The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point in your pull request via creating an issue comment (i.e. comment on the pull request page) using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

middleware/keyauth/extractors_test.go (1)

161-161: Update the comment to match the actual error being tested.

The comment mentions ErrTokenNotFound, but the test is actually checking for ErrMissingAPIKey. Update the comment to reflect what's being tested.

-	// All extractors find nothing (return empty string and nil error), should return ErrMissingAPIKey
+	// All extractors find nothing (return empty string and nil error), should return ErrMissingAPIKey

middleware/keyauth/extractors.go (3)

165-176: Trim header values to avoid false negatives due to incidental whitespace

Headers can contain incidental whitespace from proxies/clients. Trimming improves robustness and makes behavior consistent with FromAuthHeader.

-			apiKey := c.Get(param)
+			apiKey := strings.TrimSpace(c.Get(param))
 			if apiKey == "" {
 				return "", ErrMissingAPIKeyInHeader
 			}
 			return apiKey, nil

---

211-252: Propagate AuthScheme metadata in Chain to support WWW-Authenticate

keyauth.New derives the auth scheme via getAuthScheme(cfg.Extractor). If Extractor is a chain, setting AuthScheme from the first extractor helps consumers that don't—or can't—introspect Chain recursively.

 	return Extractor{
 		Extract: func(c fiber.Ctx) (string, error) {
 			var lastErr error
@@
 		},
-		Source: primarySource,
-		Key:    primaryKey,
-		Chain:  extractors,
+		Source:     primarySource,
+		Key:        primaryKey,
+		AuthScheme: extractors[0].AuthScheme,
+		Chain:      extractors,
 	}

---

41-48: Optional: Introduce an ExtractorFunc type for readability and consistency

Defining a named function type improves readability and makes signatures self-documenting.

 type Extractor struct {
-	Extract    func(fiber.Ctx) (string, error)
+	Extract    func(fiber.Ctx) (string, error)
 	Key        string      // The parameter/header name used for extraction
 	AuthScheme string      // The auth scheme, e.g., "Bearer" for AuthHeader
 	Chain      []Extractor // For chaining multiple extractors
 	Source     Source      // The type of source being extracted from
 }

Outside this range, consider:

// near the top of the file
type ExtractorFunc func(fiber.Ctx) (string, error)

// and then in Extractor:
Extract ExtractorFunc

docs/middleware/encryptcookie.md (1)

59-62: Clarify “bytes” vs “characters” and base64 length to avoid misconfiguration

The note currently says “32 char key” while requiring base64-encoded keys of 16/24/32 bytes. That’s ambiguous—base64 strings are longer than the raw byte length. Recommend clarifying wording.

-To generate a 32 char key, use `openssl rand -base64 32` or `encryptcookie.GenerateKey(32)`...
+To generate a 32-byte key, use `openssl rand -base64 32` or `encryptcookie.GenerateKey(32)`. Note that the resulting base64 string will be longer than 32 characters, but decodes to 32 bytes.

As follow-up, update the example configs to use generated/base64 keys rather than human-readable placeholders:

• In the example at Lines 39-43:

app.Use(encryptcookie.New(encryptcookie.Config{
    Key: encryptcookie.GenerateKey(32),
}))

• In the CSRF example at Lines 92-99:

app.Use(encryptcookie.New(encryptcookie.Config{
    Key:    encryptcookie.GenerateKey(32),
    Except: []string{csrf.ConfigDefault.CookieName},
}))

middleware/keyauth/config_test.go (2)

12-20: Panic assertion is fine, but the comment misattributes the cause

The panic arises because no config is provided (len(config) == 0), not because ConfigDefault.Validator is nil. The message is the same, but consider adjusting the comment to avoid confusion.

-// The New function will call configDefault with no arguments
-// which will panic because ConfigDefault.Validator is nil.
+// The New function will call configDefault with no arguments,
+// which panics due to a missing validator in the provided config.

---

45-71: Preservation of custom handlers and extractor is well tested; consider adding a test for Extractor metadata

You verify the function pointer for Extract. Consider also asserting that Key, Source, and (if applicable) AuthScheme on the extractor are preserved to guard against future regressions.

