Enable testify lint (#34222)

Updates our golangci-lint configuration to enable testifylint and
fixes all issues found.

Bump e ref to include gravitational/teleport.e#2567

.golangci.yml

@@ -28,6 +28,7 @@ linters:
     - nolintlint
     - revive
     - staticcheck
+    - testifylint
     - unconvert
     - unused
 
@@ -71,6 +72,18 @@ linters-settings:
     rules:
     - name: unused-parameter
       disabled: true
+  testifylint:
+    enable:
+      - bool-compare
+      - compares
+      - empty
+      - error-is-as
+      - error-nil
+      - expected-actual
+      - float-compare
+      - len
+      - suite-extra-assert-call
+      - suite-thelper
 
 output:
   uniq-by-line: false

api/client/alpn_conn_upgrade_test.go

@@ -233,8 +233,8 @@ func mustReadConnData(t *testing.T, conn net.Conn, wantText string) {
 	data := make([]byte, len(wantText)*2)
 	n, err := conn.Read(data)
 	require.NoError(t, err)
-	require.Equal(t, len(wantText), n)
-	require.Equal(t, string(data[:n]), wantText)
+	require.Len(t, wantText, n)
+	require.Equal(t, wantText, string(data[:n]))
 }
 
 type mockALPNServer struct {

api/client/proxy/client_test.go

@@ -397,12 +397,12 @@ func TestClient_DialHost(t *testing.T) {
 				msg := []byte("hello123")
 				n, err := conn.Write(msg)
 				require.NoError(t, err)
-				require.Equal(t, len(msg), n)
+				require.Len(t, msg, n)
 
 				out := make([]byte, len(msg))
 				n, err = conn.Read(out)
 				require.NoError(t, err)
-				require.Equal(t, len(msg), n)
+				require.Len(t, msg, n)
 				require.Equal(t, msg, out)
 
 				require.NoError(t, conn.Close())

api/client/proxy/transport/transportv1/client_test.go

@@ -192,12 +192,12 @@ func TestClient_DialCluster(t *testing.T) {
 				msg := []byte("hello")
 				n, err := conn.Write(msg)
 				require.NoError(t, err)
-				require.Equal(t, len(msg), n)
+				require.Len(t, msg, n)
 
 				out := make([]byte, n)
 				n, err = conn.Read(out)
 				require.NoError(t, err)
-				require.Equal(t, len(msg), n)
+				require.Len(t, msg, n)
 				require.Equal(t, msg, out)
 
 				require.NoError(t, conn.Close())
@@ -407,7 +407,7 @@ func TestClient_DialHost(t *testing.T) {
 				msg := []byte("hello")
 				n, err := conn.Write(msg)
 				require.NoError(t, err)
-				require.Equal(t, len(msg), n)
+				require.Len(t, msg, n)
 
 				out := make([]byte, 10)
 				n, err = conn.Read(out)
@@ -428,12 +428,12 @@ func TestClient_DialHost(t *testing.T) {
 				msg := []byte("hello")
 				n, err := conn.Write(msg)
 				require.NoError(t, err)
-				require.Equal(t, len(msg), n)
+				require.Len(t, msg, n)
 
 				out := make([]byte, n)
 				n, err = conn.Read(out)
 				require.NoError(t, err)
-				require.Equal(t, len(msg), n)
+				require.Len(t, msg, n)
 				require.Equal(t, msg, out)
 
 				n, err = conn.Read(out)
@@ -457,13 +457,13 @@ func TestClient_DialHost(t *testing.T) {
 				msg := []byte("hello")
 				n, err := conn.Write(msg)
 				require.NoError(t, err)
-				require.Equal(t, len(msg), n)
+				require.Len(t, msg, n)
 
 				// read data via ssh frames
 				out := make([]byte, n)
 				n, err = conn.Read(out)
 				require.NoError(t, err)
-				require.Equal(t, len(msg), n)
+				require.Len(t, msg, n)
 				require.Equal(t, msg, out)
 
 				// get the keys from our local keyring
@@ -479,7 +479,7 @@ func TestClient_DialHost(t *testing.T) {
 				out = make([]byte, len(keys[0].Blob))
 				n, err = conn.Read(out)
 				require.NoError(t, err)
-				require.Equal(t, len(keys[0].Blob), n)
+				require.Len(t, keys[0].Blob, n)
 				require.Equal(t, keys[0].Blob, out)
 
 				// close the stream

api/internalutils/stream/stream_test.go

@@ -43,7 +43,7 @@ func TestSlice(t *testing.T) {
 	// nil slice
 	s, err = Collect(Slice[int](nil))
 	require.NoError(t, err)
-	require.Len(t, s, 0)
+	require.Empty(t, s)
 }
 
 // TestFilterMap tests the FilterMap combinator.
@@ -75,12 +75,12 @@ func TestFilterMap(t *testing.T) {
 		return "", false
 	}))
 	require.NoError(t, err)
-	require.Len(t, s, 0)
+	require.Empty(t, s)
 
 	// empty stream
 	s, err = Collect(FilterMap(Empty[int](), func(_ int) (string, bool) { panic("unreachable") }))
 	require.NoError(t, err)
-	require.Len(t, s, 0)
+	require.Empty(t, s)
 
 	// failure
 	err = Drain(FilterMap(Fail[int](fmt.Errorf("unexpected error")), func(_ int) (string, bool) { panic("unreachable") }))
@@ -116,12 +116,12 @@ func TestMapWhile(t *testing.T) {
 		return "", false
 	}))
 	require.NoError(t, err)
-	require.Len(t, s, 0)
+	require.Empty(t, s)
 
 	// empty stream
 	s, err = Collect(MapWhile(Empty[int](), func(_ int) (string, bool) { panic("unreachable") }))
 	require.NoError(t, err)
-	require.Len(t, s, 0)
+	require.Empty(t, s)
 
 	// failure
 	err = Drain(MapWhile(Fail[int](fmt.Errorf("unexpected error")), func(_ int) (string, bool) { panic("unreachable") }))
@@ -161,7 +161,7 @@ func TestFunc(t *testing.T) {
 		return 0, io.EOF
 	}))
 	require.NoError(t, err)
-	require.Len(t, s, 0)
+	require.Empty(t, s)
 
 	// immediate error
 	err = Drain(Func(func() (int, error) {
@@ -229,7 +229,7 @@ func TestPageFunc(t *testing.T) {
 		return nil, io.EOF
 	}))
 	require.NoError(t, err)
-	require.Len(t, s, 0)
+	require.Empty(t, s)
 
 	// lots of empty pages
 	n = 0
@@ -262,7 +262,7 @@ func TestPageFunc(t *testing.T) {
 		return nil, nil
 	}))
 	require.NoError(t, err)
-	require.Len(t, s, 0)
+	require.Empty(t, s)
 
 	// eventual failure
 	n = 0
@@ -290,17 +290,17 @@ func TestEmpty(t *testing.T) {
 	// empty case
 	s, err := Collect(Empty[int]())
 	require.NoError(t, err)
-	require.Len(t, s, 0)
+	require.Empty(t, s)
 
 	// normal error case
 	s, err = Collect(Fail[int](fmt.Errorf("unexpected error")))
 	require.Error(t, err)
-	require.Len(t, s, 0)
+	require.Empty(t, s)
 
 	// nil error case
 	s, err = Collect(Fail[int](nil))
 	require.NoError(t, err)
-	require.Len(t, s, 0)
+	require.Empty(t, s)
 }
 
 func TestCollectPages(t *testing.T) {
@@ -357,7 +357,7 @@ func TestCollectPages(t *testing.T) {
 				require.Error(t, err)
 			}
 			if len(tt.expect) == 0 {
-				require.Len(t, collected, 0)
+				require.Empty(t, collected)
 			} else {
 				require.Equal(t, tt.expect, collected)
 			}

api/types/cluster_alert_test.go

@@ -171,7 +171,7 @@ func TestAlertAcknowledgement_Check(t *testing.T) {
 			err := tc.ack.Check()
 
 			if tc.expectedErr == nil {
-				require.Equal(t, err, nil)
+				require.NoError(t, err)
 				return
 			}
 

api/types/events/events_test.go

@@ -153,6 +153,6 @@ func TestTrimN(t *testing.T) {
 
 	const maxLen = 20
 	for _, test := range tests {
-		require.Equal(t, trimN(test.have, maxLen), test.want)
+		require.Equal(t, test.want, trimN(test.have, maxLen))
 	}
 }

api/types/resource_test.go

@@ -474,7 +474,7 @@ func TestResourcesWithLabels_ToMap(t *testing.T) {
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			require.Equal(t, tt.r.ToMap(), tt.want)
+			require.Equal(t, tt.want, tt.r.ToMap())
 		})
 	}
 }

api/types/saml_test.go

@@ -31,13 +31,13 @@ func TestSAMLSecretsStrip(t *testing.T) {
 		SigningKeyPair:           &AsymmetricKeyPair{PrivateKey: "test"},
 		EncryptionKeyPair:        &AsymmetricKeyPair{PrivateKey: "test"},
 	})
-	require.Nil(t, err)
-	require.Equal(t, connector.GetSigningKeyPair().PrivateKey, "test")
-	require.Equal(t, connector.GetEncryptionKeyPair().PrivateKey, "test")
+	require.NoError(t, err)
+	require.Equal(t, "test", connector.GetSigningKeyPair().PrivateKey)
+	require.Equal(t, "test", connector.GetEncryptionKeyPair().PrivateKey)
 
 	withoutSecrets := connector.WithoutSecrets().(*SAMLConnectorV2)
-	require.Equal(t, withoutSecrets.GetSigningKeyPair().PrivateKey, "")
-	require.Equal(t, withoutSecrets.GetEncryptionKeyPair().PrivateKey, "")
+	require.Empty(t, withoutSecrets.GetSigningKeyPair().PrivateKey)
+	require.Empty(t, withoutSecrets.GetEncryptionKeyPair().PrivateKey)
 }
 
 // TestSAMLAcsUriHasConnector tests that the ACS URI has the connector ID as the last part if IdP-initiated login is enabled.

api/types/userloginstate/convert/v1/user_login_state_test.go

@@ -66,7 +66,7 @@ func TestFromProtoNils(t *testing.T) {
 
 	fromProto, err := FromProto(uls)
 	require.NoError(t, err)
-	require.Equal(t, fromProto.GetUserType(), types.UserTypeLocal)
+	require.Equal(t, types.UserTypeLocal, fromProto.GetUserType())
 }
 
 func newUserLoginState(t *testing.T, name string) *userloginstate.UserLoginState {

api/utils/aws/ec2_test.go

@@ -58,7 +58,7 @@ func TestIsEC2NodeID(t *testing.T) {
 	}
 	for _, tc := range testCases {
 		t.Run(tc.name, func(t *testing.T) {
-			assert.Equal(t, IsEC2NodeID(tc.id), tc.expected)
+			assert.Equal(t, tc.expected, IsEC2NodeID(tc.id))
 		})
 	}
 }

api/utils/aws/endpoint_test.go

@@ -449,7 +449,7 @@ func TestCassandraEndpointRegion(t *testing.T) {
 				require.False(t, IsKeyspacesEndpoint(test.inputURI))
 			} else {
 				require.NoError(t, err)
-				require.Equal(t, got, test.wantRegion)
+				require.Equal(t, test.wantRegion, got)
 				require.True(t, IsKeyspacesEndpoint(test.inputURI))
 			}
 		})

api/utils/grpc/interceptors/errors_test.go

@@ -75,7 +75,7 @@ func TestGRPCErrorWrapping(t *testing.T) {
 		resp, err := client.Ping(context.Background(), &proto.PingRequest{})
 		require.Nil(t, resp)
 		require.True(t, trace.IsNotFound(err))
-		require.Equal(t, err.Error(), "not found")
+		require.Equal(t, "not found", err.Error())
 		_, ok := err.(*trace.TraceErr)
 		require.False(t, ok, "client error should not include traces originating in the middleware")
 	})
@@ -98,7 +98,7 @@ func TestGRPCErrorWrapping(t *testing.T) {
 
 		_, err = stream.Recv()
 		require.True(t, trace.IsAlreadyExists(err))
-		require.Equal(t, err.Error(), "already exists")
+		require.Equal(t, "already exists", err.Error())
 		_, ok := err.(*trace.TraceErr)
 		require.False(t, ok, "client error should not include traces originating in the middleware")
 	})

api/utils/grpc/stream/stream_test.go

@@ -79,14 +79,14 @@ func TestReadWriter_Write(t *testing.T) {
 		defer wg.Done()
 		n, err := streamConn.Write(data)
 		assert.NoError(t, err)
-		assert.Equal(t, len(data), n)
+		assert.Len(t, data, n)
 	}()
 	go func() {
 		defer wg.Done()
 		b := make([]byte, 2*MaxChunkSize)
 		n, err := local.Read(b)
 		assert.NoError(t, err)
-		assert.Equal(t, len(data), n)
+		assert.Len(t, data, n)
 		assert.Equal(t, data, b[:n])
 	}()
 
@@ -103,7 +103,7 @@ func TestReadWriter_WriteChunk(t *testing.T) {
 		defer wg.Done()
 		n, err := streamConn.Write(data)
 		assert.NoError(t, err)
-		assert.Equal(t, len(data), n)
+		assert.Len(t, data, n)
 	}()
 	go func() {
 		defer wg.Done()
@@ -133,14 +133,14 @@ func TestReadWriter_Read(t *testing.T) {
 		defer wg.Done()
 		n, err := streamConn.Read(b)
 		assert.NoError(t, err)
-		assert.Equal(t, len(data), n)
+		assert.Len(t, data, n)
 		assert.Equal(t, data, b[:n])
 	}()
 	go func() {
 		defer wg.Done()
 		n, err := local.Write(data)
 		assert.NoError(t, err)
-		assert.Equal(t, len(data), n)
+		assert.Len(t, data, n)
 	}()
 
 	wg.Wait()

api/utils/prompt/confirmation_test.go

@@ -41,14 +41,14 @@ func TestInput(t *testing.T) {
 		go write(t, "hi")
 		got, err := Input(ctx, io.Discard, r, "")
 		require.NoError(t, err)
-		require.Equal(t, got, "hi")
+		require.Equal(t, "hi", got)
 	})
 
 	t.Run("with whitespace", func(t *testing.T) {
 		go write(t, "hey\n")
 		got, err := Input(ctx, io.Discard, r, "")
 		require.NoError(t, err)
-		require.Equal(t, got, "hey")
+		require.Equal(t, "hey", got)
 	})
 
 	t.Run("closed input", func(t *testing.T) {

api/utils/prompt/context_reader_test.go

@@ -46,7 +46,7 @@ func TestContextReader(t *testing.T) {
 		go write(t, "hello")
 		buf, err := cr.ReadContext(ctx)
 		require.NoError(t, err)
-		require.Equal(t, string(buf), "hello")
+		require.Equal(t, "hello", string(buf))
 	})
 
 	t.Run("reclaim abandoned read", func(t *testing.T) {
@@ -65,7 +65,7 @@ func TestContextReader(t *testing.T) {
 		<-done // wait for write
 		buf, err = cr.ReadContext(ctx)
 		require.NoError(t, err)
-		require.Equal(t, string(buf), "after cancel")
+		require.Equal(t, "after cancel", string(buf))
 	})
 
 	t.Run("close ContextReader", func(t *testing.T) {
@@ -102,7 +102,7 @@ func TestContextReader(t *testing.T) {
 		// Read the last chunk of data successfully.
 		buf, err := cr.ReadContext(ctx)
 		require.NoError(t, err)
-		require.Equal(t, string(buf), "before close")
+		require.Equal(t, "before close", string(buf))
 
 		// Next read fails because underlying reader is closed.
 		buf, err = cr.ReadContext(ctx)

api/utils/retryutils/retry_test.go

@@ -47,17 +47,17 @@ func TestLinearV2(t *testing.T) {
 }
 
 func testLinear(t *testing.T, r Retry) {
-	require.Equal(t, r.Duration(), time.Duration(0))
+	require.Equal(t, time.Duration(0), r.Duration())
 	r.Inc()
-	require.Equal(t, r.Duration(), time.Second)
+	require.Equal(t, time.Second, r.Duration())
 	r.Inc()
-	require.Equal(t, r.Duration(), 2*time.Second)
+	require.Equal(t, 2*time.Second, r.Duration())
 	r.Inc()
-	require.Equal(t, r.Duration(), 3*time.Second)
+	require.Equal(t, 3*time.Second, r.Duration())
 	r.Inc()
-	require.Equal(t, r.Duration(), 3*time.Second)
+	require.Equal(t, 3*time.Second, r.Duration())
 	r.Reset()
-	require.Equal(t, r.Duration(), time.Duration(0))
+	require.Equal(t, time.Duration(0), r.Duration())
 }
 
 func TestExponential(t *testing.T) {
@@ -69,20 +69,20 @@ func TestExponential(t *testing.T) {
 	})
 	require.NoError(t, err)
 
-	require.Equal(t, r.Duration(), time.Duration(0))
+	require.Equal(t, time.Duration(0), r.Duration())
 	r.Inc()
-	require.Equal(t, r.Duration(), time.Second)
+	require.Equal(t, time.Second, r.Duration())
 	r.Inc()
-	require.Equal(t, r.Duration(), 2*time.Second)
+	require.Equal(t, 2*time.Second, r.Duration())
 	r.Inc()
-	require.Equal(t, r.Duration(), 4*time.Second)
+	require.Equal(t, 4*time.Second, r.Duration())
 	r.Inc()
-	require.Equal(t, r.Duration(), 8*time.Second)
+	require.Equal(t, 8*time.Second, r.Duration())
 	r.Inc()
 	// should hit configured maximum
-	require.Equal(t, r.Duration(), 12*time.Second)
+	require.Equal(t, 12*time.Second, r.Duration())
 	r.Reset()
-	require.Equal(t, r.Duration(), time.Duration(0))
+	require.Equal(t, time.Duration(0), r.Duration())
 
 	// verify that exponentiation is capped s.t. we don't wrap
 	for i := 0; i < 128; i++ {

api/utils/sshutils/conn_test.go

@@ -133,7 +133,7 @@ func TestTransportError(t *testing.T) {
 	t.Cleanup(func() { require.Error(t, sconn1.Close()) })
 
 	channel := <-nc
-	require.Equal(t, channel.ChannelType(), constants.ChanTransport)
+	require.Equal(t, constants.ChanTransport, channel.ChannelType())
 
 	sconn1.Close()
 	err := timeoutErrC(t, handlerErrC, time.Second*5)
@@ -143,7 +143,7 @@ func TestTransportError(t *testing.T) {
 	t.Cleanup(func() { require.NoError(t, sconn2.Close()) })
 
 	channel = <-nc
-	require.Equal(t, channel.ChannelType(), constants.ChanTransport)
+	require.Equal(t, constants.ChanTransport, channel.ChannelType())
 
 	err = channel.Reject(ssh.ConnectionFailed, "test reject")
 	require.NoError(t, err)

api/utils/user_test.go

@@ -33,7 +33,7 @@ func TestCurrentUser(t *testing.T) {
 		return nil, nil
 	}, 10*time.Millisecond)
 	require.Nil(t, u)
-	require.NotNil(t, err)
+	require.Error(t, err)
 	require.True(t, trace.IsLimitExceeded(err))
 
 	u, err = currentUser(func() (*user.User, error) {

build.assets/tooling/cmd/difftest/ast_test.go

@@ -64,10 +64,11 @@ func TestFindAllSuiteRunners(t *testing.T) {
 	runners, err := findAllSuiteRunners(".", []string{filepath.Join("testdata", "ast", "head", "testify_single_suite_b_test.go")})
 	require.NoError(t, err)
 
-	require.Equal(t, runners[filepath.Join("testdata", "ast", "head")], map[string]string{
+	expected := map[string]string{
 		"JiraSuite":   "TestJira",
 		"SingleSuite": "TestSingleSuite",
-	})
+	}
+	require.Equal(t, expected, runners[filepath.Join("testdata", "ast", "head")])
 }
 
 func TestParseASTTestifySuiteMulti(t *testing.T) {

build.assets/tooling/cmd/difftest/compare_test.go

@@ -36,6 +36,6 @@ func TestChangedMethods(t *testing.T) {
 	assert.True(t, r.HasNew())
 	assert.True(t, r.HasChanged())
 
-	assert.Equal(t, r.New, []Method{{Name: "TestFourth", SHA1: "035a07a1e38e5387cd682b2c6b37114d187fa3d2", RefName: "TestFourth"}})
-	assert.Equal(t, r.Changed, []Method{{Name: "TestFirst", SHA1: "f045d205e581369b1c7c4148086c838c710f97c8", RefName: "TestFirst"}})
+	assert.Equal(t, []Method{{Name: "TestFourth", SHA1: "035a07a1e38e5387cd682b2c6b37114d187fa3d2", RefName: "TestFourth"}}, r.New)
+	assert.Equal(t, []Method{{Name: "TestFirst", SHA1: "f045d205e581369b1c7c4148086c838c710f97c8", RefName: "TestFirst"}}, r.Changed)
 }

e2e/aws/eks_test.go

@@ -100,7 +100,7 @@ func awsEKSDiscoveryMatchedCluster(t *testing.T) {
 			return false
 		}
 		// Fail fast if the discovery service creates more than one cluster.
-		assert.Equal(t, 1, len(clusters))
+		assert.Len(t, clusters, 1)
 		// Fail fast if the discovery service creates a cluster with a different name.
 		assert.Equal(t, os.Getenv(eksClusterNameEnv), clusters[0].GetName())
 		return true

integration/agent_forwarding_test.go

@@ -55,7 +55,7 @@ func TestAgentSocketPermissions(t *testing.T) {
 			// Update uid to nonroot
 			_, _, serr := syscall.Syscall(syscall.SYS_SETUID, 1000, 0, 0)
 			require.Zero(t, serr)
-			require.True(t, !isRoot())
+			require.False(t, isRoot())
 
 			err := unix.Unlink(agentServer.Path)
 			require.Error(t, err)

integration/appaccess/appaccess_test.go

@@ -396,19 +396,19 @@ func testRewriteHeadersRoot(p *Pack, t *testing.T) {
 	// Dumper app just dumps HTTP request so we should be able to read it back.
 	req, err := http.ReadRequest(bufio.NewReader(strings.NewReader(resp)))
 	require.NoError(t, err)
-	require.Equal(t, req.Host, "example.com")
-	require.Equal(t, req.Header.Get("X-Teleport-Cluster"), "root")
-	require.Equal(t, req.Header.Get("X-External-Env"), "production")
-	require.Equal(t, req.Header.Get("X-Existing"), "rewritten-existing-header")
+	require.Equal(t, "example.com", req.Host)
+	require.Equal(t, "root", req.Header.Get("X-Teleport-Cluster"))
+	require.Equal(t, "production", req.Header.Get("X-External-Env"))
+	require.Equal(t, "rewritten-existing-header", req.Header.Get("X-Existing"))
 
