSummary{Id: connectionId, ChannelCount: 1}
-	})
-	require.NoError(t, err)
-
 	f := fstest.NewMemFS(fstest.WithOriginalFile())
 
 	srm := &SessionRecordingMeta{

internal/bsr/bsr_validate_test.go

@@ -23,23 +23,8 @@ func TestBSR_Validate_ValidateBSR(t *testing.T) {
 	connectionId := "test_connection"
 	channelId := "test_channel"
 	sessionId := "s_01234567881"
-	protocol := Protocol("TEST_VALIDATE_BSR_PROTOCOL")
 	fs := &fstest.MemFS{}
-
-	err := RegisterSummaryAllocFunc(protocol, ChannelContainer, func(ctx context.Context) Summary {
-		return &BaseChannelSummary{Id: "chr_123456789", ConnectionRecordingId: connectionId}
-	})
-	require.NoError(t, err)
-
-	err = RegisterSummaryAllocFunc(protocol, SessionContainer, func(ctx context.Context) Summary {
-		return &BaseSessionSummary{Id: "s_123456789", ConnectionCount: 1}
-	})
-	require.NoError(t, err)
-
-	err = RegisterSummaryAllocFunc(protocol, ConnectionContainer, func(ctx context.Context) Summary {
-		return &BaseConnectionSummary{Id: "cr_123456789", ChannelCount: 1}
-	})
-	require.NoError(t, err)
+	protocol := TestRegisterSummaryAllocFunc(t)
 
 	// Setup keys
 	keys, err := kms.CreateKeys(ctx, kms.TestWrapper(t), sessionId)
@@ -406,25 +391,9 @@ func TestBSR_Validate_ValidateBSR(t *testing.T) {
 func TestBSR_Validate_ValidateContainer(t *testing.T) {
 	ctx := context.Background()
 
-	protocol := Protocol("TEST_VALIDATE_CONTAINER_PROTOCOL")
-	connectionId := "test_connection"
 	channelId := "chr_123456789"
 	sessionId := "s_01234567881"
-
-	err := RegisterSummaryAllocFunc(protocol, ChannelContainer, func(ctx context.Context) Summary {
-		return &BaseChannelSummary{Id: channelId, ConnectionRecordingId: connectionId}
-	})
-	require.NoError(t, err)
-
-	err = RegisterSummaryAllocFunc(protocol, SessionContainer, func(ctx context.Context) Summary {
-		return &BaseSessionSummary{Id: sessionId, ConnectionCount: 1}
-	})
-	require.NoError(t, err)
-
-	err = RegisterSummaryAllocFunc(protocol, ConnectionContainer, func(ctx context.Context) Summary {
-		return &BaseConnectionSummary{Id: connectionId, ChannelCount: 1}
-	})
-	require.NoError(t, err)
+	protocol := TestRegisterSummaryAllocFunc(t)
 
 	cases := []struct {
 		name                        string

internal/bsr/container_test.go

@@ -118,20 +118,8 @@ func TestGetFailedItems(t *testing.T) {
 }
 
 func TestSessionValidateChecksums(t *testing.T) {
-	t.Parallel()
 	ctx := context.Background()
-
-	protocol := Protocol("TEST")
-	RegisterSummaryAllocFunc(protocol, SessionContainer, func(ctx context.Context) Summary {
-		return &BaseSessionSummary{Id: "s_123456789", ConnectionCount: 1}
-	})
-	RegisterSummaryAllocFunc(protocol, ConnectionContainer, func(ctx context.Context) Summary {
-		return &BaseConnectionSummary{Id: "cr_123456789", ChannelCount: 1}
-	})
-	RegisterSummaryAllocFunc(protocol, ChannelContainer, func(ctx context.Context) Summary {
-		return &BaseChannelSummary{Id: "chr_123456789", ConnectionRecordingId: "cr_123456789"}
-	})
-
+	protocol := TestRegisterSummaryAllocFunc(t)
 	cases := []struct {
 		name              string
 		c                 *container

internal/bsr/convert/convert_test.go

@@ -47,7 +47,10 @@ func testChunks(s string, d bsr.Direction, p bsr.Protocol) []bsr.Chunk {
 }
 
 func writeToChannels(ctx context.Context, w storage.Writer, chunks ...bsr.Chunk) error {
-	w.Write(bsr.Magic.Bytes())
+	_, err := w.Write(bsr.Magic.Bytes())
+	if err != nil {
+		return err
+	}
 	enc, err := bsr.NewChunkEncoder(ctx, w, bsr.NoCompression, bsr.NoEncryption)
 	if err != nil {
 		return err

internal/bsr/decode_test.go

@@ -18,15 +18,19 @@ import (
 )
 
 func init() {
-	bsr.RegisterChunkType("TEST", "TEST", func(_ context.Context, bc *bsr.BaseChunk, data []byte) (bsr.Chunk, error) {
+	if err := bsr.RegisterChunkType("TEST", "TEST", func(_ context.Context, bc *bsr.BaseChunk, data []byte) (bsr.Chunk, error) {
 		return &testChunk{
 			BaseChunk: bc,
 			Data:      data,
 		}, nil
-	})
-	bsr.RegisterChunkType("TEST", "ERRR", func(_ context.Context, bc *bsr.BaseChunk, data []byte) (bsr.Chunk, error) {
+	}); err != nil {
+		panic(err)
+	}
+	if err := bsr.RegisterChunkType("TEST", "ERRR", func(_ context.Context, bc *bsr.BaseChunk, data []byte) (bsr.Chunk, error) {
 		return nil, errors.New("error in decode function")
-	})
+	}); err != nil {
+		panic(err)
+	}
 }
 
 func TestChunkDecoder(t *testing.T) {

internal/bsr/encode_test.go

@@ -36,7 +36,7 @@ func (t *testChunk) MarshalData(_ context.Context) ([]byte, error) {
 func gziped(d string) string {
 	var buf bytes.Buffer
 	w := gzip.NewWriter(&buf)
-	w.Write([]byte(d))
+	_, _ = w.Write([]byte(d))
 	w.Close()
 	return buf.String()
 }

internal/bsr/ssh/buffer_size_test.go

@@ -27,16 +27,7 @@ import (
 // This test validates that the minimum buffer size for each file
 // type is accurate.
 func TestValidateBufferSize(t *testing.T) {
-	protocol := bsr.Protocol("TEST")
-	bsr.RegisterSummaryAllocFunc(protocol, bsr.SessionContainer, func(ctx context.Context) bsr.Summary {
-		return &bsr.BaseSessionSummary{Id: "sr_123456789", ConnectionCount: 1}
-	})
-	bsr.RegisterSummaryAllocFunc(protocol, bsr.ConnectionContainer, func(ctx context.Context) bsr.Summary {
-		return &bsr.BaseConnectionSummary{Id: "cr_123456789", ChannelCount: 1}
-	})
-	bsr.RegisterSummaryAllocFunc(protocol, bsr.ChannelContainer, func(ctx context.Context) bsr.Summary {
-		return &bsr.BaseChannelSummary{Id: "chr_123456789", ConnectionRecordingId: "cr_123456789"}
-	})
+	protocol := bsr.TestRegisterSummaryAllocFunc(t)
 
 	ctx := context.Background()
 	ts := time.Date(1995, time.March, 3, 12, 12, 12, 999999999, time.UTC)

internal/bsr/testing.go

@@ -3,6 +3,53 @@
 
 package bsr
 
+import (
+	"context"
+	"sync"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+var registerTestProtocol *sync.Once
+
+func init() {
+	registerTestProtocol = new(sync.Once)
+}
+
+// TestRegisterSummaryAllocFunc registers "TEST" as a protocol for all container types
+// The channel summary will include the following:
+//
+//	BaseChannelSummary{Id: "TEST_CHANNEL_ID", ConnectionRecordingId: "TEST_CONNECTION_RECORDING_ID"}
+//
+// The connection summary will include the following:
+//
+//	BaseConnectionSummary{Id: "TEST_CONNECTION_ID", ChannelCount: 1}
+//
+// The session summary will include the following:
+//
+//	BaseSessionSummary{Id: "TEST_SESSION_ID", ConnectionCount: 1}
+func TestRegisterSummaryAllocFunc(t *testing.T) Protocol {
+	protocol := Protocol("TEST")
+	registerTestProtocol.Do(func() {
+		require.NoError(t,
+			RegisterSummaryAllocFunc(protocol, ChannelContainer, func(ctx context.Context) Summary {
+				return &BaseChannelSummary{Id: "TEST_CHANNEL_ID", ConnectionRecordingId: "TEST_CONNECTION_RECORDING_ID"}
+			}))
+
+		require.NoError(t,
+			RegisterSummaryAllocFunc(protocol, SessionContainer, func(ctx context.Context) Summary {
+				return &BaseSessionSummary{Id: "TEST_SESSION_ID", ConnectionCount: 1}
+			}))
+
+		require.NoError(t,
+			RegisterSummaryAllocFunc(protocol, ConnectionContainer, func(ctx context.Context) Summary {
+				return &BaseConnectionSummary{Id: "TEST_CONNECTION_ID", ChannelCount: 1}
+			}))
+	})
+	return protocol
+}
+
 func TestSessionRecordingMeta(s string, p Protocol) *SessionRecordingMeta {
 	return &SessionRecordingMeta{
 		Id:       s,

