donvito · donvito · May 12, 2026
diff --git a/review-results/code-review-results.md b/review-results/code-review-results.md
@@ -0,0 +1,146 @@
+# Code Review and Test Results
+
+Generated by unofficial cursor go sdk.
+
+Date: 2026-05-12
+
+## Scope
+
+Reviewed the Go learning/examples repository under `/workspace`, with emphasis on buildability, test coverage, runtime failure modes, resource handling, and security-sensitive example behavior. The repository does not have a root `go.mod`; several subdirectories are standalone examples and a few directories are independent Go modules.
+
+## Review Findings
+
+### High severity
+
+1. **Kafka REST endpoint can report success while dropping messages**
+   - File: `rest-kafka-mongo-microservice/rest-to-kafka/rest-kafka-sample.go:47-85`
+   - `jobsPostHandler` calls `saveJobToKafka` and then returns the submitted job as success. `saveJobToKafka` creates a new asynchronous Kafka producer per request, ignores the `Produce` return error, never flushes delivery events, and never closes the producer. A request can therefore receive a successful HTTP response even when Kafka delivery failed or never completed.
+
+2. **Several external-dependency examples are not buildable in modern module mode**
+   - Examples without local `go.mod` files import third-party packages:
+     - `kafka/producer/main.go`
+     - `kafka/consumer/main.go`
+     - `rest-kafka-mongo-microservice/rest-to-kafka/rest-kafka-sample.go`
+     - `rest-kafka-mongo-microservice/kafka-to-mongo/kafka-mongo-sample.go`
+     - `mongo-microservice/rest/connect-mongo-rest-sample.go`
+     - `docker/api/main.go`
+   - With Go 1.22 module defaults and no root module, these examples require either per-example modules or explicit GOPATH-mode setup.
+
+3. **HTTP handlers panic on request, backend, or configuration errors**
+   - Files:
+     - `mongo-microservice/rest/connect-mongo-rest-sample.go:61-64`, `:89-107`
+     - `rest-kafka-mongo-microservice/rest-to-kafka/rest-kafka-sample.go:33-36`, `:73-76`
+     - `htmx/main.go:61-65`
+     - `docker/api/main.go:31-42`, `:53-64`, `:77-87`, `:100-110`
+   - Panics in HTTP request paths can crash the server or turn routine malformed input/backend failures into denial-of-service behavior. These examples should prefer error responses and logging over `panic` inside handlers.
+
+### Medium severity
+
+4. **Groq HTTP clients can leak response bodies and hang indefinitely**
+   - Files:
+     - `ai/go-groq/groq_client.go:125-140`
+     - `htmx/groq_client.go:125-140`
+   - The response body is only closed after the status-code check, so non-200 responses return without closing `resp.Body`. Both clients also use `http.Client{}` without a timeout, so outbound API calls can block indefinitely.
+
+5. **Postgres example hardcodes credentials and prints password data**
+   - File: `connect-to-db-postgres/main.go:11-16`, `:28`, `:43`, `:48`
+   - The example hardcodes `postgres/postgres`, disables SSL, selects password fields, and prints password data to stdout. Even in examples, this encourages unsafe credential and secret-handling patterns.
+
+6. **Docker API examples expose host/container inventory without authentication**
+   - File: `docker/api/main.go:22-27`, `:31-119`
+   - The HTTP server exposes local Docker image, container, network, and swarm node metadata. If bound beyond localhost, this can disclose sensitive host information. Handler panics on Docker API errors add reliability risk.
+
+### Low severity
+
+7. **`pointers/basic` is not buildable as a package**
+   - Files:
+     - `pointers/basic/main.go:8`
+     - `pointers/basic/pass-by-pointer.go:7`
+     - `pointers/basic/pass-by-pointer-struct.go:15`
+   - The directory contains three `func main()` declarations in one `package main`. Individual files can be run separately, but `go test` or `go run .` fails with redeclared `main`.
+
+8. **Mongo GET handler ignores query errors**
+   - File: `mongo-microservice/rest/connect-mongo-rest-sample.go:70-80`
+   - The `All(&results)` error is ignored, so database failures may return HTTP 200 with an empty result set.
+
+9. **Goroutine select example does not terminate the logger loop**
+   - File: `goroutine/select/main.go:35-41`
+   - `break` exits only the `select`, not the surrounding `for`. The program exits because `main` returns, but the pattern would leak or hang in code that waits for the goroutine to stop.
+
+## Test Environment
+
+```text
+go version go1.22.2 linux/amd64
+```
+
+## Test Results
+
+### Passed
+
+```text
+cd /workspace/http-server && go test ./...
+?   	httpserver	[no test files]
+
+cd /workspace/htmx && go test ./...
+?   	htmx	[no test files]
+
+cd /workspace/ai/go-groq && go test ./...
+?   	go-groq	[no test files]
+
+cd /workspace/connect-to-db-postgres && go test ./...
+?   	connect-to-db	[no test files]
+
+cd /workspace/testing && GO111MODULE=off go test
+PASS
+ok  	_/workspace/testing	0.002s
+
+cd /workspace/benchmark && GO111MODULE=off go test -run=^$ -bench=.
+BenchmarkSum10-4         	95062862	        12.20 ns/op
+BenchmarkSum100-4        	 8127459	       138.0 ns/op
+BenchmarkSum1000-4       	  905122	      1235 ns/op
+BenchmarkSum10000-4      	   74575	     15077 ns/op
+BenchmarkSum100000-4     	    7236	    175557 ns/op
+BenchmarkSum1000000-4    	     582	   2115345 ns/op
+BenchmarkSum10000000-4   	      18	 126526177 ns/op
+PASS
+ok  	_/workspace/benchmark	15.139s
+```
+
+### Failed / blocked
+
+```text
+cd /workspace/testing && go test ./...
+pattern ./...: directory prefix . does not contain main module or its selected dependencies
+```
+
+Reason: `testing` is a standalone package directory without a `go.mod`; it passes when run with `GO111MODULE=off`.
+
+```text
+cd /workspace/benchmark && go test -run=^$ -bench=.
+go: cannot find main module, but found .git/config in /workspace
+	to create a module there, run:
+	cd .. && go mod init
+```
+
+Reason: `benchmark` is a standalone package directory without a `go.mod`; it passes when run with `GO111MODULE=off`.
+
+```text
+cd /workspace/pointers/basic && GO111MODULE=off go test
+# _/workspace/pointers/basic
+./pass-by-pointer-struct.go:15:6: main redeclared in this block
+	./main.go:8:6: other declaration of main
+./pass-by-pointer.go:7:6: main redeclared in this block
+	./main.go:8:6: other declaration of main
+FAIL	_/workspace/pointers/basic [build failed]
+```
+
+Reason: the directory contains multiple example programs with separate `main` functions in the same package.
+
+## Recommendations
+
+1. Add `go.mod` files to external-dependency examples or restructure the repository into a root workspace/module layout.
+2. Replace handler panics with explicit HTTP error responses and structured logging.
+3. Reuse Kafka producers, check `Produce` errors, flush delivery events, and close producers during shutdown.
+4. Add timeouts to outbound HTTP clients and close response bodies before returning on non-200 responses.
+5. Keep credentials and secrets out of source examples; use environment variables and avoid printing password fields.
+6. Split multi-program directories such as `pointers/basic` into subdirectories or convert one-off examples into tests/documented snippets.