c573276 fix: apply CodeRabbit auto-fixes · gordon

M internal/app/migrate_env.go +2 -3


@@ -10,7 +10,6 @@ import (
10	10
11	11		"github.com/bnema/gordon/internal/adapters/out/domainsecrets"
12	12		"github.com/bnema/gordon/internal/domain"
13		-	domainerrors "github.com/bnema/gordon/internal/domain"
14	13		)
15	14
16	15		func migrateEnvFilesToPass(envDir string, passStore *domainsecrets.PassStore, log zerowrap.Logger) error {

@@ -86,7 +85,7 @@ func migrateEnvFile(envDir, name string, passStore *domainsecrets.PassStore, log
86	85		}
87	86
88	87		if len(existingKeys) > 0 {
89		-	return fmt.Errorf("%w: pass secrets already exist for %s (found %d keys); refusing to delete plaintext env file automatically", domainerrors.ErrSecretNotFound, domainName, len(existingKeys))
	88	+	return fmt.Errorf("%w: pass secrets already exist for %s (found %d keys); refusing to delete plaintext env file automatically", domain.ErrSecretsAlreadyExist, domainName, len(existingKeys))
90	89		}
91	90		if err := passStore.Set(domainName, secrets); err != nil {
92	91		return fmt.Errorf("failed to migrate secrets for %s: %w", domainName, err)

@@ -186,7 +185,7 @@ func migrateAttachmentEnvFile(envDir, name string, passStore *domainsecrets.Pass
186	185		}
187	186
188	187		if len(existingKeys) > 0 {
189		-	return fmt.Errorf("%w: pass secrets already exist for attachment %s (found %d keys); refusing to delete plaintext env file automatically", domainerrors.ErrSecretNotFound, containerName, len(existingKeys))
	188	+	return fmt.Errorf("%w: pass secrets already exist for attachment %s (found %d keys); refusing to delete plaintext env file automatically", domain.ErrSecretsAlreadyExist, containerName, len(existingKeys))
190	189		}
191	190		if err := passStore.SetAttachment(containerName, secrets); err != nil {
192	191		return fmt.Errorf("failed to migrate attachment secrets for %s: %w", containerName, err)

 	"github.com/bnema/gordon/internal/adapters/out/domainsecrets"
 	"github.com/bnema/gordon/internal/domain"
-	domainerrors "github.com/bnema/gordon/internal/domain"
 )
 func migrateEnvFilesToPass(envDir string, passStore *domainsecrets.PassStore, log zerowrap.Logger) error {
 	}
 	if len(existingKeys) > 0 {
-		return fmt.Errorf("%w: pass secrets already exist for %s (found %d keys); refusing to delete plaintext env file automatically", domainerrors.ErrSecretNotFound, domainName, len(existingKeys))
+		return fmt.Errorf("%w: pass secrets already exist for %s (found %d keys); refusing to delete plaintext env file automatically", domain.ErrSecretsAlreadyExist, domainName, len(existingKeys))
 	}
 	if err := passStore.Set(domainName, secrets); err != nil {
 		return fmt.Errorf("failed to migrate secrets for %s: %w", domainName, err)
 	}
 	if len(existingKeys) > 0 {
-		return fmt.Errorf("%w: pass secrets already exist for attachment %s (found %d keys); refusing to delete plaintext env file automatically", domainerrors.ErrSecretNotFound, containerName, len(existingKeys))
+		return fmt.Errorf("%w: pass secrets already exist for attachment %s (found %d keys); refusing to delete plaintext env file automatically", domain.ErrSecretsAlreadyExist, containerName, len(existingKeys))
 	}
 	if err := passStore.SetAttachment(containerName, secrets); err != nil {
 		return fmt.Errorf("failed to migrate attachment secrets for %s: %w", containerName, err)