internal/clientcache/cmd/daemon/logfile_test.go

@@ -98,8 +98,9 @@ func TestRotation(t *testing.T) {
 	// write 1 mb and see it all contained in a single log file
 	toWrite := make([]byte, 1024)
 	for i := 0; i < 1024; i++ {
-		rand.Read(toWrite)
-		_, err := l.Write(toWrite)
+		_, err := rand.Read(toWrite)
+		require.NoError(t, err)
+		_, err = l.Write(toWrite)
 		require.NoError(t, err)
 	}
 	ret, err := os.ReadDir(dir)
@@ -121,8 +122,9 @@ func TestRotation(t *testing.T) {
 
 	// write another 1 mb and see a third log file is created
 	for i := 0; i < 1024; i++ {
-		rand.Read(toWrite)
-		_, err := l.Write(toWrite)
+		_, err := rand.Read(toWrite)
+		require.NoError(t, err)
+		_, err = l.Write(toWrite)
 		require.NoError(t, err)
 	}
 	ret, err = os.ReadDir(dir)
@@ -131,8 +133,9 @@ func TestRotation(t *testing.T) {
 
 	// and a 4th (3 backups plus the cache.log file)
 	for i := 0; i < 1024; i++ {
-		rand.Read(toWrite)
-		_, err := l.Write(toWrite)
+		_, err := rand.Read(toWrite)
+		require.NoError(t, err)
+		_, err = l.Write(toWrite)
 		require.NoError(t, err)
 	}
 

internal/clientcache/cmd/daemon/pidfile_nonwindows.go

@@ -45,7 +45,7 @@ func writePidFile(ctx context.Context, pidFile string) (pidCleanup, error) {
 	if err := l.Lock(); err != nil {
 		return closeAndDeleteFileFn, errors.Wrap(ctx, err, op)
 	}
-	// Now that we have aquired the lock and verified we own the pid file
+	// Now that we have acquired the lock and verified we own the pid file
 	// we can remove it always when cleaning up.
 	unlockAndCleanFn := func() error {
 		return l.Remove()

internal/clientcache/internal/cache/refresh.go

@@ -304,14 +304,14 @@ func (r *RefreshService) RecheckCachingSupport(ctx context.Context, opt ...Optio
 
 		if err := r.repo.checkCachingTargets(ctx, u, tokens, opt...); err != nil {
 			if err == ErrRefreshNotSupported {
-				// This is expected so no need to propogate the error up
+				// This is expected so no need to propagate the error up
 				continue
 			}
 			retErr = stderrors.Join(retErr, errors.Wrap(ctx, err, op, errors.WithMsg(fmt.Sprintf("for user id %s", u.Id))))
 		}
 		if err := r.repo.checkCachingSessions(ctx, u, tokens, opt...); err != nil {
 			if err == ErrRefreshNotSupported {
-				// This is expected so no need to propogate the error up
+				// This is expected so no need to propagate the error up
 				continue
 			}
 			retErr = stderrors.Join(retErr, errors.Wrap(ctx, err, op, errors.WithMsg(fmt.Sprintf("for user id %s", u.Id))))

internal/clientcache/internal/cache/refresh_test.go

@@ -708,7 +708,7 @@ func TestRefresh(t *testing.T) {
 		assert.ElementsMatch(t, retSess[2:], cachedSessions)
 	})
 
-	t.Run("error propogates up", func(t *testing.T) {
+	t.Run("error propagates up", func(t *testing.T) {
 		s, err := db.Open(ctx)
 		require.NoError(t, err)
 		r, err := NewRepository(ctx, s, &sync.Map{}, mapBasedAuthTokenKeyringLookup(atMap), sliceBasedAuthTokenBoundaryReader(boundaryAuthTokens))
@@ -758,9 +758,9 @@ func TestRefresh(t *testing.T) {
 		require.NoError(t, err)
 		assert.Len(t, us, 1)
 
-		rs.Refresh(ctx,
+		require.NoError(t, rs.Refresh(ctx,
 			WithSessionRetrievalFunc(testStaticResourceRetrievalFunc[*sessions.Session](t, nil, nil)),
-			WithTargetRetrievalFunc(testStaticResourceRetrievalFunc[*targets.Target](t, nil, nil)))
+			WithTargetRetrievalFunc(testStaticResourceRetrievalFunc[*targets.Target](t, nil, nil))))
 
 		ps, err = r.listTokens(ctx, u)
 		require.NoError(t, err)
@@ -858,7 +858,7 @@ func TestRecheckCachingSupport(t *testing.T) {
 		assert.Empty(t, got)
 	})
 
-	t.Run("error propogates up", func(t *testing.T) {
+	t.Run("error propagates up", func(t *testing.T) {
 		s, err := db.Open(ctx)
 		require.NoError(t, err)
 		r, err := NewRepository(ctx, s, &sync.Map{}, mapBasedAuthTokenKeyringLookup(atMap), sliceBasedAuthTokenBoundaryReader(boundaryAuthTokens))

internal/clientcache/internal/cache/repository_refresh_token.go

@@ -79,7 +79,7 @@ func (r *Repository) cacheSupportState(ctx context.Context, u *user) (*cacheSupp
 }
 
 // lookupRefreshToken returns the last known valid refresh token or an empty
-// string if one is unkonwn. No error is returned if no valid refresh token is
+// string if one is unknown. No error is returned if no valid refresh token is
 // found.
 func (r *Repository) lookupRefreshToken(ctx context.Context, u *user, resourceType resourceType) (*refreshToken, error) {
 	const op = "cache.(Repsoitory).lookupRefreshToken"
@@ -198,7 +198,10 @@ func upsertRefreshToken(ctx context.Context, writer db.Writer, u *user, rt resou
 
 	switch tok {
 	case "":
-		writer.Delete(ctx, refTok)
+		_, err := writer.Delete(ctx, refTok)
+		if err != nil {
+			return errors.Wrap(ctx, err, op)
+		}
 	default:
 		onConflict := &db.OnConflict{
 			Target: db.Columns{"user_id", "resource_type"},

internal/clientcache/internal/cache/repository_refresh_token_test.go

@@ -46,10 +46,11 @@ func TestListRefreshToken(t *testing.T) {
 		require.NoError(t, r.rw.Create(ctx, known))
 
 		token := RefreshTokenValue("something")
-		r.rw.DoTx(ctx, 1, db.ExpBackoff{}, func(r db.Reader, w db.Writer) error {
+		_, err = r.rw.DoTx(ctx, 1, db.ExpBackoff{}, func(r db.Reader, w db.Writer) error {
 			require.NoError(t, upsertRefreshToken(ctx, w, known, targetResourceType, token))
 			return nil
 		})
+		require.NoError(t, err)
 
 		got, err := r.listRefreshTokens(ctx, known)
 		assert.NoError(t, err)
@@ -60,10 +61,11 @@ func TestListRefreshToken(t *testing.T) {
 		require.NoError(t, r.rw.Create(ctx, known))
 
 		token := sentinelNoRefreshToken
-		r.rw.DoTx(ctx, 1, db.ExpBackoff{}, func(r db.Reader, w db.Writer) error {
+		_, err = r.rw.DoTx(ctx, 1, db.ExpBackoff{}, func(r db.Reader, w db.Writer) error {
 			require.NoError(t, upsertRefreshToken(ctx, w, known, targetResourceType, token))
 			return nil
 		})
+		require.NoError(t, err)
 
