Use business campaign rules instead of status errors

Introduce accessreview.Campaign with draft/deletable predicates and
operation-specific client errors. Drop errUnlessDraftCampaign and
status-to-sentinel switches in the service layer.

Signed-off-by: Cursor Agent <cursoragent@cursor.com>

Co-authored-by: Bryan FRIMIN <bryan@frimin.fr>

pkg/accessreview/campaign.go

@@ -0,0 +1,59 @@
+// Copyright (c) 2026 Probo Inc <hello@probo.com>.
+//
+// Permission is hereby granted, free of charge, to any person obtaining a copy
+// of this software and associated documentation files (the "Software"), to deal
+// in the Software without restriction, including without limitation the rights
+// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+// copies of the Software, and to permit persons to whom the Software is
+// furnished to do so, subject to the following conditions:
+//
+// The above copyright notice and this permission notice shall be included in
+// all copies or substantial portions of the Software.
+//
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+// SOFTWARE.
+
+package accessreview
+
+import (
+	"go.probo.inc/probo/pkg/coredata"
+	"go.probo.inc/probo/pkg/gid"
+)
+
+// Campaign is the business view of a loaded access review campaign record.
+type Campaign struct {
+	ID     gid.GID
+	status coredata.AccessReviewCampaignStatus
+}
+
+func NewCampaignFromCoredata(record *coredata.AccessReviewCampaign) Campaign {
+	return Campaign{
+		ID:     record.ID,
+		status: record.Status,
+	}
+}
+
+func (c Campaign) IsDraft() bool {
+	return c.status == coredata.AccessReviewCampaignStatusDraft
+}
+
+func (c Campaign) IsDeletable() bool {
+	return c.IsDraft() || c.status == coredata.AccessReviewCampaignStatusCancelled
+}
+
+func (c Campaign) IsPendingActions() bool {
+	return c.status == coredata.AccessReviewCampaignStatusPendingActions
+}
+
+func (c Campaign) IsCompleted() bool {
+	return c.status == coredata.AccessReviewCampaignStatusCompleted
+}
+
+func (c Campaign) IsCancelled() bool {
+	return c.status == coredata.AccessReviewCampaignStatusCancelled
+}

pkg/accessreview/campaign_service.go

@@ -158,8 +158,9 @@ func (s *Service) UpdateCampaign(
 				return fmt.Errorf("cannot load campaign: %w", err)
 			}
 
-			if err := errUnlessDraftCampaign(campaign); err != nil {
+			biz := NewCampaignFromCoredata(campaign)
-				return err
+			if !biz.IsDraft() {
+				return NewCampaignNotDraftError(biz.ID)
 			}
 
 			if req.Name != nil && *req.Name != nil {
@@ -209,18 +210,9 @@ func (s *Service) DeleteCampaign(
 				return fmt.Errorf("cannot load campaign: %w", err)
 			}
 
-			if campaign.Status != coredata.AccessReviewCampaignStatusDraft &&
+			biz := NewCampaignFromCoredata(campaign)
-				campaign.Status != coredata.AccessReviewCampaignStatusCancelled {
+			if !biz.IsDeletable() {
-				switch campaign.Status {
+				return NewCampaignNotDeletableError(biz.ID)
-				case coredata.AccessReviewCampaignStatusInProgress:
-					return NewCampaignInProgressError(campaign.ID)
-				case coredata.AccessReviewCampaignStatusPendingActions:
-					return NewCampaignPendingActionsError(campaign.ID)
-				case coredata.AccessReviewCampaignStatusCompleted:
-					return NewCampaignCompletedError(campaign.ID)
-				default:
-					return NewCampaignInProgressError(campaign.ID)
-				}
 			}
 
 			if err := campaign.Delete(ctx, conn, scope); err != nil {
@@ -250,8 +242,9 @@ func (s *Service) AddCampaignSource(
 				return fmt.Errorf("cannot load campaign: %w", err)
 			}
 
-			if err := errUnlessDraftCampaign(campaign); err != nil {
+			biz := NewCampaignFromCoredata(campaign)
-				return err
+			if !biz.IsDraft() {
+				return NewCampaignNotDraftError(biz.ID)
 			}
 			if err := source.LoadByID(ctx, conn, scope, req.AccessReviewSourceID); err != nil {
 				if errors.Is(err, coredata.ErrResourceNotFound) {
@@ -297,8 +290,9 @@ func (s *Service) RemoveCampaignSource(
 				return fmt.Errorf("cannot load campaign: %w", err)
 			}
 