M internal/domain/errors.go +1 -0


@@ -57,6 +57,7 @@ var (
57	57		// Environment errors
58	58		ErrEnvFileNotFound = errors.New("environment file not found")
59	59		ErrSecretNotFound = errors.New("secret not found")
	60	+	ErrSecretsAlreadyExist = errors.New("secrets already exist")
60	61		ErrProviderNotFound = errors.New("secret provider not found")
61	62		ErrInvalidContainerName = errors.New("invalid container name")
62	63


@@ -57,6 +57,7 @@ var (
57	// Environment errors	57		// Environment errors
58	ErrEnvFileNotFound = errors.New("environment file not found")	58		ErrEnvFileNotFound = errors.New("environment file not found")
59	ErrSecretNotFound = errors.New("secret not found")	59		ErrSecretNotFound = errors.New("secret not found")
		60	+	ErrSecretsAlreadyExist = errors.New("secrets already exist")
60	ErrProviderNotFound = errors.New("secret provider not found")	61		ErrProviderNotFound = errors.New("secret provider not found")
61	ErrInvalidContainerName = errors.New("invalid container name")	62		ErrInvalidContainerName = errors.New("invalid container name")
62		63

M internal/usecase/container/service.go +12 -7


@@ -569,7 +569,7 @@ func (s *Service) prepareDeployResources(ctx context.Context, route domain.Route
569	569		log.WrapErr(err, "failed to cleanup orphaned containers")
570	570		}
571	571
572		-	imageRef, err := s.buildValidatedImageRef(route.Image)
	572	+	imageRef, err := s.buildValidatedImageRef(ctx, route.Image)
573	573		if err != nil {
574	574		return nil, err
575	575		}

@@ -1679,9 +1679,9 @@ func (s *Service) startLogCollection(ctx context.Context, containerID, domainNam
1679	1679		}
1680	1680		}
1681	1681
1682		-	func (s *Service) buildValidatedImageRef(image string) (string, error) {
	1682	+	func (s *Service) buildValidatedImageRef(ctx context.Context, image string) (string, error) {
1683	1683		imageRef := s.buildImageRef(image)
1684		-	if err := s.validateImageRef(imageRef); err != nil {
	1684	+	if err := s.validateImageRef(ctx, imageRef); err != nil {
1685	1685		return "", err
1686	1686		}
1687	1687		return imageRef, nil

@@ -1762,11 +1762,11 @@ func hasExplicitRegistry(image string) bool {
1762	1762		return false
1763	1763		}
1764	1764
1765		-	func (s *Service) validateImageRef(imageRef string) error {
	1765	+	func (s *Service) validateImageRef(ctx context.Context, imageRef string) error {
1766	1766		if !hasExplicitRegistry(imageRef) {
1767	1767		return nil
1768	1768		}
1769		-	return s.validateExternalImageRef(context.Background(), imageRef, imageRegistry(imageRef))
	1769	+	return s.validateExternalImageRef(ctx, imageRef, imageRegistry(imageRef))
1770	1770		}
1771	1771
1772	1772		func (s *Service) validateImagePullRef(ctx context.Context, imageRef string) error {

@@ -1821,6 +1821,11 @@ func imageRegistryForPolicy(imageRef string) string {
1821	1821		return "docker.io"
1822	1822		}
1823	1823
	1824	+	// normalizeRegistry normalizes a registry string for comparison purposes only.
	1825	+	// This function is used by sameRegistry to determine if two registry strings
	1826	+	// refer to the same registry. The output intentionally strips IPv6 brackets
	1827	+	// (e.g., "[fd00::1]:5000" -> "fd00::1:5000") which is acceptable for equality
	1828	+	// checks but the result MUST NOT be used to construct or emit valid registry URLs.
1824	1829		func normalizeRegistry(registry string) string {
1825	1830		registry = strings.ToLower(strings.TrimSuffix(strings.TrimSpace(registry), "."))
1826	1831		registry = strings.TrimSuffix(registry, "/")

