Fix failed to to cannot

Signed-off-by: Bryan Frimin <bryan@getprobo.com>

packages/emails/emails.go

@@ -174,13 +174,13 @@ func RenderTrustCenterAccess(hostname, fullName, organizationName, accessUrl str
 func renderEmail(textTemplate *texttemplate.Template, htmlTemplate *htmltemplate.Template, data any) (textBody string, htmlBody *string, err error) {
 	var textBuf bytes.Buffer
 	if err := textTemplate.Execute(&textBuf, data); err != nil {
-		return "", nil, fmt.Errorf("failed to execute text template: %w", err)
+		return "", nil, fmt.Errorf("cannot execute text template: %w", err)
 	}
 	textBody = textBuf.String()
 
 	var htmlBuf bytes.Buffer
 	if err := htmlTemplate.Execute(&htmlBuf, data); err != nil {
-		return "", nil, fmt.Errorf("failed to execute html template: %w", err)
+		return "", nil, fmt.Errorf("cannot execute html template: %w", err)
 	}
 	htmlBodyStr := htmlBuf.String()
 	htmlBody = &htmlBodyStr

pkg/agents/changelog_generator.go

@@ -60,7 +60,7 @@ func (a *Agent) GenerateChangelog(ctx context.Context, oldContent string, newCon
 		Temperature: param.NewOpt(a.cfg.Temperature),
 	})
 	if err != nil {
-		return nil, fmt.Errorf("failed to parse vendor info: %w", err)
+		return nil, fmt.Errorf("cannot parse vendor info: %w", err)
 	}
 
 	if len(chatCompletion.Choices) == 0 {

pkg/agents/vendor_assessment.go

@@ -133,7 +133,7 @@ func (a *Agent) AssessVendor(ctx context.Context, websiteURL string) (*vendorInf
 		Temperature: param.NewOpt(a.cfg.Temperature),
 	})
 	if err != nil {
-		return nil, fmt.Errorf("failed to parse vendor info: %w", err)
+		return nil, fmt.Errorf("cannot parse vendor info: %w", err)
 	}
 
 	if len(chatCompletion.Choices) == 0 {
@@ -143,7 +143,7 @@ func (a *Agent) AssessVendor(ctx context.Context, websiteURL string) (*vendorInf
 	var vendorInfo vendorInfo
 	err = json.Unmarshal([]byte(chatCompletion.Choices[0].Message.Content), &vendorInfo)
 	if err != nil {
-		return nil, fmt.Errorf("failed to parse vendor info: %w", err)
+		return nil, fmt.Errorf("cannot parse vendor info: %w", err)
 	}
 
 	return &vendorInfo, nil

pkg/auth/saml_config_validator.go

@@ -111,7 +111,7 @@ func validateCertificate(certPEM string) error {
 
 	block, _ := pem.Decode([]byte(certPEM))
 	if block == nil {
-		return fmt.Errorf("failed to parse certificate PEM")
+		return fmt.Errorf("cannot parse certificate PEM")
 	}
 
 	if block.Type != "CERTIFICATE" {
@@ -120,7 +120,7 @@ func validateCertificate(certPEM string) error {
 
 	_, err := x509.ParseCertificate(block.Bytes)
 	if err != nil {
-		return fmt.Errorf("failed to parse X.509 certificate: %w", err)
+		return fmt.Errorf("cannot parse X.509 certificate: %w", err)
 	}
 
 	return nil

pkg/auth/saml_mapper.go

@@ -114,7 +114,7 @@ func ExtractUserAttributes(
 		if assertion.Subject != nil && assertion.Subject.NameID != nil {
 			email = assertion.Subject.NameID.Value
 		} else {
-			return "", "", "", fmt.Errorf("failed to extract email: %w", err)
+			return "", "", "", fmt.Errorf("cannot extract email: %w", err)
 		}
 	}
 

pkg/auth/saml_metadata.go

@@ -84,7 +84,7 @@ func GenerateServiceProviderMetadata(
 
 	xmlBytes, err := xml.MarshalIndent(metadata, "", "  ")
 	if err != nil {
-		return nil, fmt.Errorf("failed to marshal SP metadata to XML: %w", err)
+		return nil, fmt.Errorf("cannot marshal SP metadata to XML: %w", err)
 	}
 
 	return xmlBytes, nil
@@ -93,12 +93,12 @@ func GenerateServiceProviderMetadata(
 func ParseIdPCertificate(certPEM string) (*x509.Certificate, error) {
 	block, _ := pem.Decode([]byte(certPEM))
 	if block == nil {
-		return nil, fmt.Errorf("failed to decode PEM block from IdP certificate")
+		return nil, fmt.Errorf("cannot decode PEM block from IdP certificate")
 	}
 
 	cert, err := x509.ParseCertificate(block.Bytes)
 	if err != nil {
-		return nil, fmt.Errorf("failed to parse X.509 certificate: %w", err)
+		return nil, fmt.Errorf("cannot parse X.509 certificate: %w", err)
 	}
 
 	return cert, nil
@@ -114,7 +114,7 @@ type IdPMetadata struct {
 func ParseIdPMetadata(metadataXML string) (*IdPMetadata, error) {
 	var entityDescriptor saml.EntityDescriptor
 	if err := xml.Unmarshal([]byte(metadataXML), &entityDescriptor); err != nil {
-		return nil, fmt.Errorf("failed to parse IdP metadata XML: %w", err)
+		return nil, fmt.Errorf("cannot parse IdP metadata XML: %w", err)
 	}
 
 	if len(entityDescriptor.IDPSSODescriptors) == 0 {
@@ -144,7 +144,7 @@ func ParseIdPMetadata(metadataXML string) (*IdPMetadata, error) {
 				certData := keyDescriptor.KeyInfo.X509Data.X509Certificates[0].Data
 				certDER, err := base64.StdEncoding.DecodeString(certData)
 				if err != nil {
-					return nil, fmt.Errorf("failed to decode certificate: %w", err)
+					return nil, fmt.Errorf("cannot decode certificate: %w", err)
 				}
 				certPEM = string(pem.EncodeToMemory(&pem.Block{
 					Type:  "CERTIFICATE",
@@ -168,13 +168,13 @@ func ParseIdPMetadata(metadataXML string) (*IdPMetadata, error) {
 func GenerateSelfSignedCertificate(entityID string) (*x509.Certificate, *rsa.PrivateKey, error) {
 	privateKey, err := rsa.GenerateKey(rand.Reader, 2048)
 	if err != nil {
-		return nil, nil, fmt.Errorf("failed to generate RSA private key: %w", err)
+		return nil, nil, fmt.Errorf("cannot generate RSA private key: %w", err)
 	}
 
 	serialNumberLimit := new(big.Int).Lsh(big.NewInt(1), 128)
 	serialNumber, err := rand.Int(rand.Reader, serialNumberLimit)
 	if err != nil {
-		return nil, nil, fmt.Errorf("failed to generate serial number: %w", err)
+		return nil, nil, fmt.Errorf("cannot generate serial number: %w", err)
 	}
 
 	template := x509.Certificate{
@@ -192,12 +192,12 @@ func GenerateSelfSignedCertificate(entityID string) (*x509.Certificate, *rsa.Pri
 
 	certDER, err := x509.CreateCertificate(rand.Reader, &template, &template, &privateKey.PublicKey, privateKey)
 	if err != nil {
-		return nil, nil, fmt.Errorf("failed to create certificate: %w", err)
+		return nil, nil, fmt.Errorf("cannot create certificate: %w", err)
 	}
 
 	cert, err := x509.ParseCertificate(certDER)
 	if err != nil {
-		return nil, nil, fmt.Errorf("failed to parse created certificate: %w", err)
+		return nil, nil, fmt.Errorf("cannot parse created certificate: %w", err)
 	}
 
 	return cert, privateKey, nil

pkg/auth/saml_validator.go

@@ -36,7 +36,7 @@ func PreventReplayAttack(
 	var assertion coredata.SAMLAssertion
 	exists, err := assertion.CheckExists(ctx, conn, assertionID)
 	if err != nil {
-		return fmt.Errorf("failed to check assertion ID: %w", err)
+		return fmt.Errorf("cannot check assertion ID: %w", err)
 	}
 
 	if exists {
@@ -52,7 +52,7 @@ func PreventReplayAttack(
 	}
 
 	if err := assertion.Insert(ctx, conn, scope); err != nil {
-		return fmt.Errorf("failed to store assertion ID: %w", err)
+		return fmt.Errorf("cannot store assertion ID: %w", err)
 	}
 
 	return nil

pkg/authz/service.go

@@ -98,7 +98,7 @@ func (s *Service) GetAllUserOrganizations(
 	err := s.pg.WithConn(ctx, func(conn pg.Conn) error {
 		var organizationList coredata.Organizations
 		if err := organizationList.LoadAllByUserID(ctx, conn, userID); err != nil {
-			return fmt.Errorf("failed to load user organizations: %w", err)
+			return fmt.Errorf("cannot load user organizations: %w", err)
 		}
 
 		organizations = organizationList
@@ -120,7 +120,7 @@ func (s *Service) GetUserOrganizations(
 
 	err := s.pg.WithConn(ctx, func(conn pg.Conn) error {
 		if err := organizations.LoadByUserID(ctx, conn, userID, cursor); err != nil {
-			return fmt.Errorf("failed to load user organizations: %w", err)
+			return fmt.Errorf("cannot load user organizations: %w", err)
 		}
 		return nil
 	})
@@ -179,12 +179,12 @@ func (s *Service) AcceptInvitation(
 			}
 