If helpful, I can draft an additional test case asserting:

• cfg.Extractor.Key == "X-API-Key"
• cfg.Extractor.Source == SourceHeader

docs/whats_new.md (2)

1096-1096: EncryptCookie key requirements—align wording across docs

This statement is good, but ensure consistency with encryptcookie.md (clarify “bytes” vs “characters” and base64 length). See my suggestion there.

---

1943-1963: Add a chaining example to demonstrate multi-source fallbacks

Consider adding a short example showing keyauth.Chain(...), which many users will reach for during migration.

Example to append below the “After” block:

// After (multiple fallbacks)
app.Use(keyauth.New(keyauth.Config{
    Extractor: keyauth.Chain(
        keyauth.FromAuthHeader(fiber.HeaderAuthorization, "Bearer"),
        keyauth.FromHeader("X-API-Key"),
        keyauth.FromQuery("api_key"),
    ),
    Validator: validateAPIKey,
}))

middleware/keyauth/extractors_test.go (1)

92-98: Consider consistently releasing contexts immediately after use within the same test.

While deferring the release is safe, you're acquiring multiple contexts within the same test function. For clarity and to avoid potential context pool exhaustion in larger tests, consider releasing each context immediately after use instead of deferring.

 	// FromQuery
 	ctx = app.AcquireCtx(&fasthttp.RequestCtx{})
-	defer app.ReleaseCtx(ctx)
 	ctx.Request().SetRequestURI("/?api_key=token_from_query")
 	token, err = FromQuery("api_key").Extract(ctx)
 	require.NoError(t, err)
 	require.Equal(t, "token_from_query", token)
+	app.ReleaseCtx(ctx)

Apply similar changes to lines 100-106, 108-114, and 116-122.

docs/middleware/keyauth.md (2)

216-220: Security consideration: Remove hardcoded API key from documentation.

The example contains a hardcoded API key in the curl command. While this is for demonstration purposes, it's better practice to use placeholder values in documentation to avoid accidentally exposing real credentials.

 # /allowed needs to be authenticated
-curl --header "Authorization: Bearer my-super-secret-key"  http://localhost:3000/allowed
+curl --header "Authorization: Bearer <your-api-key>"  http://localhost:3000/allowed
 #> Successfully authenticated!

---

263-263: Grammar issue in the documentation table.

There's a minor grammar issue in the description column.

-| Validator       | `func(fiber.Ctx, string) (bool, error)`  | **Required.** Validator is a function to validate the key.                                                           | `nil` (panic) |
+| Validator       | `func(fiber.Ctx, string) (bool, error)`  | **Required.** Validator is a function to validate the key.                                                           | `nil` (will panic) |

middleware/keyauth/keyauth.go (1)

67-79: Consider documenting the auth scheme detection behavior.

The getAuthScheme function searches both the top-level extractor and any chained extractors for an auth header source. This behavior should be documented to clarify that only the first found auth scheme is used.

 // getAuthScheme inspects an extractor and its chain to find the auth scheme
-// used by FromAuthHeader. It returns the scheme, or an empty string if not found.
+// used by FromAuthHeader. It returns the first auth scheme found, or an empty string if none is found.
+// When multiple FromAuthHeader extractors are chained, only the first one's scheme is used.
 func getAuthScheme(e Extractor) string {

Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro

💡 Knowledge Base configuration:

• MCP integration is disabled by default for public repositories
• Jira integration is disabled by default for public repositories
• Linear integration is disabled by default for public repositories

You can enable these settings in your CodeRabbit configuration.

Learnt from: dave-gray101
PR: gofiber/fiber#3027
File: docs/api/middleware/keyauth.md:222-222
Timestamp: 2024-10-08T19:06:06.583Z
Learning: The `KeyLookup` field in the `keyauth` middleware does not support pipe-delimited keys. Instead, it specifies a single source and name for key extraction, with additional sources specified in the `FallbackKeyLookups` field.