 		got, err := r.listRefreshTokens(ctx, known)
 		assert.NoError(t, err)
@@ -74,11 +76,12 @@ func TestListRefreshToken(t *testing.T) {
 		require.NoError(t, r.rw.Create(ctx, known))
 
 		token := RefreshTokenValue("something")
-		r.rw.DoTx(ctx, 1, db.ExpBackoff{}, func(r db.Reader, w db.Writer) error {
+		_, err := r.rw.DoTx(ctx, 1, db.ExpBackoff{}, func(r db.Reader, w db.Writer) error {
 			require.NoError(t, upsertRefreshToken(ctx, w, known, targetResourceType, token))
 			require.NoError(t, upsertRefreshToken(ctx, w, known, sessionResourceType, token))
 			return nil
 		})
+		require.NoError(t, err)
 
 		got, err := r.listRefreshTokens(ctx, known)
 		assert.NoError(t, err)
@@ -116,10 +119,11 @@ func TestCacheSupportState(t *testing.T) {
 
 		now := time.Now().Truncate(time.Millisecond)
 		token := sentinelNoRefreshToken
-		r.rw.DoTx(ctx, 1, db.ExpBackoff{}, func(r db.Reader, w db.Writer) error {
+		_, err = r.rw.DoTx(ctx, 1, db.ExpBackoff{}, func(r db.Reader, w db.Writer) error {
 			require.NoError(t, upsertRefreshToken(ctx, w, known, targetResourceType, token))
 			return nil
 		})
+		require.NoError(t, err)
 
 		got, err := r.listRefreshTokens(ctx, known)
 		assert.NoError(t, err)

internal/clientcache/internal/cache/repository_test.go

@@ -117,7 +117,7 @@ func TestRepository_lookupError(t *testing.T) {
 		assert.Nil(t, got)
 	})
 	t.Run("found", func(t *testing.T) {
-		r.saveError(ctx, u, sessionResourceType, testErr)
+		require.NoError(t, r.saveError(ctx, u, sessionResourceType, testErr))
 		got, err := r.lookupError(ctx, u, sessionResourceType)
 		assert.NoError(t, err)
 		assert.NotNil(t, got)

internal/clientcache/internal/cache/repository_token_test.go

@@ -758,12 +758,13 @@ func TestCleanExpiredOrOrphanedAuthTokens_Errors(t *testing.T) {
 	assert.Error(t, err)
 	assert.ErrorContains(t, err, "writer isn't part of an inflight transaction")
 
-	rw.DoTx(ctx, 1, db.ExpBackoff{}, func(_ db.Reader, writer db.Writer) error {
+	_, err = rw.DoTx(ctx, 1, db.ExpBackoff{}, func(_ db.Reader, writer db.Writer) error {
 		err := cleanExpiredOrOrphanedAuthTokens(ctx, writer, nil)
 		assert.Error(t, err)
 		assert.ErrorContains(t, err, "keyringless auth token map is nil")
 		return nil
 	})
+	require.NoError(t, err)
 }
 
 func TestUpsertUserAndAuthToken(t *testing.T) {
@@ -779,7 +780,7 @@ func TestUpsertUserAndAuthToken(t *testing.T) {
 		UserId: "u_123",
 	}
 
-	rw.DoTx(ctx, 1, db.ExpBackoff{}, func(txReader db.Reader, txWriter db.Writer) error {
+	_, err = rw.DoTx(ctx, 1, db.ExpBackoff{}, func(txReader db.Reader, txWriter db.Writer) error {
 		errorCases := []struct {
 			name          string
 			reader        db.Reader
@@ -861,4 +862,5 @@ func TestUpsertUserAndAuthToken(t *testing.T) {
 		}
 		return nil
 	})
+	require.NoError(t, err)
 }

internal/clientcache/internal/cache/search_test.go

@@ -168,7 +168,7 @@ func TestSupported(t *testing.T) {
 		assert.False(t, got)
 	})
 
-	t.Run("unkonwn", func(t *testing.T) {
+	t.Run("unknown", func(t *testing.T) {
 		at := &AuthToken{
 			Id:     "unknown",
 			UserId: "unknown",

internal/clientcache/internal/client/client_test.go

@@ -82,6 +82,7 @@ func TestClient(t *testing.T) {
 		r, err := c.Get(ctx, "/unknown/path", nil)
 		assert.NoError(t, err)
 		assert.NotNil(t, r)
+		r.HttpResponse().Body.Close()
 		assert.Equal(t, http.StatusNotFound, r.HttpResponse().StatusCode)
 	})
 

internal/clientcache/internal/daemon/server.go

@@ -86,7 +86,7 @@ type Config struct {
 	// search query to trigger an inline refresh.
 	MaxSearchStaleness time.Duration
 	// The maximum amount of time a refresh should block a search request from
-	// completeing before it times out.
+	// completing before it times out.
 	MaxSearchRefreshTimeout time.Duration
 }
 
@@ -176,7 +176,9 @@ func defaultBoundaryTokenReader(ctx context.Context, cp ClientProvider) (cache.B
 		if err != nil {
 			return nil, err
 		}
-		c.SetAddr(addr)
+		if err := c.SetAddr(addr); err != nil {
+			return nil, err
+		}
 		c.SetToken(tok)
 		atClient := authtokens.NewClient(c)
 

internal/clientcache/internal/daemon/status_handler.go

@@ -49,7 +49,7 @@ type BoundaryStatus struct {
 	Address string `json:"address,omitempty"`
 	// Whether the controller responses are supported by the cache
 	CacheSupport string `json:"cache_support,omitempty"`
-	// How long ago the Boundary instance was checked for cache compatability
+	// How long ago the Boundary instance was checked for cache compatibility
 	LastSupportCheck time.Duration `json:"last_support_check,omitempty"`
 }
 
@@ -112,7 +112,10 @@ func newStatusHandlerFunc(ctx context.Context, repo *cache.Repository, socketAdd
 			return
 		}
 		w.Header().Set("Content-Type", "application/json")
-		w.Write(j)
+		if _, err := w.Write(j); err != nil {
+			writeError(w, err.Error(), http.StatusInternalServerError)
+			return
+		}
 	}, nil
 }
 

internal/cmd/commands/database/init.go

@@ -528,7 +528,7 @@ func (c *InitCommand) verifyOplogIsEmpty(ctx context.Context) error {
 	const op = "database.(InitCommand).verifyOplogIsEmpty"
 	underlyingDB, err := c.Database.SqlDB(ctx)
 	if err != nil {
-		return errors.New(ctx, errors.Internal, op, "unable to retreive db", errors.WithWrap(err))
+		return errors.New(ctx, errors.Internal, op, "unable to retrieve db", errors.WithWrap(err))
 	}
 	r := underlyingDB.QueryRowContext(c.Context, "select not exists(select 1 from oplog_entry limit 1)")
 	if r.Err() != nil {

internal/cmd/main.go

@@ -272,10 +272,10 @@ func RunCustom(args []string, runOpts *RunOptions) (exitCode int) {
 				return exitCode
 			}
 			if !strings.Contains(api.LastOutputStringError.Error(), api.ErrOutputStringRequest) {
-				runOpts.Stdout.Write([]byte(fmt.Sprintf("Error creating request string: %s\n", api.LastOutputStringError.Error())))
+				_, _ = runOpts.Stdout.Write([]byte(fmt.Sprintf("Error creating request string: %s\n", api.LastOutputStringError.Error())))
 				return 1
 			}
-			runOpts.Stdout.Write([]byte(fmt.Sprintf("%s\n", api.LastOutputStringError.CurlString())))
+			_, _ = runOpts.Stdout.Write([]byte(fmt.Sprintf("%s\n", api.LastOutputStringError.CurlString())))
 			return 0
 		}
 	} else if err != nil {

internal/cmd/ops/server_test.go

@@ -143,7 +143,8 @@ func TestNewServerIntegration(t *testing.T) {
 				},
 			},
 			assertions: func(t *testing.T, addrs []string) {
-				_, err := http.Get("http://" + addrs[0])
+				resp, err := http.Get("http://" + addrs[0])
+				resp.Body.Close()
 				require.NoError(t, err)
 			},
 		},
@@ -164,10 +165,12 @@ func TestNewServerIntegration(t *testing.T) {
 				},
 			},
 			assertions: func(t *testing.T, addrs []string) {
-				_, err := http.Get("http://" + addrs[0])
+				resp, err := http.Get("http://" + addrs[0])
+				resp.Body.Close()
 				require.NoError(t, err)
 