@@ -2573,7 +2578,7 @@ func (s *Service) deployAttachedService(ctx context.Context, ownerDomain, servic
2573	2578		log.Info().Str(zerowrap.FieldService, serviceImage).Msg("deploying attached service")
2574	2579
2575	2580		// Ensure image (canonical ref is returned; internal pulls may use the local registry).
2576		-	imageRef, err := s.buildValidatedImageRef(serviceImage)
	2581	+	imageRef, err := s.buildValidatedImageRef(ctx, serviceImage)
2577	2582		if err != nil {
2578	2583		return err
2579	2584		}

@@ -2680,7 +2685,7 @@ func (s *Service) attachmentEnv(ctx context.Context, containerName, imageRef str
2680	2685		}
2681	2686
2682	2687		func (s Service) attachmentEnvDrifted(ctx context.Context, existing domain.Container, containerName, serviceImage string) (bool, error) {
2683		-	imageRef, err := s.buildValidatedImageRef(serviceImage)
	2688	+	imageRef, err := s.buildValidatedImageRef(ctx, serviceImage)
2684	2689		if err != nil {
2685	2690		return false, err
2686	2691		}

 		log.WrapErr(err, "failed to cleanup orphaned containers")
 	}
-	imageRef, err := s.buildValidatedImageRef(route.Image)
+	imageRef, err := s.buildValidatedImageRef(ctx, route.Image)
 	if err != nil {
 		return nil, err
 	}
 	}
 }
-func (s *Service) buildValidatedImageRef(image string) (string, error) {
+func (s *Service) buildValidatedImageRef(ctx context.Context, image string) (string, error) {
 	imageRef := s.buildImageRef(image)
-	if err := s.validateImageRef(imageRef); err != nil {
+	if err := s.validateImageRef(ctx, imageRef); err != nil {
 		return "", err
 	}
 	return imageRef, nil
 	return false
 }
-func (s *Service) validateImageRef(imageRef string) error {
+func (s *Service) validateImageRef(ctx context.Context, imageRef string) error {
 	if !hasExplicitRegistry(imageRef) {
 		return nil
 	}
-	return s.validateExternalImageRef(context.Background(), imageRef, imageRegistry(imageRef))
+	return s.validateExternalImageRef(ctx, imageRef, imageRegistry(imageRef))
 }
 func (s *Service) validateImagePullRef(ctx context.Context, imageRef string) error {
 	return "docker.io"
 }
+// normalizeRegistry normalizes a registry string for comparison purposes only.
+// This function is used by sameRegistry to determine if two registry strings
+// refer to the same registry. The output intentionally strips IPv6 brackets
+// (e.g., "[fd00::1]:5000" -> "fd00::1:5000") which is acceptable for equality
+// checks but the result MUST NOT be used to construct or emit valid registry URLs.
 func normalizeRegistry(registry string) string {
 	registry = strings.ToLower(strings.TrimSuffix(strings.TrimSpace(registry), "."))
 	registry = strings.TrimSuffix(registry, "/")
 	log.Info().Str(zerowrap.FieldService, serviceImage).Msg("deploying attached service")
 	// Ensure image (canonical ref is returned; internal pulls may use the local registry).
-	imageRef, err := s.buildValidatedImageRef(serviceImage)
+	imageRef, err := s.buildValidatedImageRef(ctx, serviceImage)
 	if err != nil {
 		return err
 	}
 }
 func (s *Service) attachmentEnvDrifted(ctx context.Context, existing *domain.Container, containerName, serviceImage string) (bool, error) {
-	imageRef, err := s.buildValidatedImageRef(serviceImage)
+	imageRef, err := s.buildValidatedImageRef(ctx, serviceImage)
 	if err != nil {
 		return false, err
 	}

