From ca169348b98ddccb1980e34888e7511b55547cfc Mon Sep 17 00:00:00 2001
From: Wikid82 <jhatfield82@gmail.com>
Date: Tue, 8 Sep 2026 23:35:39 -0400
Subject: [PATCH] chore: re-anchor go/log-injection CodeQL suppression after
 route-group split

The management-API authorization hardening changed
RemoteServerHandler.RegisterRoutes to a (read, admin *gin.RouterGroup)
split, adding lines above Update() and shifting the suppressed
logger.Log()...Warn() sink in remote_server_handler.go from line 142 to
~148. The exact-line suppression entry no longer matched, so the
findings-gate counted the (unchanged, still-false-positive) go/log-injection
result as blocking on the full-tree scan run by the main->development
propagation PR.

Widen the entry to a line_range (146-150), mirroring the existing
uptime_service.go sibling entry that hit the same drift, so the multi-line
log chain stays covered regardless of which line CodeQL anchors to.

No code or behavior change.

Claude-Session: https://claude.ai/code/session_01Jz4LgwfkxaF8E7TdAgk94y
---
 .github/codeql/codeql-suppressions.yml | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/.github/codeql/codeql-suppressions.yml b/.github/codeql/codeql-suppressions.yml
index b7766363b..0ab6be581 100644
--- a/.github/codeql/codeql-suppressions.yml
+++ b/.github/codeql/codeql-suppressions.yml
@@ -48,7 +48,9 @@ suppressions:
 
   - rule_id: go/log-injection
     path: backend/internal/api/handlers/remote_server_handler.go
-    line: 142
+    line_range:
+      start: 146
+      end: 150
     reason: >
       False positive. The logged value is the goroutine's `id uint`
       parameter (bound from `server.ID`, a GORM-assigned numeric primary
@@ -67,6 +69,14 @@ suppressions:
       this entry is the documented fallback for when a local SARIF scan
       does not populate `result.suppressions` (see the
       go/cookie-secure-not-set entry above for the same limitation).
+      Extended 2026-09-09: the management-API authorization hardening
+      (fix(security): apply deny-by-default authorization on management
+      API subroutes) changed RemoteServerHandler.RegisterRoutes to a
+      (read, admin *gin.RouterGroup) split, adding lines above Update and
+      shifting the sink from line 142 to ~148; widened to a line_range so
+      the multi-line `logger.Log().WithError(...).WithField(...).Warn(...)`
+      chain stays covered regardless of which line CodeQL anchors
+      startLine to.
     added: "2026-08-27"
     review_by: "2026-11-27"