-				_, err = http.Get("http://" + addrs[1])
+				resp, err = http.Get("http://" + addrs[1])
+				resp.Body.Close()
 				require.NoError(t, err)
 			},
 		},
@@ -288,7 +291,11 @@ func TestNewServerIntegration(t *testing.T) {
 			require.NoError(t, err)
 			require.NotNil(t, s)
 			s.Start()
-			t.Cleanup(func() { s.Shutdown() })
+			t.Cleanup(func() {
+				if err := s.Shutdown(); err != nil {
+					t.Logf("error shutting down: %v", err)
+				}
+			})
 
 			addrs := make([]string, 0, len(s.bundles))
 			for _, b := range s.bundles {

internal/credential/store.go

@@ -40,7 +40,7 @@ type StoreListQueryResult struct {
 	CaCert []byte
 	// Optional TLS server name of the credential store.
 	TlsServerName string
-	// Optionally specifices whether to skip TLS verification of the credential store.
+	// Optionally specifies whether to skip TLS verification of the credential store.
 	TlsSkipVerify bool
 	// Optional worker filter of the credential store.
 	WorkerFilter string

internal/credential/vault/internal/sshprivatekey/sshprivatekey.go

@@ -99,7 +99,7 @@ func defaultExtract(sd data, usernameAttr, privateKeyAttr, passphraseAttr string
 // kv2Extract looks for the the usernameAttr and privateKeyAttr in the embedded
 // 'data' field within the data map.
 //
-// Additionaly it validates the data is in the expected KV-v2 format:
+// Additionally it validates the data is in the expected KV-v2 format:
 //
 //	{
 //		"data": {},

internal/credential/vault/internal/usernamepassword/usernamepassword.go

@@ -84,7 +84,7 @@ func defaultExtract(sd data, usernameAttr, passwordAttr string) (username string
 // kv2Extract looks for the the usernameAttr and passwordAttr in the embedded
 // 'data' field within the data map.
 //
-// Additionaly it validates the data is in the expected KV-v2 format:
+// Additionally it validates the data is in the expected KV-v2 format:
 //
 //	{
 //		"data": {},

internal/credential/vault/repository_credential_store.go

@@ -96,7 +96,7 @@ func (r *Repository) CreateCredentialStore(ctx context.Context, cs *CredentialSt
 	missing := available.missing(requiredCapabilities)
 	if len(missing) > 0 {
 		return nil,
-			errors.New(ctx, errors.VaultTokenMissingCapabilities, op, fmt.Sprintf("missing capabilites: %v", missing))
+			errors.New(ctx, errors.VaultTokenMissingCapabilities, op, fmt.Sprintf("missing capabilities: %v", missing))
 	}
 
 	renewedToken, err := client.renewToken(ctx)
@@ -494,7 +494,7 @@ func (r *Repository) UpdateCredentialStore(ctx context.Context, cs *CredentialSt
 		if len(missing) > 0 {
 			return nil,
 				db.NoRowsAffected,
-				errors.New(ctx, errors.VaultTokenMissingCapabilities, op, fmt.Sprintf("missing capabilites: %v", missing))
+				errors.New(ctx, errors.VaultTokenMissingCapabilities, op, fmt.Sprintf("missing capabilities: %v", missing))
 		}
 	}
 	if updateToken {

internal/daemon/cluster/handlers/testing.go

@@ -15,6 +15,7 @@ import (
 	"github.com/hashicorp/nodeenrollment/rotation"
 	nodeefile "github.com/hashicorp/nodeenrollment/storage/file"
 	"github.com/hashicorp/nodeenrollment/types"
+	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/credentials/insecure"
@@ -35,7 +36,9 @@ func TestUpstreamService(t *testing.T) (UpstreamMessageServiceClientProducer, *t
 	// sending upstream requests
 	initStorage, err := nodeefile.New(testCtx)
 	require.NoError(t, err)
-	t.Cleanup(func() { initStorage.Cleanup(testCtx) })
+	t.Cleanup(func() {
+		assert.NoError(t, initStorage.Cleanup(testCtx))
+	})
 	_, err = rotation.RotateRootCertificates(testCtx, initStorage)
 	require.NoError(t, err)
 	initNodeCreds, err := types.NewNodeCredentials(testCtx, initStorage)

internal/daemon/cluster/handlers/upstream_message_service_test.go

@@ -105,7 +105,7 @@ func Test_controllerUpstreamMessageServiceServer_UpstreamMessage(t *testing.T) {
 	// Get an initial set of authorized node credentials
 	initStorage, err := nodeefile.New(testCtx)
 	require.NoError(t, err)
-	t.Cleanup(func() { initStorage.Cleanup(testCtx) })
+	t.Cleanup(func() { assert.NoError(t, initStorage.Cleanup(testCtx)) })
 	_, err = rotation.RotateRootCertificates(testCtx, initStorage)
 	require.NoError(t, err)
 	initNodeCreds, err := types.NewNodeCredentials(testCtx, initStorage)

internal/daemon/cluster/handlers/worker_service_status_test.go

@@ -46,11 +46,14 @@ func TestStatus(t *testing.T) {
 	iamRepo := iam.TestRepo(t, conn, wrapper)
 	org, prj := iam.TestScopes(t, iamRepo)
 
-	serverRepo, _ := server.NewRepository(ctx, rw, rw, kms)
-	serverRepo.UpsertController(ctx, &store.Controller{
+	serverRepo, err := server.NewRepository(ctx, rw, rw, kms)
+	require.NoError(t, err)
+	_, err = serverRepo.UpsertController(ctx, &store.Controller{
 		PrivateId: "test_controller1",
 		Address:   "127.0.0.1",
 	})
+	require.NoError(t, err)
+
 	serversRepoFn := func() (*server.Repository, error) {
 		return serverRepo, nil
 	}
@@ -482,11 +485,14 @@ func TestStatusSessionClosed(t *testing.T) {
 	kms := kms.TestKms(t, conn, wrapper)
 	org, prj := iam.TestScopes(t, iam.TestRepo(t, conn, wrapper))
 
-	serverRepo, _ := server.NewRepository(ctx, rw, rw, kms)
-	serverRepo.UpsertController(ctx, &store.Controller{
+	serverRepo, err := server.NewRepository(ctx, rw, rw, kms)
+	require.NoError(t, err)
+	_, err = serverRepo.UpsertController(ctx, &store.Controller{
 		PrivateId: "test_controller1",
 		Address:   "127.0.0.1",
 	})
+	require.NoError(t, err)
+
 	serversRepoFn := func() (*server.Repository, error) {
 		return serverRepo, nil
 	}
@@ -672,10 +678,11 @@ func TestStatusDeadConnection(t *testing.T) {
 	org, prj := iam.TestScopes(t, iam.TestRepo(t, conn, wrapper))
 
 	serverRepo, _ := server.NewRepository(ctx, rw, rw, kms)
-	serverRepo.UpsertController(ctx, &store.Controller{
+	_, err := serverRepo.UpsertController(ctx, &store.Controller{
 		PrivateId: "test_controller1",
 		Address:   "127.0.0.1",
 	})
+	require.NoError(t, err)
 
 	worker1 := server.TestKmsWorker(t, conn, wrapper)
 
@@ -826,11 +833,13 @@ func TestStatusWorkerWithKeyId(t *testing.T) {
 	kms := kms.TestKms(t, conn, wrapper)
 	org, prj := iam.TestScopes(t, iam.TestRepo(t, conn, wrapper))
 
-	serverRepo, _ := server.NewRepository(ctx, rw, rw, kms)
-	serverRepo.UpsertController(ctx, &store.Controller{
+	serverRepo, err := server.NewRepository(ctx, rw, rw, kms)
+	require.NoError(t, err)
+	_, err = serverRepo.UpsertController(ctx, &store.Controller{
 		PrivateId: "test_controller1",
 		Address:   "127.0.0.1",
 	})
+	require.NoError(t, err)
 	serversRepoFn := func() (*server.Repository, error) {
 		return serverRepo, nil
 	}

internal/daemon/cluster/handlers/worker_service_test.go

@@ -192,7 +192,7 @@ func TestLookupSession(t *testing.T) {
 			wantErrMsg: "rpc error: code = InvalidArgument desc = Did not receive worker id when looking up session",
 		},
 		{
-			name: "nonexistant worker id",
+			name: "nonexistent worker id",
 			req: &pbs.LookupSessionRequest{
 				SessionId: sessWithWorkerFilter.PublicId,
 				WorkerId:  "w_nonexistingworker",

internal/daemon/controller/auth/option.go

@@ -93,7 +93,7 @@ func WithAnonymousUserNotAllowed(notAllowed bool) Option {
 	}
 }
 
