From 0121acfe8a788b468f8d34bb1a0a85d727c31a2f Mon Sep 17 00:00:00 2001
From: "sergio.corral" <sergio.corral@conductorone.com>
Date: Fri, 10 Jul 2026 14:12:43 -0300
Subject: [PATCH] fix: return InvalidArgument instead of panicking on empty
 resource_id in enable_user/disable_user (CXH-2015)

An empty or too-short resource_id passed to parseObjectID caused a slice-bounds panic; now returns a clean error surfaced as InvalidArgument.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 pkg/connector/helpers.go      |  3 +++
 pkg/connector/helpers_test.go | 28 ++++++++++++++++++++++++++++
 2 files changed, 31 insertions(+)
 create mode 100644 pkg/connector/helpers_test.go

diff --git a/pkg/connector/helpers.go b/pkg/connector/helpers.go
index 4c35ce5..76e407f 100644
--- a/pkg/connector/helpers.go
+++ b/pkg/connector/helpers.go
@@ -13,6 +13,9 @@ func formatObjectID(resourceTypeID string, id int64) string {
 }
 
 func parseObjectID(id string) (int64, error) {
+	if len(id) < 2 {
+		return 0, fmt.Errorf("invalid resource id: %q", id)
+	}
 	return strconv.ParseInt(id[1:], 10, 64)
 }
 
diff --git a/pkg/connector/helpers_test.go b/pkg/connector/helpers_test.go
new file mode 100644
index 0000000..c3529ce
--- /dev/null
+++ b/pkg/connector/helpers_test.go
@@ -0,0 +1,28 @@
+package connector
+
+import "testing"
+
+func TestParseObjectID(t *testing.T) {
+	tests := []struct {
+		name    string
+		input   string
+		wantID  int64
+		wantErr bool
+	}{
+		{"empty string", "", 0, true},
+		{"single char prefix only", "u", 0, true},
+		{"valid user id", "u12345", 12345, false},
+		{"invalid non-numeric suffix", "uabc", 0, true},
+	}
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			got, err := parseObjectID(tc.input)
+			if (err != nil) != tc.wantErr {
+				t.Fatalf("parseObjectID(%q) error = %v, wantErr %v", tc.input, err, tc.wantErr)
+			}
+			if !tc.wantErr && got != tc.wantID {
+				t.Fatalf("parseObjectID(%q) = %d, want %d", tc.input, got, tc.wantID)
+			}
+		})
+	}
+}