 			if err := membership.Create(ctx, tx, scope); err != nil {
-				return fmt.Errorf("failed to add user to organization: %w", err)
+				return fmt.Errorf("cannot add user to organization: %w", err)
 			}
 
 			invitation.AcceptedAt = &now
 			if err := invitation.Update(ctx, tx, scope); err != nil {
-				return fmt.Errorf("failed to mark invitation as accepted: %w", err)
+				return fmt.Errorf("cannot mark invitation as accepted: %w", err)
 			}
 
 			return nil
@@ -243,12 +243,12 @@ func (s *Service) AcceptInvitationByID(
 			}
 
 			if err := membership.Create(ctx, tx, scope); err != nil {
-				return fmt.Errorf("failed to add user to organization: %w", err)
+				return fmt.Errorf("cannot add user to organization: %w", err)
 			}
 
 			invitation.AcceptedAt = &now
 			if err := invitation.Update(ctx, tx, scope); err != nil {
-				return fmt.Errorf("failed to mark invitation as accepted: %w", err)
+				return fmt.Errorf("cannot mark invitation as accepted: %w", err)
 			}
 
 			acceptedInvitation = invitation
@@ -295,7 +295,7 @@ func (s *Service) EnsureSAMLMembership(
 				}
 
 				if err := membership.Create(ctx, tx, scope); err != nil {
-					return fmt.Errorf("failed to create membership: %w", err)
+					return fmt.Errorf("cannot create membership: %w", err)
 				}
 
 				return nil
@@ -307,7 +307,7 @@ func (s *Service) EnsureSAMLMembership(
 				membership.UpdatedAt = now
 
 				if err := membership.Update(ctx, tx, scope); err != nil {
-					return fmt.Errorf("failed to update membership role: %w", err)
+					return fmt.Errorf("cannot update membership role: %w", err)
 				}
 			}
 
@@ -330,7 +330,7 @@ func (s *Service) GetUserInvitations(
 		ctx,
 		func(conn pg.Conn) error {
 			if err := invitations.LoadByEmail(ctx, conn, email, cursor, filter); err != nil {
-				return fmt.Errorf("failed to load invitations: %w", err)
+				return fmt.Errorf("cannot load invitations: %w", err)
 			}
 
 			return nil
@@ -379,11 +379,11 @@ func (s *Service) GetOrganizationByInvitationID(
 		func(conn pg.Conn) error {
 			var invitation coredata.Invitation
 			if err := invitation.LoadByID(ctx, conn, scope, invitationID); err != nil {
-				return fmt.Errorf("failed to load invitation: %w", err)
+				return fmt.Errorf("cannot load invitation: %w", err)
 			}
 
 			if err := organization.LoadByID(ctx, conn, scope, invitation.OrganizationID); err != nil {
-				return fmt.Errorf("failed to load organization: %w", err)
+				return fmt.Errorf("cannot load organization: %w", err)
 			}
 
 			return nil
@@ -422,7 +422,7 @@ func (s *Service) AddUserToOrganization(
 		ctx,
 		func(conn pg.Conn) error {
 			if err := membership.Create(ctx, conn, scope); err != nil {
-				return fmt.Errorf("failed to add user to organization: %w", err)
+				return fmt.Errorf("cannot add user to organization: %w", err)
 			}
 			return nil
 		},
@@ -441,7 +441,7 @@ func (s *TenantAuthzService) GetInvitationsByOrganizationID(
 		ctx,
 		func(conn pg.Conn) error {
 			if err := invitations.LoadByOrganizationID(ctx, conn, s.scope, orgID, cursor, filter); err != nil {
-				return fmt.Errorf("failed to load organization invitations: %w", err)
+				return fmt.Errorf("cannot load organization invitations: %w", err)
 			}
 
 			return nil
@@ -470,7 +470,7 @@ func (s *TenantAuthzService) CountOrganizationInvitations(
 		},
 	)
 	if err != nil {
-		return 0, fmt.Errorf("failed to count invitations: %w", err)
+		return 0, fmt.Errorf("cannot count invitations: %w", err)
 	}
 
 	return count, nil
@@ -485,7 +485,7 @@ func (s *TenantAuthzService) GetInvitationByID(
 		ctx,
 		func(conn pg.Conn) error {
 			if err := invitation.LoadByID(ctx, conn, s.scope, invitationID); err != nil {
-				return fmt.Errorf("failed to load invitation: %w", err)
+				return fmt.Errorf("cannot load invitation: %w", err)
 			}
 			return nil
 		},
@@ -505,11 +505,11 @@ func (s *TenantAuthzService) DeleteInvitation(
 		func(conn pg.Conn) error {
 			invitation := &coredata.Invitation{}
 			if err := invitation.LoadByID(ctx, conn, s.scope, invitationID); err != nil {
-				return fmt.Errorf("failed to load invitation: %w", err)
+				return fmt.Errorf("cannot load invitation: %w", err)
 			}
 
 			if err := invitation.Delete(ctx, conn, s.scope); err != nil {
-				return fmt.Errorf("failed to delete invitation: %w", err)
+				return fmt.Errorf("cannot delete invitation: %w", err)
 			}
 
 			return nil
@@ -528,7 +528,7 @@ func (s *TenantAuthzService) GetMembershipsByOrganizationID(
 		ctx,
 		func(conn pg.Conn) error {
 			if err := memberships.LoadByOrganizationID(ctx, conn, s.scope, orgID, cursor); err != nil {
-				return fmt.Errorf("failed to load organization memberships: %w", err)
+				return fmt.Errorf("cannot load organization memberships: %w", err)
 			}
 
 			return nil
@@ -556,7 +556,7 @@ func (s *TenantAuthzService) CountOrganizationMemberships(
 		},
 	)
 	if err != nil {
-		return 0, fmt.Errorf("failed to count memberships: %w", err)
+		return 0, fmt.Errorf("cannot count memberships: %w", err)
 	}
 
 	return count, nil
@@ -577,7 +577,7 @@ func (s *TenantAuthzService) CountOrganizationUsers(
 		},
 	)
 	if err != nil {
-		return 0, fmt.Errorf("failed to count users: %w", err)
+		return 0, fmt.Errorf("cannot count users: %w", err)
 	}
 
 	return count, nil
@@ -599,7 +599,7 @@ func (s *TenantAuthzService) CanUserAccessOrganization(
 				if _, ok := err.(coredata.ErrMembershipNotFound); ok {
 					return nil // Not an error, just no access
 				}
-				return fmt.Errorf("failed to check organization access: %w", err)
+				return fmt.Errorf("cannot check organization access: %w", err)
 			}
 			haveAccess = true
 			return nil
@@ -624,7 +624,7 @@ func (s *TenantAuthzService) GetUserRoleInOrganization(
 		ctx,
 		func(conn pg.Conn) error {
 			if err := membership.LoadByUserAndOrg(ctx, conn, s.scope, userID, orgID); err != nil {
-				return fmt.Errorf("failed to get user role: %w", err)
+				return fmt.Errorf("cannot get user role: %w", err)
 			}
 			return nil
 		},
@@ -648,7 +648,7 @@ func (s *TenantAuthzService) RemoveMemberFromOrganization(
 		ctx,
 		func(tx pg.Conn) error {
 			if err := membership.LoadByID(ctx, tx, s.scope, memberID); err != nil {
-				return fmt.Errorf("failed to load membership: %w", err)
+				return fmt.Errorf("cannot load membership: %w", err)
 			}
 
 			if membership.OrganizationID != orgID {
@@ -656,7 +656,7 @@ func (s *TenantAuthzService) RemoveMemberFromOrganization(
 			}
 
 			if err := membership.Delete(ctx, tx, s.scope); err != nil {
-				return fmt.Errorf("failed to delete membership: %w", err)
+				return fmt.Errorf("cannot delete membership: %w", err)
 			}
 
 			return nil
@@ -675,14 +675,14 @@ func (s *TenantAuthzService) UpdateUserRole(
 		func(tx pg.Conn) error {
 			membership := &coredata.Membership{}
 			if err := membership.LoadByUserAndOrg(ctx, tx, s.scope, userID, orgID); err != nil {
-				return fmt.Errorf("failed to find membership: %w", err)
+				return fmt.Errorf("cannot find membership: %w", err)
 			}
 
 			membership.Role = newRole
 			membership.UpdatedAt = time.Now()
 
 			if err := membership.Update(ctx, tx, s.scope); err != nil {
-				return fmt.Errorf("failed to update user role: %w", err)
+				return fmt.Errorf("cannot update user role: %w", err)
 			}
 
 			return nil
@@ -707,13 +707,13 @@ func (s *TenantAuthzService) InviteUserToOrganization(
 			if errors.As(err, &userNotFound) {
 				userExists = false
 			} else {
-				return fmt.Errorf("failed to check if user exists: %w", err)
+				return fmt.Errorf("cannot check if user exists: %w", err)
 			}
 		}
 
 		organization := &coredata.Organization{}
 		if err := organization.LoadByID(ctx, tx, s.scope, organizationID); err != nil {
-			return fmt.Errorf("failed to load organization: %w", err)
+			return fmt.Errorf("cannot load organization: %w", err)
 		}
 