 	// verify these headers were not rewritten.
-	require.NotEqual(t, req.Header.Get(teleport.AppJWTHeader), "rewritten-app-jwt-header")
-	require.NotEqual(t, req.Header.Get(common.TeleportAPIErrorHeader), "rewritten-x-teleport-api-error")
-	require.NotEqual(t, req.Header.Get(reverseproxy.XForwardedFor), "rewritten-x-forwarded-for-header")
-	require.NotEqual(t, req.Header.Get(reverseproxy.XForwardedHost), "rewritten-x-forwarded-host-header")
-	require.NotEqual(t, req.Header.Get(reverseproxy.XForwardedProto), "rewritten-x-forwarded-proto-header")
-	require.NotEqual(t, req.Header.Get(reverseproxy.XForwardedServer), "rewritten-x-forwarded-server-header")
-	require.NotEqual(t, req.Header.Get(common.XForwardedSSL), "rewritten-x-forwarded-ssl")
+	require.NotEqual(t, "rewritten-app-jwt-header", req.Header.Get(teleport.AppJWTHeader))
+	require.NotEqual(t, "rewritten-x-teleport-api-error", req.Header.Get(common.TeleportAPIErrorHeader))
+	require.NotEqual(t, "rewritten-x-forwarded-for-header", req.Header.Get(reverseproxy.XForwardedFor))
+	require.NotEqual(t, "rewritten-x-forwarded-host-header", req.Header.Get(reverseproxy.XForwardedHost))
+	require.NotEqual(t, "rewritten-x-forwarded-proto-header", req.Header.Get(reverseproxy.XForwardedProto))
+	require.NotEqual(t, "rewritten-x-forwarded-server-header", req.Header.Get(reverseproxy.XForwardedServer))
+	require.NotEqual(t, "rewritten-x-forwarded-ssl", req.Header.Get(common.XForwardedSSL))
 
 	// Verify JWT tokens.
 	for _, header := range []string{teleport.AppJWTHeader, "X-JWT"} {
@@ -432,20 +432,20 @@ func testRewriteHeadersLeaf(p *Pack, t *testing.T) {
 	// Dumper app just dumps HTTP request so we should be able to read it back.
 	req, err := http.ReadRequest(bufio.NewReader(strings.NewReader(resp)))
 	require.NoError(t, err)
-	require.Equal(t, req.Host, "example.com")
-	require.Equal(t, req.Header.Get("X-Teleport-Cluster"), "leaf")
+	require.Equal(t, "example.com", req.Host)
+	require.Equal(t, "leaf", req.Header.Get("X-Teleport-Cluster"))
 	require.ElementsMatch(t, []string{"root", "ubuntu", "-teleport-internal-join"}, req.Header.Values("X-Teleport-Login"))
-	require.Equal(t, req.Header.Get("X-External-Env"), "production")
-	require.Equal(t, req.Header.Get("X-Existing"), "rewritten-existing-header")
+	require.Equal(t, "production", req.Header.Get("X-External-Env"))
+	require.Equal(t, "rewritten-existing-header", req.Header.Get("X-Existing"))
 
 	// verify these headers were not rewritten.
-	require.NotEqual(t, req.Header.Get(teleport.AppJWTHeader), "rewritten-app-jwt-header")
-	require.NotEqual(t, req.Header.Get(common.TeleportAPIErrorHeader), "rewritten-x-teleport-api-error")
-	require.NotEqual(t, req.Header.Get(common.XForwardedSSL), "rewritten-x-forwarded-ssl")
-	require.NotEqual(t, req.Header.Get(reverseproxy.XForwardedFor), "rewritten-x-forwarded-for-header")
-	require.NotEqual(t, req.Header.Get(reverseproxy.XForwardedHost), "rewritten-x-forwarded-host-header")
-	require.NotEqual(t, req.Header.Get(reverseproxy.XForwardedProto), "rewritten-x-forwarded-proto-header")
-	require.NotEqual(t, req.Header.Get(reverseproxy.XForwardedServer), "rewritten-x-forwarded-server-header")
+	require.NotEqual(t, "rewritten-app-jwt-header", req.Header.Get(teleport.AppJWTHeader))
+	require.NotEqual(t, "rewritten-x-teleport-api-error", req.Header.Get(common.TeleportAPIErrorHeader))
+	require.NotEqual(t, "rewritten-x-forwarded-ssl", req.Header.Get(common.XForwardedSSL))
+	require.NotEqual(t, "rewritten-x-forwarded-for-header", req.Header.Get(reverseproxy.XForwardedFor))
+	require.NotEqual(t, "rewritten-x-forwarded-host-header", req.Header.Get(reverseproxy.XForwardedHost))
+	require.NotEqual(t, "rewritten-x-forwarded-proto-header", req.Header.Get(reverseproxy.XForwardedProto))
+	require.NotEqual(t, "rewritten-x-forwarded-server-header", req.Header.Get(reverseproxy.XForwardedServer))
 }
 
 // testLogout verifies the session is removed from the backend when the user logs out.
@@ -504,7 +504,7 @@ func testNoHeaderOverrides(p *Pack, t *testing.T) {
 	require.NoError(t, err)
 	require.Equal(t, http.StatusOK, status)
 	origHeaders := strings.Split(origHeaderResp, "\n")
-	require.Equal(t, len(origHeaders), len(forwardedHeaderNames)+1)
+	require.Len(t, origHeaders, len(forwardedHeaderNames)+1)
 
 	// Construct HTTP request with custom headers.
 	req, err := http.NewRequest(http.MethodGet, p.assembleRootProxyURL("/"), nil)
@@ -521,7 +521,7 @@ func testNoHeaderOverrides(p *Pack, t *testing.T) {
 	require.NoError(t, err)
 	require.Equal(t, http.StatusOK, status)
 	newHeaders := strings.Split(newHeaderResp, "\n")
-	require.Equal(t, len(newHeaders), len(forwardedHeaderNames)+1)
+	require.Len(t, newHeaders, len(forwardedHeaderNames)+1)
 
 	// Headers sent to the application should not be affected.
 	for i := range forwardedHeaderNames {

integration/appaccess/pack.go

@@ -245,7 +245,7 @@ func (p *Pack) initWebSession(t *testing.T) {
 	// Extract session cookie and bearer token.
 	require.Len(t, resp.Cookies(), 1)
 	cookie := resp.Cookies()[0]
-	require.Equal(t, cookie.Name, websession.CookieName)
+	require.Equal(t, websession.CookieName, cookie.Name)
 
 	p.webCookie = cookie.Value
 	p.webToken = csResp.Token

integration/assist/command_test.go

@@ -369,7 +369,7 @@ func registerMockSSHNode(t *testing.T, ctx context.Context, sshAddr, testDir str
 	require.Eventually(t, helpers.FindNodeWithLabel(t, ctx, rc.Process.GetAuthServer(), "hello", "true"), time.Second*2, time.Millisecond*50)
 	nodes, err := rc.Process.GetAuthServer().GetNodes(ctx, apidefaults.Namespace)
 	require.NoError(t, err)
-	require.Equal(t, 1, len(nodes))
+	require.Len(t, nodes, 1)
 	return nodes[0]
 }
 

integration/helpers/web.go

@@ -96,7 +96,7 @@ func LoginWebClient(t *testing.T, host, username, password string) *WebClientPac
 	// Extract session cookie and bearer token.
 	require.Len(t, resp.Cookies(), 1)
 	cookie := resp.Cookies()[0]
-	require.Equal(t, cookie.Name, websession.CookieName)
+	require.Equal(t, websession.CookieName, cookie.Name)
 
 	webClient := &WebClientPack{
 		clt:         client,

integration/integration_test.go

@@ -2184,7 +2184,7 @@ func testDisconnectScenarios(t *testing.T, suite *integrationTestSuite) {
 				ss, err := waitForSessionToBeEstablished(timeoutCtx, defaults.Namespace, site)
 				require.NoError(t, err)
 				require.Len(t, ss, 1)
-				require.Nil(t, teleport.StopAuth(false))
+				require.NoError(t, teleport.StopAuth(false))
 			},
 		},
 	}
@@ -4857,7 +4857,7 @@ func testAuditOff(t *testing.T, suite *integrationTestSuite) {
 
 	// should have no sessions in it to start with
 	sessions, _ := site.GetActiveSessionTrackers(ctx)
-	require.Len(t, sessions, 0)
+	require.Empty(t, sessions)
 
 	beforeSession := time.Now()
 
@@ -6890,7 +6890,7 @@ func testSessionStartContainsAccessRequest(t *testing.T, suite *integrationTestS
 		if event.Type != types.OpInit {
 			t.Fatalf("Unexpected event type.")
 		}
-		require.Equal(t, event.Type, types.OpInit)
+		require.Equal(t, types.OpInit, event.Type)
 	case <-watcher.Done():
 		t.Fatal(watcher.Error())
 	}
@@ -6933,14 +6933,14 @@ func testSessionStartContainsAccessRequest(t *testing.T, suite *integrationTestS
 	// Get session start event
 	sessionStart, err := findEventInLog(main, events.SessionStartEvent)
 	require.NoError(t, err)
-	require.Equal(t, sessionStart.GetCode(), events.SessionStartCode)
-	require.Equal(t, sessionStart.HasField(accessRequestsKey), true)
+	require.Equal(t, events.SessionStartCode, sessionStart.GetCode())
+	require.True(t, sessionStart.HasField(accessRequestsKey))
 
 	val, found := sessionStart[accessRequestsKey]
-	require.Equal(t, found, true)
+	require.True(t, found)
 
 	result := strings.Contains(fmt.Sprintf("%v", val), accessRequestID)
-	require.Equal(t, result, true)
+	require.True(t, result)
 }
 
 func WaitForResource(t *testing.T, watcher types.Watcher, kind, name string) {
@@ -7384,7 +7384,7 @@ func testSessionStreaming(t *testing.T, suite *integrationTestSuite) {
 
 	api := teleport.GetSiteAPI(helpers.Site)
 	uploadStream, err := api.CreateAuditStream(ctx, sessionID)
-	require.Nil(t, err)
+	require.NoError(t, err)
 
 	generatedSession := eventstest.GenerateTestSession(eventstest.SessionParams{
 		PrintEvents: 100,
@@ -7398,7 +7398,7 @@ func testSessionStreaming(t *testing.T, suite *integrationTestSuite) {
 	}
 
 	err = uploadStream.Complete(ctx)
-	require.Nil(t, err)
+	require.NoError(t, err)
 	start := time.Now()
 
 	// retry in case of error
@@ -7419,9 +7419,9 @@ outer:
 
 				receivedSession = append(receivedSession, event)
 			case <-ctx.Done():
-				require.Nil(t, ctx.Err())
+				require.NoError(t, ctx.Err())
 			case err := <-e:
-				require.Nil(t, err)
+				require.NoError(t, err)
 			case <-time.After(time.Minute * 5):
 				t.FailNow()
 			}

integration/kube_integration_test.go

@@ -1290,8 +1290,8 @@ func testKubeTransportProtocol(t *testing.T, suite *KubeSuite) {
 	resp1, err := client.Get(u.String())
 	require.NoError(t, err)
 	defer resp1.Body.Close()
-	require.Equal(t, resp1.StatusCode, 200)
-	require.Equal(t, resp1.Proto, "HTTP/1.1")
+	require.Equal(t, 200, resp1.StatusCode)
+	require.Equal(t, "HTTP/1.1", resp1.Proto)
 
 	// call proxy with an HTTP2 client
 	err = http2.ConfigureTransport(trans)
@@ -1300,8 +1300,8 @@ func testKubeTransportProtocol(t *testing.T, suite *KubeSuite) {
 	resp2, err := client.Get(u.String())
 	require.NoError(t, err)
 	defer resp2.Body.Close()
-	require.Equal(t, resp2.StatusCode, 200)
-	require.Equal(t, resp2.Proto, "HTTP/2.0")
+	require.Equal(t, 200, resp2.StatusCode)
+	require.Equal(t, "HTTP/2.0", resp2.Proto)
 
 	// stream succeeds with an h1 transport
 	command := kubeExecArgs{
@@ -1789,7 +1789,7 @@ func kubeJoinObserverWithSNISet(t *testing.T, tc *client.TeleportClient, telepor
 
 	sessions, err := teleport.Process.GetAuthServer().GetActiveSessionTrackers(context.Background())
 	require.NoError(t, err)
-	require.Greater(t, len(sessions), 0)
+	require.NotEmpty(t, sessions)
 
 	stream, err := kubeJoin(kube.ProxyConfig{
 		T:                   teleport,

integration/proxy/proxy_helpers.go

@@ -749,7 +749,7 @@ func mustGetKubePod(t *testing.T, client *kubernetes.Clientset) {
 
 	resp, err := client.CoreV1().Pods(metav1.NamespaceDefault).List(context.Background(), metav1.ListOptions{})
 	require.NoError(t, err)
-	require.Equal(t, len(resp.Items), 3)
+	require.Len(t, resp.Items, 3)
 }
 
 func mustGetProfileName(t *testing.T, webProxyAddr string) string {

integration/proxy/proxy_test.go

@@ -386,7 +386,7 @@ func TestALPNSNIProxyKube(t *testing.T) {
 
 	resp, err := k8Client.CoreV1().Pods("default").List(context.Background(), metav1.ListOptions{})
 	require.NoError(t, err)
-	require.Equal(t, 3, len(resp.Items), "pods item length mismatch")
+	require.Len(t, resp.Items, 3, "pods item length mismatch")
 
 	// Simulate how tsh uses a kube local proxy to send kube requests to
 	// Teleport Proxy with a L7 LB in front.
@@ -658,7 +658,7 @@ func TestKubePROXYProtocol(t *testing.T) {
 
 			resp, err := k8Client.CoreV1().Pods("default").List(context.Background(), metav1.ListOptions{})
 			require.NoError(t, err)
-			require.Equal(t, 3, len(resp.Items), "pods item length mismatch")
+			require.Len(t, resp.Items, 3, "pods item length mismatch")
 		})
 	}
 }
@@ -783,7 +783,7 @@ func TestKubeIPPinning(t *testing.T) {
 				return
 			}
 			require.NoError(t, err)
-			require.Equal(t, 3, len(resp.Items), "pods item length mismatch")
+			require.Len(t, resp.Items, 3, "pods item length mismatch")
 		})
 	}
 }
@@ -1201,7 +1201,7 @@ func TestALPNSNIProxyDatabaseAccess(t *testing.T) {
 		require.Error(t, err)
 		var x509Err x509.CertificateInvalidError
 		require.ErrorAs(t, err, &x509Err)
-		require.Equal(t, x509Err.Reason, x509.Expired)
+		require.Equal(t, x509.Expired, x509Err.Reason)
 		require.Contains(t, x509Err.Detail, "is after")
 
 		// Open a new connection

integration/proxy/teleterm_test.go

@@ -373,5 +373,5 @@ func checkKubeconfigPathInCommandEnv(t *testing.T, daemonService *daemon.Service
 
 	cmd, err := daemonService.GetGatewayCLICommand(gw)
 	require.NoError(t, err)
-	require.Equal(t, cmd.Env, []string{"KUBECONFIG=" + wantKubeconfigPath})
+	require.Equal(t, []string{"KUBECONFIG=" + wantKubeconfigPath}, cmd.Env)
 }

integration/teleterm_test.go

@@ -174,7 +174,7 @@ func testListRootClustersReturnsLoggedInUser(t *testing.T, pack *dbhelpers.Datab
 	response, err := handler.ListRootClusters(context.Background(), &api.ListClustersRequest{})
 	require.NoError(t, err)
 
-	require.Equal(t, 1, len(response.Clusters))
+	require.Len(t, response.Clusters, 1)
 	require.Equal(t, pack.Root.User.GetName(), response.Clusters[0].LoggedInUser.Name)
 }
 
@@ -684,7 +684,7 @@ func testCreatingAndDeletingConnectMyComputerToken(t *testing.T, pack *dbhelpers
 		if event.Type != types.OpInit {
 			t.Fatalf("Unexpected event type.")
 		}
-		require.Equal(t, event.Type, types.OpInit)
+		require.Equal(t, types.OpInit, event.Type)
 	case <-watcher.Done():
 		t.Fatal(watcher.Error())
 	}

integrations/access/discord/discord_test.go

@@ -298,8 +298,8 @@ func (s *DiscordSuite) TestMessagePosting() {
 
 	t.Logf("%q", messages[0].Text)
 	matches := requestReasonRegexp.FindAllStringSubmatch(messages[0].Text, -1)
-	require.Equal(t, 1, len(matches))
-	require.Equal(t, 3, len(matches[0]))
+	require.Len(t, matches, 1)
+	require.Len(t, matches[0], 3)
 	assert.Equal(t, "because of "+strings.Repeat("A", 489), matches[0][1])
 	assert.Equal(t, " (truncated)", matches[0][2])
 

integrations/access/jira/jira_test.go

@@ -360,7 +360,7 @@ func (s *JiraSuite) TestIssueCreationWithLargeRequestReason() {
 		t.Error("reason not found in issue description")
 		return
 	}
-	require.Equal(t, jiraReasonLimit, len(match[1]))
+	require.Len(t, match[1], jiraReasonLimit)
 }
 
 func (s *JiraSuite) TestReviewComments() {

integrations/access/mattermost/mattermost_test.go

@@ -320,8 +320,8 @@ func (s *MattermostSuite) TestMattermostMessagePosting() {
 	assert.Equal(t, s.userNames.requestor, username)
 
 	matches := requestReasonRegexp.FindAllStringSubmatch(post.Message, -1)
-	require.Equal(t, 1, len(matches))
-	require.Equal(t, 3, len(matches[0]))
+	require.Len(t, matches, 1)
+	require.Len(t, matches[0], 3)
 	assert.Equal(t, "because of "+strings.Repeat("A", 489), matches[0][1])
 	assert.Equal(t, " (truncated)", matches[0][2])
 
@@ -357,8 +357,8 @@ func (s *MattermostSuite) TestApproval() {
 	assert.Equal(t, "✅ APPROVED", statusLine)
 
 	matches := resolutionReasonRegexp.FindAllStringSubmatch(postUpdate.Message, -1)
-	require.Equal(t, 1, len(matches))
-	require.Equal(t, 3, len(matches[0]))
+	require.Len(t, matches, 1)
+	require.Len(t, matches[0], 3)
 	assert.Equal(t, "okay", matches[0][1])
 	assert.Equal(t, "", matches[0][2])
 }
@@ -390,8 +390,8 @@ func (s *MattermostSuite) TestDenial() {
 	assert.Equal(t, "❌ DENIED", statusLine)
 
 	matches := resolutionReasonRegexp.FindAllStringSubmatch(postUpdate.Message, -1)
-	require.Equal(t, 1, len(matches))
-	require.Equal(t, 3, len(matches[0]))
+	require.Len(t, matches, 1)
+	require.Len(t, matches[0], 3)
 	assert.Equal(t, "not okay "+strings.Repeat("A", 491), matches[0][1])
 	assert.Equal(t, " (truncated)", matches[0][2])
 }
@@ -509,8 +509,8 @@ func (s *MattermostSuite) TestApprovalByReview() {
 	assert.Equal(t, "✅ APPROVED", statusLine)
 
 	matches := resolutionReasonRegexp.FindAllStringSubmatch(postUpdate.Message, -1)
-	require.Equal(t, 1, len(matches))
-	require.Equal(t, 3, len(matches[0]))
+	require.Len(t, matches, 1)
+	require.Len(t, matches[0], 3)
 	assert.Equal(t, "finally okay", matches[0][1])
 	assert.Equal(t, "", matches[0][2])
 }
@@ -574,8 +574,8 @@ func (s *MattermostSuite) TestDenialByReview() {
 	assert.Equal(t, "❌ DENIED", statusLine)
 
 	matches := resolutionReasonRegexp.FindAllStringSubmatch(postUpdate.Message, -1)
-	require.Equal(t, 1, len(matches))
-	require.Equal(t, 3, len(matches[0]))
+	require.Len(t, matches, 1)
+	require.Len(t, matches[0], 3)
 	assert.Equal(t, "finally not okay", matches[0][1])
 	assert.Equal(t, "", matches[0][2])
 }

integrations/access/pagerduty/pagerduty_test.go

@@ -640,7 +640,7 @@ func (s *PagerdutySuite) assertReviewSubmitted() {
 	ev := s.assertNewEvent(watcher, types.OpPut, types.KindAccessRequest, reqID)
 	request, ok := ev.Resource.(types.AccessRequest)
 	require.True(t, ok)
-	assert.Len(t, request.GetReviews(), 0)
+	assert.Empty(t, request.GetReviews())
 	assert.Equal(t, types.RequestState_PENDING, request.GetState())
 
 	ev = s.assertNewEvent(watcher, types.OpPut, types.KindAccessRequest, reqID)
@@ -672,14 +672,14 @@ func (s *PagerdutySuite) assertNoReviewSubmitted() {
 	request, ok := ev.Resource.(types.AccessRequest)
 	require.True(t, ok)
 	assert.Equal(t, types.RequestState_PENDING, request.GetState())
-	assert.Len(t, request.GetReviews(), 0)
+	assert.Empty(t, request.GetReviews())
 
 	s.assertNoNewEvents(watcher)
 
 	request, err = s.ruler().GetAccessRequest(s.Context(), request.GetName())
 	require.NoError(t, err)
 	assert.Equal(t, types.RequestState_PENDING, request.GetState())
-	assert.Len(t, request.GetReviews(), 0)
+	assert.Empty(t, request.GetReviews())
 }
 
 func (s *PagerdutySuite) TestAutoApprovalWhenNotOnCall() {

integrations/access/servicenow/config_test.go

@@ -33,5 +33,5 @@ func TestNewBot(t *testing.T) {
 	}
 	_, err := conf.NewBot("someClusterName", "someWebProxyAddr")
 	require.NoError(t, err)
-	require.Equal(t, conf.WebProxyURL.Host, "someWebProxyAddr")
+	require.Equal(t, "someWebProxyAddr", conf.WebProxyURL.Host)
 }

