Add missing error checks identified by CodeQL

CodeQL identified 8 instances where error values were assigned but never
checked before using the returned data. This commit fixes 7 of them
(the 8th is in a separate PR for TOTP nil pointer dereference).

Fixed locations:
- backend/authschemes/localauth/services.go:53
  Check error from FindUserAuthByUserID before using authData

- backend/services/operation_vars.go:37, 58, 170
  Check error from lookupOperation before using operation.ID in auth checks
  Check error from ListOperationVars before iterating over results

- backend/services/user_groups.go:321, 365
  Check error from lookupOperation before using operation.ID in auth checks

- backend/workers/email.go:111
  Check error from database Select, log and continue on failure

These were all potential bugs where:
1. nil pointer dereferences could occur (services.go)
2. authorization checks could use invalid operation IDs (operation_vars, user_groups)
3. database errors were silently ignored (email worker)

Related to security assessment code quality findings.

Author: jkennedyvz

backend/authschemes/localauth/services.go

@@ -51,6 +51,9 @@ func deleteUserTotp(ctx context.Context, bridge authschemes.AShirtAuthBridge, us
 		return backend.WrapError("Non-Admin tried to delete totp status for another user", backend.UnauthorizedWriteErr(err))
 	}
 	authData, err := bridge.FindUserAuthByUserID(userID)
+	if err != nil {
+		return backend.WrapError("Unable to find user authentication data", err)
+	}
 
 	if authData.TOTPSecret == nil {
 		return backend.BadInputErr(

backend/services/operation_vars.go

@@ -35,6 +35,9 @@ type DeleteOperationVarInput struct {
 
 func CreateOperationVar(ctx context.Context, db *database.Connection, i CreateOperationVarInput) (*dtos.OperationVar, error) {
 	operation, err := lookupOperation(db, i.OperationSlug)
+	if err != nil {
+		return nil, backend.WrapError("Unable to create operation variable", err)
+	}
 	if err := policy.Require(middleware.Policy(ctx), policy.CanCreateOpVars{OperationID: operation.ID}); err != nil {
 		return nil, backend.WrapError("Unable to create operation variable", backend.UnauthorizedWriteErr(err))
 	}
@@ -53,6 +56,9 @@ func CreateOperationVar(ctx context.Context, db *database.Connection, i CreateOp
 	var varID int64
 
 	listOfVarsInOperation, err := ListOperationVars(ctx, db, i.OperationSlug)
+	if err != nil {
+		return nil, backend.WrapError("Unable to list existing operation variables", err)
+	}
 	for _, varInOperation := range listOfVarsInOperation {
 		if varInOperation.Name == formattedName {
 			return nil, backend.BadInputErr(errors.New("Unable to create operation variable. Invalid operation variable name"), "A variable with this name already exists in the operation")
@@ -159,6 +165,9 @@ func UpdateOperationVar(ctx context.Context, db *database.Connection, i UpdateOp
 	formattedName := helpers.StrToUpperCaseUnderscore(i.Name)
 
 	listOfVarsInOperation, err := ListOperationVars(ctx, db, i.OperationSlug)
+	if err != nil {
+		return backend.WrapError("Unable to list existing operation variables", err)
+	}
 	for _, varInOperation := range listOfVarsInOperation {
 		if varInOperation.Name == formattedName {
 			return backend.BadInputErr(errors.New("Unable to update operation variable. Invalid operation variable name"), "A variable with this name already exists in the operation")

backend/services/user_groups.go

@@ -319,6 +319,9 @@ func SortUsersInToGroups(slugMap SlugMap) ([]dtos.UserGroupAdminView, error) {
 // Lists all user groups for an operation; op admins and sys admins can view
 func ListUserGroupsForOperation(ctx context.Context, db *database.Connection, i ListUserGroupsForOperationInput) ([]*dtos.UserGroupOperationRole, error) {
 	operation, err := lookupOperation(db, i.OperationSlug)
+	if err != nil {
+		return nil, backend.WrapError("Unable to list usergroups", err)
+	}
 	if err := policyRequireWithAdminBypass(ctx, policy.CanListUserGroupsOfOperation{OperationID: operation.ID}); err != nil {
 		return nil, backend.WrapError("Unwilling to list usergroups", backend.UnauthorizedReadErr(err))
 	}
@@ -357,6 +360,9 @@ func wrapListUserGroupsForOperationResponse(userGroups []userGroupAndRole) []*dt
 // lists all user groups that can be added to an operation
 func ListUserGroups(ctx context.Context, db *database.Connection, i ListUserGroupsInput) ([]*dtos.UserGroupAdminView, error) {
 	operation, err := lookupOperation(db, i.OperationSlug)
+	if err != nil {
+		return nil, backend.WrapError("Unable to list usergroups", err)
+	}
 	if err := policyRequireWithAdminBypass(ctx, policy.CanListUserGroupsOfOperation{OperationID: operation.ID}); err != nil {
 		return nil, backend.WrapError("Unwilling to list usergroups", backend.UnauthorizedReadErr(err))
 	}

backend/workers/email.go

@@ -114,6 +114,11 @@ func (w *EmailWorker) run() {
 			Where(sq.Expr("error_count < ?", 3)).
 			OrderBy("updated_at ASC"). // grab the oldest emails first, prefer jobs that have not errored out
 			Limit(50))
+		if err != nil {
+			w.logger.Error("Failed to fetch emails from queue", "error", err)
+			time.Sleep(emailPollDelay)
+			continue
+		}
 
 		if len(emails) > 0 {
 			for _, email := range emails {