 		invitationID := gid.New(s.scope.GetTenantID(), coredata.InvitationEntityType)
@@ -752,7 +752,7 @@ func (s *TenantAuthzService) InviteUserToOrganization(
 				invitationData,
 			)
 			if err != nil {
-				return fmt.Errorf("failed to generate invitation token: %w", err)
+				return fmt.Errorf("cannot generate invitation token: %w", err)
 			}
 
 			invitationURL = fmt.Sprintf("https://%s/auth/signup-from-invitation?token=%s&fullName=%s", s.hostname, invitationToken, url.QueryEscape(fullName))
@@ -765,7 +765,7 @@ func (s *TenantAuthzService) InviteUserToOrganization(
 			invitationURL,
 		)
 		if err != nil {
-			return fmt.Errorf("failed to render invitation email: %w", err)
+			return fmt.Errorf("cannot render invitation email: %w", err)
 		}
 
 		email := coredata.NewEmail(

pkg/certmanager/provisioner.go

@@ -214,7 +214,7 @@ func (p *Provisioner) provisionDomainCertificate(
 		if err != nil {
 			p.logger.ErrorCtx(
 				ctx,
-				"failed to get HTTP challenge",
+				"cannot get HTTP challenge",
 				log.String("domain", domain.Domain),
 				log.Error(err),
 			)
@@ -233,7 +233,7 @@ func (p *Provisioner) provisionDomainCertificate(
 		fullDomain.SSLStatus = coredata.CustomDomainSSLStatusProvisioning
 
 		if err := fullDomain.Update(ctx, conn, coredata.NewNoScope(), p.encryptionKey); err != nil {
-			return fmt.Errorf("failed to update domain with challenge: %w", err)
+			return fmt.Errorf("cannot update domain with challenge: %w", err)
 		}
 
 		p.logger.InfoCtx(

pkg/certmanager/renewer.go

@@ -98,7 +98,7 @@ func (r *Renewer) checkAndRenew(ctx context.Context) error {
 			domains := coredata.CustomDomains{}
 			scope := coredata.NewNoScope()
 			if err := domains.ListDomainsForRenewal(ctx, conn, scope); err != nil {
-				return fmt.Errorf("failed to list domains for renewal: %w", err)
+				return fmt.Errorf("cannot list domains for renewal: %w", err)
 			}
 
 			if len(domains) == 0 {

pkg/certmanager/selector.go

@@ -154,7 +154,7 @@ func (s *Selector) rebuildCacheEntry(ctx context.Context, conn pg.Conn, domain s
 	}
 
 	if err := cache.Upsert(ctx, conn); err != nil {
-		return fmt.Errorf("failed to insert cache entry: %w", err)
+		return fmt.Errorf("cannot insert cache entry: %w", err)
 	}
 
 	return nil

pkg/coredata/document_classification.go

@@ -41,7 +41,7 @@ func (dc *DocumentClassification) Scan(value interface{}) error {
 	case []byte:
 		sv = string(v)
 	default:
-		return fmt.Errorf("failed to scan DocumentClassification: expected string or []byte, got %T", value)
+		return fmt.Errorf("cannot scan DocumentClassification: expected string or []byte, got %T", value)
 	}
 
 	*dc = DocumentClassification(sv)

pkg/coredata/evidence.go

@@ -434,7 +434,7 @@ WHERE
 
 	_, err := conn.Exec(ctx, q, args)
 	if err != nil {
-		return fmt.Errorf("failed to delete evidence: %w", err)
+		return fmt.Errorf("cannot delete evidence: %w", err)
 	}
 
 	return nil

pkg/coredata/vendor_compliance_report.go

@@ -219,13 +219,13 @@ RETURNING report_file_id
 	err := conn.QueryRow(ctx, q, args).Scan(&vcrFileId)
 
 	if err != nil {
-		return fmt.Errorf("failed to delete vendor compliance report: %w", err)
+		return fmt.Errorf("cannot delete vendor compliance report: %w", err)
 	}
 
 	if vcrFileId != nil {
 		file := &File{ID: *vcrFileId}
 		if err = file.SoftDelete(ctx, conn, scope); err != nil {
-			return fmt.Errorf("failed to soft delete vendor compliance file: %w", err)
+			return fmt.Errorf("cannot soft delete vendor compliance file: %w", err)
 		}
 	}
 	return nil

pkg/docgen/generator.go

@@ -94,7 +94,7 @@ const (
 func RenderHTML(data DocumentData) ([]byte, error) {
 	var buf bytes.Buffer
 	if err := documentTemplate.Execute(&buf, data); err != nil {
-		return nil, fmt.Errorf("failed to execute template: %w", err)
+		return nil, fmt.Errorf("cannot execute template: %w", err)
 	}
 
 	return buf.Bytes(), nil

pkg/gid/gid.go

@@ -36,7 +36,7 @@ func New(tenantID TenantID, entityType uint16) GID {
 	id, err := NewGID(tenantID, entityType)
 	if err != nil {
 		// This should never happen with a valid random source
-		panic(fmt.Sprintf("failed to generate GID: %v", err))
+		panic(fmt.Sprintf("cannot generate GID: %v", err))
 	}
 	return id
 }
@@ -63,7 +63,7 @@ func NewGID(tenantID TenantID, entityType uint16) (GID, error) {
 	// Fill the rest with random data (6 bytes)
 	_, err := rand.Read(id[18:24])
 	if err != nil {
-		return Nil, fmt.Errorf("failed to generate random bytes: %v", err)
+		return Nil, fmt.Errorf("cannot generate random bytes: %v", err)
 	}
 
 	return id, nil

pkg/probo/connector_service.go

@@ -142,12 +142,12 @@ func (s *ConnectorService) Create(
 
 					var buf bytes.Buffer
 					if err := welcomeTemplate.Execute(&buf, data); err != nil {
-						return fmt.Errorf("failed to execute template: %w", err)
+						return fmt.Errorf("cannot execute template: %w", err)
 					}
 
 					var body map[string]any
 					if err := json.NewDecoder(&buf).Decode(&body); err != nil {
-						return fmt.Errorf("failed to parse template JSON: %w", err)
+						return fmt.Errorf("cannot parse template JSON: %w", err)
 					}
 
 					slackMessage := coredata.NewSlackMessage(s.svc.scope, req.OrganizationID, coredata.SlackMessageTypeWelcome, body, nil)

pkg/probo/document_service.go

@@ -172,7 +172,7 @@ func (s DocumentService) GenerateChangelog(
 	if changelog == nil {
 		changelog, err = s.svc.agent.GenerateChangelog(ctx, publishedVersion.Content, draftVersion.Content)
 		if err != nil {
-			return nil, fmt.Errorf("failed to generate changelog: %w", err)
+			return nil, fmt.Errorf("cannot generate changelog: %w", err)
 		}
 	}
 

pkg/probo/trust_center_access_service.go

@@ -319,9 +319,15 @@ func (s TrustCenterAccessService) Update(
 				return fmt.Errorf("cannot upsert document accesses: %w", err)
 			}
 
+			if req.ReportIDs != nil {
+				if err := coredata.ActivateByReportIDs(ctx, tx, s.svc.scope, access.ID, req.ReportIDs, now); err != nil {
+					return fmt.Errorf("cannot activate report accesses: %w", err)
+				}
+			}
+
 			if shouldSendEmail {
 				if err := s.sendAccessEmail(ctx, tx, access); err != nil {
-					return fmt.Errorf("failed to send access email: %w", err)
+					return fmt.Errorf("cannot send access email: %w", err)
 				}
 			}
 

pkg/probo/vendor_service.go

@@ -583,7 +583,7 @@ func (s VendorService) Assess(
 ) (*coredata.Vendor, error) {
 	vendorInfo, err := s.svc.agent.AssessVendor(ctx, req.WebsiteURL)
 	if err != nil {
-		return nil, fmt.Errorf("failed to assess vendor info: %w", err)
+		return nil, fmt.Errorf("cannot assess vendor info: %w", err)
 	}
 
 	vendor := &coredata.Vendor{

pkg/probod/probod.go

@@ -316,7 +316,7 @@ func (impl *Implm) Run(
 	if impl.cfg.CustomDomains.ACME.AccountKey != "" {
 		accountKey, err = pem.DecodePrivateKey([]byte(impl.cfg.CustomDomains.ACME.AccountKey))
 		if err != nil {
-			return fmt.Errorf("failed to decode ACME account key: %w", err)
+			return fmt.Errorf("cannot decode ACME account key: %w", err)
 		}
 		l.Info("using configured ACME account key")
 	}
@@ -325,7 +325,7 @@ func (impl *Implm) Run(
 	if impl.cfg.CustomDomains.ACME.RootCA != "" {
 		rootCAs = x509.NewCertPool()
 		if !rootCAs.AppendCertsFromPEM([]byte(impl.cfg.CustomDomains.ACME.RootCA)) {
-			return fmt.Errorf("failed to parse ACME root CA certificate")
+			return fmt.Errorf("cannot parse ACME root CA certificate")
 		}
 	}
 
