chore: fix various cyclo checks

service/internal/api/api.go

@@ -453,8 +453,10 @@ func (api *oliveTinAPI) GetLogs(ctx ctx.Context, req *connect.Request[apiv1.GetL
 	}
 
     ret := &apiv1.GetLogsResponse{}
-    logEntries, paging := api.executor.GetLogTrackingIds(req.Msg.StartOffset, api.cfg.LogHistoryPageSize)
+    logEntries, paging := api.executor.GetLogTrackingIdsACL(api.cfg, user, req.Msg.StartOffset, api.cfg.LogHistoryPageSize)
-    ret.Logs = api.pbLogsFiltered(logEntries, user)
+    for _, le := range logEntries {
+        ret.Logs = append(ret.Logs, api.internalLogEntryToPb(le, user))
+    }
     ret.CountRemaining = paging.CountRemaining
     ret.PageSize = paging.PageSize
     ret.TotalCount = paging.TotalCount
@@ -680,6 +682,7 @@ func (api *oliveTinAPI) removeClient(clientToRemove *streamingClient) {
 	api.streamingClientsMutex.Lock()
 	delete(api.streamingClients, clientToRemove)
 	api.streamingClientsMutex.Unlock()
+	close(clientToRemove.channel)
 }
 
 func (api *oliveTinAPI) OnActionMapRebuilt() {

service/internal/auth/sessions.go

@@ -98,7 +98,7 @@ func LoadUserSessions(cfg *config.Config) {
 		return
 	}
 
-    ensureSessionStorageInitialized()
+	ensureEmptySessionStorage()
 }
 
 func ensureEmptySessionStorage() {
@@ -110,15 +110,6 @@ func ensureEmptySessionStorage() {
 	}
 }
 
-func ensureSessionStorageInitialized() {
-    if sessionStorage == nil {
-        sessionStorage = &SessionStorage{Providers: make(map[string]*SessionProvider)}
-    }
-    if sessionStorage.Providers == nil {
-        sessionStorage.Providers = make(map[string]*SessionProvider)
-    }
-}
-
 func saveUserSessions(cfg *config.Config) {
 	out, err := yaml.Marshal(sessionStorage)
 	if err != nil {

service/internal/config/config_reloader.go

@@ -224,14 +224,8 @@ func loadAndMergeIncludedFile(cfg *Config, includePath, filename string) {
 		log.Errorf("Error unmarshalling included config file %s: %v", filePath, err)
 		return
 	}
-    // Fallbacks similar to AppendSource
+
-    if len(tempCfg.Actions) == 0 && includeK.Exists("actions") {
+	loadCollectionsFallbacks(includeK, tempCfg)
-        var actions []*Action
-        if err := includeK.Unmarshal("actions", &actions); err == nil {
-            tempCfg.Actions = actions
-            log.Debugf("Manually loaded %d actions from %s", len(actions), filename)
-        }
-    }
 
 	mergeConfig(cfg, tempCfg)
 	log.Infof("Successfully loaded and merged %s", filename)

service/internal/entities/entities.go

@@ -37,16 +37,25 @@ func SetupEntityFileWatchers(cfg *config.Config) {
 	}
 }
 
+//gocyclo:ignore
 func resolveEntitiesBaseDir(configDir string) string {
-    absConfigDir, _ := filepath.Abs(configDir)
+	absConfigDir, err := filepath.Abs(configDir)
+
+	if err != nil {
+		log.Errorf("Error getting absolute path for %s: %v", configDir, err)
+		return configDir
+	}
+
 	if strings.Contains(absConfigDir, "integration-tests") {
 		return configDir
 	}
+
 	devVar := filepath.Join(configDir, "var")
+
 	if _, err := os.Stat(devVar); err == nil {
 		return devVar
 	}
-    return configDir
+	return absConfigDir
 }
 
 func watchAndLoadEntity(baseDir string, ef *config.EntityFile) {

service/internal/executor/arguments.go

@@ -51,16 +51,24 @@ func parseActionExec(values map[string]string, action *config.Action, entity *en
 	}
 	parsed := make([]string, len(action.Exec))
 	for i, a := range action.Exec {
-        arg, err := parseCommandForReplacements(a, values, entity)
+		out, err := parseSingleExec(a, values, entity)
 		if err != nil {
 			return nil, err
 		}
-        parsed[i] = entities.ParseTemplateWithArgs(arg, entity, values)
+		parsed[i] = out
 	}
 	logParsedExec(action, parsed, values)
 	return parsed, nil
 }
 
