mirror of
https://github.com/shankar0123/certctl.git
synced 2026-06-07 18:21:32 +00:00
shankar0123
0e29c416b1
Closes one 2026-04-24 audit finding (P2):
- cat-s6-efc7f6f6bd50: 30 strings.Contains(err.Error(), ...) sites
in internal/api/handler/ — brittle to repository-layer message
changes, untyped against the actual failure mode.
Approach (Option B from prompt design notes):
- New typed sentinels in internal/repository/errors.go:
ErrNotFound, ErrForeignKeyConstraint
IsForeignKeyError(err) helper (the only place substring
matching at the lib/pq boundary is allowed; isolates the
DB-driver string knowledge to one function).
- New typed sentinel in internal/domain/errors.go:
ErrValidation (reserved for future per-entity validation
wrappers; not yet used by all handlers).
- 49 sites in internal/repository/postgres/*.go updated to wrap
sql.ErrNoRows-derived errors via fmt.Errorf("...: %w",
repository.ErrNotFound).
- 18 not-found handler sites + 2 FK-constraint handler sites
refactored to errors.Is(err, repository.ErrNotFound) /
repository.IsForeignKeyError(err).
- 23 inline `fmt.Errorf("X not found")` test fixtures across
handler tests rewrapped to wrap repository.ErrNotFound.
- test_utils.go::ErrMockNotFound rewrapped to wrap
repository.ErrNotFound; renewal_policy.go closure docblock
updated to reflect the new convention.
- integration test mockJobRepository.Get wraps repository.ErrNotFound.
CI regression guardrail:
- .github/workflows/ci.yml::"Forbidden strings.Contains(err.Error())
regression guard (S-2)" greps for the three patterns ("not found",
"violates foreign key", "RESTRICT") under internal/api/handler/
and fails the build on regression.
Verification:
- go build ./... — clean
- go vet ./... — clean
- go test ./... -short -count=1 — all packages pass (handler +
repository + service + integration)
- golangci-lint v2.11.4 run ./... — 0 issues
- S-2 guardrail dry-run on post-fix tree → empty (good)
- All sibling guardrails (S-1, G-3, D-1+D-2, B-1, L-1, H-1, C-1, F-1, P-1) pass
Audit findings closed:
- cat-s6-efc7f6f6bd50 (P2)
Deferred follow-ups:
- 6 domain-specific substring patterns still inline in handlers
("cannot approve", "cannot reject", "cannot be parsed",
"no certificates found", "challenge password", "invalid"/
"required" validation chains in profiles + agent_groups). Each
needs its own typed sentinel, scoped per service. Documented
by the S-2 CI guardrail's allowlist for closure-comments only.
- Per-entity not-found sentinels (Option A — ErrCertificateNotFound,
ErrAgentNotFound, etc.) deferred. Generic ErrNotFound covers the
current dispatch needs; per-entity precision would let handlers
return entity-aware error bodies without a domain.Type field,
but not blocking.
63 lines
2.8 KiB
Go
63 lines
2.8 KiB
Go
// Package repository defines the repository-layer error sentinels that
|
|
// handlers map to HTTP status codes via errors.Is.
|
|
//
|
|
// S-2 closure (cat-s6-efc7f6f6bd50): pre-S-2 every handler-side
|
|
// not-found dispatch was a `strings.Contains(err.Error(), "not found")`
|
|
// site (30+ across internal/api/handler/*.go), brittle to any
|
|
// repository-layer message change and untyped against the actual
|
|
// failure mode. Post-S-2 the dispatch is type-checked: repositories
|
|
// wrap sql.ErrNoRows via fmt.Errorf("...: %w", repository.ErrNotFound)
|
|
// and FK constraint violations via repository.ErrForeignKeyConstraint;
|
|
// handlers consume via errors.Is. The substring matching is preserved
|
|
// at the lib/pq boundary inside `errors.go::isFKError` because the
|
|
// PostgreSQL driver returns un-typed *pq.Error values whose codes are
|
|
// the canonical signal — but it's confined to one helper rather than
|
|
// scattered across every handler file. See unified-audit.md
|
|
// cat-s6-efc7f6f6bd50 for the closure rationale.
|
|
package repository
|
|
|
|
import (
|
|
"errors"
|
|
"strings"
|
|
)
|
|
|
|
// ErrNotFound is the canonical sentinel for repository methods that
|
|
// return after sql.ErrNoRows (or its wrapped form). Handlers that
|
|
// surface a 404 should `errors.Is(err, repository.ErrNotFound)`
|
|
// rather than substring-match.
|
|
var ErrNotFound = errors.New("repository: row not found")
|
|
|
|
// ErrForeignKeyConstraint is the canonical sentinel for PostgreSQL
|
|
// FK / RESTRICT violations bubbling up from a DELETE or UPDATE.
|
|
// Handlers that surface a 409 Conflict should
|
|
// `errors.Is(err, repository.ErrForeignKeyConstraint)`.
|
|
//
|
|
// The B-1 closure introduced ErrRenewalPolicyInUse as the per-entity
|
|
// FK sentinel for renewal_policies; future per-entity FK sentinels
|
|
// (ErrIssuerInUse, ErrTeamInUse, ErrOwnerInUse) can wrap this generic
|
|
// one via fmt.Errorf("...: %w", ErrForeignKeyConstraint) so handlers
|
|
// can choose between generic-409 and entity-specific 409 dispatch.
|
|
var ErrForeignKeyConstraint = errors.New("repository: foreign key constraint violation")
|
|
|
|
// IsForeignKeyError detects PostgreSQL FK violation errors from the
|
|
// lib/pq driver via the canonical error-text patterns it emits. The
|
|
// substring matching is intentionally confined to this helper —
|
|
// callers should use this once at the repo layer to wrap into the
|
|
// typed ErrForeignKeyConstraint sentinel, then handlers consume via
|
|
// errors.Is.
|
|
//
|
|
// Patterns recognised:
|
|
// - "violates foreign key constraint" (the standard PG message)
|
|
// - "violates restrict" / "RESTRICT" (DELETE blocked by ON DELETE RESTRICT)
|
|
//
|
|
// Returns false for nil err so callers can defensively chain it.
|
|
func IsForeignKeyError(err error) bool {
|
|
if err == nil {
|
|
return false
|
|
}
|
|
msg := err.Error()
|
|
return strings.Contains(msg, "violates foreign key") ||
|
|
strings.Contains(msg, "RESTRICT") ||
|
|
strings.Contains(msg, "violates restrict")
|
|
}
|