@@ -338,7 +338,7 @@ func (impl *Implm) Run(
 		l,
 	)
 	if err != nil {
-		return fmt.Errorf("failed to initialize ACME service: %w", err)
+		return fmt.Errorf("cannot initialize ACME service: %w", err)
 	}
 
 	proboService, err := probo.NewService(

pkg/securecookie/securecookie.go

@@ -75,7 +75,7 @@ func DefaultConfig(name, secret string) Config {
 func Set(w http.ResponseWriter, config Config, value string) error {
 	signedValue, err := Sign(value, config.Secret)
 	if err != nil {
-		return fmt.Errorf("failed to sign cookie value: %w", err)
+		return fmt.Errorf("cannot sign cookie value: %w", err)
 	}
 
 	cookie := &http.Cookie{
@@ -153,7 +153,7 @@ func Verify(signedValue, secret string) (string, error) {
 
 	expectedSignedValue, err := Sign(value, secret)
 	if err != nil {
-		return "", fmt.Errorf("failed to sign value: %w", err)
+		return "", fmt.Errorf("cannot sign value: %w", err)
 	}
 
 	if signedValue != expectedSignedValue {

pkg/server/api/console/v1/resolver.go

@@ -157,7 +157,7 @@ func NewMux(
 			// Get the people to get their email for watermark
 			people, err := svc.Peoples.Get(r.Context(), data.Data.PeopleID)
 			if err != nil {
-				http.Error(w, "failed to get user", http.StatusInternalServerError)
+				http.Error(w, "cannot get user", http.StatusInternalServerError)
 				return
 			}
 
@@ -174,7 +174,7 @@ func NewMux(
 
 			uuid, err := uuid.NewV7()
 			if err != nil {
-				http.Error(w, "failed to generate uuid", http.StatusInternalServerError)
+				http.Error(w, "cannot generate uuid", http.StatusInternalServerError)
 				return
 			}
 
@@ -227,7 +227,7 @@ func NewMux(
 
 		organizationID, err := gid.ParseGID(r.URL.Query().Get("organization_id"))
 		if err != nil {
-			panic(fmt.Errorf("failed to parse organization id: %w", err))
+			panic(fmt.Errorf("cannot parse organization id: %w", err))
 		}
 
 		_ = GetTenantService(r.Context(), proboSvc, organizationID.TenantID())
@@ -266,7 +266,7 @@ func NewMux(
 
 		connection, organizationID, err := connectorRegistry.Complete(r.Context(), provider, r)
 		if err != nil {
-			panic(fmt.Errorf("failed to complete connector: %w", err))
+			panic(fmt.Errorf("cannot complete connector: %w", err))
 		}
 
 		continueURL := r.URL.Query().Get("continue")
@@ -283,7 +283,7 @@ func NewMux(
 			},
 		)
 		if err != nil {
-			panic(fmt.Errorf("failed to create or update connector: %w", err))
+			panic(fmt.Errorf("cannot create or update connector: %w", err))
 		}
 
 		if continueURL != "" {
@@ -364,7 +364,7 @@ func WithSession(authSvc *auth.Service, authzSvc *authz.Service, authCfg AuthCon
 
 		errorHandler := session.ErrorHandler{
 			OnCookieError: func(err error) {
-				panic(fmt.Errorf("failed to get session: %w", err))
+				panic(fmt.Errorf("cannot get session: %w", err))
 			},
 			OnParseError: func(w http.ResponseWriter, authCfg session.AuthConfig) {
 				session.ClearCookie(w, authCfg)
@@ -376,7 +376,7 @@ func WithSession(authSvc *auth.Service, authzSvc *authz.Service, authCfg AuthCon
 				session.ClearCookie(w, authCfg)
 			},
 			OnTenantError: func(err error) {
-				panic(fmt.Errorf("failed to list tenants for user: %w", err))
+				panic(fmt.Errorf("cannot list tenants for user: %w", err))
 			},
 		}
 
@@ -397,7 +397,7 @@ func WithSession(authSvc *auth.Service, authzSvc *authz.Service, authCfg AuthCon
 
 		// Update session after the handler completes
 		if _, err := authSvc.UpdateSession(ctx, authResult.Session.ID); err != nil {
-			panic(fmt.Errorf("failed to update session: %w", err))
+			panic(fmt.Errorf("cannot update session: %w", err))
 		}
 	}
 }

pkg/server/api/console/v1/v1_resolver.go

@@ -921,7 +921,7 @@ func (r *invitationConnectionResolver) TotalCount(ctx context.Context, obj *type
 		authzSvc := r.AuthzService(ctx, obj.ParentID.TenantID())
 		count, err := authzSvc.CountOrganizationInvitations(ctx, obj.ParentID, invitationFilter)
 		if err != nil {
-			panic(fmt.Errorf("failed to count organization invitations: %w", err))
+			panic(fmt.Errorf("cannot count organization invitations: %w", err))
 		}
 		return count, nil
 	case *viewerResolver:
@@ -937,7 +937,7 @@ func (r *invitationConnectionResolver) TotalCount(ctx context.Context, obj *type
 
 		count, err := r.authzSvc.CountUserInvitations(ctx, user.EmailAddress, invitationFilter)
 		if err != nil {
-			panic(fmt.Errorf("failed to count user invitations: %w", err))
+			panic(fmt.Errorf("cannot count user invitations: %w", err))
 		}
 		return count, nil
 	}
@@ -1104,7 +1104,7 @@ func (r *membershipConnectionResolver) TotalCount(ctx context.Context, obj *type
 		authzSvc := r.AuthzService(ctx, obj.ParentID.TenantID())
 		count, err := authzSvc.CountOrganizationMemberships(ctx, obj.ParentID)
 		if err != nil {
-			panic(fmt.Errorf("failed to count organization memberships: %w", err))
+			panic(fmt.Errorf("cannot count organization memberships: %w", err))
 		}
 		return count, nil
 	default:
@@ -1500,7 +1500,7 @@ func (r *mutationResolver) InviteUser(ctx context.Context, input types.InviteUse
 	authzSvc := r.AuthzService(ctx, input.OrganizationID.TenantID())
 	invitation, err := authzSvc.InviteUserToOrganization(ctx, input.OrganizationID, input.Email, input.FullName, string(authz.RoleMember))
 	if err != nil {
-		panic(fmt.Errorf("failed to invite user to organization: %w", err))
+		panic(fmt.Errorf("cannot invite user to organization: %w", err))
 	}
 
 	if input.CreatePeople {
@@ -1513,7 +1513,7 @@ func (r *mutationResolver) InviteUser(ctx context.Context, input types.InviteUse
 			Kind:                     coredata.PeopleKindEmployee,
 		})
 		if err != nil {
-			return nil, fmt.Errorf("failed to create people record: %w", err)
+			return nil, fmt.Errorf("cannot create people record: %w", err)
 		}
 	}
 
@@ -1528,7 +1528,7 @@ func (r *mutationResolver) AcceptInvitation(ctx context.Context, input types.Acc
 
 	invitation, err := r.authzSvc.AcceptInvitationByID(ctx, input.InvitationID, user.ID)
 	if err != nil {
-		panic(fmt.Errorf("failed to accept invitation: %w", err))
+		panic(fmt.Errorf("cannot accept invitation: %w", err))
 	}
 
 	return &types.AcceptInvitationPayload{Invitation: types.NewInvitation(invitation)}, nil
@@ -1539,7 +1539,7 @@ func (r *mutationResolver) DeleteInvitation(ctx context.Context, input types.Del
 	authzSvc := r.AuthzService(ctx, input.InvitationID.TenantID())
 	err := authzSvc.DeleteInvitation(ctx, input.InvitationID)
 	if err != nil {
-		panic(fmt.Errorf("failed to delete invitation: %w", err))
+		panic(fmt.Errorf("cannot delete invitation: %w", err))
 	}
 
 	return &types.DeleteInvitationPayload{
@@ -1720,7 +1720,7 @@ func (r *mutationResolver) CreateVendorContact(ctx context.Context, input types.
 
 	vendorContact, err := prb.VendorContacts.Create(ctx, req)
 	if err != nil {
-		return nil, fmt.Errorf("failed to create vendor contact: %w", err)
+		return nil, fmt.Errorf("cannot create vendor contact: %w", err)
 	}
 
 	return &types.CreateVendorContactPayload{
@@ -1742,7 +1742,7 @@ func (r *mutationResolver) UpdateVendorContact(ctx context.Context, input types.
 
 	vendorContact, err := prb.VendorContacts.Update(ctx, req)
 	if err != nil {
-		return nil, fmt.Errorf("failed to update vendor contact: %w", err)
+		return nil, fmt.Errorf("cannot update vendor contact: %w", err)
 	}
 
 	return &types.UpdateVendorContactPayload{
@@ -1756,7 +1756,7 @@ func (r *mutationResolver) DeleteVendorContact(ctx context.Context, input types.
 
 	err := prb.VendorContacts.Delete(ctx, input.VendorContactID)
 	if err != nil {
-		return nil, fmt.Errorf("failed to delete vendor contact: %w", err)
+		return nil, fmt.Errorf("cannot delete vendor contact: %w", err)
 	}
 
 	return &types.DeleteVendorContactPayload{
@@ -1776,7 +1776,7 @@ func (r *mutationResolver) CreateVendorService(ctx context.Context, input types.
 
 	vendorService, err := prb.VendorServices.Create(ctx, req)
 	if err != nil {
-		return nil, fmt.Errorf("failed to create vendor service: %w", err)
+		return nil, fmt.Errorf("cannot create vendor service: %w", err)
 	}
 
 	return &types.CreateVendorServicePayload{
@@ -1796,7 +1796,7 @@ func (r *mutationResolver) UpdateVendorService(ctx context.Context, input types.
 