integrations/access/servicenow/servicenow_test.go

@@ -375,7 +375,7 @@ func (s *ServiceNowSuite) TestApproval() {
 	require.Contains(t, incident.Description, "submitted access request")
 	assert.Contains(t, incident.CloseNotes, "Access request has been resolved")
 	assert.Contains(t, incident.CloseNotes, "Reason: okay")
-	assert.Equal(t, incident.CloseCode, "resolved")
+	assert.Equal(t, "resolved", incident.CloseCode)
 }
 
 func (s *ServiceNowSuite) TestDenial() {

integrations/access/slack/slack_test.go

@@ -309,8 +309,8 @@ func (s *SlackSuite) TestMessagePosting() {
 	require.True(t, ok)
 	t.Logf("%q", block.Text.GetText())
 	matches := requestReasonRegexp.FindAllStringSubmatch(block.Text.GetText(), -1)
-	require.Equal(t, 1, len(matches))
-	require.Equal(t, 3, len(matches[0]))
+	require.Len(t, matches, 1)
+	require.Len(t, matches[0], 3)
 	assert.Equal(t, "because of "+strings.Repeat("A", 489), matches[0][1])
 	assert.Equal(t, " (truncated)", matches[0][2])
 

integrations/kube-agent-updater/pkg/controller/updater_test.go

@@ -169,7 +169,7 @@ func Test_VersionUpdater_GetVersion(t *testing.T) {
 				require.Nil(t, image)
 			} else {
 				require.NotNil(t, image)
-				require.Equal(t, image.String(), tt.expectedImage)
+				require.Equal(t, tt.expectedImage, image.String())
 			}
 		})
 	}

integrations/lib/credentials/credentials_test.go

@@ -148,7 +148,7 @@ func TestCheckExpiredCredentials(t *testing.T) {
 				require.Error(t, err)
 				aggregate, ok := trace.Unwrap(err).(trace.Aggregate)
 				require.True(t, ok)
-				require.Equal(t, len(aggregate.Errors()), tc.expectNumErrors, "check number of errors reported")
+				require.Len(t, aggregate.Errors(), tc.expectNumErrors, "check number of errors reported")
 			}
 		})
 	}

integrations/lib/plugindata/access_request_test.go

@@ -33,7 +33,7 @@ var sampleAccessRequestData = AccessRequestData{
 
 func TestEncodeAccessRequestData(t *testing.T) {
 	dataMap, err := EncodeAccessRequestData(sampleAccessRequestData)
-	assert.Nil(t, err)
+	assert.NoError(t, err)
 	assert.Len(t, dataMap, 8)
 	assert.Equal(t, "user-foo", dataMap["user"])
 	assert.Equal(t, "role-foo,role-bar", dataMap["roles"])
@@ -56,13 +56,13 @@ func TestDecodeAccessRequestData(t *testing.T) {
 		"resolve_reason":      "foo ok",
 		"suggested_reviewers": "[\"foouser\"]",
 	})
-	assert.Nil(t, err)
+	assert.NoError(t, err)
 	assert.Equal(t, sampleAccessRequestData, pluginData)
 }
 
 func TestEncodeEmptyAccessRequestData(t *testing.T) {
 	dataMap, err := EncodeAccessRequestData(AccessRequestData{})
-	assert.Nil(t, err)
+	assert.NoError(t, err)
 	assert.Len(t, dataMap, 7)
 	for key, value := range dataMap {
 		assert.Emptyf(t, value, "value at key %q must be empty", key)
@@ -71,9 +71,9 @@ func TestEncodeEmptyAccessRequestData(t *testing.T) {
 
 func TestDecodeEmptyAccessRequestData(t *testing.T) {
 	decoded, err := DecodeAccessRequestData(nil)
-	assert.Nil(t, err)
+	assert.NoError(t, err)
 	assert.Empty(t, decoded)
 	decoded, err = DecodeAccessRequestData(make(map[string]string))
-	assert.Nil(t, err)
+	assert.NoError(t, err)
 	assert.Empty(t, decoded)
 }

integrations/lib/plugindata/cas_test.go

@@ -106,7 +106,7 @@ func TestModifyFailed(t *testing.T) {
 	})
 
 	require.Error(t, err, "fail")
-	require.Equal(t, r, mockData{})
+	require.Equal(t, mockData{}, r)
 }
 
 // We test cas is retrying modityT properly if modifyT returns a CompareFailedError during the first iteration.
@@ -130,7 +130,7 @@ func TestModifyCompareFailed(t *testing.T) {
 
 	require.NoError(t, err)
 	require.NotNil(t, r)
-	require.Equal(t, r.Bar, "other value")
+	require.Equal(t, "other value", r.Bar)
 }
 
 func TestModifySuccess(t *testing.T) {
@@ -146,7 +146,7 @@ func TestModifySuccess(t *testing.T) {
 
 	require.NoError(t, err)
 	require.NotNil(t, r)
-	require.Equal(t, r.Foo, "other value")
+	require.Equal(t, "other value", r.Foo)
 }
 
 func TestBackoff(t *testing.T) {
@@ -162,7 +162,7 @@ func TestBackoff(t *testing.T) {
 
 	require.NoError(t, err)
 	require.NotNil(t, r)
-	require.Equal(t, r.Foo, "yes")
+	require.Equal(t, "yes", r.Foo)
 }
 
 func TestWrongData(t *testing.T) {

integrations/operator/apis/resources/v3/oidcconnector_types_test.go

@@ -54,7 +54,7 @@ func TestTeleportOIDCConnectorSpec_MarshalJSON(t *testing.T) {
 		t.Run(tc.name, func(t *testing.T) {
 			result, err := json.Marshal(tc.spec)
 			require.NoError(t, err)
-			require.Equal(t, string(result), tc.expectedJSON)
+			require.Equal(t, tc.expectedJSON, string(result))
 		})
 	}
 }

integrations/operator/controllers/resources/provision_token_controller_test.go

@@ -224,9 +224,9 @@ github:
 		}
 		require.NoError(t, err)
 
-		require.Equal(t, tToken.GetName(), tokenName)
+		require.Equal(t, tokenName, tToken.GetName())
 		require.Contains(t, tToken.GetMetadata().Labels, types.OriginLabel)
-		require.Equal(t, tToken.GetMetadata().Labels[types.OriginLabel], types.OriginKubernetes)
+		require.Equal(t, types.OriginKubernetes, tToken.GetMetadata().Labels[types.OriginLabel])
 		expectedToken := &types.ProvisionTokenV2{
 			Metadata: types.Metadata{},
 			Spec:     *expectedSpec,

integrations/operator/controllers/resources/role_controller_test.go

@@ -56,9 +56,9 @@ func TestRoleCreation(t *testing.T) {
 		require.NoError(t, err)
 
 		// Role should have the same name, and have the Kubernetes origin label
-		require.Equal(t, tRole.GetName(), roleName)
+		require.Equal(t, roleName, tRole.GetName())
 		require.Contains(t, tRole.GetMetadata().Labels, types.OriginLabel)
-		require.Equal(t, tRole.GetMetadata().Labels[types.OriginLabel], types.OriginKubernetes)
+		require.Equal(t, types.OriginKubernetes, tRole.GetMetadata().Labels[types.OriginLabel])
 
 		return true
 	})
@@ -225,9 +225,9 @@ allow:
 					}
 					require.NoError(t, err)
 
-					require.Equal(t, tRole.GetName(), roleName)
+					require.Equal(t, roleName, tRole.GetName())
 					require.Contains(t, tRole.GetMetadata().Labels, types.OriginLabel)
-					require.Equal(t, tRole.GetMetadata().Labels[types.OriginLabel], types.OriginKubernetes)
+					require.Equal(t, types.OriginKubernetes, tRole.GetMetadata().Labels[types.OriginLabel])
 					expectedRole, _ := types.NewRole(roleName, *tc.expectedSpec)
 					compareRoleSpecs(t, expectedRole, tRole)
 
@@ -275,10 +275,10 @@ func TestRoleDeletionDrift(t *testing.T) {
 		}
 		require.NoError(t, err)
 
-		require.Equal(t, tRole.GetName(), roleName)
+		require.Equal(t, roleName, tRole.GetName())
 
 		require.Contains(t, tRole.GetMetadata().Labels, types.OriginLabel)
-		require.Equal(t, tRole.GetMetadata().Labels[types.OriginLabel], types.OriginKubernetes)
+		require.Equal(t, types.OriginKubernetes, tRole.GetMetadata().Labels[types.OriginLabel])
 
 		return true
 	})
@@ -457,7 +457,7 @@ func TestAddTeleportResourceOriginRole(t *testing.T) {
 			r.AddTeleportResourceOrigin(tc.resource)
 			metadata := tc.resource.GetMetadata()
 			require.Contains(t, metadata.Labels, types.OriginLabel)
-			require.Equal(t, metadata.Labels[types.OriginLabel], types.OriginKubernetes)
+			require.Equal(t, types.OriginKubernetes, metadata.Labels[types.OriginLabel])
 		})
 	}
 }

integrations/operator/controllers/resources/testlib/teleport_reconciler_tests.go

@@ -65,7 +65,7 @@ func ResourceCreationTest[T resources.TeleportResource, K resources.TeleportKube
 		require.Equal(t, tResource.GetName(), resourceName)
 
 		require.Contains(t, tResource.GetMetadata().Labels, types.OriginLabel)
-		require.Equal(t, tResource.GetMetadata().Labels[types.OriginLabel], types.OriginKubernetes)
+		require.Equal(t, types.OriginKubernetes, tResource.GetMetadata().Labels[types.OriginLabel])
 
 		return true
 	})
@@ -106,7 +106,7 @@ func ResourceDeletionDriftTest[T resources.TeleportResource, K resources.Telepor
 		require.Equal(t, tResource.GetName(), resourceName)
 
 		require.Contains(t, tResource.GetMetadata().Labels, types.OriginLabel)
-		require.Equal(t, tResource.GetMetadata().Labels[types.OriginLabel], types.OriginKubernetes)
+		require.Equal(t, types.OriginKubernetes, tResource.GetMetadata().Labels[types.OriginLabel])
 
 		return true
 	})

integrations/operator/controllers/resources/user_controller_test.go

@@ -64,10 +64,10 @@ func TestUserCreation(t *testing.T) {
 		}
 		require.NoError(t, err)
 
-		require.Equal(t, tUser.GetName(), userName)
+		require.Equal(t, userName, tUser.GetName())
 
 		require.Contains(t, tUser.GetMetadata().Labels, types.OriginLabel)
-		require.Equal(t, tUser.GetMetadata().Labels[types.OriginLabel], types.OriginKubernetes)
+		require.Equal(t, types.OriginKubernetes, tUser.GetMetadata().Labels[types.OriginLabel])
 
 		return true
 	})
@@ -193,9 +193,9 @@ traits:
 					}
 					require.NoError(t, err)
 
-					require.Equal(t, tUser.GetName(), userName)
+					require.Equal(t, userName, tUser.GetName())
 					require.Contains(t, tUser.GetMetadata().Labels, types.OriginLabel)
-					require.Equal(t, tUser.GetMetadata().Labels[types.OriginLabel], types.OriginKubernetes)
+					require.Equal(t, types.OriginKubernetes, tUser.GetMetadata().Labels[types.OriginLabel])
 					require.Equal(t, setup.OperatorName, tUser.GetCreatedBy().User.Name)
 					expectedUser := &types.UserV2{
 						Metadata: types.Metadata{},
@@ -256,10 +256,10 @@ func TestUserDeletionDrift(t *testing.T) {
 		}
 		require.NoError(t, err)
 
-		require.Equal(t, tUser.GetName(), userName)
+		require.Equal(t, userName, tUser.GetName())
 
 		require.Contains(t, tUser.GetMetadata().Labels, types.OriginLabel)
-		require.Equal(t, tUser.GetMetadata().Labels[types.OriginLabel], types.OriginKubernetes)
+		require.Equal(t, types.OriginKubernetes, tUser.GetMetadata().Labels[types.OriginLabel])
 
 		return true
 	})
@@ -274,7 +274,7 @@ func TestUserDeletionDrift(t *testing.T) {
 		return trace.IsNotFound(err)
 	})
 
-	// We flag the role for deletion in Kubernetes (it won't be fully remopved until the operator has processed it and removed the finalizer)
+	// We flag the role for deletion in Kubernetes (it won't be fully removed until the operator has processed it and removed the finalizer)
 	k8sDeleteUser(ctx, t, setup.K8sClient, userName, setup.Namespace.Name)
 
 	// Test section: We resume the operator, it should reconcile and recover from the drift

integrations/operator/controllers/resources/utils_test.go

@@ -87,9 +87,9 @@ func TestCheckOwnership(t *testing.T) {
 			condition, isOwned := checkOwnership(tc.existingResource)
 
 			require.Equal(t, tc.isOwned, isOwned)
-			require.Equal(t, condition.Type, ConditionTypeTeleportResourceOwned)
-			require.Equal(t, condition.Status, tc.expectedConditionStatus)
-			require.Equal(t, condition.Reason, tc.expectedConditionReason)
+			require.Equal(t, ConditionTypeTeleportResourceOwned, condition.Type)
+			require.Equal(t, tc.expectedConditionStatus, condition.Status)
+			require.Equal(t, tc.expectedConditionReason, condition.Reason)
 		})
 	}
 }

lib/ai/chat_test.go

@@ -97,7 +97,7 @@ func TestChat_PromptTokens(t *testing.T) {
 			server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 				w.Header().Set("Content-Type", "text/event-stream")
 
-				require.GreaterOrEqual(t, len(responses), 1, "Unexpected request")
+				require.NotEmpty(t, responses, "Unexpected request")
 				dataBytes := responses[0]
 				_, err := w.Write([]byte(dataBytes))
 				require.NoError(t, err, "Write error")
@@ -147,7 +147,7 @@ func TestChat_Complete(t *testing.T) {
 	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		w.Header().Set("Content-Type", "text/event-stream")
 
-		require.GreaterOrEqual(t, len(responses), 1, "Unexpected request")
+		require.NotEmpty(t, responses, "Unexpected request")
 		dataBytes := responses[0]
 
 		_, err := w.Write(dataBytes)

lib/ai/testutils/http.go

@@ -50,7 +50,7 @@ func GetTestHandlerFn(t *testing.T, responses []string) http.HandlerFunc {
 func streamResponse(w http.ResponseWriter, t *testing.T, responses []string) []string {
 	w.Header().Set("Content-Type", "text/event-stream")
 
-	if !assert.GreaterOrEqual(t, len(responses), 1, "Unexpected request") {
+	if !assert.NotEmpty(t, responses, "Unexpected request") {
 		http.Error(w, "Unexpected request", http.StatusBadRequest)
 		return responses
 	}
@@ -95,7 +95,7 @@ func messageResponse(w http.ResponseWriter, r *http.Request, t *testing.T, respo
 	}
 
 	// Use assert as require doesn't work when called from a goroutine
-	if !assert.GreaterOrEqual(t, len(responses), 1, "Unexpected request") {
+	if !assert.NotEmpty(t, responses, "Unexpected request") {
 		http.Error(w, "Unexpected request", http.StatusBadRequest)
 		return responses
 	}

lib/assist/assist_test.go

@@ -104,7 +104,7 @@ func TestChatComplete(t *testing.T) {
 				return nil
 			}
 			require.Equal(t, MessageKindCommand, kind)
-			require.Equal(t, string(payload), `{"command":"df -h","nodes":["localhost"]}`)
+			require.Equal(t, `{"command":"df -h","nodes":["localhost"]}`, string(payload))
 			called = true
 			return nil
 		}, "Show free disk space on localhost")
@@ -150,19 +150,19 @@ func TestClassifyMessage(t *testing.T) {
 	t.Run("Valid class", func(t *testing.T) {
 		class, err := client.ClassifyMessage(ctx, "whatever", MessageClasses)
 		require.NoError(t, err)
-		require.Equal(t, class, "troubleshooting")
+		require.Equal(t, "troubleshooting", class)
 	})
 
 	t.Run("Valid class starting with upper-case", func(t *testing.T) {
 		class, err := client.ClassifyMessage(ctx, "whatever", MessageClasses)
 		require.NoError(t, err)
-		require.Equal(t, class, "troubleshooting")
+		require.Equal(t, "troubleshooting", class)
 	})
 
 	t.Run("Valid class starting with upper-case and ending with dot", func(t *testing.T) {
 		class, err := client.ClassifyMessage(ctx, "whatever", MessageClasses)
 		require.NoError(t, err)
-		require.Equal(t, class, "troubleshooting")
+		require.Equal(t, "troubleshooting", class)
 	})
 
 	t.Run("Model hallucinates", func(t *testing.T) {

lib/auth/access_test.go

@@ -47,14 +47,14 @@ func TestUpsertDeleteRoleEventsEmitted(t *testing.T) {
 	// Creating a role should emit a RoleCreatedEvent.
 	role, err = p.a.CreateRole(ctx, role)
 	require.NoError(t, err)
-	require.Equal(t, p.mockEmitter.LastEvent().GetType(), events.RoleCreatedEvent)
+	require.Equal(t, events.RoleCreatedEvent, p.mockEmitter.LastEvent().GetType())
 	require.Equal(t, p.mockEmitter.LastEvent().(*apievents.RoleCreate).Name, role.GetName())
 	p.mockEmitter.Reset()
 
 	// Upserting a role should emit a RoleCreatedEvent.
 	role, err = p.a.UpsertRole(ctx, role)
 	require.NoError(t, err)
-	require.Equal(t, p.mockEmitter.LastEvent().GetType(), events.RoleCreatedEvent)
+	require.Equal(t, events.RoleCreatedEvent, p.mockEmitter.LastEvent().GetType())
 	require.Equal(t, p.mockEmitter.LastEvent().(*apievents.RoleCreate).Name, role.GetName())
 	p.mockEmitter.Reset()
 
@@ -62,14 +62,14 @@ func TestUpsertDeleteRoleEventsEmitted(t *testing.T) {
 	role.SetLogins(types.Allow, []string{"llama"})
 	role, err = p.a.UpdateRole(ctx, role)
 	require.NoError(t, err)
-	require.Equal(t, p.mockEmitter.LastEvent().GetType(), events.RoleUpdatedEvent)
+	require.Equal(t, events.RoleUpdatedEvent, p.mockEmitter.LastEvent().GetType())
 	require.Equal(t, p.mockEmitter.LastEvent().(*apievents.RoleUpdate).Name, role.GetName())
 	p.mockEmitter.Reset()
 
 	// Deleting a role should emit a RoleDeletedEvent.
 	err = p.a.DeleteRole(ctx, role.GetName())
 	require.NoError(t, err)
-	require.Equal(t, p.mockEmitter.LastEvent().GetType(), events.RoleDeletedEvent)
+	require.Equal(t, events.RoleDeletedEvent, p.mockEmitter.LastEvent().GetType())
 	require.Equal(t, p.mockEmitter.LastEvent().(*apievents.RoleDelete).Name, role.GetName())
 	p.mockEmitter.Reset()
 

lib/auth/accountrecovery_test.go

@@ -192,9 +192,9 @@ func TestStartAccountRecovery(t *testing.T) {
 
 			// Test events emitted.
 			event := mockEmitter.LastEvent()
-			require.Equal(t, event.GetType(), events.RecoveryTokenCreateEvent)
-			require.Equal(t, event.GetCode(), events.RecoveryTokenCreateCode)
-			require.Equal(t, event.(*apievents.UserTokenCreate).Name, u.username)
+			require.Equal(t, events.RecoveryTokenCreateEvent, event.GetType())
+			require.Equal(t, events.RecoveryTokenCreateCode, event.GetCode())
+			require.Equal(t, u.username, event.(*apievents.UserTokenCreate).Name)
 		})
 	}
 }
@@ -424,9 +424,9 @@ func TestVerifyAccountRecovery_WithAuthnErrors(t *testing.T) {
 
 			// Test events emitted.
 			event := mockEmitter.LastEvent()
-			require.Equal(t, event.GetType(), events.RecoveryTokenCreateEvent)
-			require.Equal(t, event.GetCode(), events.RecoveryTokenCreateCode)
-			require.Equal(t, event.(*apievents.UserTokenCreate).Name, u.username)
+			require.Equal(t, events.RecoveryTokenCreateEvent, event.GetType())
+			require.Equal(t, events.RecoveryTokenCreateCode, event.GetCode())
+			require.Equal(t, u.username, event.(*apievents.UserTokenCreate).Name)
 
 			// Test start token got deleted.
 			_, err = srv.Auth().GetUserToken(ctx, startToken.GetName())
@@ -440,7 +440,7 @@ func TestVerifyAccountRecovery_WithAuthnErrors(t *testing.T) {
 			// Test recovery attempts are deleted.
 			attempts, err = srv.Auth().GetUserRecoveryAttempts(ctx, u.username)
 			require.NoError(t, err)
-			require.Len(t, attempts, 0)
+			require.Empty(t, attempts)
 		})
 	}
 }
@@ -511,7 +511,7 @@ func TestVerifyAccountRecovery_WithLock(t *testing.T) {
 	// Test recovery attempts got reset.
 	attempts, err := srv.Auth().GetUserRecoveryAttempts(ctx, u.username)
 	require.NoError(t, err)
-	require.Len(t, attempts, 0)
+	require.Empty(t, attempts)
 }
 
 func TestVerifyAccountRecovery_WithErrors(t *testing.T) {
@@ -651,7 +651,7 @@ func TestCompleteAccountRecovery(t *testing.T) {
 	// Test login attempts are removed.
 	attempts, err := srv.Auth().GetUserLoginAttempts(u.username)
 	require.NoError(t, err)
-	require.Len(t, attempts, 0)
+	require.Empty(t, attempts)
 
 	// Test adding MFA devices.
 	approvedToken, err = srv.Auth().createRecoveryToken(ctx, u.username, UserTokenTypeRecoveryApproved, types.UserTokenUsage_USER_TOKEN_RECOVER_MFA)
@@ -715,9 +715,9 @@ func TestCompleteAccountRecovery(t *testing.T) {
 
 			// Test events emitted.
 			event := mockEmitter.LastEvent()
-			require.Equal(t, event.GetType(), events.MFADeviceAddEvent)
-			require.Equal(t, event.GetCode(), events.MFADeviceAddEventCode)
-			require.Equal(t, event.(*apievents.MFADeviceAdd).UserMetadata.User, u.username)
+			require.Equal(t, events.MFADeviceAddEvent, event.GetType())
+			require.Equal(t, events.MFADeviceAddEventCode, event.GetCode())
+			require.Equal(t, u.username, event.(*apievents.MFADeviceAdd).UserMetadata.User)
 
