fix: code review fixes — .dockerignore, -trimpath, -race, rand.Read error handling

.dockerignore

@@ -0,0 +1,9 @@
+.git
+.gitignore
+docs/
+*.md
+LICENSE
+VERSION
+dist/
+*.json
+*.exe

Dockerfile

@@ -4,7 +4,7 @@ WORKDIR /app
 COPY go.mod go.sum* ./
 RUN go mod download 2>/dev/null || true
 COPY . .
-RUN CGO_ENABLED=0 go build -o notable ./cmd/notable
+RUN CGO_ENABLED=0 go build -trimpath -o notable ./cmd/notable
 
 FROM alpine:3.20
 RUN apk add --no-cache ca-certificates

Makefile

@@ -4,10 +4,10 @@ BINARY=notable
 CMD_DIR=cmd/notable
 
 build:
-	CGO_ENABLED=0 go build -o $(BINARY) ./$(CMD_DIR)
+	CGO_ENABLED=0 go build -trimpath -o $(BINARY) ./$(CMD_DIR)
 
 test:
-	go test ./...
+	go test ./... -count=1 -race
 
 vet:
 	go vet ./...

internal/api/api.go

@@ -449,12 +449,12 @@ func (s *Server) handleUpdateNote(w http.ResponseWriter, r *http.Request, worksp
 	body := r.FormValue("body")
 	tagsStr := r.FormValue("tags")
 	var tags []string
-	if tagsStr != "" || r.FormValue("tags") != "" {
+	if tagsStr != "" {
 		tags = parseTags(tagsStr)
 	}
 
 	// Check if at least one field is being updated
-	if title == "" && body == "" && tags == nil && r.FormValue("tags") == "" {
+	if title == "" && body == "" && tags == nil {
 		s.errorResponse(w, r, http.StatusBadRequest, "no fields to update",
 			"PATCH with title=<new-title>&body=<new-body>&tags=<new-tags> (any field can be omitted)")
 		return

internal/auth/auth.go

@@ -18,7 +18,9 @@ func New(secret string) *AuthService {
 	if secret == "" {
 		// Generate a random secret
 		b := make([]byte, 32)
-		rand.Read(b)
+		if _, err := rand.Read(b); err != nil {
+			panic(fmt.Sprintf("crypto/rand failed: %v", err))
+		}
 		secret = hex.EncodeToString(b)
 	}
 	return &AuthService{secret: secret}
@@ -27,15 +29,19 @@ func New(secret string) *AuthService {
 // GenerateToken creates a new bearer token.
 func (a *AuthService) GenerateToken(workspace string) string {
 	b := make([]byte, 24)
-	rand.Read(b)
+	if _, err := rand.Read(b); err != nil {
+		panic(fmt.Sprintf("crypto/rand failed: %v", err))
+	}
 	h := sha256.Sum256(append(b, []byte(a.secret)...))
 	return "nb_" + hex.EncodeToString(h[:16])
 }
 
 // GenerateOTP creates a 6-digit OTP code.
 func (a *AuthService) GenerateOTP() string {
 	b := make([]byte, 4)
-	rand.Read(b)
+	if _, err := rand.Read(b); err != nil {
+		panic(fmt.Sprintf("crypto/rand failed: %v", err))
+	}
 	val := uint32(b[0])<<24 | uint32(b[1])<<16 | uint32(b[2])<<8 | uint32(b[3])
 	code := fmt.Sprintf("%06d", val%1000000)
 	return code
@@ -45,7 +51,9 @@ func (a *AuthService) GenerateOTP() string {
 func GenerateHandle(prefix string) string {
 	const charset = "abcdefghijklmnopqrstuvwxyz0123456789"
 	b := make([]byte, 5)
-	rand.Read(b)
+	if _, err := rand.Read(b); err != nil {
+		panic(fmt.Sprintf("crypto/rand failed: %v", err))
+	}
 	for i := range b {
 		b[i] = charset[int(b[i])%len(charset)]
 	}