mir-backend-go-ginlisted

Make It Right (Gin module). Gin web framework reliability augmentation for Go backends. Chains: mir-backend (generic gates) -> mir-backend-go (Go runtime) -> this (Gin library mechanics). Adds the mechanical footguns the runtime-agnostic tiers omit: *gin.Context is request-scoped and pooled, so it must be copied with c.Copy() before any spawned goroutine touches it; passing *gin.Context as a context.Context silently drops cancellation unless engine.ContextWithFallback is set; binding and validation discipline (ShouldBindJSON, binding tags, a separate request struct, EnableDecoderDisallowUnknownFields); middleware ordering and graceful shutdown wiring (http.Server.Shutdown on SIGTERM); and Gin's insecure defaults - SetTrustedProxies defaults to 0.0.0.0/0 so c.ClientIP() is attacker-controlled, and gin-contrib/cors will emit credentials with a reflected origin. TRIGGER only when the Go backend uses the Gin framework - building, reviewing, or debugging a Gin handler, middleware, or router. SKIP for Fiber (mir-ba
anantbhandarkar/make-it-right · ★ 15 · API & Backend · score 81

Install: claude install-skill anantbhandarkar/make-it-right

# /mir-backend-go-gin · Make It Right (Gin) Bottom tier of the chain: `mir-backend` (generic gates) → `mir-backend-go` (Go runtime model) → **this** (Gin library mechanics). Run the gates first; load the Go runtime tier for goroutine lifecycle, context propagation, and race discipline; reach for *this* at Gate 5 (design mechanics), Gate 6 (implementation), and Gate 7 review. **Runtime-level concerns (goroutine leaks, data races, context propagation, typed-nil, slice aliasing, `http.Server` timeouts) live in `mir-backend-go` — not here.** **Stack state, verified 13 Aug 2026.** `github.com/gin-gonic/gin` **v1.12.0** (2026-02-28) is current; v1.11.0 (2025-09-20) added HTTP/3 via quic-go and `BindPlain`. v1.12.0's `go.mod` requires **Go 1.25** — an older toolchain will not build it. Gin is a `net/http` framework: `*gin.Engine` implements `http.Handler`, so standard `net/http` middleware composes with it. If the project uses `gin-contrib/*` middleware or GORM, note the interaction before applying these. ## The Gin footguns AI walks into most ### 1. `*gin.Context` is request-scoped — never retain it across the handler boundary `*gin.Context` is reused from a `sync.Pool` after the handler returns. Passing a `*gin.Context` reference to a goroutine spawned inside the handler and then accessing it after the handler returns causes a data race on the pooled object — you get another request's data or a crash. - **Call `c.Copy()` before passing `*gin.Context` to any goroutine.** ``