-// WithResource specifies a resouce to use
+// WithResource specifies a resource to use
 func WithResource(resource *perms.Resource) Option {
 	return func(o *options) {
 		o.withResource = resource

internal/daemon/controller/controller.go

@@ -551,7 +551,7 @@ func (c *Controller) Start() error {
 				-1,
 			)
 			if err != nil {
-				errors.Wrap(c.baseContext, err, op)
+				event.WriteError(c.baseContext, op, fmt.Errorf("connection management ticker exited with error: %w", err))
 			}
 		}()
 	}

internal/daemon/controller/handlers/accounts/account_service_test.go

@@ -3028,9 +3028,9 @@ func TestUpdatePassword(t *testing.T) {
 			err: handlers.ApiErrorWithCode(codes.InvalidArgument),
 		},
 		{
-			name: "Only non-existant paths in Mask",
+			name: "Only non-existent paths in Mask",
 			req: &pbs.UpdateAccountRequest{
-				UpdateMask: &field_mask.FieldMask{Paths: []string{"nonexistant_field"}},
+				UpdateMask: &field_mask.FieldMask{Paths: []string{"nonexistent_field"}},
 				Item: &pb.Account{
 					Name:        &wrapperspb.StringValue{Value: "updated name"},
 					Description: &wrapperspb.StringValue{Value: "updated desc"},
@@ -3425,9 +3425,9 @@ func TestUpdateOidc(t *testing.T) {
 			err: handlers.ApiErrorWithCode(codes.InvalidArgument),
 		},
 		{
-			name: "Only non-existant paths in Mask",
+			name: "Only non-existent paths in Mask",
 			req: &pbs.UpdateAccountRequest{
-				UpdateMask: &field_mask.FieldMask{Paths: []string{"nonexistant_field"}},
+				UpdateMask: &field_mask.FieldMask{Paths: []string{"nonexistent_field"}},
 				Item: &pb.Account{
 					Name:        &wrapperspb.StringValue{Value: "updated name"},
 					Description: &wrapperspb.StringValue{Value: "updated desc"},
@@ -3814,7 +3814,7 @@ func TestUpdateLdap(t *testing.T) {
 		{
 			name: "Only non-existent paths in Mask",
 			req: &pbs.UpdateAccountRequest{
-				UpdateMask: &field_mask.FieldMask{Paths: []string{"nonexistant_field"}},
+				UpdateMask: &field_mask.FieldMask{Paths: []string{"nonexistent_field"}},
 				Item: &pb.Account{
 					Name:        &wrapperspb.StringValue{Value: "updated name"},
 					Description: &wrapperspb.StringValue{Value: "updated desc"},

internal/daemon/controller/handlers/authmethods/ldap_test.go

@@ -202,7 +202,7 @@ func Test_UpdateLdap(t *testing.T) {
 		{
 			name: "non-existent-paths-in-mask",
 			req: &pbs.UpdateAuthMethodRequest{
-				UpdateMask: &field_mask.FieldMask{Paths: []string{"nonexistant_field"}},
+				UpdateMask: &field_mask.FieldMask{Paths: []string{"nonexistent_field"}},
 				Item: &pb.AuthMethod{
 					Name:        &wrapperspb.StringValue{Value: "updated name"},
 					Description: &wrapperspb.StringValue{Value: "updated desc"},

internal/daemon/controller/handlers/authmethods/oidc_test.go

@@ -493,9 +493,9 @@ func TestUpdate_OIDC(t *testing.T) {
 			err: handlers.ApiErrorWithCode(codes.InvalidArgument),
 		},
 		{
-			name: "Only non-existant paths in Mask",
+			name: "Only non-existent paths in Mask",
 			req: &pbs.UpdateAuthMethodRequest{
-				UpdateMask: &field_mask.FieldMask{Paths: []string{"nonexistant_field"}},
+				UpdateMask: &field_mask.FieldMask{Paths: []string{"nonexistent_field"}},
 				Item: &pb.AuthMethod{
 					Name:        &wrapperspb.StringValue{Value: "updated name"},
 					Description: &wrapperspb.StringValue{Value: "updated desc"},

internal/daemon/controller/handlers/authmethods/password_test.go

@@ -181,9 +181,9 @@ func TestUpdate_Password(t *testing.T) {
 			err: handlers.ApiErrorWithCode(codes.InvalidArgument),
 		},
 		{
-			name: "Only non-existant paths in Mask",
+			name: "Only non-existent paths in Mask",
 			req: &pbs.UpdateAuthMethodRequest{
-				UpdateMask: &field_mask.FieldMask{Paths: []string{"nonexistant_field"}},
+				UpdateMask: &field_mask.FieldMask{Paths: []string{"nonexistent_field"}},
 				Item: &pb.AuthMethod{
 					Name:        &wrapperspb.StringValue{Value: "updated name"},
 					Description: &wrapperspb.StringValue{Value: "updated desc"},

internal/daemon/controller/handlers/credentialstores/vault_test.go

@@ -17,7 +17,7 @@ func TestPkAndClientCerts(t *testing.T) {
 	ctx := context.Background()
 	s := vault.NewTestVaultServer(t, vault.WithTestVaultTLS(vault.TestClientTLS))
 
-	t.Run("seperate client cert and key", func(t *testing.T) {
+	t.Run("separate client cert and key", func(t *testing.T) {
 		c, k, err := extractClientCertAndPk(ctx, string(s.ClientCert), string(s.ClientKey))
 		assert.NoError(t, err)
 		require.NotNil(t, k)

internal/daemon/controller/handlers/filtering.go

@@ -21,7 +21,7 @@ type Filter struct {
 	eval *bexpr.Evaluator
 }
 
-// NewFilter returns a Filter which can be evluated against.  An empty string paramter indicates
+// NewFilter returns a Filter which can be evaluated against.  An empty string parameter indicates
 // all items passed to it should succeed.
 func NewFilter(ctx context.Context, f string) (*Filter, error) {
 	const op = "handlers.NewFilter"

internal/daemon/controller/handlers/groups/group_service_test.go

@@ -157,7 +157,7 @@ func TestGet(t *testing.T) {
 			res:     &pbs.GetGroupResponse{Item: wantOrgGroup},
 		},
 		{
-			name: "Get a non existant Group",
+			name: "Get a non existent Group",
 			req:  &pbs.GetGroupRequest{Id: globals.GroupPrefix + "_DoesntExis"},
 			res:  nil,
 			err:  handlers.ApiErrorWithCode(codes.NotFound),
@@ -181,7 +181,7 @@ func TestGet(t *testing.T) {
 			res:     &pbs.GetGroupResponse{Item: wantProjGroup},
 		},
 		{
-			name:    "Project Scoped Get a non existant Group",
+			name:    "Project Scoped Get a non existent Group",
 			scopeId: pg.GetScopeId(),
 			req:     &pbs.GetGroupRequest{Id: globals.GroupPrefix + "_DoesntExis"},
 			res:     nil,
@@ -1254,10 +1254,10 @@ func TestUpdate(t *testing.T) {
 			err: handlers.ApiErrorWithCode(codes.InvalidArgument),
 		},
 		{
-			name:    "Only non-existant paths in Mask",
+			name:    "Only non-existent paths in Mask",
 			scopeId: og.GetScopeId(),
 			req: &pbs.UpdateGroupRequest{
-				UpdateMask: &field_mask.FieldMask{Paths: []string{"nonexistant_field"}},
+				UpdateMask: &field_mask.FieldMask{Paths: []string{"nonexistent_field"}},
 				Item: &pb.Group{
 					Name:        &wrapperspb.StringValue{Value: "updated name"},
 					Description: &wrapperspb.StringValue{Value: "updated desc"},