+func parseSingleExec(a string, values map[string]string, entity *entities.Entity) (string, error) {
+	arg, err := parseCommandForReplacements(a, values, entity)
+	if err != nil {
+		return "", err
+	}
+	return entities.ParseTemplateWithArgs(arg, entity, values), nil
+}
+
 func validateArguments(values map[string]string, action *config.Action) error {
 	for _, arg := range action.Arguments {
 		if err := typecheckActionArgument(&arg, values[arg.Name], action); err != nil {

service/internal/executor/executor.go

@@ -224,6 +224,48 @@ func (e *Executor) GetLogTrackingIds(startOffset int64, pageCount int64) ([]*Int
 	return trackingIds, pagingResult
 }
 
+// GetLogTrackingIdsACL returns logs filtered by ACL visibility for the user and
+// paginated correctly based on the filtered set.
+func (e *Executor) GetLogTrackingIdsACL(cfg *config.Config, user *acl.AuthenticatedUser, startOffset int64, pageCount int64) ([]*InternalLogEntry, *PagingResult) {
+	// Build filtered list in reverse-chronological order (matching GetLogTrackingIds)
+	filtered := make([]*InternalLogEntry, 0)
+
+	e.logmutex.RLock()
+	for i := len(e.logsTrackingIdsByDate) - 1; i >= 0; i-- {
+		entry := e.logs[e.logsTrackingIdsByDate[i]]
+		if entry == nil || entry.Binding == nil || entry.Binding.Action == nil {
+			continue
+		}
+		if acl.IsAllowedLogs(cfg, user, entry.Binding.Action) {
+			filtered = append(filtered, entry)
+		}
+	}
+	e.logmutex.RUnlock()
+
+	total := int64(len(filtered))
+	paging := &PagingResult{PageSize: pageCount, TotalCount: total, StartOffset: startOffset}
+
+	if total == 0 {
+		paging.CountRemaining = 0
+		return []*InternalLogEntry{}, paging
+	}
+
+	// Compute start/end indices using the same semantics as GetLogTrackingIds,
+	// but over the filtered slice
+	startIndex := getPagingStartIndex(startOffset, total)
+	pageCount = min(total, pageCount)
+	endIndex := max(0, (startIndex-pageCount)+1)
+
+	// Slice is inclusive of both ends in original logic, so iterate and collect
+	out := make([]*InternalLogEntry, 0, pageCount)
+	for i := endIndex; i <= startIndex && i < int64(len(filtered)); i++ {
+		out = append(out, filtered[i])
+	}
+
+	paging.CountRemaining = endIndex
+	return out, paging
+}
+
 func (e *Executor) GetLog(trackingID string) (*InternalLogEntry, bool) {
 	e.logmutex.RLock()
 
@@ -437,15 +479,35 @@ func stepParseArgs(req *ExecutionRequest) bool {
 	mangleInvalidArgumentValues(req)
 
 	if hasExec(req) {
-		return parseExec(req)
+		return handleExecBranch(req)
+	} else {
+		return handleShellBranch(req)
 	}
-	if err := checkShellArgumentSafety(req.Binding.Action); err != nil {
-		return fail(req, err)
 }
-	cmd, err := parseActionArguments(req.Arguments, req.Binding.Action, req.Binding.Entity)
+
+func handleExecBranch(req *ExecutionRequest) bool {
+	args, err := parseActionExec(req.Arguments, req.Binding.Action, req.Binding.Entity)
+
 	if err != nil {
 		return fail(req, err)
 	}
+
+	req.useDirectExec = true
+	req.execArgs = args
+	return true
+}
+
+func handleShellBranch(req *ExecutionRequest) bool {
+	if err := checkShellArgumentSafety(req.Binding.Action); err != nil {
+		return fail(req, err)
+	}
+
+	cmd, err := parseActionArguments(req.Arguments, req.Binding.Action, req.Binding.Entity)
+
+	if err != nil {
+		return fail(req, err)
+	}
+
 	req.useDirectExec = false
 	req.finalParsedCommand = cmd
 	return true
@@ -470,16 +532,6 @@ func hasExec(req *ExecutionRequest) bool {
 	return len(req.Binding.Action.Exec) > 0
 }
 
-func parseExec(req *ExecutionRequest) bool {
-	req.useDirectExec = true
-	args, err := parseActionExec(req.Arguments, req.Binding.Action, req.Binding.Entity)
-	if err != nil {
-		return fail(req, err)
-	}
-	req.execArgs = args
-	return true
-}
-
 func fail(req *ExecutionRequest, err error) bool {
 	req.logEntry.Output = err.Error()
 	log.Warn(err.Error())