M internal/usecase/container/service_test.go +12 -12


@@ -4202,15 +4202,15 @@ func TestService_BuildValidatedImageRef_RegistryPolicy(t *testing.T) {
4202	4202		AllowedRegistries: []string{"docker.io"},
4203	4203		}, nil)
4204	4204
4205		-	ref, err := svc.buildValidatedImageRef("myapp:latest")
	4205	+	ref, err := svc.buildValidatedImageRef(context.Background(), "myapp:latest")
4206	4206		require.NoError(t, err)
4207	4207		assert.Equal(t, "registry.example.com/myapp:latest", ref)
4208	4208
4209		-	ref, err = svc.buildValidatedImageRef("registry.example.com/myapp:latest")
	4209	+	ref, err = svc.buildValidatedImageRef(context.Background(), "registry.example.com/myapp:latest")
4210	4210		require.NoError(t, err)
4211	4211		assert.Equal(t, "registry.example.com/myapp:latest", ref)
4212	4212
4213		-	ref, err = svc.buildValidatedImageRef("docker.io/library/nginx:latest")
	4213	+	ref, err = svc.buildValidatedImageRef(context.Background(), "docker.io/library/nginx:latest")
4214	4214		require.NoError(t, err)
4215	4215		assert.Equal(t, "docker.io/library/nginx:latest", ref)
4216	4216

@@ -4222,7 +4222,7 @@ func TestService_BuildValidatedImageRef_RegistryPolicy(t *testing.T) {
4222	4222		"169.254.169.254/app:latest",
4223	4223		} {
4224	4224		t.Run(image, func(t *testing.T) {
4225		-	_, err := svc.buildValidatedImageRef(image)
	4225	+	_, err := svc.buildValidatedImageRef(context.Background(), image)
4226	4226		require.Error(t, err)
4227	4227		})
4228	4228		}

@@ -4231,7 +4231,7 @@ func TestService_BuildValidatedImageRef_RegistryPolicy(t *testing.T) {
4231	4231		func TestService_BuildValidatedImageRef_RejectsExternalRegistryWhenAllowlistEmpty(t *testing.T) {
4232	4232		svc := NewService(nil, nil, nil, nil, Config{}, nil)
4233	4233
4234		-	_, err := svc.buildValidatedImageRef("ghcr.io/acme/app:latest")
	4234	+	_, err := svc.buildValidatedImageRef(context.Background(), "ghcr.io/acme/app:latest")
4235	4235		require.Error(t, err)
4236	4236		assert.Contains(t, err.Error(), "images.allowed_registries")
4237	4237

@@ -4248,33 +4248,33 @@ func TestService_BuildValidatedImageRef_RequireDigestOnlyForExternalAllowedRegis
4248	4248		AllowedRegistries: []string{"docker.io"},
4249	4249		}, nil)
4250	4250
4251		-	_, err := svc.buildValidatedImageRef("docker.io/library/nginx:latest")
	4251	+	_, err := svc.buildValidatedImageRef(context.Background(), "docker.io/library/nginx:latest")
4252	4252		require.Error(t, err)
4253	4253
4254	4254		err = svc.validateImagePullRef(context.Background(), "nginx:latest")
4255	4255		require.Error(t, err)
4256	4256
4257		-	_, err = svc.buildValidatedImageRef("docker.io/library/nginx@sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa")
	4257	+	_, err = svc.buildValidatedImageRef(context.Background(), "docker.io/library/nginx@sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa")
4258	4258		require.NoError(t, err)
4259	4259
4260		-	_, err = svc.buildValidatedImageRef("docker.io/library/nginx@sha256:not-a-digest")
	4260	+	_, err = svc.buildValidatedImageRef(context.Background(), "docker.io/library/nginx@sha256:not-a-digest")
4261	4261		require.Error(t, err)
4262	4262
4263		-	ref, err := svc.buildValidatedImageRef("myapp:latest")
	4263	+	ref, err := svc.buildValidatedImageRef(context.Background(), "myapp:latest")
4264	4264		require.NoError(t, err)
4265	4265		assert.Equal(t, "registry.example.com/myapp:latest", ref)
4266	4266
4267		-	_, err = svc.buildValidatedImageRef("registry.example.com/myapp:latest")
	4267	+	_, err = svc.buildValidatedImageRef(context.Background(), "registry.example.com/myapp:latest")
4268	4268		require.NoError(t, err)
4269	4269		}
4270	4270
4271	4271		func TestService_BuildValidatedImageRef_AllowedRegistryMatchesPort(t *testing.T) {
4272	4272		svc := NewService(nil, nil, nil, nil, Config{AllowedRegistries: []string{"docker.io:5000"}}, nil)
4273	4273
4274		-	_, err := svc.buildValidatedImageRef("docker.io:5000/app:latest")
	4274	+	_, err := svc.buildValidatedImageRef(context.Background(), "docker.io:5000/app:latest")
4275	4275		require.NoError(t, err)
4276	4276
4277		-	_, err = svc.buildValidatedImageRef("docker.io:5001/app:latest")
	4277	+	_, err = svc.buildValidatedImageRef(context.Background(), "docker.io:5001/app:latest")
4278	4278		require.Error(t, err)
4279	4279		}
4280	4280