internal/daemon/controller/handlers/host_catalogs/host_catalog_service_test.go

@@ -1588,9 +1588,9 @@ func TestUpdate_Static(t *testing.T) {
 			err: handlers.ApiErrorWithCode(codes.InvalidArgument),
 		},
 		{
-			name: "Only non-existant paths in Mask",
+			name: "Only non-existent paths in Mask",
 			req: &pbs.UpdateHostCatalogRequest{
-				UpdateMask: &field_mask.FieldMask{Paths: []string{"nonexistant_field"}},
+				UpdateMask: &field_mask.FieldMask{Paths: []string{"nonexistent_field"}},
 				Item: &pb.HostCatalog{
 					Name:        &wrappers.StringValue{Value: "updated name"},
 					Description: &wrappers.StringValue{Value: "updated desc"},
@@ -2049,8 +2049,8 @@ func TestUpdate_Plugin(t *testing.T) {
 			err: handlers.ApiErrorWithCode(codes.InvalidArgument),
 		},
 		{
-			name:  "Only non-existant paths in Mask",
-			masks: []string{"nonexistant_field"},
+			name:  "Only non-existent paths in Mask",
+			masks: []string{"nonexistent_field"},
 			changes: []updateFn{
 				clearReadOnlyFields(),
 				updateName(wrapperspb.String("new")),

internal/daemon/controller/handlers/host_sets/host_set_service_test.go

@@ -1921,9 +1921,9 @@ func TestUpdate_Static(t *testing.T) {
 			err: handlers.ApiErrorWithCode(codes.InvalidArgument),
 		},
 		{
-			name: "Only non-existant paths in Mask",
+			name: "Only non-existent paths in Mask",
 			req: &pbs.UpdateHostSetRequest{
-				UpdateMask: &field_mask.FieldMask{Paths: []string{"nonexistant_field"}},
+				UpdateMask: &field_mask.FieldMask{Paths: []string{"nonexistent_field"}},
 				Item: &pb.HostSet{
 					Name:        &wrappers.StringValue{Value: "updated name"},
 					Description: &wrappers.StringValue{Value: "updated desc"},
@@ -2376,8 +2376,8 @@ func TestUpdate_Plugin(t *testing.T) {
 			err: handlers.ApiErrorWithCode(codes.InvalidArgument),
 		},
 		{
-			name:  "Only non-existant paths in Mask",
-			masks: []string{"nonexistant_field"},
+			name:  "Only non-existent paths in Mask",
+			masks: []string{"nonexistent_field"},
 			changes: []updateFn{
 				clearReadOnlyFields(),
 				updateName(wrapperspb.String("new")),

internal/daemon/controller/handlers/hosts/host_service_test.go

@@ -1625,7 +1625,7 @@ func TestUpdate_Static(t *testing.T) {
 			name: "Only non-existent paths in Mask",
 			req: &pbs.UpdateHostRequest{
 				Id:         h.GetPublicId(),
-				UpdateMask: &field_mask.FieldMask{Paths: []string{"nonexistant_field"}},
+				UpdateMask: &field_mask.FieldMask{Paths: []string{"nonexistent_field"}},
 				Item: &pb.Host{
 					Name:        &wrappers.StringValue{Value: "updated name"},
 					Description: &wrappers.StringValue{Value: "updated desc"},

internal/daemon/controller/handlers/managed_groups/managed_group_service_test.go

@@ -2060,7 +2060,7 @@ func TestUpdateOidc(t *testing.T) {
 		{
 			name: "Only non-existent paths in Mask",
 			req: &pbs.UpdateManagedGroupRequest{
-				UpdateMask: &field_mask.FieldMask{Paths: []string{"nonexistant_field"}},
+				UpdateMask: &field_mask.FieldMask{Paths: []string{"nonexistent_field"}},
 				Item: &pb.ManagedGroup{
 					Name:        &wrapperspb.StringValue{Value: "updated name"},
 					Description: &wrapperspb.StringValue{Value: "updated desc"},
@@ -2452,7 +2452,7 @@ func TestUpdateLdap(t *testing.T) {
 		{
 			name: "Only non-existent paths in Mask",
 			req: &pbs.UpdateManagedGroupRequest{
-				UpdateMask: &field_mask.FieldMask{Paths: []string{"nonexistant_field"}},
+				UpdateMask: &field_mask.FieldMask{Paths: []string{"nonexistent_field"}},
 				Item: &pb.ManagedGroup{
 					Name:        &wrapperspb.StringValue{Value: "updated name"},
 					Description: &wrapperspb.StringValue{Value: "updated desc"},

internal/daemon/controller/handlers/roles/role_service_test.go

@@ -137,7 +137,7 @@ func TestGet(t *testing.T) {
 			res:     &pbs.GetRoleResponse{Item: wantOrgRole},
 		},
 		{
-			name: "Get a non existant Role",
+			name: "Get a non existent Role",
 			req:  &pbs.GetRoleRequest{Id: globals.RolePrefix + "_DoesntExis"},
 			res:  nil,
 			err:  handlers.ApiErrorWithCode(codes.NotFound),
@@ -161,7 +161,7 @@ func TestGet(t *testing.T) {
 			res:     &pbs.GetRoleResponse{Item: wantProjRole},
 		},
 		{
-			name:    "Project Scoped Get a non existant Role",
+			name:    "Project Scoped Get a non existent Role",
 			scopeId: pr.GetScopeId(),
 			req:     &pbs.GetRoleRequest{Id: globals.RolePrefix + "_DoesntExis"},
 			res:     nil,
@@ -1254,10 +1254,10 @@ func TestUpdate(t *testing.T) {
 			err: handlers.ApiErrorWithCode(codes.InvalidArgument),
 		},
 		{
-			name:    "Only non-existant paths in Mask",
+			name:    "Only non-existent paths in Mask",
 			scopeId: or.GetScopeId(),
 			req: &pbs.UpdateRoleRequest{
-				UpdateMask: &field_mask.FieldMask{Paths: []string{"nonexistant_field"}},
+				UpdateMask: &field_mask.FieldMask{Paths: []string{"nonexistent_field"}},
 				Item: &pb.Role{
 					Name:        &wrapperspb.StringValue{Value: "updated name"},
 					Description: &wrapperspb.StringValue{Value: "updated desc"},
@@ -2491,7 +2491,7 @@ func TestRemoveGrants(t *testing.T) {
 			result:   []string{"ids=hcst_2;type=*;actions=delete"},
 		},
 		{
-			name:     "Remove non existant",
+			name:     "Remove non existent",
 			existing: []string{"ids=hcst_2;type=*;actions=delete"},
 			remove:   []string{"ids=hcst_1;type=*;actions=read"},
 			result:   []string{"ids=hcst_2;type=*;actions=delete"},
@@ -3266,7 +3266,7 @@ func TestRemoveGrantScopes(t *testing.T) {
 			result:   []string{"this"},
 		},
 		{
-			name:     "Remove non existant - global",
+			name:     "Remove non existent - global",
 			scopeId:  scope.Global.String(),
 			existing: []string{"this", "descendants"},
 			remove:   []string{"p_foobar1234"},
@@ -3300,7 +3300,7 @@ func TestRemoveGrantScopes(t *testing.T) {
 			result:   []string{"this"},
 		},
 		{
-			name:     "Remove non existant - org",
+			name:     "Remove non existent - org",
 			scopeId:  o.PublicId,
 			existing: []string{"this", "children"},
 			remove:   []string{"p_foobar1234"},
@@ -3327,7 +3327,7 @@ func TestRemoveGrantScopes(t *testing.T) {
 			result:   []string{},
 		},
 		{
-			name:     "Remove non existant - proj",
+			name:     "Remove non existent - proj",
 			scopeId:  p.PublicId,
 			existing: []string{"this"},
 			remove:   []string{"p_foobar1234"},

internal/daemon/controller/handlers/scopes/scope_service_test.go

@@ -1782,10 +1782,10 @@ func TestUpdate(t *testing.T) {
 			err: handlers.ApiErrorWithCode(codes.InvalidArgument),
 		},
 		{
-			name:    "Only non-existant paths in Mask",
+			name:    "Only non-existent paths in Mask",
 			scopeId: org.GetPublicId(),
 			req: &pbs.UpdateScopeRequest{
-				UpdateMask: &field_mask.FieldMask{Paths: []string{"nonexistant_field"}},
+				UpdateMask: &field_mask.FieldMask{Paths: []string{"nonexistent_field"}},
 				Item: &pb.Scope{
 					Name:        &wrapperspb.StringValue{Value: "updated name"},
 					Description: &wrapperspb.StringValue{Value: "updated desc"},