 			// Test new device has been added.
 			mfas, err := srv.Auth().Services.GetMFADevices(ctx, u.username, false)
@@ -1323,9 +1323,9 @@ func triggerLoginLock(t *testing.T, srv *Server, username string) {
 
 		// Test last attempt returns locked error.
 		if i == defaults.MaxLoginAttempts {
-			require.Equal(t, err.Error(), MaxFailedAttemptsErrMsg)
+			require.Equal(t, MaxFailedAttemptsErrMsg, err.Error())
 		} else {
-			require.NotEqual(t, err.Error(), MaxFailedAttemptsErrMsg)
+			require.NotEqual(t, MaxFailedAttemptsErrMsg, err.Error())
 		}
 	}
 }

lib/auth/auth_login_test.go

@@ -269,9 +269,9 @@ func TestCreateAuthenticateChallenge_WithUserCredentials_WithLock(t *testing.T)
 
 		// Test last attempt returns locked error.
 		if i == defaults.MaxLoginAttempts {
-			require.Equal(t, err.Error(), MaxFailedAttemptsErrMsg)
+			require.Equal(t, MaxFailedAttemptsErrMsg, err.Error())
 		} else {
-			require.NotEqual(t, err.Error(), MaxFailedAttemptsErrMsg)
+			require.NotEqual(t, MaxFailedAttemptsErrMsg, err.Error())
 		}
 	}
 }
@@ -928,7 +928,7 @@ func TestServer_Authenticate_passwordless(t *testing.T) {
 			require.NoError(t, err)
 			require.Empty(t, attempts, "Login attempts not reset")
 
-			require.Equal(t, len(test.loginHooks), int(loginHookCounter.Load()))
+			require.Len(t, test.loginHooks, int(loginHookCounter.Load()))
 		})
 	}
 }

lib/auth/auth_test.go

@@ -300,14 +300,14 @@ func TestAuthenticateSSHUser(t *testing.T) {
 		RouteToCluster: s.clusterName.GetClusterName(),
 	})
 	require.NoError(t, err)
-	require.Equal(t, resp.Username, user)
+	require.Equal(t, user, resp.Username)
 	// Verify the public key and principals in SSH cert.
 	inSSHPub, _, _, _, err := ssh.ParseAuthorizedKey(pub)
 	require.NoError(t, err)
 	gotSSHCert, err := sshutils.ParseCertificate(resp.Cert)
 	require.NoError(t, err)
-	require.Equal(t, gotSSHCert.Key, inSSHPub)
-	require.Equal(t, gotSSHCert.ValidPrincipals, []string{user, teleport.SSHSessionJoinPrincipal})
+	require.Equal(t, inSSHPub, gotSSHCert.Key)
+	require.Equal(t, []string{user, teleport.SSHSessionJoinPrincipal}, gotSSHCert.ValidPrincipals)
 	// Verify the public key and Subject in TLS cert.
 	inCryptoPub := inSSHPub.(ssh.CryptoPublicKey).CryptoPublicKey()
 	gotTLSCert, err := tlsca.ParseCertificatePEM(resp.TLSCert)
@@ -359,7 +359,7 @@ func TestAuthenticateSSHUser(t *testing.T) {
 	}
 	gotID, err = tlsca.FromSubject(gotTLSCert.Subject, gotTLSCert.NotAfter)
 	require.NoError(t, err)
-	require.Equal(t, *gotID, wantID)
+	require.Equal(t, wantID, *gotID)
 
 	// Register a kubernetes cluster to verify the defaulting logic in TLS cert
 	// generation.
@@ -405,7 +405,7 @@ func TestAuthenticateSSHUser(t *testing.T) {
 	}
 	gotID, err = tlsca.FromSubject(gotTLSCert.Subject, gotTLSCert.NotAfter)
 	require.NoError(t, err)
-	require.Equal(t, *gotID, wantID)
+	require.Equal(t, wantID, *gotID)
 
 	// Login without specifying kube cluster. A registered one should be picked
 	// automatically.
@@ -422,7 +422,7 @@ func TestAuthenticateSSHUser(t *testing.T) {
 		KubernetesCluster: "",
 	})
 	require.NoError(t, err)
-	require.Equal(t, resp.Username, user)
+	require.Equal(t, user, resp.Username)
 	gotTLSCert, err = tlsca.ParseCertificatePEM(resp.TLSCert)
 	require.NoError(t, err)
 	wantID = tlsca.Identity{
@@ -439,7 +439,7 @@ func TestAuthenticateSSHUser(t *testing.T) {
 	}
 	gotID, err = tlsca.FromSubject(gotTLSCert.Subject, gotTLSCert.NotAfter)
 	require.NoError(t, err)
-	require.Equal(t, *gotID, wantID)
+	require.Equal(t, wantID, *gotID)
 
 	// Login specifying a valid kube cluster. It should appear in the TLS cert.
 	resp, err = s.a.AuthenticateSSHUser(ctx, AuthenticateSSHRequest{
@@ -453,7 +453,7 @@ func TestAuthenticateSSHUser(t *testing.T) {
 		KubernetesCluster: "root-kube-cluster",
 	})
 	require.NoError(t, err)
-	require.Equal(t, resp.Username, user)
+	require.Equal(t, user, resp.Username)
 	gotTLSCert, err = tlsca.ParseCertificatePEM(resp.TLSCert)
 	require.NoError(t, err)
 	wantID = tlsca.Identity{
@@ -470,7 +470,7 @@ func TestAuthenticateSSHUser(t *testing.T) {
 	}
 	gotID, err = tlsca.FromSubject(gotTLSCert.Subject, gotTLSCert.NotAfter)
 	require.NoError(t, err)
-	require.Equal(t, *gotID, wantID)
+	require.Equal(t, wantID, *gotID)
 
 	// Login without specifying kube cluster. A registered one should be picked
 	// automatically.
@@ -487,7 +487,7 @@ func TestAuthenticateSSHUser(t *testing.T) {
 		KubernetesCluster: "",
 	})
 	require.NoError(t, err)
-	require.Equal(t, resp.Username, user)
+	require.Equal(t, user, resp.Username)
 	gotTLSCert, err = tlsca.ParseCertificatePEM(resp.TLSCert)
 	require.NoError(t, err)
 	wantID = tlsca.Identity{
@@ -504,7 +504,7 @@ func TestAuthenticateSSHUser(t *testing.T) {
 	}
 	gotID, err = tlsca.FromSubject(gotTLSCert.Subject, gotTLSCert.NotAfter)
 	require.NoError(t, err)
-	require.Equal(t, *gotID, wantID)
+	require.Equal(t, wantID, *gotID)
 
 	// Login specifying an invalid kube cluster. This should fail.
 	_, err = s.a.AuthenticateSSHUser(ctx, AuthenticateSSHRequest{
@@ -703,7 +703,7 @@ func TestUpdateConfig(t *testing.T) {
 	require.Equal(t, cn.GetClusterName(), s.clusterName.GetClusterName())
 	st, err := s.a.GetStaticTokens()
 	require.NoError(t, err)
-	require.Equal(t, st.GetStaticTokens(), []types.ProvisionToken{})
+	require.Empty(t, st.GetStaticTokens())
 
 	// try and set cluster name, this should fail because you can only set the
 	// cluster name once
@@ -777,8 +777,8 @@ func TestCreateAndUpdateUserEventsEmitted(t *testing.T) {
 	})
 	user, err = s.a.CreateUser(ctx, user)
 	require.NoError(t, err)
-	require.Equal(t, s.mockEmitter.LastEvent().GetType(), events.UserCreateEvent)
-	require.Equal(t, s.mockEmitter.LastEvent().(*apievents.UserCreate).User, "some-auth-user")
+	require.Equal(t, events.UserCreateEvent, s.mockEmitter.LastEvent().GetType())
+	require.Equal(t, "some-auth-user", s.mockEmitter.LastEvent().(*apievents.UserCreate).User)
 	s.mockEmitter.Reset()
 
 	// test create user with existing user
@@ -791,7 +791,7 @@ func TestCreateAndUpdateUserEventsEmitted(t *testing.T) {
 	require.NoError(t, err)
 	_, err = s.a.CreateUser(ctx, user2)
 	require.NoError(t, err)
-	require.Equal(t, s.mockEmitter.LastEvent().(*apievents.UserCreate).User, teleport.UserSystem)
+	require.Equal(t, teleport.UserSystem, s.mockEmitter.LastEvent().(*apievents.UserCreate).User)
 	s.mockEmitter.Reset()
 
 	// test update on non-existent user
@@ -804,8 +804,8 @@ func TestCreateAndUpdateUserEventsEmitted(t *testing.T) {
 	// test update user
 	_, err = s.a.UpdateUser(ctx, user)
 	require.NoError(t, err)
-	require.Equal(t, s.mockEmitter.LastEvent().GetType(), events.UserUpdatedEvent)
-	require.Equal(t, s.mockEmitter.LastEvent().(*apievents.UserUpdate).User, teleport.UserSystem)
+	require.Equal(t, events.UserUpdatedEvent, s.mockEmitter.LastEvent().GetType())
+	require.Equal(t, teleport.UserSystem, s.mockEmitter.LastEvent().(*apievents.UserUpdate).User)
 }
 
 func TestTrustedClusterCRUDEventEmitted(t *testing.T) {
@@ -839,7 +839,7 @@ func TestTrustedClusterCRUDEventEmitted(t *testing.T) {
 
 	_, err = s.a.UpsertTrustedCluster(ctx, tc)
 	require.NoError(t, err)
-	require.Equal(t, s.mockEmitter.LastEvent().GetType(), events.TrustedClusterCreateEvent)
+	require.Equal(t, events.TrustedClusterCreateEvent, s.mockEmitter.LastEvent().GetType())
 	s.mockEmitter.Reset()
 
 	// test create event for switch case: when tc exists but enabled is true
@@ -847,13 +847,13 @@ func TestTrustedClusterCRUDEventEmitted(t *testing.T) {
 
 	_, err = s.a.UpsertTrustedCluster(ctx, tc)
 	require.NoError(t, err)
-	require.Equal(t, s.mockEmitter.LastEvent().GetType(), events.TrustedClusterCreateEvent)
+	require.Equal(t, events.TrustedClusterCreateEvent, s.mockEmitter.LastEvent().GetType())
 	s.mockEmitter.Reset()
 
 	// test delete event
 	err = s.a.DeleteTrustedCluster(ctx, "test")
 	require.NoError(t, err)
-	require.Equal(t, s.mockEmitter.LastEvent().GetType(), events.TrustedClusterDeleteEvent)
+	require.Equal(t, events.TrustedClusterDeleteEvent, s.mockEmitter.LastEvent().GetType())
 }
 
 func TestGithubConnectorCRUDEventsEmitted(t *testing.T) {
@@ -875,7 +875,7 @@ func TestGithubConnectorCRUDEventsEmitted(t *testing.T) {
 	github, err = s.a.createGithubConnector(ctx, github)
 	require.NoError(t, err)
 	require.IsType(t, &apievents.GithubConnectorCreate{}, s.mockEmitter.LastEvent())
-	require.Equal(t, s.mockEmitter.LastEvent().GetType(), events.GithubConnectorCreatedEvent)
+	require.Equal(t, events.GithubConnectorCreatedEvent, s.mockEmitter.LastEvent().GetType())
 	s.mockEmitter.Reset()
 
 	// test github update event
@@ -883,7 +883,7 @@ func TestGithubConnectorCRUDEventsEmitted(t *testing.T) {
 	github, err = s.a.updateGithubConnector(ctx, github)
 	require.NoError(t, err)
 	require.IsType(t, &apievents.GithubConnectorUpdate{}, s.mockEmitter.LastEvent())
-	require.Equal(t, s.mockEmitter.LastEvent().GetType(), events.GithubConnectorUpdatedEvent)
+	require.Equal(t, events.GithubConnectorUpdatedEvent, s.mockEmitter.LastEvent().GetType())
 	s.mockEmitter.Reset()
 
 	// test github upsert event
@@ -891,14 +891,14 @@ func TestGithubConnectorCRUDEventsEmitted(t *testing.T) {
 	err = s.a.upsertGithubConnector(ctx, github)
 	require.NoError(t, err)
 	require.IsType(t, &apievents.GithubConnectorCreate{}, s.mockEmitter.LastEvent())
-	require.Equal(t, s.mockEmitter.LastEvent().GetType(), events.GithubConnectorCreatedEvent)
+	require.Equal(t, events.GithubConnectorCreatedEvent, s.mockEmitter.LastEvent().GetType())
 	s.mockEmitter.Reset()
 
 	// test github delete event
 	err = s.a.deleteGithubConnector(ctx, "test")
 	require.NoError(t, err)
 	require.IsType(t, &apievents.GithubConnectorDelete{}, s.mockEmitter.LastEvent())
-	require.Equal(t, s.mockEmitter.LastEvent().GetType(), events.GithubConnectorDeletedEvent)
+	require.Equal(t, events.GithubConnectorDeletedEvent, s.mockEmitter.LastEvent().GetType())
 }
 
 func TestOIDCConnectorCRUDEventsEmitted(t *testing.T) {
@@ -923,7 +923,7 @@ func TestOIDCConnectorCRUDEventsEmitted(t *testing.T) {
 	oidc, err = s.a.CreateOIDCConnector(ctx, oidc)
 	require.NoError(t, err)
 	require.IsType(t, &apievents.OIDCConnectorCreate{}, s.mockEmitter.LastEvent())
-	require.Equal(t, s.mockEmitter.LastEvent().GetType(), events.OIDCConnectorCreatedEvent)
+	require.Equal(t, events.OIDCConnectorCreatedEvent, s.mockEmitter.LastEvent().GetType())
 	s.mockEmitter.Reset()
 
 	// test oidc update event
@@ -931,7 +931,7 @@ func TestOIDCConnectorCRUDEventsEmitted(t *testing.T) {
 	oidc, err = s.a.UpdateOIDCConnector(ctx, oidc)
 	require.NoError(t, err)
 	require.IsType(t, &apievents.OIDCConnectorUpdate{}, s.mockEmitter.LastEvent())
-	require.Equal(t, s.mockEmitter.LastEvent().GetType(), events.OIDCConnectorUpdatedEvent)
+	require.Equal(t, events.OIDCConnectorUpdatedEvent, s.mockEmitter.LastEvent().GetType())
 	s.mockEmitter.Reset()
 
 	// test oidc upsert event
@@ -939,14 +939,14 @@ func TestOIDCConnectorCRUDEventsEmitted(t *testing.T) {
 	err = s.a.UpsertOIDCConnector(ctx, oidc)
 	require.NoError(t, err)
 	require.IsType(t, &apievents.OIDCConnectorCreate{}, s.mockEmitter.LastEvent())
-	require.Equal(t, s.mockEmitter.LastEvent().GetType(), events.OIDCConnectorCreatedEvent)
+	require.Equal(t, events.OIDCConnectorCreatedEvent, s.mockEmitter.LastEvent().GetType())
 	s.mockEmitter.Reset()
 
 	// test oidc delete event
 	err = s.a.DeleteOIDCConnector(ctx, "test")
 	require.NoError(t, err)
 	require.IsType(t, &apievents.OIDCConnectorDelete{}, s.mockEmitter.LastEvent())
-	require.Equal(t, s.mockEmitter.LastEvent().GetType(), events.OIDCConnectorDeletedEvent)
+	require.Equal(t, events.OIDCConnectorDeletedEvent, s.mockEmitter.LastEvent().GetType())
 }
 
 func TestSAMLConnectorCRUDEventsEmitted(t *testing.T) {
@@ -995,7 +995,7 @@ func TestSAMLConnectorCRUDEventsEmitted(t *testing.T) {
 	saml, err = s.a.CreateSAMLConnector(ctx, saml)
 	require.NoError(t, err)
 	require.IsType(t, &apievents.SAMLConnectorCreate{}, s.mockEmitter.LastEvent())
-	require.Equal(t, s.mockEmitter.LastEvent().GetType(), events.SAMLConnectorCreatedEvent)
+	require.Equal(t, events.SAMLConnectorCreatedEvent, s.mockEmitter.LastEvent().GetType())
 	s.mockEmitter.Reset()
 
 	// test saml update event
@@ -1003,7 +1003,7 @@ func TestSAMLConnectorCRUDEventsEmitted(t *testing.T) {
 	saml, err = s.a.UpdateSAMLConnector(ctx, saml)
 	require.NoError(t, err)
 	require.IsType(t, &apievents.SAMLConnectorUpdate{}, s.mockEmitter.LastEvent())
-	require.Equal(t, s.mockEmitter.LastEvent().GetType(), events.SAMLConnectorUpdatedEvent)
+	require.Equal(t, events.SAMLConnectorUpdatedEvent, s.mockEmitter.LastEvent().GetType())
 	s.mockEmitter.Reset()
 
 	// test saml upsert event
@@ -1011,14 +1011,14 @@ func TestSAMLConnectorCRUDEventsEmitted(t *testing.T) {
 	err = s.a.UpsertSAMLConnector(ctx, saml)
 	require.NoError(t, err)
 	require.IsType(t, &apievents.SAMLConnectorCreate{}, s.mockEmitter.LastEvent())
-	require.Equal(t, s.mockEmitter.LastEvent().GetType(), events.SAMLConnectorCreatedEvent)
+	require.Equal(t, events.SAMLConnectorCreatedEvent, s.mockEmitter.LastEvent().GetType())
 	s.mockEmitter.Reset()
 
 	// test saml delete event
 	err = s.a.DeleteSAMLConnector(ctx, "test")
 	require.NoError(t, err)
 	require.IsType(t, &apievents.SAMLConnectorDelete{}, s.mockEmitter.LastEvent())
-	require.Equal(t, s.mockEmitter.LastEvent().GetType(), events.SAMLConnectorDeletedEvent)
+	require.Equal(t, events.SAMLConnectorDeletedEvent, s.mockEmitter.LastEvent().GetType())
 }
 
 func TestEmitSSOLoginFailureEvent(t *testing.T) {
@@ -1026,7 +1026,7 @@ func TestEmitSSOLoginFailureEvent(t *testing.T) {
 
 	emitSSOLoginFailureEvent(context.Background(), mockE, "test", trace.BadParameter("some error"), false)
 
-	require.Equal(t, mockE.LastEvent(), &apievents.UserLogin{
+	expectedLoginFailure := &apievents.UserLogin{
 		Metadata: apievents.Metadata{
 			Type: events.UserLoginEvent,
 			Code: events.UserSSOLoginFailureCode,
@@ -1037,11 +1037,12 @@ func TestEmitSSOLoginFailureEvent(t *testing.T) {
 			Error:       "some error",
 			UserMessage: "some error",
 		},
-	})
+	}
+	require.Equal(t, expectedLoginFailure, mockE.LastEvent())
 
 	emitSSOLoginFailureEvent(context.Background(), mockE, "test", trace.BadParameter("some error"), true)
 
-	require.Equal(t, mockE.LastEvent(), &apievents.UserLogin{
+	expectedTestFailure := &apievents.UserLogin{
 		Metadata: apievents.Metadata{
 			Type: events.UserLoginEvent,
 			Code: events.UserSSOTestFlowLoginFailureCode,
@@ -1052,7 +1053,8 @@ func TestEmitSSOLoginFailureEvent(t *testing.T) {
 			Error:       "some error",
 			UserMessage: "some error",
 		},
-	})
+	}
+	require.Equal(t, expectedTestFailure, mockE.LastEvent())
 }
 
 func TestServer_AugmentContextUserCertificates(t *testing.T) {
@@ -1190,8 +1192,7 @@ func TestServer_AugmentContextUserCertificates(t *testing.T) {
 			newSSHCert, err := sshutils.ParseCertificate(certs.SSH)
 			require.NoError(t, err, "ParseCertificate failed")
 			test.assertSSHCert(t, newSSHCert)
-			assert.True(t,
-				uint64(validAfter.Unix()) < newSSHCert.ValidAfter,
+			assert.Less(t, uint64(validAfter.Unix()), newSSHCert.ValidAfter,
 				"got newSSHCert.ValidAfter = %v, want > %v", newSSHCert.ValidAfter, validAfter.Unix())
 			assert.Equal(t, uint64(xCert.NotAfter.Unix()), newSSHCert.ValidBefore, "newSSHCert.ValidBefore mismatch")
 		})
@@ -3275,7 +3276,7 @@ func TestGetLicense(t *testing.T) {
 
 	// GetLicense should return error if license is not set
 	_, err := s.a.GetLicense(context.Background())
-	assert.NotNil(t, err)
+	assert.Error(t, err)
 
 	// GetLicense should return cert and key pem concatenated, when license is set
 	l := license.License{
@@ -3285,7 +3286,7 @@ func TestGetLicense(t *testing.T) {
 	s.a.SetLicense(&l)
 
 	actual, err := s.a.GetLicense(context.Background())
-	assert.Nil(t, err)
+	assert.NoError(t, err)
 	assert.Equal(t, fmt.Sprintf("%s%s", l.CertPEM, l.KeyPEM), actual)
 }
 

lib/auth/auth_with_roles_test.go

@@ -719,7 +719,7 @@ func TestGenerateUserCertsForHeadlessKube(t *testing.T) {
 			require.NoError(t, err)
 			identity, err := tlsca.FromSubject(tlsCert.Subject, tlsCert.NotAfter)
 			require.NoError(t, err)
-			require.True(t, tt.expiration.Sub(identity.Expires).Abs() < 10*time.Second,
+			require.Less(t, tt.expiration.Sub(identity.Expires).Abs(), 10*time.Second,
 				"Identity expiration is out of expected boundaries")
 		})
 	}
@@ -1718,7 +1718,7 @@ func TestStreamSessionEvents_Builtin(t *testing.T) {
 	})
 	require.NoError(t, err)
 
-	require.Equal(t, 0, len(searchEvents))
+	require.Empty(t, searchEvents)
 }
 
 // TestGetSessionEvents ensures that when a user streams a session's events, it emits an audit event.
@@ -2664,7 +2664,7 @@ func TestApps(t *testing.T) {
 	require.NoError(t, err)
 	apps, err = adminClt.GetApps(ctx)
 	require.NoError(t, err)
-	require.Len(t, apps, 0)
+	require.Empty(t, apps)
 }
 