 	vendorService, err := prb.VendorServices.Update(ctx, req)
 	if err != nil {
-		return nil, fmt.Errorf("failed to update vendor service: %w", err)
+		return nil, fmt.Errorf("cannot update vendor service: %w", err)
 	}
 
 	return &types.UpdateVendorServicePayload{
@@ -1810,7 +1810,7 @@ func (r *mutationResolver) DeleteVendorService(ctx context.Context, input types.
 
 	err := prb.VendorServices.Delete(ctx, input.VendorServiceID)
 	if err != nil {
-		return nil, fmt.Errorf("failed to delete vendor service: %w", err)
+		return nil, fmt.Errorf("cannot delete vendor service: %w", err)
 	}
 
 	return &types.DeleteVendorServicePayload{
@@ -2448,7 +2448,7 @@ func (r *mutationResolver) DeleteEvidence(ctx context.Context, input types.Delet
 
 	err := prb.Evidences.Delete(ctx, input.EvidenceID)
 	if err != nil {
-		panic(fmt.Errorf("failed to delete evidence: %w", err))
+		panic(fmt.Errorf("cannot delete evidence: %w", err))
 	}
 
 	return &types.DeleteEvidencePayload{
@@ -2496,7 +2496,7 @@ func (r *mutationResolver) UploadVendorComplianceReport(ctx context.Context, inp
 		},
 	)
 	if err != nil {
-		panic(fmt.Errorf("failed to upload vendor compliance report: %w", err))
+		panic(fmt.Errorf("cannot upload vendor compliance report: %w", err))
 	}
 
 	return &types.UploadVendorComplianceReportPayload{
@@ -2510,7 +2510,7 @@ func (r *mutationResolver) DeleteVendorComplianceReport(ctx context.Context, inp
 
 	err := prb.VendorComplianceReports.Delete(ctx, input.ReportID)
 	if err != nil {
-		panic(fmt.Errorf("failed to delete vendor compliance report: %w", err))
+		panic(fmt.Errorf("cannot delete vendor compliance report: %w", err))
 	}
 
 	return &types.DeleteVendorComplianceReportPayload{
@@ -2533,7 +2533,7 @@ func (r *mutationResolver) UploadVendorBusinessAssociateAgreement(ctx context.Co
 		},
 	)
 	if err != nil {
-		return nil, fmt.Errorf("failed to upload vendor business associate agreement: %w", err)
+		return nil, fmt.Errorf("cannot upload vendor business associate agreement: %w", err)
 	}
 
 	return &types.UploadVendorBusinessAssociateAgreementPayload{
@@ -2554,7 +2554,7 @@ func (r *mutationResolver) UpdateVendorBusinessAssociateAgreement(ctx context.Co
 		},
 	)
 	if err != nil {
-		return nil, fmt.Errorf("failed to update vendor business associate agreement: %w", err)
+		return nil, fmt.Errorf("cannot update vendor business associate agreement: %w", err)
 	}
 
 	return &types.UpdateVendorBusinessAssociateAgreementPayload{
@@ -2568,7 +2568,7 @@ func (r *mutationResolver) DeleteVendorBusinessAssociateAgreement(ctx context.Co
 
 	err := prb.VendorBusinessAssociateAgreements.DeleteByVendorID(ctx, input.VendorID)
 	if err != nil {
-		return nil, fmt.Errorf("failed to delete vendor business associate agreement: %w", err)
+		return nil, fmt.Errorf("cannot delete vendor business associate agreement: %w", err)
 	}
 
 	return &types.DeleteVendorBusinessAssociateAgreementPayload{
@@ -2591,7 +2591,7 @@ func (r *mutationResolver) UploadVendorDataPrivacyAgreement(ctx context.Context,
 		},
 	)
 	if err != nil {
-		return nil, fmt.Errorf("failed to upload vendor data privacy agreement: %w", err)
+		return nil, fmt.Errorf("cannot upload vendor data privacy agreement: %w", err)
 	}
 
 	return &types.UploadVendorDataPrivacyAgreementPayload{
@@ -2612,7 +2612,7 @@ func (r *mutationResolver) UpdateVendorDataPrivacyAgreement(ctx context.Context,
 		},
 	)
 	if err != nil {
-		return nil, fmt.Errorf("failed to update vendor data privacy agreement: %w", err)
+		return nil, fmt.Errorf("cannot update vendor data privacy agreement: %w", err)
 	}
 
 	return &types.UpdateVendorDataPrivacyAgreementPayload{
@@ -2626,7 +2626,7 @@ func (r *mutationResolver) DeleteVendorDataPrivacyAgreement(ctx context.Context,
 
 	err := prb.VendorDataPrivacyAgreements.DeleteByVendorID(ctx, input.VendorID)
 	if err != nil {
-		return nil, fmt.Errorf("failed to delete vendor data privacy agreement: %w", err)
+		return nil, fmt.Errorf("cannot delete vendor data privacy agreement: %w", err)
 	}
 
 	return &types.DeleteVendorDataPrivacyAgreementPayload{
@@ -3522,7 +3522,7 @@ func (r *mutationResolver) CreateCustomDomain(ctx context.Context, input types.C
 		Domain:         input.Domain,
 	})
 	if err != nil {
-		return nil, fmt.Errorf("failed to create custom domain: %w", err)
+		return nil, fmt.Errorf("cannot create custom domain: %w", err)
 	}
 
 	return &types.CreateCustomDomainPayload{
@@ -3537,7 +3537,7 @@ func (r *mutationResolver) DeleteCustomDomain(ctx context.Context, input types.D
 	// Get the current custom domain ID before deleting
 	domain, err := prb.CustomDomains.GetOrganizationCustomDomain(ctx, input.OrganizationID)
 	if err != nil {
-		return nil, fmt.Errorf("failed to get custom domain: %w", err)
+		return nil, fmt.Errorf("cannot get custom domain: %w", err)
 	}
 
 	if domain == nil {
@@ -3547,7 +3547,7 @@ func (r *mutationResolver) DeleteCustomDomain(ctx context.Context, input types.D
 	deletedDomainID := domain.ID
 
 	if err := prb.CustomDomains.DeleteCustomDomain(ctx, input.OrganizationID); err != nil {
-		return nil, fmt.Errorf("failed to delete custom domain: %w", err)
+		return nil, fmt.Errorf("cannot delete custom domain: %w", err)
 	}
 
 	return &types.DeleteCustomDomainPayload{
@@ -3567,7 +3567,7 @@ func (r *mutationResolver) InitiateDomainVerification(ctx context.Context, input
 
 	config, err := r.authSvc.InitiateDomainVerification(ctx, tenantID, organizationID, input.EmailDomain)
 	if err != nil {
-		return nil, fmt.Errorf("failed to initiate domain verification: %w", err)
+		return nil, fmt.Errorf("cannot initiate domain verification: %w", err)
 	}
 
 	dnsRecord := auth.GetDomainVerificationRecord(*config.DomainVerificationToken)
@@ -3594,7 +3594,7 @@ func (r *mutationResolver) VerifyDomain(ctx context.Context, input types.VerifyD
 
 	config, verified, err := r.authSvc.VerifyDomain(ctx, tenantID, configID)
 	if err != nil {
-		return nil, fmt.Errorf("failed to verify domain: %w", err)
+		return nil, fmt.Errorf("cannot verify domain: %w", err)
 	}
 
 	return &types.VerifyDomainPayload{
@@ -3623,7 +3623,7 @@ func (r *mutationResolver) CreateSAMLConfiguration(ctx context.Context, input ty
 	if input.IdpMetadataXML != nil && *input.IdpMetadataXML != "" {
 		metadata, err := auth.ParseIdPMetadata(*input.IdpMetadataXML)
 		if err != nil {
-			return nil, fmt.Errorf("failed to parse IdP metadata XML: %w", err)
+			return nil, fmt.Errorf("cannot parse IdP metadata XML: %w", err)
 		}
 		idpEntityID = metadata.EntityID
 		idpSsoURL = metadata.SsoURL
@@ -3691,7 +3691,7 @@ func (r *mutationResolver) CreateSAMLConfiguration(ctx context.Context, input ty
 		AutoSignupEnabled:  autoSignupEnabled,
 	})
 	if err != nil {
-		return nil, fmt.Errorf("failed to create SAML configuration: %w", err)
+		return nil, fmt.Errorf("cannot create SAML configuration: %w", err)
 	}
 
 	return &types.CreateSAMLConfigurationPayload{
@@ -3729,7 +3729,7 @@ func (r *mutationResolver) UpdateSAMLConfiguration(ctx context.Context, input ty
 		AutoSignupEnabled:  input.AutoSignupEnabled,
 	})
 	if err != nil {
-		return nil, fmt.Errorf("failed to update SAML configuration: %w", err)
+		return nil, fmt.Errorf("cannot update SAML configuration: %w", err)
 	}
 
 	return &types.UpdateSAMLConfigurationPayload{
@@ -3753,7 +3753,7 @@ func (r *mutationResolver) DeleteSAMLConfiguration(ctx context.Context, input ty
 
 	err := r.authSvc.WithTenant(tenantID).DeleteSAMLConfiguration(ctx, configID)
 	if err != nil {
-		return nil, fmt.Errorf("failed to delete SAML configuration: %w", err)
+		return nil, fmt.Errorf("cannot delete SAML configuration: %w", err)
 	}
 
 	return &types.DeleteSAMLConfigurationPayload{
@@ -3773,7 +3773,7 @@ func (r *mutationResolver) EnableSaml(ctx context.Context, input types.EnableSAM
 