@@ -4202,15 +4202,15 @@ func TestService_BuildValidatedImageRef_RegistryPolicy(t *testing.T) {
4202		AllowedRegistries: []string{"docker.io"},	4202		AllowedRegistries: []string{"docker.io"},
4203		}, nil)	4203		}, nil)
4204			4204
4205	-	ref, err := svc.buildValidatedImageRef("myapp:latest")	4205	+	ref, err := svc.buildValidatedImageRef(context.Background(), "myapp:latest")
4206		require.NoError(t, err)	4206		require.NoError(t, err)
4207		assert.Equal(t, "registry.example.com/myapp:latest", ref)	4207		assert.Equal(t, "registry.example.com/myapp:latest", ref)
4208			4208
4209	-	ref, err = svc.buildValidatedImageRef("registry.example.com/myapp:latest")	4209	+	ref, err = svc.buildValidatedImageRef(context.Background(), "registry.example.com/myapp:latest")
4210		require.NoError(t, err)	4210		require.NoError(t, err)
4211		assert.Equal(t, "registry.example.com/myapp:latest", ref)	4211		assert.Equal(t, "registry.example.com/myapp:latest", ref)
4212			4212
4213	-	ref, err = svc.buildValidatedImageRef("docker.io/library/nginx:latest")	4213	+	ref, err = svc.buildValidatedImageRef(context.Background(), "docker.io/library/nginx:latest")
4214		require.NoError(t, err)	4214		require.NoError(t, err)
4215		assert.Equal(t, "docker.io/library/nginx:latest", ref)	4215		assert.Equal(t, "docker.io/library/nginx:latest", ref)
4216			4216

@@ -4222,7 +4222,7 @@ func TestService_BuildValidatedImageRef_RegistryPolicy(t *testing.T) {
4222		"169.254.169.254/app:latest",	4222		"169.254.169.254/app:latest",
4223		} {	4223		} {
4224		t.Run(image, func(t *testing.T) {	4224		t.Run(image, func(t *testing.T) {
4225	-	_, err := svc.buildValidatedImageRef(image)	4225	+	_, err := svc.buildValidatedImageRef(context.Background(), image)
4226		require.Error(t, err)	4226		require.Error(t, err)
4227		})	4227		})
4228		}	4228		}