 // TestReplaceRemoteLocksRBAC verifies that only a remote proxy may replace the
@@ -3076,7 +3076,7 @@ func TestGetAndList_KubernetesServers(t *testing.T) {
 	require.NoError(t, err)
 	servers, err = clt.GetKubernetesServers(ctx)
 	require.NoError(t, err)
-	require.Len(t, servers, 0)
+	require.Empty(t, servers)
 	resp, err = clt.ListResources(ctx, listRequest)
 	require.NoError(t, err)
 	require.Empty(t, resp.Resources)
@@ -3266,7 +3266,7 @@ func TestListResources_NeedTotalCountFlag(t *testing.T) {
 	require.NoError(t, err)
 	require.Len(t, resp.Resources, 2)
 	require.NotEmpty(t, resp.NextKey)
-	require.Equal(t, len(testNodes), resp.TotalCount)
+	require.Len(t, testNodes, resp.TotalCount)
 
 	// No total.
 	resp, err = clt.ListResources(ctx, proto.ListResourcesRequest{
@@ -3651,7 +3651,7 @@ func TestListResources_KindKubernetesCluster(t *testing.T) {
 		require.NoError(t, err)
 		require.Empty(t, res.NextKey)
 		require.Len(t, res.Resources, len(testNames))
-		require.Equal(t, res.TotalCount, len(testNames))
+		require.Len(t, testNames, res.TotalCount)
 
 		clusters, err := types.ResourcesWithLabels(res.Resources).AsKubeClusters()
 		require.NoError(t, err)
@@ -3792,7 +3792,7 @@ func TestListResources_KindUserGroup(t *testing.T) {
 		require.NoError(t, err)
 		require.Empty(t, res.NextKey)
 		require.Len(t, res.Resources, 3)
-		require.Equal(t, res.TotalCount, 3)
+		require.Equal(t, 3, res.TotalCount)
 
 		userGroups, err := types.ResourcesWithLabels(res.Resources).AsUserGroups()
 		require.NoError(t, err)
@@ -3917,7 +3917,7 @@ func TestDeleteUserAppSessions(t *testing.T) {
 	// No sessions left.
 	sessions, nextKey, err = srv.Auth().ListAppSessions(ctx, 10, "", "")
 	require.NoError(t, err)
-	require.Len(t, sessions, 0)
+	require.Empty(t, sessions)
 	require.Empty(t, nextKey)
 }
 
@@ -4039,7 +4039,7 @@ func TestListResources_SortAndDeduplicate(t *testing.T) {
 			})
 			require.NoError(t, err)
 			require.Len(t, resp.Resources, 2)
-			require.Equal(t, len(uniqueNames), resp.TotalCount)
+			require.Len(t, uniqueNames, resp.TotalCount)
 			fetchedResources = append(fetchedResources, resp.Resources...)
 
 			resp, err = clt.ListResources(ctx, proto.ListResourcesRequest{
@@ -4051,7 +4051,7 @@ func TestListResources_SortAndDeduplicate(t *testing.T) {
 			})
 			require.NoError(t, err)
 			require.Len(t, resp.Resources, 1)
-			require.Equal(t, len(uniqueNames), resp.TotalCount)
+			require.Len(t, uniqueNames, resp.TotalCount)
 			fetchedResources = append(fetchedResources, resp.Resources...)
 
 			r := types.ResourcesWithLabels(fetchedResources)
@@ -5128,7 +5128,7 @@ func TestListReleasesPermissions(t *testing.T) {
 	for _, tc := range tt {
 		t.Run(tc.Name, func(t *testing.T) {
 			role, err := CreateRole(ctx, srv.Auth(), "test-role", tc.Role)
-			require.Nil(t, err)
+			require.NoError(t, err)
 
 			user, err := CreateUser(ctx, srv.Auth(), "test-user", role)
 			require.NoError(t, err)
@@ -5183,7 +5183,7 @@ func TestGetLicensePermissions(t *testing.T) {
 	for _, tc := range tt {
 		t.Run(tc.Name, func(t *testing.T) {
 			role, err := CreateRole(ctx, srv.Auth(), "test-role", tc.Role)
-			require.Nil(t, err)
+			require.NoError(t, err)
 
 			user, err := CreateUser(ctx, srv.Auth(), "test-user", role)
 			require.NoError(t, err)
@@ -5696,7 +5696,7 @@ func TestUpdateHeadlessAuthenticationState(t *testing.T) {
 			state:       types.HeadlessAuthenticationState_HEADLESS_AUTHENTICATION_STATE_DENIED,
 			assertError: require.NoError,
 			assertEvents: func(t *testing.T, emitter *eventstest.MockRecorderEmitter) {
-				require.Equal(t, 1, len(emitter.Events()))
+				require.Len(t, emitter.Events(), 1)
 				require.Equal(t, events.UserHeadlessLoginRejectedCode, emitter.LastEvent().GetCode())
 			},
 		}, {
@@ -5705,7 +5705,7 @@ func TestUpdateHeadlessAuthenticationState(t *testing.T) {
 			withMFA:     true,
 			assertError: require.NoError,
 			assertEvents: func(t *testing.T, emitter *eventstest.MockRecorderEmitter) {
-				require.Equal(t, 1, len(emitter.Events()))
+				require.Len(t, emitter.Events(), 1)
 				require.Equal(t, events.UserHeadlessLoginApprovedCode, emitter.LastEvent().GetCode())
 			},
 		}, {
@@ -5714,7 +5714,7 @@ func TestUpdateHeadlessAuthenticationState(t *testing.T) {
 			withMFA:     false,
 			assertError: assertAccessDenied,
 			assertEvents: func(t *testing.T, emitter *eventstest.MockRecorderEmitter) {
-				require.Equal(t, 1, len(emitter.Events()))
+				require.Len(t, emitter.Events(), 1)
 				require.Equal(t, events.UserHeadlessLoginApprovedFailureCode, emitter.LastEvent().GetCode())
 			},
 		}, {

lib/auth/github_test.go

@@ -130,7 +130,7 @@ func TestCreateGithubUser(t *testing.T) {
 		SessionTTL:    1 * time.Minute,
 	}, true)
 	require.NoError(t, err)
-	require.Equal(t, user.GetName(), "[email protected]")
+	require.Equal(t, "[email protected]", user.GetName())
 
 	// Dry-run must not create a user.
 	_, err = tt.a.GetUser(ctx, "[email protected]", false)
@@ -217,10 +217,10 @@ func TestValidateGithubAuthCallbackEventsEmitted(t *testing.T) {
 		return auth, nil
 	}
 	_, _ = validateGithubAuthCallbackHelper(context.Background(), m, diagCtx, nil, tt.a.emitter)
-	require.Equal(t, tt.mockEmitter.LastEvent().GetType(), events.UserLoginEvent)
-	require.Equal(t, tt.mockEmitter.LastEvent().GetCode(), events.UserSSOLoginCode)
-	require.Equal(t, tt.mockEmitter.LastEvent().(*apievents.UserLogin).AppliedLoginRules, []string{"login-rule"})
-	require.Equal(t, ssoDiagInfoCalls, 0)
+	require.Equal(t, events.UserLoginEvent, tt.mockEmitter.LastEvent().GetType())
+	require.Equal(t, events.UserSSOLoginCode, tt.mockEmitter.LastEvent().GetCode())
+	require.Equal(t, []string{"login-rule"}, tt.mockEmitter.LastEvent().(*apievents.UserLogin).AppliedLoginRules)
+	require.Equal(t, 0, ssoDiagInfoCalls)
 	tt.mockEmitter.Reset()
 
 	// Test failure event, non-test-flow.
@@ -230,8 +230,8 @@ func TestValidateGithubAuthCallbackEventsEmitted(t *testing.T) {
 		return auth, trace.BadParameter("")
 	}
 	_, _ = validateGithubAuthCallbackHelper(context.Background(), m, diagCtx, nil, tt.a.emitter)
-	require.Equal(t, tt.mockEmitter.LastEvent().GetCode(), events.UserSSOLoginFailureCode)
-	require.Equal(t, ssoDiagInfoCalls, 0)
+	require.Equal(t, events.UserSSOLoginFailureCode, tt.mockEmitter.LastEvent().GetCode())
+	require.Equal(t, 0, ssoDiagInfoCalls)
 
 	// Test success event, test-flow.
 	diagCtx = ssoDiagContextFixture(true /* testFlow */)
@@ -240,9 +240,9 @@ func TestValidateGithubAuthCallbackEventsEmitted(t *testing.T) {
 		return auth, nil
 	}
 	_, _ = validateGithubAuthCallbackHelper(context.Background(), m, diagCtx, nil, tt.a.emitter)
-	require.Equal(t, tt.mockEmitter.LastEvent().GetType(), events.UserLoginEvent)
-	require.Equal(t, tt.mockEmitter.LastEvent().GetCode(), events.UserSSOTestFlowLoginCode)
-	require.Equal(t, ssoDiagInfoCalls, 1)
+	require.Equal(t, events.UserLoginEvent, tt.mockEmitter.LastEvent().GetType())
+	require.Equal(t, events.UserSSOTestFlowLoginCode, tt.mockEmitter.LastEvent().GetCode())
+	require.Equal(t, 1, ssoDiagInfoCalls)
 	tt.mockEmitter.Reset()
 
 	// Test failure event, test-flow.
@@ -252,8 +252,8 @@ func TestValidateGithubAuthCallbackEventsEmitted(t *testing.T) {
 		return auth, trace.BadParameter("")
 	}
 	_, _ = validateGithubAuthCallbackHelper(context.Background(), m, diagCtx, nil, tt.a.emitter)
-	require.Equal(t, tt.mockEmitter.LastEvent().GetCode(), events.UserSSOTestFlowLoginFailureCode)
-	require.Equal(t, ssoDiagInfoCalls, 2)
+	require.Equal(t, events.UserSSOTestFlowLoginFailureCode, tt.mockEmitter.LastEvent().GetCode())
+	require.Equal(t, 2, ssoDiagInfoCalls)
 }
 
 type mockedGithubManager struct {

lib/auth/grpcserver_test.go

@@ -289,7 +289,7 @@ func TestMFADeviceManagement(t *testing.T) {
 		deviceIDs[dev.GetName()] = dev.Id
 	}
 	sort.Strings(deviceNames)
-	require.Equal(t, deviceNames, []string{pwdlessDevName, devs.TOTPName, devs.WebName, webDev2Name})
+	require.Equal(t, []string{pwdlessDevName, devs.TOTPName, devs.WebName, webDev2Name}, deviceNames)
 
 	// Delete several of the MFA devices.
 	deleteTests := []struct {
@@ -1191,7 +1191,7 @@ func TestGenerateUserCerts_singleUseCerts(t *testing.T) {
 					require.Equal(t, userCertExpires, identity.PreviousIdentityExpires)
 					require.True(t, net.ParseIP(identity.LoginIP).IsLoopback())
 					require.Equal(t, []string{teleport.UsageDatabaseOnly}, identity.Usage)
-					require.Equal(t, identity.RouteToDatabase.ServiceName, "db-a")
+					require.Equal(t, "db-a", identity.RouteToDatabase.ServiceName)
 				},
 			},
 		},
@@ -1230,7 +1230,7 @@ func TestGenerateUserCerts_singleUseCerts(t *testing.T) {
 					require.Equal(t, userCertExpires, identity.PreviousIdentityExpires)
 					require.True(t, net.ParseIP(identity.LoginIP).IsLoopback())
 					require.Equal(t, []string{teleport.UsageDatabaseOnly}, identity.Usage)
-					require.Equal(t, identity.RouteToDatabase.ServiceName, "db-a")
+					require.Equal(t, "db-a", identity.RouteToDatabase.ServiceName)
 				},
 			},
 		},
@@ -1267,7 +1267,7 @@ func TestGenerateUserCerts_singleUseCerts(t *testing.T) {
 					require.Equal(t, userCertExpires, identity.PreviousIdentityExpires)
 					require.True(t, net.ParseIP(identity.LoginIP).IsLoopback())
 					require.Equal(t, []string{teleport.UsageKubeOnly}, identity.Usage)
-					require.Equal(t, identity.KubernetesCluster, "kube-a")
+					require.Equal(t, "kube-a", identity.KubernetesCluster)
 				},
 			},
 		},
@@ -1558,7 +1558,7 @@ func TestGenerateUserCerts_singleUseCerts(t *testing.T) {
 					require.Equal(t, userCertExpires, identity.PreviousIdentityExpires)
 					require.True(t, net.ParseIP(identity.LoginIP).IsLoopback())
 					require.Equal(t, []string{teleport.UsageDatabaseOnly}, identity.Usage)
-					require.Equal(t, identity.RouteToDatabase.ServiceName, "db-b")
+					require.Equal(t, "db-b", identity.RouteToDatabase.ServiceName)
 				},
 			},
 		},
@@ -2031,7 +2031,7 @@ func testOriginDynamicStored(t *testing.T, setWithOrigin func(*Client, string) e
 
 			stored, err := getStored(srv.Auth())
 			require.NoError(t, err)
-			require.Equal(t, stored.Origin(), types.OriginDynamic)
+			require.Equal(t, types.OriginDynamic, stored.Origin())
 		})
 	}
 }
@@ -2227,7 +2227,7 @@ func TestGetSSHTargets(t *testing.T) {
 	})
 	require.NoError(t, err)
 	require.Len(t, rsp.Servers, 1)
-	require.Equal(t, rsp.Servers[0].GetHostname(), "foo")
+	require.Equal(t, "foo", rsp.Servers[0].GetHostname())
 
 	cnc := types.DefaultClusterNetworkingConfig()
 	cnc.SetCaseInsensitiveRouting(true)
@@ -2487,7 +2487,7 @@ func TestApplicationServersCRUD(t *testing.T) {
 	// Initially we expect no app servers.
 	out, err := clt.GetApplicationServers(ctx, apidefaults.Namespace)
 	require.NoError(t, err)
-	require.Equal(t, 0, len(out))
+	require.Empty(t, out)
 
 	// Register all app servers.
 	_, err = clt.UpsertApplicationServer(ctx, server1)
@@ -2528,7 +2528,7 @@ func TestApplicationServersCRUD(t *testing.T) {
 	require.NoError(t, err)
 	out, err = clt.GetApplicationServers(ctx, apidefaults.Namespace)
 	require.NoError(t, err)
-	require.Equal(t, 0, len(out))
+	require.Empty(t, out)
 }
 
 // TestAppsCRUD tests application resource operations.
@@ -2559,7 +2559,7 @@ func TestAppsCRUD(t *testing.T) {
 	// Initially we expect no apps.
 	out, err := clt.GetApps(ctx)
 	require.NoError(t, err)
-	require.Equal(t, 0, len(out))
+	require.Empty(t, out)
 
 	// Create both apps.
 	err = clt.CreateApp(ctx, app1)
@@ -2617,7 +2617,7 @@ func TestAppsCRUD(t *testing.T) {
 	require.NoError(t, err)
 	out, err = clt.GetApps(ctx)
 	require.NoError(t, err)
-	require.Len(t, out, 0)
+	require.Empty(t, out)
 }
 
 // TestAppServersCRUD tests application server resource operations.
@@ -2748,7 +2748,7 @@ func TestDatabasesCRUD(t *testing.T) {
 	// Initially we expect no databases.
 	out, err := clt.GetDatabases(ctx)
 	require.NoError(t, err)
-	require.Equal(t, 0, len(out))
+	require.Empty(t, out)
 
 	// Create both databases.
 	err = clt.CreateDatabase(ctx, db1)
@@ -2806,7 +2806,7 @@ func TestDatabasesCRUD(t *testing.T) {
 	require.NoError(t, err)
 	out, err = clt.GetDatabases(ctx)
 	require.NoError(t, err)
-	require.Len(t, out, 0)
+	require.Empty(t, out)
 }
 
 // TestDatabaseServicesCRUD tests DatabaseService resource operations.
@@ -3234,7 +3234,7 @@ func TestListResources(t *testing.T) {
 				Limit:        100,
 			})
 			require.NoError(t, err)
-			require.Len(t, resp.Resources, 0)
+			require.Empty(t, resp.Resources)
 			require.Empty(t, resp.NextKey)
 
 			// create two resources

lib/auth/init_test.go

@@ -75,10 +75,10 @@ func TestReadIdentity(t *testing.T) {
 
 	id, err := ReadSSHIdentityFromKeyPair(priv, cert)
 	require.NoError(t, err)
-	require.Equal(t, id.ClusterName, "example.com")
-	require.Equal(t, id.ID, IdentityID{HostUUID: "id1.example.com", Role: types.RoleNode})
-	require.Equal(t, id.CertBytes, cert)
-	require.Equal(t, id.KeyBytes, priv)
+	require.Equal(t, "example.com", id.ClusterName)
+	require.Equal(t, IdentityID{HostUUID: "id1.example.com", Role: types.RoleNode}, id.ID)
+	require.Equal(t, cert, id.CertBytes)
+	require.Equal(t, priv, id.KeyBytes)
 
 	// test TTL by converting the generated cert to text -> back and making sure ExpireAfter is valid
 	ttl := 10 * time.Second
@@ -409,7 +409,7 @@ func TestClusterID(t *testing.T) {
 	cc, err := authServer.GetClusterName()
 	require.NoError(t, err)
 	clusterID := cc.GetClusterID()
-	require.NotEqual(t, clusterID, "")
+	require.NotEmpty(t, clusterID)
 
 	// do it again and make sure cluster ID hasn't changed
 	authServer, err = Init(context.Background(), conf)
@@ -418,7 +418,7 @@ func TestClusterID(t *testing.T) {
 
 	cc, err = authServer.GetClusterName()
 	require.NoError(t, err)
-	require.Equal(t, cc.GetClusterID(), clusterID)
+	require.Equal(t, clusterID, cc.GetClusterID())
 }
 
 // TestClusterName ensures that a cluster can not be renamed.

lib/auth/keygen/keygen_test.go

@@ -244,6 +244,6 @@ func TestUserCertCompatibility(t *testing.T) {
 
 		// Check if users custom extension was added.
 		extVal := userCertificate.Extensions["[email protected]"]
-		require.Equal(t, extVal, "hello")
+		require.Equal(t, "hello", extVal)
 	}
 }

lib/auth/keystore/testhelpers.go

@@ -33,7 +33,7 @@ var (
 	cacheMutex   sync.Mutex
 )
 
-// SetupSoftHSMToken is for use in tests only and creates a test SOFTHSM2
+// SetupSoftHSMTest is for use in tests only and creates a test SOFTHSM2
 // token.  This should be used for all tests which need to use SoftHSM because
 // the library can only be initialized once and SOFTHSM2_PATH and SOFTHSM2_CONF
 // cannot be changed. New tokens added after the library has been initialized
@@ -49,7 +49,7 @@ var (
 // many keys for a given token.
 func SetupSoftHSMTest(t *testing.T) Config {
 	path := os.Getenv("SOFTHSM2_PATH")
-	require.NotEqual(t, path, "")
+	require.NotEmpty(t, path, "SOFTHSM2_PATH must be provided to run soft hsm tests")
 
 	cacheMutex.Lock()
 	defer cacheMutex.Unlock()

lib/auth/kube_test.go

@@ -92,7 +92,7 @@ func TestProcessKubeCSR(t *testing.T) {
 	wantUserID := userID
 	// Auth server should overwrite the Usage field and enforce UsageKubeOnly.
 	wantUserID.Usage = []string{teleport.UsageKubeOnly}
-	require.Equal(t, *gotUserID, wantUserID)
+	require.Equal(t, wantUserID, *gotUserID)
 }
 
 // newTestCSR creates and PEM-encodes an x509 CSR with given subject.

lib/auth/methods_test.go

@@ -40,5 +40,5 @@ func TestServerAuthenticateUserUserAgentTrim(t *testing.T) {
 	event := emitter.LastEvent()
 	loginEvent, ok := event.(*apievents.UserLogin)
 	require.True(t, ok)
-	require.True(t, len(loginEvent.UserAgent) <= maxUserAgentLen)
+	require.LessOrEqual(t, len(loginEvent.UserAgent), maxUserAgentLen)
 }

lib/auth/periodic_test.go

@@ -93,7 +93,7 @@ func TestInstanceMetricsPeriodic(t *testing.T) {
 
 			require.Equal(t, tt.expectEnrolled, periodic.TotalEnrolledInUpgrades(), "tt=%q", tt.desc)
 
-			require.Equal(t, len(tt.upgraders), periodic.TotalInstances(), "tt=%q", tt.desc)
+			require.Len(t, tt.upgraders, periodic.TotalInstances(), "tt=%q", tt.desc)
 		})
 	}
 }

lib/auth/tls_test.go

@@ -211,7 +211,7 @@ func TestRemoteRotation(t *testing.T) {
 	// remote cluster starts rotation
 	gracePeriod := time.Hour
 	remoteServer.AuthServer.privateKey, ok = fixtures.PEMBytes["rsa"]
-	require.Equal(t, ok, true)
+	require.True(t, ok)
 	err = remoteServer.AuthServer.RotateCertAuthority(ctx, RotateRequest{
 		Type:        types.HostCA,
 		GracePeriod: &gracePeriod,
@@ -345,7 +345,7 @@ func TestAutoRotation(t *testing.T) {
 
 	// starts rotation
 	testSrv.Auth().privateKey, ok = fixtures.PEMBytes["rsa"]
-	require.Equal(t, ok, true)
+	require.True(t, ok)
 	gracePeriod := time.Hour
 	err = testSrv.Auth().RotateCertAuthority(ctx, RotateRequest{
 		Type:        types.HostCA,
@@ -364,7 +364,7 @@ func TestAutoRotation(t *testing.T) {
 		Type:       types.HostCA,
 	}, false)
 	require.NoError(t, err)
-	require.Equal(t, ca.GetRotation().Phase, types.RotationPhaseUpdateClients)
+	require.Equal(t, types.RotationPhaseUpdateClients, ca.GetRotation().Phase)
 
 	// old clients should work
 	_, err = testSrv.CloneClient(t, proxy).GetNodes(ctx, apidefaults.Namespace)
@@ -384,7 +384,7 @@ func TestAutoRotation(t *testing.T) {
 		Type:       types.HostCA,
 	}, false)
 	require.NoError(t, err)
-	require.Equal(t, ca.GetRotation().Phase, types.RotationPhaseUpdateServers)
+	require.Equal(t, types.RotationPhaseUpdateServers, ca.GetRotation().Phase)
 
