Closes Top-10 fix#4 of the 2026-05-03 issuer-coverage audit (see
cowork/issuer-coverage-audit-2026-05-03/RESULTS.md). Pre-fix, both
adapters had only happy-path test coverage with a single generic
ServerError pair each. Cloud CAs are typically the first-deployed
issuer in enterprise pilots; their diligence reviews dig hard into
IAM-error / cloud-error coverage. This commit lands the contract
tests.
AWSACMPCA — 5 tests in awsacmpca_failure_test.go. Each injects a
typed AWS SDK v2 error via the existing mockACMPCAClient seam and
asserts (1) error non-nil, (2) errors.As against the SDK's typed
value succeeds (so the wrap chain through fmt.Errorf("...%w", ...)
is intact), and (3) operator-actionable substring is present.
1. Issue_AccessDenied — *smithy.GenericAPIError with
Code="AccessDeniedException" (the SDK does NOT generate a
typed *types.AccessDeniedException; AWS uses the smithy
APIError shape for IAM denials). Asserts ErrorCode +
"not authorized" + IAM resource path preserved through wrap.
2. Issue_ResourceNotFound — *types.ResourceNotFoundException
names the missing CA ARN.
3. Issue_Throttling — *smithy.GenericAPIError with
Code="ThrottlingException", Fault=FaultServer. Asserts the
retryable class (FaultServer) is preserved through wrap so
upstream retry logic can engage.
4. Issue_MalformedCSR — *types.MalformedCSRException is terminal
(operator must fix the CSR, not retry); asserts the
validation-issue substring survives.
5. Issue_RequestInProgress — *types.RequestInProgressException
wraps cleanly; classification (retry vs reissue) is upstream's
responsibility per the spec's "no new retry logic" rule.
GoogleCAS — 5 tests in googlecas_failure_test.go. The adapter uses
stdlib net/http directly (NO Google Cloud Go SDK dependency in
googlecas.go), so SDK typed-error assertions don't translate. Each
test runs an httptest.Server that returns the canonical Google API
JSON error envelope:
{"error":{"code":N,"message":"...","status":"<STATUS>"}}
and asserts (1) error non-nil, (2) operator-actionable substring,
and (3) the canonical status string ("PERMISSION_DENIED",
"NOT_FOUND", "UNAVAILABLE") survives the wrap chain so upstream
classification can branch on it.
1. Issue_PermissionDenied — 403 / PERMISSION_DENIED; surfaced
error names the IAM resource path.
2. Issue_CAPoolNotFound — 404 / NOT_FOUND; surfaced error names
the missing pool resource.
3. Issue_OAuth2TokenRefreshFailure — token endpoint returns 401
invalid_grant; surfaced error mentions "token" so an operator
reading the log immediately distinguishes a credential failure
(rotate SA key) from a CA-side error (fix IAM binding). Test
also asserts the CAS endpoint is NOT reached when the token
exchange fails.
4. Issue_RegionalAPIUnavailable — 503 / UNAVAILABLE; surfaced
error preserves the retryable class markers (status code +
UNAVAILABLE string) for upstream retry classification.
5. Revoke_PermissionDenied — adapter does NOT silently swallow
the failure; pin the contract so the audit-row atomicity
guarantee from Bundle G (which lives in the service-layer
wrapper, not the adapter) continues to apply. Test also
verifies the revoke endpoint was actually reached, guarding
against a future regression that short-circuits before the
HTTP call.
Coverage delta:
awsacmpca: 71.0% → 71.0% (failure tests reuse existing wrap
code paths; behaviour-pin contract tests, not coverage tests).
googlecas: 83.4% → 84.4% (+1.0pp).
go.mod: smithy-go moved indirect → direct, since the new AWSACMPCA
test file imports it. CI's go-mod-tidy-drift gate enforces this.
Test-only commit. No production code changes.
Verified locally:
- gofmt clean.
- go vet ./internal/connector/issuer/awsacmpca/...
./internal/connector/issuer/googlecas/... clean.
- go test -short -count=1 ./internal/connector/issuer/... green.
- go test -race -count=10 ./internal/connector/issuer/awsacmpca
./internal/connector/issuer/googlecas green.
Audit reference: cowork/issuer-coverage-audit-2026-05-03/RESULTS.md
Top-10 fix#4.
shankar0123