 	enabledConfig, err := r.authSvc.WithTenant(tenantID).EnableSAMLConfiguration(ctx, configID)
 	if err != nil {
-		return nil, fmt.Errorf("failed to enable SAML: %w", err)
+		return nil, fmt.Errorf("cannot enable SAML: %w", err)
 	}
 
 	return &types.EnableSAMLPayload{
@@ -3797,7 +3797,7 @@ func (r *mutationResolver) DisableSaml(ctx context.Context, input types.DisableS
 
 	disabledConfig, err := r.authSvc.WithTenant(tenantID).DisableSAMLConfiguration(ctx, configID)
 	if err != nil {
-		return nil, fmt.Errorf("failed to disable SAML: %w", err)
+		return nil, fmt.Errorf("cannot disable SAML: %w", err)
 	}
 
 	return &types.DisableSAMLPayload{
@@ -4544,7 +4544,7 @@ func (r *organizationResolver) CustomDomain(ctx context.Context, obj *types.Orga
 
 	domain, err := prb.CustomDomains.GetOrganizationCustomDomain(ctx, obj.ID)
 	if err != nil {
-		return nil, fmt.Errorf("failed to get custom domain: %w", err)
+		return nil, fmt.Errorf("cannot get custom domain: %w", err)
 	}
 
 	if domain == nil {
@@ -4560,7 +4560,7 @@ func (r *organizationResolver) SamlConfigurations(ctx context.Context, obj *type
 
 	configs, err := r.authSvc.WithTenant(tenantID).GetSAMLConfigurationsByOrganizationID(ctx, obj.ID)
 	if err != nil {
-		return nil, fmt.Errorf("failed to load SAML configurations: %w", err)
+		return nil, fmt.Errorf("cannot load SAML configurations: %w", err)
 	}
 
 	result := make([]*types.SAMLConfiguration, len(configs))
@@ -5027,12 +5027,12 @@ func (r *sAMLConfigurationResolver) Organization(ctx context.Context, obj *types
 
 	config, err := r.authSvc.WithTenant(tenantID).GetSAMLConfigurationByID(ctx, obj.ID)
 	if err != nil {
-		return nil, fmt.Errorf("failed to load SAML configuration: %w", err)
+		return nil, fmt.Errorf("cannot load SAML configuration: %w", err)
 	}
 
 	org, err := prb.Organizations.Get(ctx, config.OrganizationID)
 	if err != nil {
-		return nil, fmt.Errorf("failed to load organization: %w", err)
+		return nil, fmt.Errorf("cannot load organization: %w", err)
 	}
 
 	return types.NewOrganization(org), nil
@@ -5191,7 +5191,7 @@ func (r *taskResolver) Evidences(ctx context.Context, obj *types.Task, first *in
 	cursor := types.NewCursor(first, after, last, before, pageOrderBy)
 	page, err := prb.Evidences.ListForTaskID(ctx, obj.ID, cursor)
 	if err != nil {
-		panic(fmt.Errorf("failed to list task evidences: %w", err))
+		panic(fmt.Errorf("cannot list task evidences: %w", err))
 	}
 
 	return types.NewEvidenceConnection(page, r, obj.ID), nil
@@ -5225,7 +5225,7 @@ func (r *trustCenterResolver) NdaFileURL(ctx context.Context, obj *types.TrustCe
 
 	fileURL, err := prb.TrustCenters.GenerateNDAFileURL(ctx, obj.ID, 15*time.Minute)
 	if err != nil {
-		panic(fmt.Errorf("failed to generate NDA file URL: %w", err))
+		panic(fmt.Errorf("cannot generate NDA file URL: %w", err))
 	}
 
 	return fileURL, nil
@@ -5448,7 +5448,7 @@ func (r *trustCenterReferenceResolver) LogoURL(ctx context.Context, obj *types.T
 
 	fileURL, err := prb.TrustCenterReferences.GenerateLogoURL(ctx, obj.ID, 1*time.Hour)
 	if err != nil {
-		panic(fmt.Errorf("failed to generate logo URL: %w", err))
+		panic(fmt.Errorf("cannot generate logo URL: %w", err))
 	}
 
 	return fileURL, nil
@@ -5472,7 +5472,7 @@ func (r *userConnectionResolver) TotalCount(ctx context.Context, obj *types.User
 		authzSvc := r.AuthzService(ctx, obj.ParentID.TenantID())
 		count, err := authzSvc.CountOrganizationUsers(ctx, obj.ParentID)
 		if err != nil {
-			panic(fmt.Errorf("failed to count organization users: %w", err))
+			panic(fmt.Errorf("cannot count organization users: %w", err))
 		}
 		return count, nil
 	default:
@@ -5516,7 +5516,7 @@ func (r *vendorResolver) ComplianceReports(ctx context.Context, obj *types.Vendo
 
 	page, err := prb.VendorComplianceReports.ListForVendorID(ctx, obj.ID, cursor)
 	if err != nil {
-		panic(fmt.Errorf("failed to list vendor compliance reports: %w", err))
+		panic(fmt.Errorf("cannot list vendor compliance reports: %w", err))
 	}
 
 	return types.NewVendorComplianceReportConnection(page), nil
@@ -5532,7 +5532,7 @@ func (r *vendorResolver) BusinessAssociateAgreement(ctx context.Context, obj *ty
 			return nil, nil
 		}
 
-		panic(fmt.Errorf("failed to get vendor business associate agreement: %w", err))
+		panic(fmt.Errorf("cannot get vendor business associate agreement: %w", err))
 	}
 
 	return types.NewVendorBusinessAssociateAgreement(vendorBusinessAssociateAgreement, file), nil
@@ -5548,7 +5548,7 @@ func (r *vendorResolver) DataPrivacyAgreement(ctx context.Context, obj *types.Ve
 			return nil, nil
 		}
 
-		panic(fmt.Errorf("failed to get vendor data privacy agreement: %w", err))
+		panic(fmt.Errorf("cannot get vendor data privacy agreement: %w", err))
 	}
 
 	return types.NewVendorDataPrivacyAgreement(vendorDataPrivacyAgreement, file), nil
@@ -5573,7 +5573,7 @@ func (r *vendorResolver) Contacts(ctx context.Context, obj *types.Vendor, first
 
 	page, err := prb.VendorContacts.List(ctx, obj.ID, cursor)
 	if err != nil {
-		panic(fmt.Errorf("failed to list vendor contacts: %w", err))
+		panic(fmt.Errorf("cannot list vendor contacts: %w", err))
 	}
 
 	return types.NewVendorContactConnection(page), nil
@@ -5598,7 +5598,7 @@ func (r *vendorResolver) Services(ctx context.Context, obj *types.Vendor, first
 
 	page, err := prb.VendorServices.List(ctx, obj.ID, cursor)
 	if err != nil {
-		panic(fmt.Errorf("failed to list vendor services: %w", err))
+		panic(fmt.Errorf("cannot list vendor services: %w", err))
 	}
 
 	return types.NewVendorServiceConnection(page), nil
@@ -5623,7 +5623,7 @@ func (r *vendorResolver) RiskAssessments(ctx context.Context, obj *types.Vendor,
 
 	page, err := prb.Vendors.ListRiskAssessments(ctx, obj.ID, cursor)
 	if err != nil {
-		panic(fmt.Errorf("failed to list vendor risk assessments: %w", err))
+		panic(fmt.Errorf("cannot list vendor risk assessments: %w", err))
 	}
 
 	return types.NewVendorRiskAssessmentConnection(page), nil
@@ -5635,7 +5635,7 @@ func (r *vendorResolver) BusinessOwner(ctx context.Context, obj *types.Vendor) (
 
 	vendor, err := prb.Vendors.Get(ctx, obj.ID)
 	if err != nil {
-		panic(fmt.Errorf("failed to get vendor: %w", err))
+		panic(fmt.Errorf("cannot get vendor: %w", err))
 	}
 
 	if vendor.BusinessOwnerID == nil {
@@ -5644,7 +5644,7 @@ func (r *vendorResolver) BusinessOwner(ctx context.Context, obj *types.Vendor) (
 
 	people, err := prb.Peoples.Get(ctx, *vendor.BusinessOwnerID)
 	if err != nil {
-		panic(fmt.Errorf("failed to get business owner: %w", err))
+		panic(fmt.Errorf("cannot get business owner: %w", err))
 	}
 
 	return types.NewPeople(people), nil
@@ -5655,7 +5655,7 @@ func (r *vendorResolver) SecurityOwner(ctx context.Context, obj *types.Vendor) (
 	prb := r.ProboService(ctx, obj.ID.TenantID())
 	vendor, err := prb.Vendors.Get(ctx, obj.ID)
 	if err != nil {
-		panic(fmt.Errorf("failed to get vendor: %w", err))
+		panic(fmt.Errorf("cannot get vendor: %w", err))
 	}
 
 	if vendor.SecurityOwnerID == nil {
@@ -5664,7 +5664,7 @@ func (r *vendorResolver) SecurityOwner(ctx context.Context, obj *types.Vendor) (
 
 	people, err := prb.Peoples.Get(ctx, *vendor.SecurityOwnerID)
 	if err != nil {
-		panic(fmt.Errorf("failed to get security owner: %w", err))
+		panic(fmt.Errorf("cannot get security owner: %w", err))
 	}
 
 	return types.NewPeople(people), nil
@@ -5676,7 +5676,7 @@ func (r *vendorBusinessAssociateAgreementResolver) Vendor(ctx context.Context, o
 
 	vendor, err := prb.Vendors.Get(ctx, obj.ID)
 	if err != nil {
-		return nil, fmt.Errorf("failed to get vendor: %w", err)
+		return nil, fmt.Errorf("cannot get vendor: %w", err)
 	}
 
 	return types.NewVendor(vendor), nil
@@ -5688,7 +5688,7 @@ func (r *vendorBusinessAssociateAgreementResolver) FileURL(ctx context.Context,
 
 	fileURL, err := prb.VendorBusinessAssociateAgreements.GenerateFileURL(ctx, obj.ID, 1*time.Hour)
 	if err != nil {
-		return "", fmt.Errorf("failed to generate file URL: %w", err)
+		return "", fmt.Errorf("cannot generate file URL: %w", err)
 	}
 
 	return fileURL, nil
@@ -5700,7 +5700,7 @@ func (r *vendorComplianceReportResolver) Vendor(ctx context.Context, obj *types.
 