 	// old clients should work
 	_, err = testSrv.CloneClient(t, proxy).GetNodes(ctx, apidefaults.Namespace)
@@ -406,7 +406,7 @@ func TestAutoRotation(t *testing.T) {
 		Type:       types.HostCA,
 	}, false)
 	require.NoError(t, err)
-	require.Equal(t, ca.GetRotation().Phase, types.RotationPhaseStandby)
+	require.Equal(t, types.RotationPhaseStandby, ca.GetRotation().Phase)
 	require.NoError(t, err)
 
 	// old clients should no longer work
@@ -446,7 +446,7 @@ func TestAutoFallback(t *testing.T) {
 
 	// starts rotation
 	testSrv.Auth().privateKey, ok = fixtures.PEMBytes["rsa"]
-	require.Equal(t, ok, true)
+	require.True(t, ok)
 	gracePeriod := time.Hour
 	err = testSrv.Auth().RotateCertAuthority(ctx, RotateRequest{
 		Type:        types.HostCA,
@@ -465,8 +465,8 @@ func TestAutoFallback(t *testing.T) {
 		Type:       types.HostCA,
 	}, false)
 	require.NoError(t, err)
-	require.Equal(t, ca.GetRotation().Phase, types.RotationPhaseUpdateClients)
-	require.Equal(t, ca.GetRotation().Mode, types.RotationModeAuto)
+	require.Equal(t, types.RotationPhaseUpdateClients, ca.GetRotation().Phase)
+	require.Equal(t, types.RotationModeAuto, ca.GetRotation().Mode)
 
 	// rollback rotation
 	err = testSrv.Auth().RotateCertAuthority(ctx, RotateRequest{
@@ -482,8 +482,8 @@ func TestAutoFallback(t *testing.T) {
 		Type:       types.HostCA,
 	}, false)
 	require.NoError(t, err)
-	require.Equal(t, ca.GetRotation().Phase, types.RotationPhaseRollback)
-	require.Equal(t, ca.GetRotation().Mode, types.RotationModeManual)
+	require.Equal(t, types.RotationPhaseRollback, ca.GetRotation().Phase)
+	require.Equal(t, types.RotationModeManual, ca.GetRotation().Mode)
 }
 
 // TestManualRotation tests local manual rotation
@@ -507,7 +507,7 @@ func TestManualRotation(t *testing.T) {
 	// can't jump to mid-phase
 	gracePeriod := time.Hour
 	testSrv.Auth().privateKey, ok = fixtures.PEMBytes["rsa"]
-	require.Equal(t, ok, true)
+	require.True(t, ok)
 	err = testSrv.Auth().RotateCertAuthority(ctx, RotateRequest{
 		Type:        types.HostCA,
 		GracePeriod: &gracePeriod,
@@ -617,7 +617,7 @@ func TestRollback(t *testing.T) {
 	// starts rotation
 	gracePeriod := time.Hour
 	testSrv.Auth().privateKey, ok = fixtures.PEMBytes["rsa"]
-	require.Equal(t, ok, true)
+	require.True(t, ok)
 	err = testSrv.Auth().RotateCertAuthority(ctx, RotateRequest{
 		Type:        types.HostCA,
 		GracePeriod: &gracePeriod,
@@ -753,7 +753,7 @@ func TestAppTokenRotation(t *testing.T) {
 		Type:       types.JWTSigner,
 	}, true)
 	require.NoError(t, err)
-	require.Equal(t, oldCA.GetRotation().Phase, types.RotationPhaseInit)
+	require.Equal(t, types.RotationPhaseInit, oldCA.GetRotation().Phase)
 	require.Len(t, oldCA.GetTrustedJWTKeyPairs(), 2)
 
 	// Verify that the JWT token validates with the JWT authority.
@@ -791,7 +791,7 @@ func TestAppTokenRotation(t *testing.T) {
 		Type:       types.JWTSigner,
 	}, true)
 	require.NoError(t, err)
-	require.Equal(t, newCA.GetRotation().Phase, types.RotationPhaseUpdateClients)
+	require.Equal(t, types.RotationPhaseUpdateClients, newCA.GetRotation().Phase)
 	require.Len(t, newCA.GetTrustedJWTKeyPairs(), 2)
 
 	// Both JWT should now validate.
@@ -815,7 +815,7 @@ func TestAppTokenRotation(t *testing.T) {
 		Type:       types.JWTSigner,
 	}, true)
 	require.NoError(t, err)
-	require.Equal(t, newCA.GetRotation().Phase, types.RotationPhaseUpdateServers)
+	require.Equal(t, types.RotationPhaseUpdateServers, newCA.GetRotation().Phase)
 	require.Len(t, newCA.GetTrustedJWTKeyPairs(), 2)
 
 	// Both JWT should continue to validate.
@@ -839,7 +839,7 @@ func TestAppTokenRotation(t *testing.T) {
 		Type:       types.JWTSigner,
 	}, true)
 	require.NoError(t, err)
-	require.Equal(t, newCA.GetRotation().Phase, types.RotationPhaseStandby)
+	require.Equal(t, types.RotationPhaseStandby, newCA.GetRotation().Phase)
 	require.Len(t, newCA.GetTrustedJWTKeyPairs(), 1)
 
 	// Old token should no longer validate.
@@ -907,7 +907,7 @@ func TestOIDCIdPTokenRotation(t *testing.T) {
 		Type:       types.OIDCIdPCA,
 	}, true)
 	require.NoError(t, err)
-	require.Equal(t, oldCA.GetRotation().Phase, types.RotationPhaseInit)
+	require.Equal(t, types.RotationPhaseInit, oldCA.GetRotation().Phase)
 	require.Len(t, oldCA.GetTrustedJWTKeyPairs(), 2)
 
 	// Verify that the JWT token validates with the JWT authority.
@@ -938,7 +938,7 @@ func TestOIDCIdPTokenRotation(t *testing.T) {
 		Type:       types.OIDCIdPCA,
 	}, true)
 	require.NoError(t, err)
-	require.Equal(t, newCA.GetRotation().Phase, types.RotationPhaseUpdateClients)
+	require.Equal(t, types.RotationPhaseUpdateClients, newCA.GetRotation().Phase)
 	require.Len(t, newCA.GetTrustedJWTKeyPairs(), 2)
 
 	// Both JWT should now validate.
@@ -962,7 +962,7 @@ func TestOIDCIdPTokenRotation(t *testing.T) {
 		Type:       types.OIDCIdPCA,
 	}, true)
 	require.NoError(t, err)
-	require.Equal(t, newCA.GetRotation().Phase, types.RotationPhaseUpdateServers)
+	require.Equal(t, types.RotationPhaseUpdateServers, newCA.GetRotation().Phase)
 	require.Len(t, newCA.GetTrustedJWTKeyPairs(), 2)
 
 	// Both JWT should continue to validate.
@@ -986,7 +986,7 @@ func TestOIDCIdPTokenRotation(t *testing.T) {
 		Type:       types.OIDCIdPCA,
 	}, true)
 	require.NoError(t, err)
-	require.Equal(t, newCA.GetRotation().Phase, types.RotationPhaseStandby)
+	require.Equal(t, types.RotationPhaseStandby, newCA.GetRotation().Phase)
 	require.Len(t, newCA.GetTrustedJWTKeyPairs(), 1)
 
 	// Old token should no longer validate.
@@ -1252,14 +1252,14 @@ func TestUsersCRUD(t *testing.T) {
 
 	users, err := clt.GetUsers(ctx, false)
 	require.NoError(t, err)
-	require.Equal(t, len(users), 1)
-	require.Equal(t, users[0].GetName(), "user1")
+	require.Len(t, users, 1)
+	require.Equal(t, "user1", users[0].GetName())
 
 	require.NoError(t, clt.DeleteUser(ctx, "user1"))
 
 	users, err = clt.GetUsers(ctx, false)
 	require.NoError(t, err)
-	require.Equal(t, len(users), 0)
+	require.Empty(t, users)
 }
 
 func TestPasswordGarbage(t *testing.T) {
@@ -1394,7 +1394,7 @@ func TestWebSessionWithoutAccessRequest(t *testing.T) {
 	// success with password set up
 	ws, err := proxy.AuthenticateWebUser(ctx, req)
 	require.NoError(t, err)
-	require.NotEqual(t, ws, "")
+	require.NotEmpty(t, ws)
 
 	web, err := testSrv.NewClientFromWebSession(ws)
 	require.NoError(t, err)
@@ -1720,10 +1720,10 @@ func TestWebSessionWithApprovedAccessRequestAndSwitchback(t *testing.T) {
 	}
 
 	_, hasRole := mappedRole[initialRole]
-	require.Equal(t, hasRole, true)
+	require.True(t, hasRole)
 
 	_, hasRole = mappedRole["test-request-role"]
-	require.Equal(t, hasRole, true)
+	require.True(t, hasRole)
 
 	// certRequests extracts the active requests from a PEM encoded TLS cert.
 	certRequests := func(tlsCert []byte) []string {
@@ -1755,7 +1755,7 @@ func TestWebSessionWithApprovedAccessRequestAndSwitchback(t *testing.T) {
 	require.NoError(t, err)
 	require.Empty(t, cmp.Diff(roles, []string{initialRole}))
 
-	require.Len(t, certRequests(sess2.GetTLSCert()), 0)
+	require.Empty(t, certRequests(sess2.GetTLSCert()))
 }
 
 func TestExtendWebSessionWithReloadUser(t *testing.T) {
@@ -1816,8 +1816,8 @@ func TestExtendWebSessionWithReloadUser(t *testing.T) {
 	require.NoError(t, err)
 	roles, err := services.ExtractRolesFromCert(sshcert)
 	require.NoError(t, err)
-	require.Equal(t, traits[constants.TraitLogins], []string{"apple", "banana"})
-	require.Equal(t, traits[constants.TraitDBUsers], []string{"llama", "alpaca"})
+	require.Equal(t, []string{"apple", "banana"}, traits[constants.TraitLogins])
+	require.Equal(t, []string{"llama", "alpaca"}, traits[constants.TraitDBUsers])
 	require.Contains(t, roles, newRoleName)
 }
 
@@ -2081,10 +2081,10 @@ func TestPluginData(t *testing.T) {
 		Resource: req.GetName(),
 	})
 	require.NoError(t, err)
-	require.Equal(t, len(data), 1)
+	require.Len(t, data, 1)
 
 	entry, ok := data[0].Entries()[plugin]
-	require.Equal(t, ok, true)
+	require.True(t, ok)
 	require.Empty(t, cmp.Diff(entry.Data, map[string]string{"foo": "bar"}))
 
 	err = pluginClient.UpdatePluginData(ctx, types.PluginDataUpdateParams{
@@ -2106,10 +2106,10 @@ func TestPluginData(t *testing.T) {
 		Resource: req.GetName(),
 	})
 	require.NoError(t, err)
-	require.Equal(t, len(data), 1)
+	require.Len(t, data, 1)
 
 	entry, ok = data[0].Entries()[plugin]
-	require.Equal(t, ok, true)
+	require.True(t, ok)
 	require.Empty(t, cmp.Diff(entry.Data, map[string]string{"spam": "eggs"}))
 }
 
@@ -2576,7 +2576,7 @@ func TestGenerateAppToken(t *testing.T) {
 				URI:      "http://localhost:8080",
 			})
 			require.NoError(t, err, ts.inComment)
-			require.Equal(t, claims.Username, "[email protected]", ts.inComment)
+			require.Equal(t, "[email protected]", claims.Username, ts.inComment)
 			require.Empty(t, cmp.Diff(claims.Roles, []string{"bar", "baz"}), ts.inComment)
 			require.Empty(t, cmp.Diff(claims.Traits, wrappers.Traits{
 				"trait1": {"value1", "value2"},
@@ -2829,7 +2829,7 @@ func TestLoginAttempts(t *testing.T) {
 	// clears all failed attempts after success
 	loginAttempts, err = testSrv.Auth().GetUserLoginAttempts(user)
 	require.NoError(t, err)
-	require.Len(t, loginAttempts, 0)
+	require.Empty(t, loginAttempts)
 }
 
 func TestChangeUserAuthenticationSettings(t *testing.T) {
@@ -3262,7 +3262,7 @@ func TestClusterAlertAck(t *testing.T) {
 
 	require.Len(t, acks, 1)
 
-	require.Equal(t, acks[0].AlertID, "alert-1")
+	require.Equal(t, "alert-1", acks[0].AlertID)
 
 	clear := proto.ClearAlertAcksRequest{
 		AlertID: "alert-1",
@@ -3274,7 +3274,7 @@ func TestClusterAlertAck(t *testing.T) {
 	acks, err = adminClt.GetAlertAcks(ctx)
 	require.NoError(t, err)
 
-	require.Len(t, acks, 0)
+	require.Empty(t, acks)
 }
 
 func TestClusterAlertClearAckWildcard(t *testing.T) {
@@ -3318,8 +3318,8 @@ func TestClusterAlertClearAckWildcard(t *testing.T) {
 
 	require.Len(t, acks, 2)
 
-	require.Equal(t, acks[0].AlertID, "alert-1")
-	require.Equal(t, acks[1].AlertID, "alert-2")
+	require.Equal(t, "alert-1", acks[0].AlertID)
+	require.Equal(t, "alert-2", acks[1].AlertID)
 
 	clear := proto.ClearAlertAcksRequest{
 		AlertID: "*",
@@ -3331,7 +3331,7 @@ func TestClusterAlertClearAckWildcard(t *testing.T) {
 	acks, err = adminClt.GetAlertAcks(ctx)
 	require.NoError(t, err)
 
-	require.Len(t, acks, 0)
+	require.Empty(t, acks)
 }
 
 // TestClusterAlertAccessControls verifies expected behaviors of cluster alert
@@ -3558,7 +3558,7 @@ func TestEventsPermissions(t *testing.T) {
 	case <-time.After(2 * time.Second):
 		t.Fatalf("Timeout waiting for init event")
 	case event := <-w.Events():
-		require.Equal(t, event.Type, types.OpInit)
+		require.Equal(t, types.OpInit, event.Type)
 	}
 
 	// start rotation
@@ -3726,7 +3726,7 @@ func TestEventsPermissionsPartialSuccess(t *testing.T) {
 			select {
 			case event := <-w.Events():
 				if len(tc.expectedConfirmedKinds) > 0 {
-					require.Equal(t, event.Type, types.OpInit)
+					require.Equal(t, types.OpInit, event.Type)
 					watchStatus, ok := event.Resource.(types.WatchStatus)
 					require.True(t, ok)
 					require.Equal(t, tc.expectedConfirmedKinds, watchStatus.GetKinds())
@@ -3791,7 +3791,7 @@ func TestEventsClusterConfig(t *testing.T) {
 	case <-time.After(2 * time.Second):
 		t.Fatalf("Timeout waiting for init event")
 	case event := <-w.Events():
-		require.Equal(t, event.Type, types.OpInit)
+		require.Equal(t, types.OpInit, event.Type)
 	}
 
 	// start rotation

lib/auth/usertoken_test.go

@@ -64,9 +64,9 @@ func TestCreateResetPasswordToken(t *testing.T) {
 	require.Equal(t, token.GetURL(), "https://<proxyhost>:3080/web/reset/"+token.GetName())
 
 	event := mockEmitter.LastEvent()
-	require.Equal(t, event.GetType(), events.ResetPasswordTokenCreateEvent)
-	require.Equal(t, event.(*apievents.UserTokenCreate).Name, username)
-	require.Equal(t, event.(*apievents.UserTokenCreate).User, teleport.UserSystem)
+	require.Equal(t, events.ResetPasswordTokenCreateEvent, event.GetType())
+	require.Equal(t, username, event.(*apievents.UserTokenCreate).Name)
+	require.Equal(t, teleport.UserSystem, event.(*apievents.UserTokenCreate).User)
 
 	// verify that user has no MFA devices
 	devs, err := srv.Auth().Services.GetMFADevices(ctx, username, false)
@@ -351,10 +351,10 @@ func TestCreatePrivilegeToken(t *testing.T) {
 
 			// Test events emitted.
 			event := mockEmitter.LastEvent()
-			require.Equal(t, event.GetType(), events.PrivilegeTokenCreateEvent)
-			require.Equal(t, event.GetCode(), events.PrivilegeTokenCreateCode)
-			require.Equal(t, event.(*apievents.UserTokenCreate).Name, username)
-			require.Equal(t, event.(*apievents.UserTokenCreate).User, username)
+			require.Equal(t, events.PrivilegeTokenCreateEvent, event.GetType())
+			require.Equal(t, events.PrivilegeTokenCreateCode, event.GetCode())
+			require.Equal(t, username, event.(*apievents.UserTokenCreate).Name)
+			require.Equal(t, username, event.(*apievents.UserTokenCreate).User)
 
 			// Test token expires after designated time.
 			fakeClock.Advance(defaults.PrivilegeTokenTTL)
@@ -426,9 +426,9 @@ func TestCreatePrivilegeToken_WithLock(t *testing.T) {
 
 				// Test last attempt returns locked error.
 				if i == defaults.MaxLoginAttempts {
-					require.Equal(t, err.Error(), MaxFailedAttemptsErrMsg)
+					require.Equal(t, MaxFailedAttemptsErrMsg, err.Error())
 				} else {
-					require.NotEqual(t, err.Error(), MaxFailedAttemptsErrMsg)
+					require.NotEqual(t, MaxFailedAttemptsErrMsg, err.Error())
 				}
 			}
 

lib/auth/webauthncli/fido2_test.go

@@ -1699,7 +1699,7 @@ func TestFIDO2Register(t *testing.T) {
 			case test.wantErr != nil && err == nil:
 				t.Fatalf("FIDO2Register returned err = nil, wantErr %q", test.wantErr)
 			case test.wantErr != nil:
-				require.True(t, errors.Is(err, test.wantErr), "FIDO2Register returned err = %q, wantErr %q", err, test.wantErr)
+				require.ErrorIs(t, err, test.wantErr, "FIDO2Register returned err = %q, wantErr %q", err, test.wantErr)
 				return
 			default:
 				require.NoError(t, err, "FIDO2Register failed")

lib/auth/windows/windows_test.go

@@ -118,15 +118,15 @@ func TestGenerateCredentials(t *testing.T) {
 					var san SubjectAltName[upn]
 					_, err = asn1.Unmarshal(extension.Value, &san)
 					require.NoError(t, err)
-					require.Equal(t, san.OtherName.OID, UPNOtherNameOID)
-					require.Equal(t, san.OtherName.Value.Value, user+"@"+domain)
+					require.Equal(t, UPNOtherNameOID, san.OtherName.OID)
+					require.Equal(t, user+"@"+domain, san.OtherName.Value.Value)
 				case extension.Id.Equal(ADUserMappingExtensionOID):
 					foundAdUserMapping = true
 					var adUserMapping SubjectAltName[adSid]
 					_, err = asn1.Unmarshal(extension.Value, &adUserMapping)
 					require.NoError(t, err)
-					require.Equal(t, adUserMapping.OtherName.OID, ADUserMappingInternalOID)
-					require.Equal(t, adUserMapping.OtherName.Value.Value, []byte(testSid))
+					require.Equal(t, ADUserMappingInternalOID, adUserMapping.OtherName.OID)
+					require.Equal(t, []byte(testSid), adUserMapping.OtherName.Value.Value)
 
 				}
 			}

lib/automaticupgrades/config_test.go

@@ -52,7 +52,7 @@ func TestIsEnabled(t *testing.T) {
 		t.Setenv(automaticUpgradesEnvar, "foo")
 		require.False(t, IsEnabled())
 
-		require.Equal(t, 1, len(hook.Entries))
+		require.Len(t, hook.Entries, 1)
 		require.Equal(t, logrus.WarnLevel, hook.LastEntry().Level)
 		require.Equal(t, `unexpected value for ENV:TELEPORT_AUTOMATIC_UPGRADES: strconv.ParseBool: parsing "foo": invalid syntax`, hook.LastEntry().Message)
 	})

lib/backend/buffer_test.go

@@ -43,7 +43,7 @@ func TestWatcherSimple(t *testing.T) {
 
 	select {
 	case e := <-w.Events():
-		require.Equal(t, e.Type, types.OpInit)
+		require.Equal(t, types.OpInit, e.Type)
 	case <-time.After(100 * time.Millisecond):
 		t.Fatalf("Timeout waiting for event.")
 	}
@@ -52,7 +52,7 @@ func TestWatcherSimple(t *testing.T) {
 
 	select {
 	case e := <-w.Events():
-		require.Equal(t, e.Item.ID, int64(1))
+		require.Equal(t, int64(1), e.Item.ID)
 	case <-time.After(100 * time.Millisecond):
 		t.Fatalf("Timeout waiting for event.")
 	}
@@ -92,7 +92,7 @@ func TestWatcherCapacity(t *testing.T) {
 
 	select {
 	case e := <-w.Events():
-		require.Equal(t, e.Type, types.OpInit)
+		require.Equal(t, types.OpInit, e.Type)
 	default:
 		t.Fatalf("Expected immediate OpInit.")
 	}
@@ -157,14 +157,14 @@ func TestWatcherClose(t *testing.T) {
 
 	select {
 	case e := <-w.Events():
-		require.Equal(t, e.Type, types.OpInit)
+		require.Equal(t, types.OpInit, e.Type)
 	case <-time.After(100 * time.Millisecond):
 		t.Fatalf("Timeout waiting for event.")
 	}
 
-	require.Equal(t, b.watchers.Len(), 1)
+	require.Equal(t, 1, b.watchers.Len())
 	w.(*BufferWatcher).closeAndRemove(removeSync)
-	require.Equal(t, b.watchers.Len(), 0)
+	require.Equal(t, 0, b.watchers.Len())
 }
 
 // TestRemoveRedundantPrefixes removes redundant prefixes
@@ -216,7 +216,7 @@ func TestWatcherMulti(t *testing.T) {
 
 	select {
 	case e := <-w.Events():
-		require.Equal(t, e.Type, types.OpInit)
+		require.Equal(t, types.OpInit, e.Type)
 	case <-time.After(100 * time.Millisecond):
 		t.Fatalf("Timeout waiting for event.")
 	}
@@ -225,13 +225,12 @@ func TestWatcherMulti(t *testing.T) {
 
 	select {
 	case e := <-w.Events():
-		require.Equal(t, e.Item.ID, int64(1))
+		require.Equal(t, int64(1), e.Item.ID)
 	case <-time.After(100 * time.Millisecond):
 		t.Fatalf("Timeout waiting for event.")
 	}
 