-			if err := errUnlessDraftCampaign(campaign); err != nil {
+			biz := NewCampaignFromCoredata(campaign)
-				return err
+			if !biz.IsDraft() {
+				return NewCampaignNotDraftError(biz.ID)
 			}
 
 			campaignSource := &coredata.AccessReviewCampaignSource{}
@@ -406,8 +400,9 @@ func (s *Service) StartCampaign(
 				return fmt.Errorf("cannot load campaign: %w", err)
 			}
 
-			if err := errUnlessDraftCampaign(campaign); err != nil {
+			biz := NewCampaignFromCoredata(campaign)
-				return err
+			if !biz.IsDraft() {
+				return NewCampaignNotDraftError(biz.ID)
 			}
 
 			var campaignSources coredata.AccessReviewCampaignSources
@@ -460,19 +455,9 @@ func (s *Service) CloseCampaign(
 				return fmt.Errorf("cannot load campaign: %w", err)
 			}
 
-			if campaign.Status != coredata.AccessReviewCampaignStatusPendingActions {
+			biz := NewCampaignFromCoredata(campaign)
-				switch campaign.Status {
+			if !biz.IsPendingActions() {
-				case coredata.AccessReviewCampaignStatusInProgress:
+				return NewCampaignNotPendingActionsError(biz.ID)
-					return NewCampaignInProgressError(campaign.ID)
-				case coredata.AccessReviewCampaignStatusCompleted:
-					return NewCampaignCompletedError(campaign.ID)
-				case coredata.AccessReviewCampaignStatusCancelled:
-					return NewCampaignCancelledError(campaign.ID)
-				case coredata.AccessReviewCampaignStatusDraft:
-					return NewCampaignInProgressError(campaign.ID)
-				default:
-					return NewCampaignInProgressError(campaign.ID)
-				}
 			}
 
 			entries := coredata.AccessReviewEntries{}
@@ -596,12 +581,13 @@ func (s *Service) CancelCampaign(
 				return fmt.Errorf("cannot load campaign: %w", err)
 			}
 
-			if campaign.Status == coredata.AccessReviewCampaignStatusCompleted {
+			biz := NewCampaignFromCoredata(campaign)
-				return NewCampaignCompletedError(campaign.ID)
+			if biz.IsCompleted() {
+				return NewCampaignCompletedError(biz.ID)
 			}
 
-			if campaign.Status == coredata.AccessReviewCampaignStatusCancelled {
+			if biz.IsCancelled() {
-				return NewCampaignCancelledError(campaign.ID)
+				return NewCampaignCancelledError(biz.ID)
 			}
 
 			now := time.Now()
@@ -752,22 +738,3 @@ func (s *Service) CountCampaignsForOrganizationID(
 
 	return count, nil
 }
-
-func errUnlessDraftCampaign(campaign *coredata.AccessReviewCampaign) error {
-	if campaign.Status == coredata.AccessReviewCampaignStatusDraft {
-		return nil
-	}
-
-	switch campaign.Status {
-	case coredata.AccessReviewCampaignStatusInProgress:
-		return NewCampaignInProgressError(campaign.ID)
-	case coredata.AccessReviewCampaignStatusPendingActions:
-		return NewCampaignPendingActionsError(campaign.ID)
-	case coredata.AccessReviewCampaignStatusCompleted:
-		return NewCampaignCompletedError(campaign.ID)
-	case coredata.AccessReviewCampaignStatusCancelled:
-		return NewCampaignCancelledError(campaign.ID)
-	default:
-		return NewCampaignInProgressError(campaign.ID)
-	}
-}

pkg/accessreview/errors.go

@@ -28,11 +28,12 @@ import (
 )
 
 var (
-	ErrCampaignMissingSources = errors.New("access review campaign missing scope sources")
+	ErrCampaignMissingSources    = errors.New("access review campaign missing scope sources")
-	ErrCampaignInProgress     = errors.New("access review campaign in progress")
+	ErrCampaignNotDraft          = errors.New("access review campaign not draft")
-	ErrCampaignPendingActions = errors.New("access review campaign pending actions")
+	ErrCampaignNotDeletable      = errors.New("access review campaign not deletable")
-	ErrCampaignCompleted      = errors.New("access review campaign completed")
+	ErrCampaignNotPendingActions = errors.New("access review campaign not pending actions")
-	ErrCampaignCancelled      = errors.New("access review campaign cancelled")
+	ErrCampaignCompleted         = errors.New("access review campaign completed")
+	ErrCampaignCancelled         = errors.New("access review campaign cancelled")
 )
 
 type (
@@ -40,11 +41,15 @@ type (
 		CampaignID gid.GID
 	}
 
-	CampaignInProgressError struct {
+	CampaignNotDraftError struct {
 		CampaignID gid.GID
 	}
 
