mirror of
https://github.com/shankar0123/certctl.git
synced 2026-06-07 16:11:29 +00:00
0e29c416b1
Closes one 2026-04-24 audit finding (P2):
- cat-s6-efc7f6f6bd50: 30 strings.Contains(err.Error(), ...) sites
in internal/api/handler/ — brittle to repository-layer message
changes, untyped against the actual failure mode.
Approach (Option B from prompt design notes):
- New typed sentinels in internal/repository/errors.go:
ErrNotFound, ErrForeignKeyConstraint
IsForeignKeyError(err) helper (the only place substring
matching at the lib/pq boundary is allowed; isolates the
DB-driver string knowledge to one function).
- New typed sentinel in internal/domain/errors.go:
ErrValidation (reserved for future per-entity validation
wrappers; not yet used by all handlers).
- 49 sites in internal/repository/postgres/*.go updated to wrap
sql.ErrNoRows-derived errors via fmt.Errorf("...: %w",
repository.ErrNotFound).
- 18 not-found handler sites + 2 FK-constraint handler sites
refactored to errors.Is(err, repository.ErrNotFound) /
repository.IsForeignKeyError(err).
- 23 inline `fmt.Errorf("X not found")` test fixtures across
handler tests rewrapped to wrap repository.ErrNotFound.
- test_utils.go::ErrMockNotFound rewrapped to wrap
repository.ErrNotFound; renewal_policy.go closure docblock
updated to reflect the new convention.
- integration test mockJobRepository.Get wraps repository.ErrNotFound.
CI regression guardrail:
- .github/workflows/ci.yml::"Forbidden strings.Contains(err.Error())
regression guard (S-2)" greps for the three patterns ("not found",
"violates foreign key", "RESTRICT") under internal/api/handler/
and fails the build on regression.
Verification:
- go build ./... — clean
- go vet ./... — clean
- go test ./... -short -count=1 — all packages pass (handler +
repository + service + integration)
- golangci-lint v2.11.4 run ./... — 0 issues
- S-2 guardrail dry-run on post-fix tree → empty (good)
- All sibling guardrails (S-1, G-3, D-1+D-2, B-1, L-1, H-1, C-1, F-1, P-1) pass
Audit findings closed:
- cat-s6-efc7f6f6bd50 (P2)
Deferred follow-ups:
- 6 domain-specific substring patterns still inline in handlers
("cannot approve", "cannot reject", "cannot be parsed",
"no certificates found", "challenge password", "invalid"/
"required" validation chains in profiles + agent_groups). Each
needs its own typed sentinel, scoped per service. Documented
by the S-2 CI guardrail's allowlist for closure-comments only.
- Per-entity not-found sentinels (Option A — ErrCertificateNotFound,
ErrAgentNotFound, etc.) deferred. Generic ErrNotFound covers the
current dispatch needs; per-entity precision would let handlers
return entity-aware error bodies without a domain.Type field,
but not blocking.