-	require.Equal(t, len(w.Events()), 0)
-
+	require.Empty(t, w.Events())
 }
 
 // TestWatcherReset tests scenarios with watchers and buffer resets
@@ -249,7 +248,7 @@ func TestWatcherReset(t *testing.T) {
 
 	select {
 	case e := <-w.Events():
-		require.Equal(t, e.Type, types.OpInit)
+		require.Equal(t, types.OpInit, e.Type)
 	case <-time.After(100 * time.Millisecond):
 		t.Fatalf("Timeout waiting for event.")
 	}
@@ -270,7 +269,7 @@ func TestWatcherReset(t *testing.T) {
 
 	select {
 	case e := <-w2.Events():
-		require.Equal(t, e.Type, types.OpInit)
+		require.Equal(t, types.OpInit, e.Type)
 	case <-time.After(100 * time.Millisecond):
 		t.Fatalf("Timeout waiting for event.")
 	}
@@ -279,7 +278,7 @@ func TestWatcherReset(t *testing.T) {
 
 	select {
 	case e := <-w2.Events():
-		require.Equal(t, e.Item.ID, int64(2))
+		require.Equal(t, int64(2), e.Item.ID)
 	case <-time.After(100 * time.Millisecond):
 		t.Fatalf("Timeout waiting for event.")
 	}
@@ -288,10 +287,10 @@ func TestWatcherReset(t *testing.T) {
 // TestWatcherTree tests buffer watcher tree
 func TestWatcherTree(t *testing.T) {
 	wt := newWatcherTree()
-	require.Equal(t, wt.rm(nil), false)
+	require.False(t, wt.rm(nil))
 
 	w1 := &BufferWatcher{Watch: Watch{Prefixes: [][]byte{[]byte("/a"), []byte("/a/a1"), []byte("/c")}}}
-	require.Equal(t, wt.rm(w1), false)
+	require.False(t, wt.rm(w1))
 
 	w2 := &BufferWatcher{Watch: Watch{Prefixes: [][]byte{[]byte("/a")}}}
 
@@ -319,8 +318,8 @@ func TestWatcherTree(t *testing.T) {
 	require.Equal(t, matched[0], w1)
 	require.Equal(t, matched[1], w2)
 
-	require.Equal(t, wt.rm(w1), true)
-	require.Equal(t, wt.rm(w1), false)
+	require.True(t, wt.rm(w1))
+	require.False(t, wt.rm(w1))
 
 	matched = nil
 	wt.walkPath("/a", func(w *BufferWatcher) {
@@ -329,5 +328,5 @@ func TestWatcherTree(t *testing.T) {
 	require.Len(t, matched, 1)
 	require.Equal(t, matched[0], w2)
 
-	require.Equal(t, wt.rm(w2), true)
+	require.True(t, wt.rm(w2))
 }

lib/backend/etcdbk/etcd_test.go

@@ -236,7 +236,7 @@ func TestLeaseBucketing(t *testing.T) {
 
 	// ensure that we averaged more than 1 item per lease, but
 	// also spanned more than one bucket.
-	require.Greater(t, len(leases), 1)
+	require.NotEmpty(t, leases)
 	require.Less(t, len(leases), count/2)
 }
 

lib/backend/kubernetes/kubernetes_test.go

@@ -248,7 +248,7 @@ func TestBackend_Get(t *testing.T) {
 			} else if (err != nil) && trace.IsNotFound(err) && tt.wantNotFound {
 				return
 			}
-			require.Equal(t, got.Value, tt.want)
+			require.Equal(t, tt.want, got.Value)
 		})
 	}
 }
@@ -390,7 +390,7 @@ func TestBackend_Put(t *testing.T) {
 			// get secret loads the kubernetes secret to compare.
 			got, err := b.getSecret(context.TODO())
 			require.NoError(t, err)
-			require.Equal(t, got, tt.want)
+			require.Equal(t, tt.want, got)
 		})
 	}
 }

lib/backend/test/suite.go

@@ -643,7 +643,7 @@ func testFetchLimit(t *testing.T, newBackend Constructor) {
 
 	result, err := uut.GetRange(ctx, prefix("/db"), backend.RangeEnd(prefix("/db")), backend.NoLimit)
 	require.NoError(t, err)
-	require.Equal(t, itemsCount, len(result.Items))
+	require.Len(t, result.Items, itemsCount)
 }
 
 // testLimit tests limit.
@@ -684,7 +684,7 @@ func testLimit(t *testing.T, newBackend Constructor) {
 
 	result, err := uut.GetRange(ctx, prefix("/db"), backend.RangeEnd(prefix("/db")), 2)
 	require.NoError(t, err)
-	require.Equal(t, 2, len(result.Items))
+	require.Len(t, result.Items, 2)
 }
 
 // requireEvent asserts that a given event type with the given key is emitted

lib/cache/cache_test.go

@@ -2340,7 +2340,7 @@ func TestRelativeExpiry(t *testing.T) {
 
 	// make sure the event buffer is much larger than node count
 	// so that we can batch create nodes without waiting on each event
-	require.True(t, int(nodeCount*3) < eventBufferSize)
+	require.Less(t, int(nodeCount*3), eventBufferSize)
 
 	ctx := context.Background()
 
@@ -2404,7 +2404,7 @@ func TestRelativeExpiry(t *testing.T) {
 	// verify that sliding window has preserved most recent nodes
 	nodes, err = p.cache.GetNodes(ctx, apidefaults.Namespace)
 	require.NoError(t, err)
-	require.True(t, len(nodes) > 0, "node_count=%d", len(nodes))
+	require.NotEmpty(t, nodes, "node_count=%d", len(nodes))
 }
 
 func TestRelativeExpiryLimit(t *testing.T) {
@@ -2416,7 +2416,7 @@ func TestRelativeExpiryLimit(t *testing.T) {
 
 	// make sure the event buffer is much larger than node count
 	// so that we can batch create nodes without waiting on each event
-	require.True(t, int(nodeCount*3) < eventBufferSize)
+	require.Less(t, int(nodeCount*3), eventBufferSize)
 
 	ctx := context.Background()
 

lib/client/api_test.go

@@ -219,26 +219,26 @@ func TestParseLabels(t *testing.T) {
 	require.NotNil(t, m)
 	require.NoError(t, err)
 	require.Len(t, m, 3)
-	require.Equal(t, m["role"], "master")
-	require.Equal(t, m["type"], "database")
-	require.Equal(t, m["ver"], "mongoDB v1,2")
+	require.Equal(t, "master", m["role"])
+	require.Equal(t, "database", m["type"])
+	require.Equal(t, "mongoDB v1,2", m["ver"])
 
 	// multiple and unicode:
 	m, err = ParseLabelSpec(`服务器环境=测试,操作系统类别=Linux,机房=华北`)
 	require.NoError(t, err)
 	require.NotNil(t, m)
 	require.Len(t, m, 3)
-	require.Equal(t, m["服务器环境"], "测试")
-	require.Equal(t, m["操作系统类别"], "Linux")
-	require.Equal(t, m["机房"], "华北")
+	require.Equal(t, "测试", m["服务器环境"])
+	require.Equal(t, "Linux", m["操作系统类别"])
+	require.Equal(t, "华北", m["机房"])
 
 	// invalid specs
 	m, err = ParseLabelSpec(`type="database,"role"=master,ver="mongoDB v1,2"`)
 	require.Nil(t, m)
-	require.NotNil(t, err)
+	require.Error(t, err)
 	m, err = ParseLabelSpec(`type="database",role,master`)
 	require.Nil(t, m)
-	require.NotNil(t, err)
+	require.Error(t, err)
 }
 
 func TestPortsParsing(t *testing.T) {
@@ -374,7 +374,7 @@ func TestDynamicPortsParsing(t *testing.T) {
 	for _, tt := range dynamicPortForwardParsingTestCases {
 		specs, err := ParseDynamicPortForwardSpec(tt.spec)
 		if tt.isError {
-			require.NotNil(t, err)
+			require.Error(t, err)
 			continue
 		} else {
 			require.NoError(t, err)

lib/client/client_store_test.go

@@ -332,7 +332,7 @@ func TestProxySSHConfig(t *testing.T) {
 		// rejected and fail.
 		_, err = clt.NewSession()
 		require.Error(t, err)
-		require.Equal(t, int(called.Load()), 1)
+		require.Equal(t, 1, int(called.Load()))
 
 		_, spub, err := testauthority.New().GenerateKeyPair()
 		require.NoError(t, err)

lib/client/client_test.go

@@ -39,9 +39,9 @@ import (
 )
 
 func TestHelperFunctions(t *testing.T) {
-	assert.Equal(t, nodeName(targetNode{addr: "one"}), "one")
-	assert.Equal(t, nodeName(targetNode{addr: "one:22"}), "one")
-	assert.Equal(t, nodeName(targetNode{addr: "one", hostname: "example.com"}), "example.com")
+	assert.Equal(t, "one", nodeName(targetNode{addr: "one"}))
+	assert.Equal(t, "one", nodeName(targetNode{addr: "one:22"}))
+	assert.Equal(t, "example.com", nodeName(targetNode{addr: "one", hostname: "example.com"}))
 }
 
 func TestNewSession(t *testing.T) {
@@ -55,12 +55,12 @@ func TestNewSession(t *testing.T) {
 	ses, err := newSession(ctx, nc, nil, nil, nil, nil, nil, true)
 	require.NoError(t, err)
 	require.NotNil(t, ses)
-	require.Equal(t, ses.NodeClient(), nc)
-	require.Equal(t, ses.namespace, nc.Namespace)
+	require.Equal(t, nc, ses.NodeClient())
+	require.Equal(t, nc.Namespace, ses.namespace)
 	require.NotNil(t, ses.env)
-	require.Equal(t, ses.terminal.Stderr(), os.Stderr)
-	require.Equal(t, ses.terminal.Stdout(), os.Stdout)
-	require.Equal(t, ses.terminal.Stdin(), os.Stdin)
+	require.Equal(t, os.Stderr, ses.terminal.Stderr())
+	require.Equal(t, os.Stdout, ses.terminal.Stdout())
+	require.Equal(t, os.Stdin, ses.terminal.Stdin())
 
 	// pass environ map
 	env := map[string]string{
@@ -71,7 +71,7 @@ func TestNewSession(t *testing.T) {
 	require.NotNil(t, ses)
 	require.Empty(t, cmp.Diff(ses.env, env))
 	// the session ID must be taken from tne environ map, if passed:
-	require.Equal(t, string(ses.id), "session-id")
+	require.Equal(t, "session-id", string(ses.id))
 }
 
 // TestProxyConnection verifies that client or server-side disconnect

lib/client/escape/reader_test.go

@@ -44,10 +44,10 @@ func runCase(t *testing.T, tc readerTestCase) {
 	})
 
 	_, err := io.Copy(out, r)
-	require.Equal(t, err, tc.wantReadErr)
-	require.Equal(t, disconnectErr, tc.wantDisconnectErr)
-	require.Equal(t, out.String(), tc.wantOut)
-	require.Equal(t, helpOut.String(), tc.wantHelp)
+	require.Equal(t, tc.wantReadErr, err)
+	require.Equal(t, tc.wantDisconnectErr, disconnectErr)
+	require.Equal(t, tc.wantOut, out.String())
+	require.Equal(t, tc.wantHelp, helpOut.String())
 }
 
 func TestNormalReads(t *testing.T) {

lib/client/identityfile/identity_test.go

@@ -211,7 +211,7 @@ func TestWriteAllFormats(t *testing.T) {
 			for _, file := range files {
 				require.True(t, strings.HasPrefix(file, cfg.OutputPath))
 			}
-			require.True(t, len(files) > 0)
+			require.NotEmpty(t, files)
 		})
 	}
 }

lib/client/known_hosts_migrate_test.go

@@ -53,7 +53,7 @@ func generateHostCert(t *testing.T, s *knownHostsMigrateTest, clusterName string
 		ClusterName:   clusterName,
 		PublicHostKey: hostPub,
 	})
-	require.Nil(t, err)
+	require.NoError(t, err)
 
 	return cert
 }
@@ -63,7 +63,7 @@ func generateOldHostEntry(
 ) *knownHostEntry {
 	formatted := fmt.Sprintf("%s %s", clusterName, strings.TrimSpace(string(cert)))
 	entry, err := parseKnownHost(formatted)
-	require.Nil(t, err)
+	require.NoError(t, err)
 	require.Equal(t, formatted, entry.raw)
 
 	return entry
@@ -77,7 +77,7 @@ func generateNewHostEntry(
 		proxyName, clusterName, clusterName, strings.TrimSpace(string(cert)),
 	)
 	entry, err := parseKnownHost(formatted)
-	require.Nil(t, err)
+	require.NoError(t, err)
 	require.Equal(t, formatted, entry.raw)
 
 	return entry
@@ -94,7 +94,7 @@ func TestParseKnownHost(t *testing.T) {
 	require.Equal(t, []string{"example.com"}, oldEntry.hosts)
 
 	oldCertParsed, _, _, _, err := ssh.ParseAuthorizedKey(oldCert)
-	require.Nil(t, err)
+	require.NoError(t, err)
 	require.True(t, bytes.Equal(oldCertParsed.Marshal(), oldEntry.pubKey.Marshal()))
 
 	newCert := generateHostCert(t, &s, "example.com")
@@ -105,7 +105,7 @@ func TestParseKnownHost(t *testing.T) {
 	require.Equal(t, "type=host", newEntry.comment)
 
 	newCertParsed, _, _, _, err := ssh.ParseAuthorizedKey(newCert)
-	require.Nil(t, err)
+	require.NoError(t, err)
 	require.True(t, bytes.Equal(newCertParsed.Marshal(), newEntry.pubKey.Marshal()))
 }
 
@@ -125,13 +125,13 @@ func TestIsOldHostsEntry(t *testing.T) {
 	// In this case, multiple hosts should invalidate the key.
 	hostsEntryString := fmt.Sprintf("foo,bar %s", strings.TrimSpace(string(cert)))
 	hostsEntry, err := parseKnownHost(hostsEntryString)
-	require.Nil(t, err)
+	require.NoError(t, err)
 	require.False(t, isOldStyleHostsEntry(hostsEntry))
 
 	// Additionally, any comment invalidates it.
 	commentEntryString := fmt.Sprintf("foo %s comment", strings.TrimSpace(string(cert)))
 	commentEntry, err := parseKnownHost(commentEntryString)
-	require.Nil(t, err)
+	require.NoError(t, err)
 	require.False(t, isOldStyleHostsEntry(commentEntry))
 }
 

lib/client/tncon/buffer_test.go

@@ -167,7 +167,7 @@ func BenchmarkBufferedChannelPipe(b *testing.B) {
 			for n := 0; n < b.N; n++ {
 				written, err := buffer.Write(data)
 				require.NoError(b, err)
-				require.Equal(b, len(data), written)
+				require.Len(b, data, written)
 			}
 			require.NoError(b, <-errCh)
 			b.StopTimer()

lib/client/trusted_certs_store_test.go

@@ -178,24 +178,24 @@ func TestAddTrustedHostKeys(t *testing.T) {
 		err = clientStore.AddTrustedHostKeys("leaf.example.com", "leaf", pub2)
 		require.NoError(t, err)
 		after, _ := clientStore.GetTrustedHostKeys()
-		require.Equal(t, len(before), len(after))
+		require.Len(t, before, len(after))
 
 		// check by hostname:
 		keys, _ = clientStore.GetTrustedHostKeys("nocluster")
-		require.Equal(t, len(keys), 0)
+		require.Empty(t, keys)
 		keys, _ = clientStore.GetTrustedHostKeys("leaf")
-		require.Equal(t, len(keys), 1)
+		require.Len(t, keys, 1)
 		require.True(t, apisshutils.KeysEqual(keys[0], pub2))
 
 		// check for proxy and wildcard as well:
 		keys, _ = clientStore.GetTrustedHostKeys("leaf.example.com")
-		require.Equal(t, 1, len(keys))
+		require.Len(t, keys, 1)
 		require.True(t, apisshutils.KeysEqual(keys[0], pub2))
 		keys, _ = clientStore.GetTrustedHostKeys("*.leaf")
-		require.Equal(t, 1, len(keys))
+		require.Len(t, keys, 1)
 		require.True(t, apisshutils.KeysEqual(keys[0], pub2))
 		keys, _ = clientStore.GetTrustedHostKeys("prefix.leaf")
-		require.Equal(t, 1, len(keys))
+		require.Len(t, keys, 1)
 		require.True(t, apisshutils.KeysEqual(keys[0], pub2))
 	})
 }

lib/cloud/azure/kubernetes_test.go

@@ -87,7 +87,7 @@ func Test_aKSClient_ClusterCredentials(t *testing.T) {
 				},
 			},
 			validateRestConfig: func(t *testing.T, c *rest.Config) {
-				require.Equal(t, c.Username, "exp")
+				require.Equal(t, "exp", c.Username)
 			},
 		},
 		{

lib/cloud/azure/vm_test.go

@@ -60,7 +60,7 @@ func TestGetVirtualMachine(t *testing.T) {
 				vm, ok := val.(*VirtualMachine)
 				require.Truef(t, ok, "expected *VirtualMachine, got %T", val)
 				require.Equal(t, vm.ID, validResourceID)
-				require.Equal(t, vm.Name, "name")
+				require.Equal(t, "name", vm.Name)
 				require.ElementsMatch(t, []Identity{
 					{ResourceID: "system assigned"},
 					{ResourceID: "identity1"},
@@ -83,7 +83,7 @@ func TestGetVirtualMachine(t *testing.T) {
 				vm, ok := val.(*VirtualMachine)
 				require.Truef(t, ok, "expected *VirtualMachine, got %T", val)
 				require.Equal(t, vm.ID, validResourceID)
-				require.Equal(t, vm.Name, "name")
+				require.Equal(t, "name", vm.Name)
 				require.Empty(t, vm.Identities)
 			},
 		},
@@ -108,7 +108,7 @@ func TestGetVirtualMachine(t *testing.T) {
 				vm, ok := val.(*VirtualMachine)
 				require.Truef(t, ok, "expected *VirtualMachine, got %T", val)
 				require.Equal(t, vm.ID, validResourceID)
-				require.Equal(t, vm.Name, "name")
+				require.Equal(t, "name", vm.Name)
 				require.ElementsMatch(t, []Identity{
 					{ResourceID: "identity1"},
 					{ResourceID: "identity2"},

lib/cloud/gcp/kubernetes_test.go

@@ -167,7 +167,7 @@ func Test_gcpGKEClient_ListClusters(t *testing.T) {
 				return got[i].Name < got[j].Name
 			})
 
-			require.Equal(t, got, tt.want)
+			require.Equal(t, tt.want, got)
 		})
 	}
 }

lib/config/configuration_test.go

@@ -19,7 +19,6 @@ package config
 import (
 	"bytes"
 	"encoding/base64"
-	"errors"
 	"fmt"
 	"net"
 	"os"
@@ -207,8 +206,8 @@ func TestSampleConfig(t *testing.T) {
 			require.NoError(t, err)
 
 			// validate a couple of values:
-			require.Equal(t, fc.Global.DataDir, defaults.DataDir)
-			require.Equal(t, fc.Logger.Severity, "INFO")
+			require.Equal(t, defaults.DataDir, fc.Global.DataDir)
+			require.Equal(t, "INFO", fc.Logger.Severity)
 			require.Equal(t, testCase.expectClusterName, fc.Auth.ClusterName)
 			require.Equal(t, testCase.expectLicenseFile, fc.Auth.LicenseFile)
 			require.Equal(t, testCase.expectProxyWebAddr, fc.Proxy.WebAddr)
@@ -592,7 +591,7 @@ func TestLabelParsing(t *testing.T) {
 	var err error
 	// empty spec. no errors, no labels
 	err = parseLabelsApply("", &conf)
-	require.Nil(t, err)
+	require.NoError(t, err)
 	require.Nil(t, conf.CmdLabels)
 	require.Nil(t, conf.Labels)
 
@@ -600,7 +599,7 @@ func TestLabelParsing(t *testing.T) {
 	err = parseLabelsApply(`key=value,more="much better"`, &conf)
 	require.NoError(t, err)
 	require.NotNil(t, conf.CmdLabels)
-	require.Len(t, conf.CmdLabels, 0)
+	require.Empty(t, conf.CmdLabels)
 	require.Equal(t, map[string]string{
 		"key":  "value",
 		"more": "much better",
@@ -608,7 +607,7 @@ func TestLabelParsing(t *testing.T) {
 
 	// static labels + command labels
 	err = parseLabelsApply(`key=value,more="much better",arch=[5m2s:/bin/uname -m "p1 p2"]`, &conf)
-	require.Nil(t, err)
+	require.NoError(t, err)
 	require.Equal(t, map[string]string{
 		"key":  "value",
 		"more": "much better",
@@ -758,7 +757,7 @@ func TestApplyConfig(t *testing.T) {
 	require.Equal(t, "tcp://mongo.example:27017", cfg.Proxy.MongoPublicAddrs[0].FullAddress())
 	require.Equal(t, "tcp://peerhost:1234", cfg.Proxy.PeerAddress.FullAddress())
 	require.Equal(t, "tcp://peer.example:1234", cfg.Proxy.PeerPublicAddr.FullAddress())
-	require.Equal(t, true, cfg.Proxy.IdP.SAMLIdP.Enabled)
+	require.True(t, cfg.Proxy.IdP.SAMLIdP.Enabled)
 	require.Equal(t, "", cfg.Proxy.IdP.SAMLIdP.BaseURL)
 
 	require.Equal(t, "tcp://127.0.0.1:3000", cfg.DiagnosticAddr.FullAddress())
@@ -880,7 +879,7 @@ SREzU8onbBsjMg9QDiSf5oJLKvd/Ren+zGY7
 			},
 		},
 	))
-	require.Equal(t, cfg.Kube.KubeconfigPath, "/tmp/kubeconfig")
+	require.Equal(t, "/tmp/kubeconfig", cfg.Kube.KubeconfigPath)
 	require.Empty(t, cmp.Diff(cfg.Kube.StaticLabels,
 		map[string]string{
 			"testKey": "testValue",
@@ -888,22 +887,22 @@ SREzU8onbBsjMg9QDiSf5oJLKvd/Ren+zGY7
 	))
 
 	require.True(t, cfg.Discovery.Enabled)
-	require.Equal(t, cfg.Discovery.AWSMatchers[0].Regions, []string{"eu-central-1"})
-	require.Equal(t, cfg.Discovery.AWSMatchers[0].Types, []string{"ec2"})
-	require.Equal(t, cfg.Discovery.AWSMatchers[0].AssumeRole.RoleARN, "arn:aws:iam::123456789012:role/DBDiscoverer")
-	require.Equal(t, cfg.Discovery.AWSMatchers[0].AssumeRole.ExternalID, "externalID123")
-	require.Equal(t, cfg.Discovery.AWSMatchers[0].Params, &types.InstallerParams{
+	require.Equal(t, []string{"eu-central-1"}, cfg.Discovery.AWSMatchers[0].Regions)
+	require.Equal(t, []string{"ec2"}, cfg.Discovery.AWSMatchers[0].Types)
+	require.Equal(t, "arn:aws:iam::123456789012:role/DBDiscoverer", cfg.Discovery.AWSMatchers[0].AssumeRole.RoleARN)
+	require.Equal(t, "externalID123", cfg.Discovery.AWSMatchers[0].AssumeRole.ExternalID)
+	require.Equal(t, &types.InstallerParams{
 		InstallTeleport: true,
 		JoinMethod:      "iam",
 		JoinToken:       types.IAMInviteTokenName,
 		ScriptName:      "default-installer",
 		SSHDConfig:      types.SSHDConfigPath,
-	})
+	}, cfg.Discovery.AWSMatchers[0].Params)
 
 	require.True(t, cfg.Okta.Enabled)
-	require.Equal(t, cfg.Okta.APIEndpoint, "https://some-endpoint")
-	require.Equal(t, cfg.Okta.APITokenPath, oktaAPITokenPath)
-	require.Equal(t, cfg.Okta.SyncPeriod, time.Second*300)
+	require.Equal(t, "https://some-endpoint", cfg.Okta.APIEndpoint)
+	require.Equal(t, oktaAPITokenPath, cfg.Okta.APITokenPath)
+	require.Equal(t, time.Second*300, cfg.Okta.SyncPeriod)
 }
 
