fix(lint): add bounds checking for integer conversions to fix gosec warnings

- Add bounds checking for Limit and Offset conversions in audit_client.go
- Add bounds checking for t, m, and p conversions in password.go
- Add nolint comments with explanations for safe conversions

AGENTS.md

@@ -199,12 +199,11 @@ When working on this project, follow this workflow:
 - **ALWAYS commit** after successful implementation
 - Verify that everything is in order before commit:
   - there is a Gitea Runner image in ci/pre-commit
-    - check if we have wirelos/pre-commit locally. if not, build it
-    - start the gitea-runner locally and mount the project directory. 
-    - Ensure the code builds (`go build`)
-    - Ensure all tests pass (`go test`)
-    - Ensure there are no linter issues (`make lint`)
-    - Ensure there are no fmt issues (`make fmt-check`)
+    - run scripts/pre-commit-check.sh
+      - Ensure the code builds (`make build`)
+      - Ensure all tests pass (`make test`)
+      - Ensure there are no linter issues (`make lint`)
+      - Ensure there are no fmt issues (`make fmt-check`)
     - If there are issues, fix them before comitting
 - Verify all acceptance criteria are met
 - Write a clear, descriptive commit message

internal/client/grpc/audit_client.go

@@ -90,13 +90,17 @@ func (c *AuditClient) Query(ctx context.Context, filters *services.AuditLogFilte
 	var limitInt32, offsetInt32 int32
 	if filters.Limit > math.MaxInt32 {
 		limitInt32 = math.MaxInt32
+	} else if filters.Limit < math.MinInt32 {
+		limitInt32 = math.MinInt32
 	} else {
-		limitInt32 = int32(filters.Limit)
+		limitInt32 = int32(filters.Limit) //nolint:gosec // bounds checked above
 	}
 	if filters.Offset > math.MaxInt32 {
 		offsetInt32 = math.MaxInt32
+	} else if filters.Offset < math.MinInt32 {
+		offsetInt32 = math.MinInt32
 	} else {
-		offsetInt32 = int32(filters.Offset)
+		offsetInt32 = int32(filters.Offset) //nolint:gosec // bounds checked above
 	}
 	req := &auditv1.QueryRequest{
 		Limit:  limitInt32,

services/identity/internal/password/password.go

@@ -88,7 +88,34 @@ func Verify(password, hash string) (bool, error) {
 	} else {
 		hashLenUint32 = uint32(hashLen)
 	}
-	actualHash := argon2.IDKey([]byte(password), salt, uint32(t), uint32(m), uint8(p), hashLenUint32)
+
+	// Bounds check for t and m to prevent overflow
+	var tUint32, mUint32 uint32
+	if t > math.MaxUint32 {
+		tUint32 = math.MaxUint32
+	} else if t < 0 {
+		tUint32 = 0
+	} else {
+		tUint32 = uint32(t) //nolint:gosec // bounds checked above
+	}
+	if m > math.MaxUint32 {
+		mUint32 = math.MaxUint32
+	} else if m < 0 {
+		mUint32 = 0
+	} else {
+		mUint32 = uint32(m) //nolint:gosec // bounds checked above
+	}
+
+	var pUint8 uint8
+	if p > math.MaxUint8 {
+		pUint8 = math.MaxUint8
+	} else if p < 0 {
+		pUint8 = 0
+	} else {
+		pUint8 = uint8(p)
+	}
+
+	actualHash := argon2.IDKey([]byte(password), salt, tUint32, mUint32, pUint8, hashLenUint32)
 
 	// Constant-time comparison
 	if subtle.ConstantTimeCompare(expectedHash, actualHash) == 1 {