137 lines
3.2 KiB
Go
137 lines
3.2 KiB
Go
package postgres
|
|
|
|
import (
|
|
"github.com/shankar0123/certctl/internal/repository"
|
|
"context"
|
|
"database/sql"
|
|
"fmt"
|
|
|
|
"github.com/google/uuid"
|
|
"github.com/shankar0123/certctl/internal/domain"
|
|
)
|
|
|
|
// TeamRepository implements repository.TeamRepository
|
|
type TeamRepository struct {
|
|
db *sql.DB
|
|
}
|
|
|
|
// NewTeamRepository creates a new TeamRepository
|
|
func NewTeamRepository(db *sql.DB) *TeamRepository {
|
|
return &TeamRepository{db: db}
|
|
}
|
|
|
|
// List returns all teams
|
|
func (r *TeamRepository) List(ctx context.Context) ([]*domain.Team, error) {
|
|
rows, err := r.db.QueryContext(ctx, `
|
|
SELECT id, name, description, created_at, updated_at
|
|
FROM teams
|
|
ORDER BY created_at DESC
|
|
`)
|
|
|
|
if err != nil {
|
|
return nil, fmt.Errorf("failed to query teams: %w", err)
|
|
}
|
|
defer rows.Close()
|
|
|
|
var teams []*domain.Team
|
|
for rows.Next() {
|
|
var team domain.Team
|
|
if err := rows.Scan(&team.ID, &team.Name, &team.Description,
|
|
&team.CreatedAt, &team.UpdatedAt); err != nil {
|
|
return nil, fmt.Errorf("failed to scan team: %w", err)
|
|
}
|
|
teams = append(teams, &team)
|
|
}
|
|
|
|
if err := rows.Err(); err != nil {
|
|
return nil, fmt.Errorf("error iterating team rows: %w", err)
|
|
}
|
|
|
|
return teams, nil
|
|
}
|
|
|
|
// Get retrieves a team by ID
|
|
func (r *TeamRepository) Get(ctx context.Context, id string) (*domain.Team, error) {
|
|
var team domain.Team
|
|
err := r.db.QueryRowContext(ctx, `
|
|
SELECT id, name, description, created_at, updated_at
|
|
FROM teams
|
|
WHERE id = $1
|
|
`, id).Scan(&team.ID, &team.Name, &team.Description,
|
|
&team.CreatedAt, &team.UpdatedAt)
|
|
|
|
if err != nil {
|
|
if err == sql.ErrNoRows {
|
|
return nil, fmt.Errorf("team not found: %w", repository.ErrNotFound)
|
|
}
|
|
return nil, fmt.Errorf("failed to query team: %w", err)
|
|
}
|
|
|
|
return &team, nil
|
|
}
|
|
|
|
// Create stores a new team
|
|
func (r *TeamRepository) Create(ctx context.Context, team *domain.Team) error {
|
|
if team.ID == "" {
|
|
team.ID = uuid.New().String()
|
|
}
|
|
|
|
err := r.db.QueryRowContext(ctx, `
|
|
INSERT INTO teams (id, name, description, created_at, updated_at)
|
|
VALUES ($1, $2, $3, $4, $5)
|
|
RETURNING id
|
|
`, team.ID, team.Name, team.Description, team.CreatedAt, team.UpdatedAt).Scan(&team.ID)
|
|
|
|
if err != nil {
|
|
return fmt.Errorf("failed to create team: %w", err)
|
|
}
|
|
|
|
return nil
|
|
}
|
|
|
|
// Update modifies an existing team
|
|
func (r *TeamRepository) Update(ctx context.Context, team *domain.Team) error {
|
|
result, err := r.db.ExecContext(ctx, `
|
|
UPDATE teams SET
|
|
name = $1,
|
|
description = $2,
|
|
updated_at = $3
|
|
WHERE id = $4
|
|
`, team.Name, team.Description, team.UpdatedAt, team.ID)
|
|
|
|
if err != nil {
|
|
return fmt.Errorf("failed to update team: %w", err)
|
|
}
|
|
|
|
rows, err := result.RowsAffected()
|
|
if err != nil {
|
|
return fmt.Errorf("failed to get rows affected: %w", err)
|
|
}
|
|
|
|
if rows == 0 {
|
|
return fmt.Errorf("team not found: %w", repository.ErrNotFound)
|
|
}
|
|
|
|
return nil
|
|
}
|
|
|
|
// Delete removes a team
|
|
func (r *TeamRepository) Delete(ctx context.Context, id string) error {
|
|
result, err := r.db.ExecContext(ctx, "DELETE FROM teams WHERE id = $1", id)
|
|
|
|
if err != nil {
|
|
return fmt.Errorf("failed to delete team: %w", err)
|
|
}
|
|
|
|
rows, err := result.RowsAffected()
|
|
if err != nil {
|
|
return fmt.Errorf("failed to get rows affected: %w", err)
|
|
}
|
|
|
|
if rows == 0 {
|
|
return fmt.Errorf("team not found: %w", repository.ErrNotFound)
|
|
}
|
|
|
|
return nil
|
|
}
|