 	vendor, err := prb.Vendors.Get(ctx, obj.ID)
 	if err != nil {
-		panic(fmt.Errorf("failed to get vendor: %w", err))
+		panic(fmt.Errorf("cannot get vendor: %w", err))
 	}
 
 	return types.NewVendor(vendor), nil
@@ -5762,12 +5762,12 @@ func (r *vendorContactResolver) Vendor(ctx context.Context, obj *types.VendorCon
 	// Get the vendor contact to access the VendorID
 	vendorContact, err := prb.VendorContacts.Get(ctx, obj.ID)
 	if err != nil {
-		panic(fmt.Errorf("failed to get vendor contact: %w", err))
+		panic(fmt.Errorf("cannot get vendor contact: %w", err))
 	}
 
 	vendor, err := prb.Vendors.Get(ctx, vendorContact.VendorID)
 	if err != nil {
-		panic(fmt.Errorf("failed to get vendor: %w", err))
+		panic(fmt.Errorf("cannot get vendor: %w", err))
 	}
 
 	return types.NewVendor(vendor), nil
@@ -5779,7 +5779,7 @@ func (r *vendorDataPrivacyAgreementResolver) Vendor(ctx context.Context, obj *ty
 
 	vendor, err := prb.Vendors.Get(ctx, obj.ID)
 	if err != nil {
-		panic(fmt.Errorf("failed to get vendor: %w", err))
+		panic(fmt.Errorf("cannot get vendor: %w", err))
 	}
 
 	return types.NewVendor(vendor), nil
@@ -5791,7 +5791,7 @@ func (r *vendorDataPrivacyAgreementResolver) FileURL(ctx context.Context, obj *t
 
 	fileURL, err := prb.VendorDataPrivacyAgreements.GenerateFileURL(ctx, obj.ID, 1*time.Hour)
 	if err != nil {
-		panic(fmt.Errorf("failed to generate file URL: %w", err))
+		panic(fmt.Errorf("cannot generate file URL: %w", err))
 	}
 
 	return fileURL, nil
@@ -5803,7 +5803,7 @@ func (r *vendorRiskAssessmentResolver) Vendor(ctx context.Context, obj *types.Ve
 
 	vendor, err := prb.Vendors.Get(ctx, obj.ID)
 	if err != nil {
-		panic(fmt.Errorf("failed to get vendor: %w", err))
+		panic(fmt.Errorf("cannot get vendor: %w", err))
 	}
 
 	return types.NewVendor(vendor), nil
@@ -5816,12 +5816,12 @@ func (r *vendorServiceResolver) Vendor(ctx context.Context, obj *types.VendorSer
 	// Get the vendor service to access the VendorID
 	vendorService, err := prb.VendorServices.Get(ctx, obj.ID)
 	if err != nil {
-		panic(fmt.Errorf("failed to get vendor service: %w", err))
+		panic(fmt.Errorf("cannot get vendor service: %w", err))
 	}
 
 	vendor, err := prb.Vendors.Get(ctx, vendorService.VendorID)
 	if err != nil {
-		panic(fmt.Errorf("failed to get vendor: %w", err))
+		panic(fmt.Errorf("cannot get vendor: %w", err))
 	}
 
 	return types.NewVendor(vendor), nil
@@ -5845,7 +5845,7 @@ func (r *viewerResolver) Organizations(ctx context.Context, obj *types.Viewer, f
 
 	organizations, err := r.authzSvc.GetUserOrganizations(ctx, user.ID, cursor)
 	if err != nil {
-		panic(fmt.Errorf("failed to list organizations for user: %w", err))
+		panic(fmt.Errorf("cannot list organizations for user: %w", err))
 	}
 
 	// Show all organizations the user is a member of
@@ -5878,7 +5878,7 @@ func (r *viewerResolver) Invitations(ctx context.Context, obj *types.Viewer, fir
 
 	invitations, err := r.authzSvc.GetUserInvitations(ctx, user.EmailAddress, cursor, invitationFilter)
 	if err != nil {
-		panic(fmt.Errorf("failed to list invitations for user: %w", err))
+		panic(fmt.Errorf("cannot list invitations for user: %w", err))
 	}
 
 	return types.NewInvitationConnection(invitations, r, gid.GID{}, filter), nil

pkg/server/api/trust/v1/resolver.go

@@ -266,7 +266,7 @@ func updateSessionIfNeeded(ctx context.Context, authSvc *auth.Service) {
 	session := SessionFromContext(ctx)
 	if session != nil {
 		if _, err := authSvc.UpdateSession(ctx, session.ID); err != nil {
-			panic(fmt.Errorf("failed to update session: %w", err))
+			panic(fmt.Errorf("cannot update session: %w", err))
 		}
 	}
 }

pkg/server/api/trust/v1/slack_handler.go

@@ -202,7 +202,7 @@ func slackHandler(trustSvc *trust.Service, slackSigningSecret string, logger *lo
 			reportIDs,
 			fileIDs,
 		); err != nil {
-			logger.ErrorCtx(ctx, "failed to grant access", log.Error(err))
+			logger.ErrorCtx(ctx, "cannot grant access", log.Error(err))
 			httpserver.RenderJSON(w, http.StatusInternalServerError, SlackInteractiveResponse{Success: false, Message: "internal server error"})
 			return
 		}
@@ -213,7 +213,7 @@ func slackHandler(trustSvc *trust.Service, slackSigningSecret string, logger *lo
 			slackPayload.ResponseURL,
 			requesterEmail,
 		); err != nil {
-			logger.ErrorCtx(ctx, "failed to update Slack message", log.Error(err))
+			logger.ErrorCtx(ctx, "cannot update Slack message", log.Error(err))
 			httpserver.RenderJSON(w, http.StatusInternalServerError, SlackInteractiveResponse{Success: false, Message: "internal server error"})
 			return
 		}

pkg/server/api/trust/v1/trust_center_access_handler.go

@@ -91,7 +91,7 @@ func authTokenHandler(trustSvc *trust.Service, trustAuthCfg TrustAuthConfig) htt
 			*accessData,
 		)
 		if err != nil {
-			httpserver.RenderError(w, http.StatusInternalServerError, fmt.Errorf("failed to create token: %w", err))
+			httpserver.RenderError(w, http.StatusInternalServerError, fmt.Errorf("cannot create token: %w", err))
 			return
 		}
 

pkg/server/api/trust/v1/v1_resolver.go

@@ -592,56 +592,56 @@ func (r *queryResolver) Node(ctx context.Context, id gid.GID) (types.Node, error
 	case coredata.OrganizationEntityType:
 		organization, err := publicTrustService.Organizations.Get(ctx, id)
 		if err != nil {
-			panic(fmt.Errorf("failed to get organization: %w", err))
+			panic(fmt.Errorf("cannot get organization: %w", err))
 		}
 		return types.NewOrganization(organization), nil
 
 	case coredata.DocumentEntityType:
 		document, err := publicTrustService.Documents.Get(ctx, id)
 		if err != nil {
-			panic(fmt.Errorf("failed to get document: %w", err))
+			panic(fmt.Errorf("cannot get document: %w", err))
 		}
 		return types.NewDocument(document), nil
 
 	case coredata.FrameworkEntityType:
 		framework, err := publicTrustService.Frameworks.Get(ctx, id)
 		if err != nil {
-			panic(fmt.Errorf("failed to get framework: %w", err))
+			panic(fmt.Errorf("cannot get framework: %w", err))
 		}
 		return types.NewFramework(framework), nil
 
 	case coredata.ReportEntityType:
 		report, err := publicTrustService.Reports.Get(ctx, id)
 		if err != nil {
-			panic(fmt.Errorf("failed to get report: %w", err))
+			panic(fmt.Errorf("cannot get report: %w", err))
 		}
 		return types.NewReport(report), nil
 
 	case coredata.AuditEntityType:
 		audit, err := publicTrustService.Audits.Get(ctx, id)
 		if err != nil {
-			panic(fmt.Errorf("failed to get audit: %w", err))
+			panic(fmt.Errorf("cannot get audit: %w", err))
 		}
 		return types.NewAudit(audit), nil
 
 	case coredata.VendorEntityType:
 		vendor, err := publicTrustService.Vendors.Get(ctx, id)
 		if err != nil {
-			panic(fmt.Errorf("failed to get vendor: %w", err))
+			panic(fmt.Errorf("cannot get vendor: %w", err))
 		}
 		return types.NewVendor(vendor), nil
 
