fix(web): stop handlers after error responses

[sawka]

Summary

• Return immediately after error responses in the service, wave-file, and local-file handlers.
• Prevent partially decoded service calls from running after a 400 response and avoid extra work or output on other error paths.
• Add regression tests for invalid service bodies, response serialization failure, and invalid file offsets.

Verification

• go test ./pkg/web -count=1 -v
• go test -race ./pkg/web -count=1
• go vet ./pkg/web

The file metadata serialization and local home-expansion error branches are not directly covered by these tests.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Advanced

Run ID: 7f2134cc-bf59-4d40-b27a-7b2a5dadb416

📥 Commits

Reviewing files that changed from the base of the PR and between c58bf7f and 69f303a.

📒 Files selected for processing (2)

• pkg/web/web.go
• pkg/web/web_test.go

Included review availability: Your plan provides up to 10 included reviews per hour; 9 remain after this review.

---

Walkthrough

The service and file handlers now return after selected request parsing, serialization, and path expansion errors. Tests cover malformed service input, response serialization failure, and an invalid wave-file offset. The copyright year is updated to 2026.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to 69f30

The handlers stop after the specified HTTP errors, and no actionable merge risk is established.

Security Architecture Review

Security architecture risk: 🔵 Low · up to 69f30

The handlers now stop processing after selected errors, reducing unintended service calls and file processing. The routes and request shape remain unchanged. Some error paths and production concurrency behavior are not directly tested.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• inferred — For the reviewed error paths, attacker-supplied malformed service JSON and offsets have less downstream reach: they terminate before service invocation or file-store access, respectively.

Trust Boundaries and Controls

• observed — The service-request decode result is checked before dispatch, and the file offset is parsed before file-store operations. These returns enforce termination at existing HTTP request boundaries.

Resilience and Maintainability Implications

• observed — The serialization-error return prevents further HTTP response writing, not an already-completed service call. The new tests exercise individual handlers synchronously and do not establish behavior under concurrent public-route requests.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 6 functions across 2 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly and concisely states that web handlers now stop after writing error responses. It matches the main change in the pull request.
Description check	✅ Passed	The description accurately summarizes the handler fixes, regression tests, verification commands, and uncovered error branches. It is directly related to the changeset.

• Fix all pre-merge checks with AI

✨ Finishing Touches 💡 2

📝 Generate docstrings 💡

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

🛠️ Fix failing CI checks 💡

• Commit to this branch
• Create a new PR

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}