Deep Review: 20260330-155444-pr-198

Any error from GetClient().Get() — not-found, kine database issue, context cancellation — returns HTTP 404. During UI development, this masks real backend problems as "container not found." Distinguishing not-found from internal errors improves debuggability.

	var container v1alpha1.Container
	err := c.mgr.GetClient().Get(r.Context(), types.NamespacedName{
		Namespace: apiNamespace,
		Name:      containerID,
	}, &container)
	if err != nil {
		log.V(5).Info("Failed to get container", "error", err)
		http.Error(w, "Failed to get container", http.StatusNotFound)
		return
	}

Fix: Use apierrors.IsNotFound to differentiate (already imported in mock_controller.go).

+	if apierrors.IsNotFound(err) {
+		log.V(5).Info("Container not found", "container", containerID)
+		http.Error(w, "Container not found", http.StatusNotFound)
+		return
+	}
 	if err != nil {
-		log.V(5).Info("Failed to get container", "error", err)
-		http.Error(w, "Failed to get container", http.StatusNotFound)
+		log.V(5).Info("Failed to get container", "container", containerID, "error", err)
+		http.Error(w, "Failed to get container", http.StatusInternalServerError)
 		return
 	}

strings.Cut extracts the first path segment as containerID and discards the rest. A request to /passthrough/mock/logs/1234/extra/stuff succeeds with container ID 1234. While harmless for a mock endpoint, it can mask malformed frontend requests during development.

func (c *controller) handleLogs(w http.ResponseWriter, r *http.Request) {
	log := ctrl.LoggerFrom(r.Context())
	containerID, _, _ := strings.Cut(strings.TrimLeft(r.URL.Path, "/"), "/")
	log.Info("Handling logs request", "container", containerID)

	if !containerIDValidator.MatchString(containerID) {
		log.V(5).Info("Invalid container ID", "container", containerID)
		http.Error(w, "Invalid container ID", http.StatusBadRequest)

Fix: Check the after return value and reject requests with extra segments.

-	containerID, _, _ := strings.Cut(strings.TrimLeft(r.URL.Path, "/"), "/")
+	containerID, after, _ := strings.Cut(strings.TrimLeft(r.URL.Path, "/"), "/")
+	if after != "" {
+		http.Error(w, "Invalid path", http.StatusBadRequest)
+		return
+	}

The deferred conn.Close() runs immediately after the close-frame write without waiting for the client to echo the close frame. Browser clients may see 1006 Abnormal Closure instead of the clean 1000 Normal Closure. Acceptable for a mock endpoint, but a brief read loop after sending the close message would produce cleaner client-side behavior.

	defer conn.Close()
	defer func() {
		message := websocket.FormatCloseMessage(websocket.CloseNormalClosure, "Closing connection")
		err := conn.WriteControl(websocket.CloseMessage, message, time.Now().Add(time.Second))
		if err != nil {
			log.V(5).Info("Failed to close WebSocket", "error", err)
		}
	}()