@@ -4231,7 +4231,7 @@ func TestService_BuildValidatedImageRef_RegistryPolicy(t *testing.T) {
4231		func TestService_BuildValidatedImageRef_RejectsExternalRegistryWhenAllowlistEmpty(t *testing.T) {	4231		func TestService_BuildValidatedImageRef_RejectsExternalRegistryWhenAllowlistEmpty(t *testing.T) {
4232		svc := NewService(nil, nil, nil, nil, Config{}, nil)	4232		svc := NewService(nil, nil, nil, nil, Config{}, nil)
4233			4233
4234	-	_, err := svc.buildValidatedImageRef("ghcr.io/acme/app:latest")	4234	+	_, err := svc.buildValidatedImageRef(context.Background(), "ghcr.io/acme/app:latest")
4235		require.Error(t, err)	4235		require.Error(t, err)
4236		assert.Contains(t, err.Error(), "images.allowed_registries")	4236		assert.Contains(t, err.Error(), "images.allowed_registries")
4237			4237

@@ -4248,33 +4248,33 @@ func TestService_BuildValidatedImageRef_RequireDigestOnlyForExternalAllowedRegis
4248		AllowedRegistries: []string{"docker.io"},	4248		AllowedRegistries: []string{"docker.io"},
4249		}, nil)	4249		}, nil)
4250			4250
4251	-	_, err := svc.buildValidatedImageRef("docker.io/library/nginx:latest")	4251	+	_, err := svc.buildValidatedImageRef(context.Background(), "docker.io/library/nginx:latest")
4252		require.Error(t, err)	4252		require.Error(t, err)
4253			4253
4254		err = svc.validateImagePullRef(context.Background(), "nginx:latest")	4254		err = svc.validateImagePullRef(context.Background(), "nginx:latest")
4255		require.Error(t, err)	4255		require.Error(t, err)
4256			4256
4257	-	_, err = svc.buildValidatedImageRef("docker.io/library/nginx@sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa")	4257	+	_, err = svc.buildValidatedImageRef(context.Background(), "docker.io/library/nginx@sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa")
4258		require.NoError(t, err)	4258		require.NoError(t, err)
4259			4259
4260	-	_, err = svc.buildValidatedImageRef("docker.io/library/nginx@sha256:not-a-digest")	4260	+	_, err = svc.buildValidatedImageRef(context.Background(), "docker.io/library/nginx@sha256:not-a-digest")
4261		require.Error(t, err)	4261		require.Error(t, err)
4262			4262
4263	-	ref, err := svc.buildValidatedImageRef("myapp:latest")	4263	+	ref, err := svc.buildValidatedImageRef(context.Background(), "myapp:latest")
4264		require.NoError(t, err)	4264		require.NoError(t, err)
4265		assert.Equal(t, "registry.example.com/myapp:latest", ref)	4265		assert.Equal(t, "registry.example.com/myapp:latest", ref)
4266			4266
4267	-	_, err = svc.buildValidatedImageRef("registry.example.com/myapp:latest")	4267	+	_, err = svc.buildValidatedImageRef(context.Background(), "registry.example.com/myapp:latest")
4268		require.NoError(t, err)	4268		require.NoError(t, err)
4269		}	4269		}
4270			4270
4271		func TestService_BuildValidatedImageRef_AllowedRegistryMatchesPort(t *testing.T) {	4271		func TestService_BuildValidatedImageRef_AllowedRegistryMatchesPort(t *testing.T) {
4272		svc := NewService(nil, nil, nil, nil, Config{AllowedRegistries: []string{"docker.io:5000"}}, nil)	4272		svc := NewService(nil, nil, nil, nil, Config{AllowedRegistries: []string{"docker.io:5000"}}, nil)
4273			4273
4274	-	_, err := svc.buildValidatedImageRef("docker.io:5000/app:latest")	4274	+	_, err := svc.buildValidatedImageRef(context.Background(), "docker.io:5000/app:latest")
4275		require.NoError(t, err)	4275		require.NoError(t, err)
4276			4276
4277	-	_, err = svc.buildValidatedImageRef("docker.io:5001/app:latest")	4277	+	_, err = svc.buildValidatedImageRef(context.Background(), "docker.io:5001/app:latest")
4278		require.Error(t, err)	4278		require.Error(t, err)
4279		}	4279		}
4280			4280