internal/daemon/controller/handlers/targets/tcp/target_service_test.go

@@ -1390,9 +1390,9 @@ func TestUpdate(t *testing.T) {
 			err: handlers.ApiErrorWithCode(codes.InvalidArgument),
 		},
 		{
-			name: "Only non-existant paths in Mask",
+			name: "Only non-existent paths in Mask",
 			req: &pbs.UpdateTargetRequest{
-				UpdateMask: &field_mask.FieldMask{Paths: []string{"nonexistant_field"}},
+				UpdateMask: &field_mask.FieldMask{Paths: []string{"nonexistent_field"}},
 				Item: &pb.Target{
 					Name:        wrapperspb.String("updated name"),
 					Description: wrapperspb.String("updated desc"),

internal/daemon/controller/handlers/users/user_service_test.go

@@ -125,7 +125,7 @@ func TestGet(t *testing.T) {
 			res:  &pbs.GetUserResponse{Item: wantU},
 		},
 		{
-			name: "Get a non existant User",
+			name: "Get a non existent User",
 			req:  &pbs.GetUserRequest{Id: globals.UserPrefix + "_DoesntExis"},
 			res:  nil,
 			err:  handlers.ApiErrorWithCode(codes.NotFound),
@@ -1022,9 +1022,9 @@ func TestUpdate(t *testing.T) {
 			err: handlers.ApiErrorWithCode(codes.InvalidArgument),
 		},
 		{
-			name: "Only non-existant paths in Mask",
+			name: "Only non-existent paths in Mask",
 			req: &pbs.UpdateUserRequest{
-				UpdateMask: &field_mask.FieldMask{Paths: []string{"nonexistant_field"}},
+				UpdateMask: &field_mask.FieldMask{Paths: []string{"nonexistent_field"}},
 				Item: &pb.User{
 					Name:        &wrapperspb.StringValue{Value: "updated name"},
 					Description: &wrapperspb.StringValue{Value: "updated desc"},

internal/daemon/controller/handlers/workers/worker_service_test.go

@@ -717,9 +717,9 @@ func TestUpdate(t *testing.T) {
 			err: handlers.ApiErrorWithCode(codes.InvalidArgument),
 		},
 		{
-			name: "Only non-existant paths in Mask",
+			name: "Only non-existent paths in Mask",
 			req: &pbs.UpdateWorkerRequest{
-				UpdateMask: &field_mask.FieldMask{Paths: []string{"nonexistant_field"}},
+				UpdateMask: &field_mask.FieldMask{Paths: []string{"nonexistent_field"}},
 				Item: &pb.Worker{
 					Name:        wrapperspb.String("updated name"),
 					Description: wrapperspb.String("updated desc"),

internal/daemon/controller/listeners.go

@@ -46,6 +46,8 @@ func closeListener(_ context.Context, l net.Listener, _ any) error {
 }
 
 func (c *Controller) startListeners() error {
+	const op = "controller.startListeners"
+
 	servers := make([]func(), 0, len(c.conf.Listeners))
 
 	grpcServer, gwTicket, err := newGrpcServer(c.baseContext, c.IamRepoFn, c.AuthTokenRepoFn, c.ServersRepoFn, c.PasswordAuthRepoFn, c.OidcRepoFn, c.LdapRepoFn, c.kms, c.conf.Eventer)
@@ -62,7 +64,13 @@ func (c *Controller) startListeners() error {
 
 	c.apiGrpcServerListener = newGrpcServerListener()
 	servers = append(servers, func() {
-		go c.apiGrpcServer.Serve(c.apiGrpcServerListener)
+		go func() {
+			if err := c.apiGrpcServer.Serve(c.apiGrpcServerListener); err != nil {
+				// Use a background context as we might be shutting down and the
+				// base context might be canceled.
+				event.WriteError(context.Background(), op, fmt.Errorf("api grpc server returned with non-nil err: %w", err))
+			}
+		}()
 	})
 
 	for i := range c.apiListeners {

internal/daemon/controller/testing_test.go

@@ -52,7 +52,7 @@ func Test_TestController(t *testing.T) {
 			// copy the output in a separate goroutine so writing to stderr can't block indefinitely
 			go func() {
 				var buf bytes.Buffer
-				io.Copy(&buf, r)
+				_, _ = io.Copy(&buf, r)
 				outC <- buf.String()
 			}()
 

internal/daemon/worker/controller_connection_test.go

@@ -136,7 +136,9 @@ func createTestServers(t *testing.T) ([]*serverTestInfo, error) {
 		lInfo := &serverTestInfo{srv: srv, address: listener.Addr().String()}
 		servers = append(servers, lInfo)
 		go func(i int) {
-			servers[i].srv.Serve(listener)
+			if err := servers[i].srv.Serve(listener); err != nil {
+				t.Logf("error serving: %v", err)
+			}
 		}(i)
 	}
 

internal/daemon/worker/internal/metric/proxy_ws_test.go

@@ -228,7 +228,8 @@ func TestHijack_MultipleCalls(t *testing.T) {
 
 	n := 10
 	for i := 0; i < n; i++ {
-		mw.Hijack()
+		_, _, err := mw.Hijack()
+		require.NoError(t, err)
 	}
 	require.Equal(t, n, thh.hijackCalledN)
 	require.Equal(t, 1, tpg.incCalledN)

internal/daemon/worker/proxy/proxydialer_test.go

@@ -30,7 +30,7 @@ func TestProxyDialer(t *testing.T) {
 	l, err := net.Listen("tcp", "127.0.0.1:0")
 	require.NoError(t, err)
 	go func() {
-		l.Accept()
+		_, _ = l.Accept()
 	}()
 	defer l.Close()
 	ctx := context.Background()

internal/daemon/worker/proxy/testing.go

@@ -48,6 +48,7 @@ func TestWsConn(t testing.TB, ctx context.Context) (clientConn, proxyConn *webso
 	time.Sleep(time.Duration(1.5 * float64(time.Second)))
 	clientConn, _, err = websocket.Dial(ctx, fmt.Sprintf("ws://%s", l.Addr().String()), nil)
 	require.NoError(err)
+	t.Cleanup(func() { _ = clientConn.Close(websocket.StatusGoingAway, "done") })
 	wg.Wait()
 	return
 }

internal/daemon/worker/session/session.go

@@ -214,7 +214,7 @@ func (s *sess) GetLocalConnections() map[string]ConnInfo {
 	return res
 }
 
-// Return local tofu token, if availble; otherwise return the tofu token from the resp
+// Return local tofu token, if available; otherwise return the tofu token from the resp
 func (s *sess) GetTofuToken() string {
 	s.lock.RLock()
 	defer s.lock.RUnlock()
@@ -352,7 +352,9 @@ func (s *sess) RequestConnectConnection(ctx context.Context, info *pbs.ConnectCo
 	if err != nil {
 		return err
 	}
-	s.ApplyLocalConnectionStatus(info.GetConnectionId(), st)
+	if err := s.ApplyLocalConnectionStatus(info.GetConnectionId(), st); err != nil {
+		return fmt.Errorf("error applying local connection status: %w", err)
+	}
 	return nil
 }
 

internal/daemon/worker/testing.go

@@ -559,7 +559,7 @@ func NewTestMultihopWorkers(t testing.TB,
 }
 
 // NewAuthorizedPkiTestWorker creates a new test worker with the provided upstreams
-// and creates it in the provided repo as an authroized worker. It returns
+// and creates it in the provided repo as an authorized worker. It returns
 // The TestWorker and it's boundary id.
 func NewAuthorizedPkiTestWorker(t *testing.T, repo *server.Repository, name string, upstreams []string) (*TestWorker, string) {
 	t.Helper()

internal/db/schema/manager_test.go

@@ -620,7 +620,7 @@ func TestApplyMigrations_BadSQL(t *testing.T) {
 				LatestVersion: 1,
 				Migrations: migration.Migrations{
 					2: migration.Migration{
-						Statements: []byte(`select 1 from nonexistanttable;`),
+						Statements: []byte(`select 1 from nonexistenttable;`),
 						Edition:    "oss",
 						Version:    2,
 					},

internal/db/sqltest/tests/wh/network_address_dimension/upsert_network_address_group_key.sql

@@ -6,7 +6,7 @@ begin;
   select plan(4);
   select wtt_load('widgets', 'iam', 'kms', 'auth', 'hosts');
 
