Fix error handling in some cases (#527)

.golangci.yml

@@ -25,7 +25,6 @@ linters:
     - wrapcheck
     - gosec
     - gocritic
-    - errorlint
     - gci
     - gofumpt
     - nlreturn

pkg/encryption/rotation.go

@@ -74,7 +74,7 @@ func (c *CertificationRotation) Watch() error {
 	// add the files to the watch list
 	for _, x := range []string{c.certificateFile, c.privateKeyFile} {
 		if err := watcher.Add(path.Dir(x)); err != nil {
-			return fmt.Errorf("unable to add watch on directory: %s, error: %s", path.Dir(x), err)
+			return fmt.Errorf("unable to add watch on directory: %s, error: %w", path.Dir(x), err)
 		}
 	}
 

pkg/google/config/config.go

@@ -595,7 +595,7 @@ func (r *Config) isUpstreamValid() error {
 
 	if !r.NoProxy {
 		if _, err := url.ParseRequestURI(r.Upstream); err != nil {
-			return fmt.Errorf("the upstream endpoint is invalid, %s", err)
+			return fmt.Errorf("the upstream endpoint is invalid, %w", err)
 		}
 	}
 
@@ -719,7 +719,7 @@ func (r *Config) isSecureCookieValid() error {
 func (r *Config) isStoreURLValid() error {
 	if r.StoreURL != "" {
 		if _, err := url.ParseRequestURI(r.StoreURL); err != nil {
-			return fmt.Errorf("the store url is invalid, error: %s", err)
+			return fmt.Errorf("the store url is invalid, error: %w", err)
 		}
 	}
 

pkg/keycloak/config/config.go

@@ -506,7 +506,7 @@ func (r *Config) isTLSMinValid() error {
 func (r *Config) isUpstreamProxyValid() error {
 	if r.UpstreamProxy != "" {
 		if _, err := url.ParseRequestURI(r.UpstreamProxy); err != nil {
-			return fmt.Errorf("the upstream proxy is invalid, %s", err)
+			return fmt.Errorf("the upstream proxy is invalid, %w", err)
 		}
 	}
 	return nil
@@ -613,7 +613,7 @@ func (r *Config) isUpstreamValid() error {
 
 	if !r.NoProxy {
 		if _, err := url.ParseRequestURI(r.Upstream); err != nil {
-			return fmt.Errorf("the upstream endpoint is invalid, %s", err)
+			return fmt.Errorf("the upstream endpoint is invalid, %w", err)
 		}
 	}
 
@@ -717,7 +717,7 @@ func (r *Config) isSecureCookieValid() error {
 func (r *Config) isStoreURLValid() error {
 	if r.StoreURL != "" {
 		if _, err := redis.ParseURL(r.StoreURL); err != nil {
-			return fmt.Errorf("the store url is invalid, error: %s", err)
+			return fmt.Errorf("the store url is invalid, error: %w", err)
 		}
 	}
 

pkg/keycloak/proxy/middleware.go

@@ -18,6 +18,7 @@ package proxy
 import (
 	"bytes"
 	"context"
+	"errors"
 	"fmt"
 	"io"
 	"net/http"
@@ -202,18 +203,18 @@ func authorizationMiddleware(
 				}
 			}
 
-			switch err {
-			case apperrors.ErrPermissionNotInToken:
+			switch true {
+			case errors.Is(err, apperrors.ErrPermissionNotInToken):
 				scope.Logger.Info(apperrors.ErrPermissionNotInToken.Error())
-			case apperrors.ErrResourceRetrieve:
+			case errors.Is(err, apperrors.ErrResourceRetrieve):
 				scope.Logger.Info(apperrors.ErrResourceRetrieve.Error())
-			case apperrors.ErrNoIDPResourceForPath:
+			case errors.Is(err, apperrors.ErrNoIDPResourceForPath):
 				scope.Logger.Info(apperrors.ErrNoIDPResourceForPath.Error())
-			case apperrors.ErrResourceIDNotPresent:
+			case errors.Is(err, apperrors.ErrResourceIDNotPresent):
 				scope.Logger.Info(apperrors.ErrResourceIDNotPresent.Error())
-			case apperrors.ErrTokenScopeNotMatchResourceScope:
+			case errors.Is(err, apperrors.ErrTokenScopeNotMatchResourceScope):
 				scope.Logger.Info(apperrors.ErrTokenScopeNotMatchResourceScope.Error())
-			case apperrors.ErrNoAuthzFound:
+			case errors.Is(err, apperrors.ErrNoAuthzFound):
 			default:
 				if err != nil {
 					scope.Logger.Error(apperrors.ErrFailedAuthzRequest.Error(), zap.Error(err))

pkg/keycloak/proxy/misc.go

@@ -258,8 +258,8 @@ func getRPT(
 	)
 	if err != nil {
 		return nil, fmt.Errorf(
-			"%s %s",
-			apperrors.ErrNoIDPResourceForPath.Error(),
+			"%w %w",
+			apperrors.ErrNoIDPResourceForPath,
 			err,
 		)
 	}

pkg/keycloak/proxy/server.go

@@ -841,7 +841,7 @@ func (r *OauthProxy) createForwardingProxy() error {
 		cAuthority, err := encryption.LoadCA(r.Config.TLSCaCertificate, r.Config.TLSCaPrivateKey)
 
 		if err != nil {
-			return fmt.Errorf("unable to load certificate authority, error: %s", err)
+			return fmt.Errorf("unable to load certificate authority, error: %w", err)
 		}
 
 		// implement the goproxy connect method

pkg/proxy/cli.go

@@ -278,7 +278,7 @@ func parseCLIOptions(cliCtx *cli.Context, config core.Configs) error {
 		for _, x := range cliCtx.StringSlice("resources") {
 			resource, err := authorization.NewResource().Parse(x)
 			if err != nil {
-				return fmt.Errorf("invalid resource %s, %s", x, err)
+				return fmt.Errorf("invalid resource %s, %w", x, err)
 			}
 			config.SetResources(append(config.GetResources(), resource))
 		}

pkg/proxy/middleware/oauth.go

@@ -184,8 +184,8 @@ func AuthenticationMiddleware(
 
 					newAccToken, newRawAccToken, newRefreshToken, accessExpiresAt, refreshExpiresIn, err := utils.GetRefreshedToken(ctx, conf, httpClient, refresh)
 					if err != nil {
-						switch err {
-						case apperrors.ErrRefreshTokenExpired:
+						switch true {
+						case errors.Is(err, apperrors.ErrRefreshTokenExpired):
 							lLog.Warn("refresh token has expired, cannot retrieve access token")
 							cookMgr.ClearAllCookies(req.WithContext(ctx), wrt)
 						default:

pkg/proxy/session/token.go

@@ -4,6 +4,7 @@ import (
 	"bytes"
 	"context"
 	"encoding/base64"
+	"errors"
 	"fmt"
 	"net/http"
 	"net/url"
@@ -49,14 +50,14 @@ func GetTokenInRequest(
 
 	if tokenHeader == "" && !skipAuthorizationHeaderIdentity {
 		token, err = GetTokenInBearer(req)
-		if err != nil && err != apperrors.ErrSessionNotFound {
+		if err != nil && !errors.Is(err, apperrors.ErrSessionNotFound) {
 			return "", false, err
 		}
 	}
 
 	if tokenHeader != "" {
 		token, err = GetTokenInHeader(req, tokenHeader)
-		if err != nil && err != apperrors.ErrSessionNotFound {
+		if err != nil && !errors.Is(err, apperrors.ErrSessionNotFound) {
 			return "", false, err
 		}
 	}