-	CampaignPendingActionsError struct {
+	CampaignNotDeletableError struct {
+		CampaignID gid.GID
+	}
+
+	CampaignNotPendingActionsError struct {
 		CampaignID gid.GID
 	}
 
@@ -72,28 +77,46 @@ func (e *CampaignMissingSourcesError) Is(target error) bool {
 	return target == ErrCampaignMissingSources
 }
 
-func NewCampaignInProgressError(campaignID gid.GID) error {
+func NewCampaignNotDraftError(campaignID gid.GID) error {
-	return &CampaignInProgressError{CampaignID: campaignID}
+	return &CampaignNotDraftError{CampaignID: campaignID}
 }
 
-func (e *CampaignInProgressError) Error() string {
+func (e *CampaignNotDraftError) Error() string {
-	return fmt.Sprintf("access review campaign %q is in progress", e.CampaignID)
+	return fmt.Sprintf("access review campaign %q is not in draft", e.CampaignID)
 }
 
-func (e *CampaignInProgressError) Is(target error) bool {
+func (e *CampaignNotDraftError) Is(target error) bool {
-	return target == ErrCampaignInProgress
+	return target == ErrCampaignNotDraft
 }
 
-func NewCampaignPendingActionsError(campaignID gid.GID) error {
+func NewCampaignNotDeletableError(campaignID gid.GID) error {
-	return &CampaignPendingActionsError{CampaignID: campaignID}
+	return &CampaignNotDeletableError{CampaignID: campaignID}
 }
 
-func (e *CampaignPendingActionsError) Error() string {
+func (e *CampaignNotDeletableError) Error() string {
-	return fmt.Sprintf("access review campaign %q is pending actions", e.CampaignID)
+	return fmt.Sprintf(
+		"access review campaign %q cannot be deleted unless it is draft or cancelled",
+		e.CampaignID,
+	)
 }
 
-func (e *CampaignPendingActionsError) Is(target error) bool {
+func (e *CampaignNotDeletableError) Is(target error) bool {
-	return target == ErrCampaignPendingActions
+	return target == ErrCampaignNotDeletable
+}
+
+func NewCampaignNotPendingActionsError(campaignID gid.GID) error {
+	return &CampaignNotPendingActionsError{CampaignID: campaignID}
+}
+
+func (e *CampaignNotPendingActionsError) Error() string {
+	return fmt.Sprintf(
+		"access review campaign %q cannot be closed unless it is pending actions",
+		e.CampaignID,
+	)
+}
+
+func (e *CampaignNotPendingActionsError) Is(target error) bool {
+	return target == ErrCampaignNotPendingActions
 }
 
 func NewCampaignCompletedError(campaignID gid.GID) error {
@@ -101,7 +124,7 @@ func NewCampaignCompletedError(campaignID gid.GID) error {
 }
 
 func (e *CampaignCompletedError) Error() string {
-	return fmt.Sprintf("access review campaign %q is completed", e.CampaignID)
+	return fmt.Sprintf("access review campaign %q is already completed", e.CampaignID)
 }
 
 func (e *CampaignCompletedError) Is(target error) bool {
@@ -113,7 +136,7 @@ func NewCampaignCancelledError(campaignID gid.GID) error {
 }
 
 func (e *CampaignCancelledError) Error() string {
-	return fmt.Sprintf("access review campaign %q is cancelled", e.CampaignID)
+	return fmt.Sprintf("access review campaign %q is already cancelled", e.CampaignID)
 }
 