 // TestApplyConfigNoneEnabled makes sure that if a section is not enabled,
@@ -1020,7 +1019,7 @@ func TestApplyCustomSessionRecordingConfig(t *testing.T) {
 	require.NoError(t, err)
 
 	require.True(t, cfg.Auth.Enabled)
-	require.Equal(t, cfg.Auth.ClusterName.GetClusterName(), "example.com")
+	require.Equal(t, "example.com", cfg.Auth.ClusterName.GetClusterName())
 	require.Equal(t, types.OriginDefaults, cfg.Auth.Preference.Origin())
 	require.Equal(t, types.OriginDefaults, cfg.Auth.NetworkingConfig.Origin())
 	require.Equal(t, types.OriginConfigFile, cfg.Auth.SessionRecordingConfig.Origin())
@@ -1207,8 +1206,8 @@ func TestBackendDefaults(t *testing.T) {
        type: dir
        path: /var/lib/teleport/mybackend
 `)
-	require.Equal(t, cfg.Auth.StorageConfig.Type, lite.GetName())
-	require.Equal(t, cfg.Auth.StorageConfig.Params[defaults.BackendPath], "/var/lib/teleport/mybackend")
+	require.Equal(t, lite.GetName(), cfg.Auth.StorageConfig.Type)
+	require.Equal(t, "/var/lib/teleport/mybackend", cfg.Auth.StorageConfig.Params[defaults.BackendPath])
 
 	// Kubernetes proxy is disabled by default.
 	cfg = read(`teleport:
@@ -1323,9 +1322,9 @@ func TestParseCachePolicy(t *testing.T) {
 }
 
 func checkStaticConfig(t *testing.T, conf *FileConfig) {
-	require.Equal(t, conf.AuthToken, "xxxyyy")
-	require.Equal(t, conf.AdvertiseIP, "10.10.10.1:3022")
-	require.Equal(t, conf.PIDFile, "/var/run/teleport.pid")
+	require.Equal(t, "xxxyyy", conf.AuthToken)
+	require.Equal(t, "10.10.10.1:3022", conf.AdvertiseIP)
+	require.Equal(t, "/var/run/teleport.pid", conf.PIDFile)
 
 	require.Empty(t, cmp.Diff(conf.Limits, ConnectionLimits{
 		MaxConnections: 90,
@@ -2905,10 +2904,7 @@ func TestDatabaseCLIFlags(t *testing.T) {
 				require.Contains(t, err.Error(), tt.outError)
 			} else {
 				require.NoError(t, err)
-				require.Equal(t,
-					config.Databases.Databases,
-					[]servicecfg.Database{tt.outDatabase},
-				)
+				require.Equal(t, []servicecfg.Database{tt.outDatabase}, config.Databases.Databases)
 			}
 		})
 	}
@@ -3574,7 +3570,7 @@ func TestAuthHostedPlugins(t *testing.T) {
 	}
 	notExist := func(t require.TestingT, err error, msgAndArgs ...interface{}) {
 		require.Error(t, err)
-		require.True(t, errors.Is(err, os.ErrNotExist), `expected "does not exist", but got %v`)
+		require.ErrorIs(t, err, os.ErrNotExist, `expected "does not exist", but got %v`, err)
 	}
 
 	tmpDir := t.TempDir()

lib/config/database_test.go

@@ -514,7 +514,7 @@ func TestMakeDatabaseConfig(t *testing.T) {
 		t.Run("empty", func(t *testing.T) {
 			flags := DatabaseSampleFlags{}
 			databases := generateAndParseConfig(t, flags)
-			require.Len(t, databases.ResourceMatchers, 0)
+			require.Empty(t, databases.ResourceMatchers)
 		})
 
 		t.Run("multiple labels", func(t *testing.T) {

lib/config/fileconf_test.go

@@ -521,7 +521,7 @@ func TestAuthenticationConfig_Parse_StaticToken(t *testing.T) {
 				Token:   tt.token,
 				Expires: provisionToken.Expires,
 			}
-			require.Equal(t, provisionToken, want)
+			require.Equal(t, want, provisionToken)
 		})
 	}
 }

lib/events/athena/querier_test.go

@@ -104,7 +104,7 @@ func TestSearchEvents(t *testing.T) {
 	}
 
 	wantCallsToAthena := func(t *testing.T, mock *mockAthenaExecutor, want int) {
-		require.Equal(t, want, len(mock.startQueryReqs))
+		require.Len(t, mock.startQueryReqs, want)
 	}
 	wantSingleCallToAthena := func(t *testing.T, mock *mockAthenaExecutor) {
 		wantCallsToAthena(t, mock, 1)

lib/events/azsessions/azsessions_test.go

@@ -50,7 +50,7 @@ func TestStreams(t *testing.T) {
 	require.NoError(t, err)
 
 	handler, err := NewHandler(ctx, config)
-	require.Nil(t, err)
+	require.NoError(t, err)
 
 	t.Run("StreamManyParts", func(t *testing.T) {
 		test.StreamManyParts(t, handler)

lib/events/emitter_test.go

@@ -81,11 +81,11 @@ func TestProtoStreamer(t *testing.T) {
 				Uploader:       uploader,
 				MinUploadBytes: tc.minUploadBytes,
 			})
-			require.Nil(t, err)
+			require.NoError(t, err)
 
 			sid := session.ID(fmt.Sprintf("test-%v", i))
 			stream, err := streamer.CreateAuditStream(ctx, sid)
-			require.Nil(t, err)
+			require.NoError(t, err)
 
 			evts := tc.events
 			for _, event := range evts {
@@ -94,21 +94,21 @@ func TestProtoStreamer(t *testing.T) {
 					require.IsType(t, tc.err, err)
 					return
 				}
-				require.Nil(t, err)
+				require.NoError(t, err)
 			}
 			err = stream.Complete(ctx)
-			require.Nil(t, err)
+			require.NoError(t, err)
 
 			var outEvents []apievents.AuditEvent
 			uploads, err := uploader.ListUploads(ctx)
-			require.Nil(t, err)
+			require.NoError(t, err)
 			parts, err := uploader.GetParts(uploads[0].ID)
-			require.Nil(t, err)
+			require.NoError(t, err)
 
 			for _, part := range parts {
 				reader := events.NewProtoReader(bytes.NewReader(part))
 				out, err := reader.ReadAll(ctx)
-				require.Nil(t, err, "part crash %#v", part)
+				require.NoError(t, err, "part crash %#v", part)
 				outEvents = append(outEvents, out...)
 			}
 
@@ -205,7 +205,7 @@ func TestAsyncEmitter(t *testing.T) {
 
 		// context will not wait until all events have been submitted
 		emitter.Close()
-		require.True(t, int(counter.Count()) <= len(evts))
+		require.LessOrEqual(t, int(counter.Count()), len(evts))
 
 		// make sure all emit calls returned after context is done
 		for range evts {
@@ -272,5 +272,5 @@ func TestExport(t *testing.T) {
 		count++
 	}
 	require.NoError(t, snl.Err())
-	require.Equal(t, len(outEvents), count)
+	require.Len(t, outEvents, count)
 }

lib/events/filelog_test.go

@@ -98,7 +98,7 @@ func TestFileLogPagination(t *testing.T) {
 		Order:    types.EventOrderAscending,
 		StartKey: checkpoint,
 	})
-	require.Nil(t, err)
+	require.NoError(t, err)
 	require.Len(t, eventArr, 1)
 	require.Empty(t, checkpoint)
 }
@@ -113,7 +113,7 @@ func TestSearchSessionEvents(t *testing.T) {
 		RotationPeriod: time.Hour * 24,
 		Clock:          clock,
 	})
-	require.Nil(t, err)
+	require.NoError(t, err)
 	clock.Advance(1 * time.Minute)
 
 	require.NoError(t, log.EmitAuditEvent(ctx, &events.SessionEnd{
@@ -133,8 +133,8 @@ func TestSearchSessionEvents(t *testing.T) {
 	})
 	require.NoError(t, err)
 	require.Len(t, result, 1)
-	require.Equal(t, result[0].GetType(), SessionEndEvent)
-	require.Equal(t, result[0].GetID(), "a")
+	require.Equal(t, SessionEndEvent, result[0].GetType())
+	require.Equal(t, "a", result[0].GetID())
 
 	// emit a non-session event, it should not show up in the next query
 	require.NoError(t, log.EmitAuditEvent(ctx, &events.SessionJoin{
@@ -154,8 +154,8 @@ func TestSearchSessionEvents(t *testing.T) {
 	})
 	require.NoError(t, err)
 	require.Len(t, result, 1)
-	require.Equal(t, result[0].GetType(), SessionEndEvent)
-	require.Equal(t, result[0].GetID(), "a")
+	require.Equal(t, SessionEndEvent, result[0].GetType())
+	require.Equal(t, "a", result[0].GetID())
 
 	// emit a desktop session event, it should show up in the next query
 	require.NoError(t, log.EmitAuditEvent(ctx, &events.WindowsDesktopSessionEnd{
@@ -175,10 +175,10 @@ func TestSearchSessionEvents(t *testing.T) {
 	})
 	require.NoError(t, err)
 	require.Len(t, result, 2)
-	require.Equal(t, result[0].GetType(), SessionEndEvent)
-	require.Equal(t, result[0].GetID(), "a")
-	require.Equal(t, result[1].GetType(), WindowsDesktopSessionEndEvent)
-	require.Equal(t, result[1].GetID(), "c")
+	require.Equal(t, SessionEndEvent, result[0].GetType())
+	require.Equal(t, "a", result[0].GetID())
+	require.Equal(t, WindowsDesktopSessionEndEvent, result[1].GetType())
+	require.Equal(t, "c", result[1].GetID())
 }
 
 // TestLargeEvent test fileLog behavior in case of large events.
@@ -188,7 +188,7 @@ func TestLargeEvent(t *testing.T) {
 
 	hasEventsLength := func(n int) check {
 		return func(t *testing.T, ee []events.AuditEvent) {
-			require.Equal(t, n, len(ee), "events length mismatch")
+			require.Len(t, ee, n, "events length mismatch")
 		}
 	}
 	hasEventsIDs := func(ids ...string) check {

lib/events/filesessions/fileasync_test.go

@@ -48,7 +48,7 @@ func TestUploadOK(t *testing.T) {
 	p.clock.BlockUntil(1)
 
 	fileStreamer, err := NewStreamer(p.scanDir)
-	require.Nil(t, err)
+	require.NoError(t, err)
 
 	inEvents := eventstest.GenerateTestSession(eventstest.SessionParams{PrintEvents: 1024})
 	sid := inEvents[0].(events.SessionMetadataGetter).GetSessionID()
@@ -63,7 +63,7 @@ func TestUploadOK(t *testing.T) {
 	select {
 	case event = <-p.memEventsC:
 		require.Equal(t, event.SessionID, sid)
-		require.Nil(t, event.Error)
+		require.NoError(t, event.Error)
 	case <-p.ctx.Done():
 		t.Fatalf("Timeout waiting for async upload, try `go test -v` to get more logs for details")
 	}
@@ -86,7 +86,7 @@ func TestUploadParallel(t *testing.T) {
 
 	for i := 0; i < 5; i++ {
 		fileStreamer, err := NewStreamer(p.scanDir)
-		require.Nil(t, err)
+		require.NoError(t, err)
 
 		sessionEvents := eventstest.GenerateTestSession(eventstest.SessionParams{PrintEvents: 1024})
 		sid := sessionEvents[0].(events.SessionMetadataGetter).GetSessionID()
@@ -105,10 +105,9 @@ func TestUploadParallel(t *testing.T) {
 		var found bool
 		select {
 		case event = <-p.memEventsC:
-			require.Nil(t, event.Error)
+			require.NoError(t, event.Error)
 			sessionEvents, found = sessions[event.SessionID]
-			require.Equal(t, found, true,
-				"session %q is not expected, possible duplicate event", event.SessionID)
+			require.True(t, found, "session %q is not expected, possible duplicate event", event.SessionID)
 		case <-p.ctx.Done():
 			t.Fatalf("Timeout waiting for async upload, try `go test -v` to get more logs for details")
 		}
@@ -202,12 +201,12 @@ func TestUploadResume(t *testing.T) {
 					},
 					OnResumeAuditStream: func(ctx context.Context, sid session.ID, uploadID string, streamer events.Streamer) (apievents.Stream, error) {
 						stream, err := streamer.ResumeAuditStream(ctx, sid, uploadID)
-						require.Nil(t, err)
+						require.NoError(t, err)
 						streamResumed.Add(1)
 						return stream, nil
 					},
 				})
-				require.Nil(t, err)
+				require.NoError(t, err)
 				return resumeTestTuple{
 					streamer: callbackStreamer,
 					verify: func(t *testing.T, tc resumeTestCase) {
@@ -234,12 +233,12 @@ func TestUploadResume(t *testing.T) {
 					},
 					OnResumeAuditStream: func(ctx context.Context, sid session.ID, uploadID string, streamer events.Streamer) (apievents.Stream, error) {
 						stream, err := streamer.ResumeAuditStream(ctx, sid, uploadID)
-						require.Nil(t, err)
+						require.NoError(t, err)
 						streamResumed.Add(1)
 						return stream, nil
 					},
 				})
-				require.Nil(t, err)
+				require.NoError(t, err)
 				return resumeTestTuple{
 					streamer: callbackStreamer,
 					verify: func(t *testing.T, tc resumeTestCase) {
@@ -267,7 +266,7 @@ func TestUploadResume(t *testing.T) {
 					},
 					OnCreateAuditStream: func(ctx context.Context, sid session.ID, streamer events.Streamer) (apievents.Stream, error) {
 						stream, err := streamer.CreateAuditStream(ctx, sid)
-						require.Nil(t, err)
+						require.NoError(t, err)
 						streamCreated.Add(1)
 						return stream, nil
 					},
@@ -275,7 +274,7 @@ func TestUploadResume(t *testing.T) {
 						return nil, trace.NotFound("stream not found")
 					},
 				})
-				require.Nil(t, err)
+				require.NoError(t, err)
 				return resumeTestTuple{
 					streamer: callbackStreamer,
 					verify: func(t *testing.T, tc resumeTestCase) {
@@ -289,7 +288,7 @@ func TestUploadResume(t *testing.T) {
 			retries: 1,
 			onRetry: func(t *testing.T, attempt int, uploader *Uploader) {
 				files, err := os.ReadDir(uploader.cfg.ScanDir)
-				require.Nil(t, err)
+				require.NoError(t, err)
 				checkpointsDeleted := 0
 				for i := range files {
 					fi := files[i]
@@ -298,7 +297,7 @@ func TestUploadResume(t *testing.T) {
 					}
 					if filepath.Ext(fi.Name()) == checkpointExt {
 						err := os.Remove(filepath.Join(uploader.cfg.ScanDir, fi.Name()))
-						require.Nil(t, err)
+						require.NoError(t, err)
 						log.Debugf("Deleted checkpoint file: %v.", fi.Name())
 						checkpointsDeleted++
 					}
@@ -321,18 +320,18 @@ func TestUploadResume(t *testing.T) {
 					},
 					OnCreateAuditStream: func(ctx context.Context, sid session.ID, streamer events.Streamer) (apievents.Stream, error) {
 						stream, err := streamer.CreateAuditStream(ctx, sid)
-						require.Nil(t, err)
+						require.NoError(t, err)
 						streamCreated.Add(1)
 						return stream, nil
 					},
 					OnResumeAuditStream: func(ctx context.Context, sid session.ID, uploadID string, streamer events.Streamer) (apievents.Stream, error) {
 						stream, err := streamer.ResumeAuditStream(ctx, sid, uploadID)
-						require.Nil(t, err)
+						require.NoError(t, err)
 						streamResumed.Add(1)
 						return stream, nil
 					},
 				})
-				require.Nil(t, err)
+				require.NoError(t, err)
 				return resumeTestTuple{
 					streamer: callbackStreamer,
 					verify: func(t *testing.T, tc resumeTestCase) {
@@ -425,7 +424,7 @@ func TestUploadBackoff(t *testing.T) {
 	// Make sure that durations between retries are increasing
 	for i, diff := range diffs {
 		if i > 0 {
-			require.True(t, diff > diffs[i-1], "Expected next retry to take longer, got %v vs %v", diffs[i-1], diff)
+			require.Greater(t, diff, diffs[i-1], "Expected next retry to take longer, got %v vs %v", diffs[i-1], diff)
 		}
 	}
 
@@ -555,7 +554,7 @@ func runResume(t *testing.T, testCase resumeTestCase) {
 		Uploader:       memUploader,
 		MinUploadBytes: 1024,
 	})
-	require.Nil(t, err)
+	require.NoError(t, err)
 
 	test := testCase.newTest(streamer)
 
@@ -571,7 +570,7 @@ func runResume(t *testing.T, testCase resumeTestCase) {
 		Streamer:     test.streamer,
 		Clock:        clock,
 	})
-	require.Nil(t, err)
+	require.NoError(t, err)
 	go uploader.Serve(ctx)
 	// wait until uploader blocks on the clock
 	clock.BlockUntil(1)
@@ -579,7 +578,7 @@ func runResume(t *testing.T, testCase resumeTestCase) {
 	defer uploader.Close()
 
 	fileStreamer, err := NewStreamer(scanDir)
-	require.Nil(t, err)
+	require.NoError(t, err)
 
 	inEvents := eventstest.GenerateTestSession(eventstest.SessionParams{PrintEvents: 1024})
 	sid := inEvents[0].(events.SessionMetadataGetter).GetSessionID()
@@ -615,7 +614,7 @@ func runResume(t *testing.T, testCase resumeTestCase) {
 		case event = <-eventsC:
 			require.Equal(t, event.SessionID, sid)
 			if i == testCase.retries-1 {
-				require.Nil(t, event.Error)
+				require.NoError(t, event.Error)
 			} else {
 				require.IsType(t, trace.ConnectionProblem(nil, "connection problem"), event.Error)
 			}
@@ -638,13 +637,13 @@ func emitStream(ctx context.Context, t *testing.T, streamer events.Streamer, inE
 	sid := inEvents[0].(events.SessionMetadataGetter).GetSessionID()
 
 	stream, err := streamer.CreateAuditStream(ctx, session.ID(sid))
-	require.Nil(t, err)
+	require.NoError(t, err)
 	for _, event := range inEvents {
 		err := stream.RecordEvent(ctx, eventstest.PrepareEvent(event))
-		require.Nil(t, err)
+		require.NoError(t, err)
 	}
 	err = stream.Complete(ctx)
-	require.Nil(t, err)
+	require.NoError(t, err)
 }
 
 // readStream reads and decodes the audit stream from uploadID

lib/events/filesessions/fileuploader_test.go

@@ -43,7 +43,7 @@ func TestStreams(t *testing.T) {
 	handler, err := NewHandler(Config{
 		Directory: dir,
 	})
-	require.Nil(t, err)
+	require.NoError(t, err)
 	defer handler.Close()
 
 	t.Run("Stream", func(t *testing.T) {
@@ -60,7 +60,7 @@ func TestStreams(t *testing.T) {
 				return nil
 			},
 		})
-		require.Nil(t, err)
+		require.NoError(t, err)
 		defer handler.Close()
 
 		test.StreamResumeManyParts(t, handler)

lib/events/gcssessions/gcshandler_test.go

@@ -46,7 +46,7 @@ func TestFakeStreams(t *testing.T) {
 		Endpoint: server.URL(),
 		Bucket:   fmt.Sprintf("teleport-test-%v", uuid.New().String()),
 	}, server.Client())
-	require.Nil(t, err)
+	require.NoError(t, err)
 	defer handler.Close()
 
 	t.Run("UploadDownload", func(t *testing.T) {

lib/events/gcssessions/gcsstream_test.go

@@ -75,7 +75,7 @@ func TestStreams(t *testing.T) {
 			teleport.GCSTestURI)
 	}
 	u, err := url.Parse(uri)
-	require.Nil(t, err)
+	require.NoError(t, err)
 
 	config := Config{}
 	err = config.SetFromURL(u)

lib/events/s3sessions/s3handler_test.go

@@ -44,7 +44,7 @@ func TestStreams(t *testing.T) {
 		Path:   "/test/",
 		Bucket: fmt.Sprintf("teleport-unit-tests"),
 	})
-	require.Nil(t, err)
+	require.NoError(t, err)
 
 	defer handler.Close()
 
@@ -73,7 +73,7 @@ func TestACL(t *testing.T) {
 	} {
 		t.Run(tc.desc, func(t *testing.T) {
 			url, err := url.Parse(fmt.Sprintf("%s?acl=%s", baseUrl, tc.acl))
-			require.Nil(t, err)
+			require.NoError(t, err)
 			conf := Config{}
 			err = conf.SetFromURL(url, "")
 			if tc.isError {