From 15df570ce88d5f6c8887753dad5be60145d01cbc Mon Sep 17 00:00:00 2001
From: Bryan Frimin <bryan@probo.com>
Date: Fri, 24 Jul 2026 22:25:29 +0000
Subject: [PATCH] Remove unused SAML auth error code mapper

All SAML assertion failures now share authentication_failed, so
the dedicated mapper and its tests are no longer needed.

Signed-off-by: Cursor Agent <cursoragent@cursor.com>

Co-authored-by: Bryan FRIMIN <bryan@frimin.fr>
---
 pkg/server/api/connect/v1/auth_error.go      | 39 ---------
 pkg/server/api/connect/v1/auth_error_test.go | 87 --------------------
 2 files changed, 126 deletions(-)

diff --git a/pkg/server/api/connect/v1/auth_error.go b/pkg/server/api/connect/v1/auth_error.go
index 4122946ec..581607a84 100644
--- a/pkg/server/api/connect/v1/auth_error.go
+++ b/pkg/server/api/connect/v1/auth_error.go
@@ -21,11 +21,8 @@
 package connect_v1
 
 import (
-	"errors"
 	"net/http"
 	"net/url"
-
-	"go.probo.inc/probo/pkg/iam/saml"
 )
 
 const (
@@ -49,39 +46,3 @@ func redirectAuthError(w http.ResponseWriter, r *http.Request, code string) {
 
 	http.Redirect(w, r, redirectURL.String(), http.StatusFound)
 }
-
-func authErrorCodeFromSAML(err error) (string, bool) {
-	if _, ok := errors.AsType[*saml.ErrSAMLDisabled](err); ok {
-		return authErrorAuthenticationFailed, true
-	}
-
-	if _, ok := errors.AsType[*saml.ErrSAMLConfigurationNotFound](err); ok {
-		return authErrorAuthenticationFailed, true
-	}
-
-	if _, ok := errors.AsType[*saml.ErrEmailDomainMismatch](err); ok {
-		return authErrorAuthenticationFailed, true
-	}
-
-	if _, ok := errors.AsType[*saml.ErrSAMLAutoSignupDisabled](err); ok {
-		return authErrorAuthenticationFailed, true
-	}
-
-	if _, ok := errors.AsType[*saml.ErrUserInactive](err); ok {
-		return authErrorAuthenticationFailed, true
-	}
-
-	if _, ok := errors.AsType[*saml.ErrSAMLSubjectAlreadyInUse](err); ok {
-		return authErrorAuthenticationFailed, true
-	}
-
-	if _, ok := errors.AsType[*saml.ErrInvalidAssertion](err); ok {
-		return authErrorAuthenticationFailed, true
-	}
-
-	if _, ok := errors.AsType[*saml.ErrReplayAttackDetected](err); ok {
-		return authErrorAuthenticationFailed, true
-	}
-
-	return "", false
-}
diff --git a/pkg/server/api/connect/v1/auth_error_test.go b/pkg/server/api/connect/v1/auth_error_test.go
index a444c4685..3329f286b 100644
--- a/pkg/server/api/connect/v1/auth_error_test.go
+++ b/pkg/server/api/connect/v1/auth_error_test.go
@@ -21,17 +21,12 @@
 package connect_v1
 
 import (
-	"errors"
 	"net/http"
 	"net/http/httptest"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
-	"go.probo.inc/probo/pkg/coredata"
-	"go.probo.inc/probo/pkg/gid"
-	"go.probo.inc/probo/pkg/iam/saml"
-	"go.probo.inc/probo/pkg/mail"
 )
 
 func TestRedirectAuthError(t *testing.T) {
@@ -48,85 +43,3 @@ func TestRedirectAuthError(t *testing.T) {
 	assert.Equal(t, "/auth/error", location.Path)
 	assert.Equal(t, authErrorPersonalAccountNotAllowed, location.Query().Get("error"))
 }
-
-func TestAuthErrorCodeFromSAML(t *testing.T) {
-	t.Parallel()
-
-	configID := gid.New(gid.NewTenantID(), coredata.SAMLConfigurationEntityType)
-	email, err := mail.ParseAddr("user@example.com")
-	require.NoError(t, err)
-
-	tests := []struct {
-		name string
-		err  error
-		code string
-		ok   bool
-	}{
-		{
-			name: "disabled stays generic",
-			err:  saml.NewSAMLDisabledError(),
-			code: authErrorAuthenticationFailed,
-			ok:   true,
-		},
-		{
-			name: "configuration not found stays generic",
-			err:  saml.NewSAMLConfigurationNotFoundError(configID),
-			code: authErrorAuthenticationFailed,
-			ok:   true,
-		},
-		{
-			name: "email domain mismatch stays generic",
-			err:  saml.NewEmailDomainMismatchError(email, "acme.com"),
-			code: authErrorAuthenticationFailed,
-			ok:   true,
-		},
-		{
-			name: "auto signup disabled stays generic",
-			err:  saml.NewSAMLAutoSignupDisabledError(configID),
-			code: authErrorAuthenticationFailed,
-			ok:   true,
-		},
-		{
-			name: "user inactive stays generic",
-			err:  saml.NewUserInactiveError(configID),
-			code: authErrorAuthenticationFailed,
-			ok:   true,
-		},
-		{
-			name: "subject already in use stays generic",
-			err:  saml.NewSAMLSubjectAlreadyInUseError("assertion-1"),
-			code: authErrorAuthenticationFailed,
-			ok:   true,
-		},
-		{
-			name: "invalid assertion stays generic",
-			err:  saml.NewInvalidAssertionError("assertion-1", errors.New("bad signature")),
-			code: authErrorAuthenticationFailed,
-			ok:   true,
-		},
-		{
-			name: "replay stays generic",
-			err:  saml.NewReplayAttackDetectedError("assertion-1"),
-			code: authErrorAuthenticationFailed,
-			ok:   true,
-		},
-		{
-			name: "unknown error",
-			err:  errors.New("boom"),
-			ok:   false,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(
-			tt.name,
-			func(t *testing.T) {
-				t.Parallel()
-
-				code, ok := authErrorCodeFromSAML(tt.err)
-				assert.Equal(t, tt.ok, ok)
-				assert.Equal(t, tt.code, code)
-			},
-		)
-	}
-}