 func (e *CampaignCancelledError) Is(target error) bool {

pkg/accessreview/errors_test.go

@@ -52,27 +52,39 @@ func TestCampaignClientErrors(t *testing.T) {
 			sentinel: accessreview.ErrCampaignMissingSources,
 		},
 		{
-			name:     "in progress",
+			name:     "not draft",
-			err:      accessreview.NewCampaignInProgressError(campaignID),
+			err:      accessreview.NewCampaignNotDraftError(campaignID),
-			wantText: fmt.Sprintf("access review campaign %q is in progress", campaignID),
+			wantText: fmt.Sprintf("access review campaign %q is not in draft", campaignID),
-			sentinel: accessreview.ErrCampaignInProgress,
+			sentinel: accessreview.ErrCampaignNotDraft,
 		},
 		{
-			name:     "pending actions",
+			name: "not deletable",
-			err:      accessreview.NewCampaignPendingActionsError(campaignID),
+			err:  accessreview.NewCampaignNotDeletableError(campaignID),
-			wantText: fmt.Sprintf("access review campaign %q is pending actions", campaignID),
+			wantText: fmt.Sprintf(
-			sentinel: accessreview.ErrCampaignPendingActions,
+				"access review campaign %q cannot be deleted unless it is draft or cancelled",
+				campaignID,
+			),
+			sentinel: accessreview.ErrCampaignNotDeletable,
+		},
+		{
+			name: "not pending actions",
+			err:  accessreview.NewCampaignNotPendingActionsError(campaignID),
+			wantText: fmt.Sprintf(
+				"access review campaign %q cannot be closed unless it is pending actions",
+				campaignID,
+			),
+			sentinel: accessreview.ErrCampaignNotPendingActions,
 		},
 		{
 			name:     "completed",
 			err:      accessreview.NewCampaignCompletedError(campaignID),
-			wantText: fmt.Sprintf("access review campaign %q is completed", campaignID),
+			wantText: fmt.Sprintf("access review campaign %q is already completed", campaignID),
 			sentinel: accessreview.ErrCampaignCompleted,
 		},
 		{
 			name:     "cancelled",
 			err:      accessreview.NewCampaignCancelledError(campaignID),
-			wantText: fmt.Sprintf("access review campaign %q is cancelled", campaignID),
+			wantText: fmt.Sprintf("access review campaign %q is already cancelled", campaignID),
 			sentinel: accessreview.ErrCampaignCancelled,
 		},
 	}

pkg/server/api/console/v1/access_review_campaign_resolvers.go

@@ -761,13 +761,7 @@ func (r *mutationResolver) UpdateAccessReviewCampaign(ctx context.Context, input
 			return nil, gqlutils.NotFound(ctx, err)
 		}
 
-		if errorx.AnyOf(
+		if errorx.AnyOf(err, accessreview.ErrCampaignNotDraft) {
-			err,
-			accessreview.ErrCampaignInProgress,
-			accessreview.ErrCampaignPendingActions,
-			accessreview.ErrCampaignCompleted,
-			accessreview.ErrCampaignCancelled,
-		) {
 			return nil, gqlutils.Invalid(ctx, err)
 		}
 
@@ -793,6 +787,10 @@ func (r *mutationResolver) DeleteAccessReviewCampaign(ctx context.Context, input
 			return nil, gqlutils.NotFound(ctx, err)
 		}
 
+		if errors.Is(err, accessreview.ErrCampaignNotDeletable) {
+			return nil, gqlutils.Invalid(ctx, err)
+		}
+
 		r.logger.ErrorCtx(ctx, "cannot delete access review campaign", log.Error(err))
 
 		return nil, gqlutils.Internal(ctx)
@@ -815,10 +813,7 @@ func (r *mutationResolver) StartAccessReviewCampaign(ctx context.Context, input
 		if errorx.AnyOf(
 			err,
 			accessreview.ErrCampaignMissingSources,
-			accessreview.ErrCampaignInProgress,
+			accessreview.ErrCampaignNotDraft,
-			accessreview.ErrCampaignPendingActions,
-			accessreview.ErrCampaignCompleted,
-			accessreview.ErrCampaignCancelled,
 		) {
 			return nil, gqlutils.Invalid(ctx, err)
 		}
@@ -842,6 +837,10 @@ func (r *mutationResolver) CloseAccessReviewCampaign(ctx context.Context, input
 
 	campaign, err := r.accessReview.CloseCampaign(ctx, scope, input.AccessReviewCampaignID)
 	if err != nil {
+		if errors.Is(err, accessreview.ErrCampaignNotPendingActions) {
+			return nil, gqlutils.Invalid(ctx, err)
+		}
+
 		r.logger.ErrorCtx(ctx, "cannot close access review campaign", log.Error(err))
 
 		return nil, gqlutils.Internal(ctx)
@@ -895,13 +894,7 @@ func (r *mutationResolver) AddAccessReviewCampaignSource(ctx context.Context, in
 			return nil, gqlutils.NotFound(ctx, err)
 		}
 
-		if errorx.AnyOf(
+		if errors.Is(err, accessreview.ErrCampaignNotDraft) {
-			err,
-			accessreview.ErrCampaignInProgress,
-			accessreview.ErrCampaignPendingActions,
-			accessreview.ErrCampaignCompleted,
-			accessreview.ErrCampaignCancelled,
-		) {
 			return nil, gqlutils.Invalid(ctx, err)
 		}
 
@@ -931,6 +924,10 @@ func (r *mutationResolver) RemoveAccessReviewCampaignSource(ctx context.Context,
 		},
 	)
 	if err != nil {
+		if errors.Is(err, accessreview.ErrCampaignNotDraft) {
+			return nil, gqlutils.Invalid(ctx, err)
+		}
+
 		r.logger.ErrorCtx(ctx, "cannot remove scope source from access review campaign", log.Error(err))
 
 		return nil, gqlutils.Internal(ctx)