[jeferson0306]

Repository hygiene

CI. The tests existed and nothing ran them — a pull request could break master in silence. The workflow checks gofmt, runs go vet, and runs the suite with -race. The race detector matters here specifically: the cache and the HTTP handlers run concurrently, and a data race would surface as a wrong validation result under load, which is the worst way for this service to fail.

Licence. A public repository without one cannot legally be adopted by anyone who finds it. MIT, matching the other published work.

.idea/ removed and ignored. JetBrains project files are per-developer, not per-project.

CNPJ

The validation people reach for first, and the one that was missing.

Ported from the shared TypeScript validators so the two implementations cannot drift, with the weights and the "remainder below 2 yields zero" rule from the Receita Federal specification.

Two details worth review:

• It joins validationCount. Without that, ?cpf=…&cnpj=… would slip past the one-parameter-per-request rule — CNPJ would have been the hole through which two validations arrived at once.
• The character guard covers it, with / allowed, because a CNPJ legitimately carries one. The other documents do not, and still reject it.

Tests

Fourteen new cases, go test ./... -race green:

• real published CNPJs (Petrobras, Banco do Brasil) formatted, bare and spaced
• each check digit wrong independently
• lengths above and below fourteen
• 00.000.000/0000-00 and 11.111.111/1111-11 — these pass the check-digit arithmetic and have to be excluded by name
• stray letters before and after
• the handler route, including the cpf + cnpj collision returning MULTIPLE_PARAMETERS

The Swagger spec is regenerated, so cnpj appears in the UI.

Note from production

With #4 deployed, /health now answers:

{"cache":"unreachable","status":"ok"}

That confirms what the timings suggested: Redis is not connected on Render. The service degrades correctly — validation is pure computation — but the CPF path was paying 150–220 ms for a cache that never returned a hit. Worth either provisioning Redis or setting REDIS_ADDR; the 150 ms cap from #4 bounds the damage until then.