-  select is(wh_upsert_network_address_dimension('non-existant-key'), 'No Addresses');
+  select is(wh_upsert_network_address_dimension('non-existent-key'), 'No Addresses');
 
   -- The network address group key remains the same for the same set of
   -- addresses.

internal/event/testing_test.go

@@ -40,7 +40,7 @@ func Test_TestWithoutEventing(t *testing.T) {
 		// copy the output in a separate goroutine so writing to stderr can't block indefinitely
 		go func() {
 			var buf bytes.Buffer
-			io.Copy(&buf, r)
+			_, _ = io.Copy(&buf, r)
 			outC <- buf.String()
 		}()
 

internal/iam/repository_group.go

@@ -440,7 +440,7 @@ func (r *Repository) SetGroupMembers(ctx context.Context, groupId string, groupV
 			var groupOplogMsg oplog.Message
 			rowsUpdated, err := w.Update(ctx, &updatedGroup, []string{"Version"}, nil, db.NewOplogMsg(&groupOplogMsg), db.WithVersion(&groupVersion))
 			if err != nil {
-				return errors.Wrap(ctx, err, op, errors.WithMsg("unable to update group verison"))
+				return errors.Wrap(ctx, err, op, errors.WithMsg("unable to update group version"))
 			}
 			if rowsUpdated != 1 {
 				return errors.New(ctx, errors.MultipleRecords, op, fmt.Sprintf("updated group and %d rows updated", rowsUpdated))

internal/listtoken/list_token.go

@@ -388,7 +388,7 @@ func (tk *Token) Validate(
 		case st.LastItemId == "":
 			return errors.New(ctx, errors.InvalidListToken, op, "list tokens's pagination component missing last item ID")
 		case st.LastItemCreateTime.After(tk.CreateTime):
-			// A resource created in the same instant that we did the intial listing
+			// A resource created in the same instant that we did the initial listing
 			// would have a timestamp equal to the create time. If it's after the
 			// create time, something weird is going on.
 			return errors.New(ctx, errors.InvalidListToken, op, "list token's pagination component's last item was created after the token")

internal/listtoken/list_token_test.go

@@ -718,7 +718,7 @@ func Test_ValidateRefreshToken(t *testing.T) {
 			wantErrCode:   errors.InvalidListToken,
 		},
 		{
-			name: "emtpy last item id",
+			name: "empty last item id",
 			token: &listtoken.Token{
 				CreateTime:   fiveDaysAgo,
 				ResourceType: resource.Target,

internal/oplog/ticketer_test.go

@@ -66,7 +66,9 @@ func Test_Redeem(t *testing.T) {
 
 		tx, err := dbw.New(db).Begin(testCtx)
 		require.NoError(err)
-		defer tx.Commit(testCtx)
+		defer func() {
+			assert.NoError(t, tx.Commit(testCtx))
+		}()
 		ticketer, err := NewTicketer(testCtx, tx.DB(), WithAggregateNames(true))
 		require.NoError(err)
 
@@ -81,7 +83,9 @@ func Test_Redeem(t *testing.T) {
 
 		tx, err := dbw.New(db).Begin(testCtx)
 		require.NoError(err)
-		defer tx.Commit(testCtx)
+		defer func() {
+			assert.NoError(tx.Commit(testCtx))
+		}()
 
 		ticketer, err := NewTicketer(testCtx, tx.DB(), WithAggregateNames(true))
 		require.NoError(err)
@@ -110,7 +114,7 @@ func Test_Redeem(t *testing.T) {
 
 		err = ticketer.Redeem(testCtx, ticket)
 		require.NoError(err)
-		tx.Commit(testCtx)
+		assert.NoError(tx.Commit(testCtx))
 
 		err = secondTicketer.Redeem(testCtx, secondTicket)
 		assert.Contains(err.Error(), "ticket already redeemed: integrity violation: error #106")

internal/oplog/writer_test.go

@@ -23,7 +23,9 @@ func Test_WriterCreate(t *testing.T) {
 		assert, require := assert.New(t), require.New(t)
 		tx, err := dbw.New(db).Begin(testCtx)
 		require.NoError(err)
-		defer tx.Rollback(testCtx)
+		defer func() {
+			assert.NoError(tx.Rollback(testCtx))
+		}()
 		w := Writer{tx.DB()}
 		user := oplog_test.TestUser{
 			Name: "foo-" + testId(t),
@@ -45,7 +47,9 @@ func Test_WriterCreate(t *testing.T) {
 		assert, require := assert.New(t), require.New(t)
 		tx, err := dbw.New(db).Begin(testCtx)
 		require.NoError(err)
-		defer tx.Rollback(testCtx)
+		defer func() {
+			assert.NoError(tx.Rollback(testCtx))
+		}()
 		w := Writer{tx.DB()}
 		err = dbw.New(w.DB).Create(testCtx, nil)
 		require.Error(err)
@@ -61,7 +65,9 @@ func Test_WriterDelete(t *testing.T) {
 		assert, require := assert.New(t), require.New(t)
 		tx, err := dbw.New(db).Begin(testCtx)
 		require.NoError(err)
-		defer tx.Rollback(testCtx)
+		defer func() {
+			assert.NoError(tx.Rollback(testCtx))
+		}()
 		w := Writer{tx.DB()}
 
 		id := testId(t)

internal/plugin/loopback/storage.go

@@ -101,7 +101,7 @@ type (
 
 type Bucket map[ObjectName]*storagePluginStorageInfo
 
-// storagePluginStorageInfo is an in-memory represenation of an object
+// storagePluginStorageInfo is an in-memory representation of an object
 // that would be normally stored in an external object store.
 type storagePluginStorageInfo struct {
 	DataChunks []Chunk `mapstructure:"dataChunks"`

internal/plugin/loopback/storage_test.go

@@ -555,7 +555,7 @@ func TestLoopbackHeadObject(t *testing.T) {
 			expectedErr: codes.InvalidArgument,
 		},
 		{
-			name: "emtpy object key",
+			name: "empty object key",
 			request: &plgpb.HeadObjectRequest{
 				Bucket: &storagebuckets.StorageBucket{
 					BucketName: "aws_s3_mock",
@@ -731,7 +731,7 @@ func TestLoopbackGetObject(t *testing.T) {
 			expectedErr: codes.InvalidArgument,
 		},
 		{
-			name: "emtpy object key",
+			name: "empty object key",
 			request: &plgpb.GetObjectRequest{
 				Bucket: &storagebuckets.StorageBucket{
 					BucketName: "aws_s3_mock",
@@ -1078,7 +1078,7 @@ func TestLoopbackPutObject(t *testing.T) {
 			expectedErr: codes.PermissionDenied,
 		},
 		{
-			name: "emtpy-object-data",
+			name: "empty-object-data",
 			request: &plgpb.PutObjectRequest{
 				Bucket: &storagebuckets.StorageBucket{
 					BucketName: "object_store",

internal/plugin/loopback/testing_grpc_stream_test.go

@@ -242,7 +242,7 @@ func Test_GetObjectStream_Server(t *testing.T) {
 		require.Contains(err.Error(), "stream is closed")
 	})
 
-	t.Run("recieve empty message", func(t *testing.T) {
+	t.Run("receive empty message", func(t *testing.T) {
 		stream := newGetObjectStream()
 		defer stream.Close()
 		require.NotNil(stream)
@@ -399,7 +399,7 @@ func Test_GetObjectStream(t *testing.T) {
 	t.Run("client receives error when server sends error", func(t *testing.T) {
 		stream := newGetObjectStream()
 
-		// Validate the client recieves an error when the server sends an error
+		// Validate the client receives an error when the server sends an error
 		// Validate the channel messages is closed
 		go func() {
 			err := stream.server.SendMsg(fmt.Errorf("mock error"))

internal/plugin/testing.go

@@ -105,12 +105,12 @@ func TestPlugin(t testing.TB, conn *db.DB, name string, opt ...TestOption) *Plug
 
 	if opts.withHostFlag {
 		// add the host supported flag
-		repo.AddSupportFlag(context.Background(), p, PluginTypeHost)
+		require.NoError(t, repo.AddSupportFlag(context.Background(), p, PluginTypeHost))
 	}
 
 	if opts.withStorageFlag {
 		// add the storage supported flag
-		repo.AddSupportFlag(context.Background(), p, PluginTypeStorage)
+		require.NoError(t, repo.AddSupportFlag(context.Background(), p, PluginTypeStorage))
 	}
 
 	return p