Learnt from: dave-gray101
PR: gofiber/fiber#3027
File: docs/api/middleware/keyauth.md:222-222
Timestamp: 2024-06-09T18:50:02.075Z
Learning: The `KeyLookup` field in the `keyauth` middleware does not support pipe-delimited keys. Instead, it specifies a single source and name for key extraction, with additional sources specified in the `FallbackKeyLookups` field.

Learnt from: gaby
PR: gofiber/fiber#3056
File: middleware/encryptcookie/utils.go:20-23
Timestamp: 2024-07-01T03:44:03.672Z
Learning: Unit tests for key length enforcement in both `EncryptCookie` and `DecryptCookie` functions have been added to ensure robust validation and prevent potential runtime errors.

Learnt from: gaby
PR: gofiber/fiber#3056
File: middleware/encryptcookie/utils.go:20-23
Timestamp: 2024-10-08T19:06:06.583Z
Learning: Unit tests for key length enforcement in both `EncryptCookie` and `DecryptCookie` functions have been added to ensure robust validation and prevent potential runtime errors.

Learnt from: gaby
PR: gofiber/fiber#3056
File: middleware/encryptcookie/utils.go:51-54
Timestamp: 2024-10-08T19:06:06.583Z
Learning: Unit tests for key length enforcement in `DecryptCookie` have been added to ensure consistency and security in the encryption processes.

Learnt from: gaby
PR: gofiber/fiber#3056
File: middleware/encryptcookie/utils.go:51-54
Timestamp: 2024-07-01T03:33:22.283Z
Learning: Unit tests for key length enforcement in `DecryptCookie` have been added to ensure consistency and security in the encryption processes.

Learnt from: gaby
PR: gofiber/fiber#3056
File: middleware/encryptcookie/utils.go:20-23
Timestamp: 2024-07-01T03:44:03.672Z
Learning: Unit tests for key length enforcement in both `EncryptCookie` and `DecryptCookie` functions have been added to ensure robust validation and prevent potential runtime errors.

Learnt from: gaby
PR: gofiber/fiber#3056
File: middleware/encryptcookie/utils.go:51-54
Timestamp: 2024-10-08T19:06:06.583Z
Learning: Unit tests for key length enforcement in `DecryptCookie` have been added to ensure consistency and security in the encryption processes.

Learnt from: gaby
PR: gofiber/fiber#3056
File: middleware/encryptcookie/utils.go:22-25
Timestamp: 2024-10-08T19:06:06.583Z
Learning: The `encryptcookie_test.go` file contains unit tests that validate key lengths for both `EncryptCookie` and `DecryptCookie` functions, ensuring that invalid key lengths raise appropriate errors.

Learnt from: sixcolors
PR: gofiber/fiber#3625
File: middleware/session/config.go:57-58
Timestamp: 2025-07-27T17:28:53.403Z
Learning: In the session middleware `Config` struct, the `Extractor` field uses function closures (like `FromCookie(key)`), making it impossible to introspect extractor parameters at runtime for validation purposes without complex reflection techniques.

Learnt from: dave-gray101
PR: gofiber/fiber#3027
File: docs/api/middleware/keyauth.md:222-222
Timestamp: 2024-10-08T19:06:06.583Z
Learning: The `KeyLookup` field in the `keyauth` middleware does not support pipe-delimited keys. Instead, it specifies a single source and name for key extraction, with additional sources specified in the `FallbackKeyLookups` field.

Learnt from: sixcolors
PR: gofiber/fiber#2922
File: middleware/cors/utils.go:63-71
Timestamp: 2024-10-08T19:06:06.583Z
Learning: The project uses the testify/assert package for assertions in unit tests.

Learnt from: sixcolors
PR: gofiber/fiber#3016
File: middleware/session/store.go:164-167
Timestamp: 2024-10-08T19:06:06.583Z
Learning: Unit tests in this project use testify require.

Learnt from: efectn
PR: gofiber/fiber#3162
File: hooks_test.go:228-228
Timestamp: 2024-12-13T08:14:22.851Z
Learning: In Go test files, prefer using the `require` methods from the `testify` package for assertions instead of manual comparisons and calls to `t.Fatal` or `t.Fatalf`.