[albertodonato]

ENG-9440

what

Move the GraphQL client and wrappers to internal/api/platform, and keep in
internal/api the HTTP transports, error types (APIError, NotFound,
Conflict) and the MaskSecrets helper for masking secrets in logs.

why

Allow adding other API clients (e.g. for the IaC API) sharing authentication,
logging and error handling with the platform one.

testing

just lint, just test-unit and just test (replay mode) pass. No
functional changes.

docs

Updated dev docs for the new layout, also fixing references to code that no
longer exists or has moved.

[cubic-dev-ai]

1 issue found across 109 files

Confidence score: 1/5

• newClient can send the bearer API key over plaintext HTTP when the configured endpoint uses http://. Reject non-HTTPS endpoints before creating the client.

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="internal/api/platform/client.go">

<violation number="1" location="internal/api/platform/client.go:56">
P1: Custom agent: **Flag Security Vulnerabilities**

`newClient` passes the configured endpoint straight to the HTTP client, so an `http://` endpoint sends the `Authorization: Bearer` API key without TLS. Reject non-HTTPS endpoints before creating the client.</violation>
</file>

Architecture diagram

sequenceDiagram
    participant Provider as Terraform Provider
    participant ProviderData as providerdata
    participant API as internal/api
    participant Platform as internal/api/platform
    participant Resources as Resources/DataSources
    participant Models as internal/models
    participant GraphQL as GraphQL API (external)

    Note over Provider,GraphQL: Runtime request flow

    Provider->>ProviderData: New(config)
    ProviderData->>Platform: platform.New(config)
    Platform->>API: NewTransport(apiKey, version)
    API->>API: Build AuthTransport/LogTransport chain
    
    ProviderData-->>Provider: Configured providerData
    
    Provider->>Resources: Configure with API client
    Resources->>Platform: Access platform.API methods
    
    Resources->>Platform: API calls (Read/Create/Update/Delete)
    Platform->>API: MaskSecrets(ctx, secrets...)
    API-->>Platform: Context with masked secrets
    
    Platform->>GraphQL: Query/Mutate via graphql-client
    GraphQL->>GraphQL: Auth (Bearer token)
    GraphQL->>GraphQL: Log request/response
    
    GraphQL-->>Platform: Response/Errors
    Platform->>API: Convert errors (NewAPIError)
    Platform->>Platform: Check for NotFound/Conflict
    
    alt Error: APIError
        Platform-->>Resources: Return error
    else Success
        Platform-->>Resources: Return typed data
        Resources->>Models: Update(ctx, apiData)
        Models-->>Resources: Update with diagnostics
    else NotFound
        Platform-->>Resources: Return api.NotFound
        Resources->>Resources: Remove from state
    end
    
    Resources-->>Provider: Return result

Loading

<sub>Tip: Get a Slack DM when cubic finishes reviewing your PRs. Connect Slack

Re-trigger cubic</sub>

[cubic-dev-ai]

P1: Custom agent: Flag Security Vulnerabilities

newClient passes the configured endpoint straight to the HTTP client, so an http:// endpoint sends the Authorization: Bearer API key without TLS. Reject non-HTTPS endpoints before creating the client.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. At internal/api/platform/client.go, line 56:

<comment>`newClient` passes the configured endpoint straight to the HTTP client, so an `http://` endpoint sends the `Authorization: Bearer` API key without TLS. Reject non-HTTPS endpoints before creating the client.</comment>

<file context>
@@ -0,0 +1,93 @@
+		},
+	}
+	return &client{
+		c:        graphql.NewClient(config.Endpoint, httpClient),
+		pageSize: config.PageSize,
+	}
</file context>

[albertodonato]

Production deployments are always on https, this is not a concern for the client itself

[fwereade]

LGTM, tanks