 	case coredata.TrustCenterEntityType:
 		trustCenter, file, err := publicTrustService.TrustCenters.Get(ctx, id)
 		if err != nil {
-			panic(fmt.Errorf("failed to get trust center: %w", err))
+			panic(fmt.Errorf("cannot get trust center: %w", err))
 		}
 		return types.NewTrustCenter(trustCenter, file), nil
 
 	case coredata.TrustCenterReferenceEntityType:
 		reference, err := publicTrustService.TrustCenterReferences.Get(ctx, id)
 		if err != nil {
-			panic(fmt.Errorf("failed to get trust center reference: %w", err))
+			panic(fmt.Errorf("cannot get trust center reference: %w", err))
 		}
 		return types.NewTrustCenterReference(reference), nil
 

pkg/server/auth/accept_invitation_handler.go

@@ -62,7 +62,7 @@ func AcceptInvitationHandler(authSvc *authsvc.Service, authzSvc *authz.Service,
 				httpserver.RenderError(w, http.StatusUnauthorized, fmt.Errorf("user not found"))
 			},
 			OnTenantError: func(err error) {
-				panic(fmt.Errorf("failed to list tenants for user: %w", err))
+				panic(fmt.Errorf("cannot list tenants for user: %w", err))
 			},
 		}
 

pkg/server/auth/list_invitations_handler.go

@@ -127,7 +127,7 @@ func ListInvitationsHandler(authSvc *authsvc.Service, authzSvc *authz.Service, a
 				httpserver.RenderError(w, http.StatusUnauthorized, fmt.Errorf("user not found"))
 			},
 			OnTenantError: func(err error) {
-				panic(fmt.Errorf("failed to list tenants for user: %w", err))
+				panic(fmt.Errorf("cannot list tenants for user: %w", err))
 			},
 		}
 
@@ -152,7 +152,7 @@ func ListInvitationsHandler(authSvc *authsvc.Service, authzSvc *authz.Service, a
 
 		invitationsPage, err := authzSvc.GetUserInvitations(ctx, authResult.User.EmailAddress, cursor, invitationFilter)
 		if err != nil {
-			panic(fmt.Errorf("failed to list invitations for user: %w", err))
+			panic(fmt.Errorf("cannot list invitations for user: %w", err))
 		}
 
 		// Build response
@@ -195,7 +195,7 @@ func ListInvitationsHandler(authSvc *authsvc.Service, authzSvc *authz.Service, a
 			return nil
 		})
 		if err != nil {
-			panic(fmt.Errorf("failed to load organization details: %w", err))
+			panic(fmt.Errorf("cannot load organization details: %w", err))
 		}
 
 		httpserver.RenderJSON(w, http.StatusOK, response)

pkg/server/auth/list_organizations_handler.go

@@ -113,7 +113,7 @@ func ListOrganizationsHandler(authSvc *authsvc.Service, authzSvc *authz.Service,
 				httpserver.RenderError(w, http.StatusUnauthorized, fmt.Errorf("user not found"))
 			},
 			OnTenantError: func(err error) {
-				panic(fmt.Errorf("failed to list tenants for user: %w", err))
+				panic(fmt.Errorf("cannot list tenants for user: %w", err))
 			},
 		}
 
@@ -126,7 +126,7 @@ func ListOrganizationsHandler(authSvc *authsvc.Service, authzSvc *authz.Service,
 		// Get all organizations for the user (without filtering by authentication state)
 		organizations, err := authzSvc.GetAllUserOrganizations(ctx, authResult.User.ID)
 		if err != nil {
-			panic(fmt.Errorf("failed to list organizations for user: %w", err))
+			panic(fmt.Errorf("cannot list organizations for user: %w", err))
 		}
 
 		// Build response with authentication requirements for each organization

pkg/server/auth/saml_acs_handler.go

@@ -44,8 +44,8 @@ func SAMLACSHandler(samlSvc *authsvc.SAMLService, authSvc *authsvc.Service, auth
 		ctx := r.Context()
 
 		if err := r.ParseForm(); err != nil {
-			logger.ErrorCtx(ctx, "failed to parse form", log.Error(err))
+			logger.ErrorCtx(ctx, "cannot parse form", log.Error(err))
-			http.Error(w, "failed to parse form", http.StatusBadRequest)
+			http.Error(w, "cannot parse form", http.StatusBadRequest)
 			return
 		}
 
@@ -71,14 +71,14 @@ func SAMLACSHandler(samlSvc *authsvc.SAMLService, authSvc *authsvc.Service, auth
 		user, err := authSvc.CreateOrGetSAMLUser(ctx, userInfo.Email, userInfo.FullName, userInfo.SAMLSubject)
 		if err != nil {
 			logger.ErrorCtx(ctx, "cannot create or get SAML user", log.Error(err), log.String("email", userInfo.Email))
-			http.Error(w, "failed to create user", http.StatusInternalServerError)
+			http.Error(w, "cannot create user", http.StatusInternalServerError)
 			return
 		}
 
 		err = authzSvc.EnsureSAMLMembership(ctx, userInfo.TenantID, user.ID, userInfo.OrganizationID, userInfo.Role)
 		if err != nil {
 			logger.ErrorCtx(ctx, "cannot ensure membership", log.Error(err), log.String("user_id", user.ID.String()), log.String("org_id", userInfo.OrganizationID.String()))
-			http.Error(w, "failed to create membership", http.StatusInternalServerError)
+			http.Error(w, "cannot create membership", http.StatusInternalServerError)
 			return
 		}
 
@@ -93,7 +93,7 @@ func SAMLACSHandler(samlSvc *authsvc.SAMLService, authSvc *authsvc.Service, auth
 			session, err = authSvc.CreateSessionForUser(ctx, user.ID, authCfg.SessionDuration)
 			if err != nil {
 				logger.ErrorCtx(ctx, "cannot create session", log.Error(err), log.String("user_id", user.ID.String()))
-				http.Error(w, "failed to create session", http.StatusInternalServerError)
+				http.Error(w, "cannot create session", http.StatusInternalServerError)
 				return
 			}
 		}
@@ -110,7 +110,7 @@ func SAMLACSHandler(samlSvc *authsvc.SAMLService, authSvc *authsvc.Service, auth
 		err = authSvc.UpdateSessionData(ctx, session.ID, session.Data)
 		if err != nil {
 			logger.ErrorCtx(ctx, "cannot update session data", log.Error(err), log.String("session_id", session.ID.String()))
-			http.Error(w, "failed to update session", http.StatusInternalServerError)
+			http.Error(w, "cannot update session", http.StatusInternalServerError)
 			return
 		}
 

pkg/server/auth/saml_metadata_handler.go

@@ -27,7 +27,7 @@ func SAMLMetadataHandler(samlSvc *authsvc.SAMLService) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
 		metadataXML, err := samlSvc.GenerateMetadata()
 		if err != nil {
-			http.Error(w, fmt.Sprintf("failed to generate metadata: %v", err), http.StatusInternalServerError)
+			http.Error(w, fmt.Sprintf("cannot generate metadata: %v", err), http.StatusInternalServerError)
 			return
 		}
 

pkg/slack/client.go

@@ -91,7 +91,7 @@ func (c *Client) CreateMessage(ctx context.Context, accessToken string, channelI
 
 	responseBody, err := io.ReadAll(resp.Body)
 	if err != nil {
-		return nil, fmt.Errorf("failed to read response body: %w", err)
+		return nil, fmt.Errorf("cannot read response body: %w", err)
 	}
 
 	if resp.StatusCode != http.StatusOK {
@@ -101,7 +101,7 @@ func (c *Client) CreateMessage(ctx context.Context, accessToken string, channelI
 	var slackResponse SlackResponse
 
 	if err := json.Unmarshal(responseBody, &slackResponse); err != nil {
-		return nil, fmt.Errorf("failed to parse Slack response: %w (body: %s)", err, string(responseBody))
+		return nil, fmt.Errorf("cannot parse Slack response: %w (body: %s)", err, string(responseBody))
 	}
 
 	if !slackResponse.OK {
@@ -142,7 +142,7 @@ func (c *Client) UpdateInteractiveMessage(ctx context.Context, responseURL strin
 
 	responseBody, err := io.ReadAll(resp.Body)
 	if err != nil {
-		return fmt.Errorf("failed to read response body: %w", err)
+		return fmt.Errorf("cannot read response body: %w", err)
 	}
 
 	if resp.StatusCode != http.StatusOK {
@@ -197,7 +197,7 @@ func (c *Client) UpdateMessage(ctx context.Context, accessToken string, channelI
 
 	responseBody, err := io.ReadAll(resp.Body)
 	if err != nil {
-		return fmt.Errorf("failed to read response body: %w", err)
+		return fmt.Errorf("cannot read response body: %w", err)
 	}
 
 	if resp.StatusCode != http.StatusOK {
@@ -206,7 +206,7 @@ func (c *Client) UpdateMessage(ctx context.Context, accessToken string, channelI
 
 	var slackResponse SlackResponse
 	if err := json.NewDecoder(bytes.NewReader(responseBody)).Decode(&slackResponse); err != nil {
-		return fmt.Errorf("failed to parse Slack response: %w (body: %s)", err, string(responseBody))
+		return fmt.Errorf("cannot parse Slack response: %w (body: %s)", err, string(responseBody))
 	}
 
 	if !slackResponse.OK {
@@ -242,7 +242,7 @@ func (c *Client) JoinChannel(ctx context.Context, accessToken string, channelID
 
 	responseBody, err := io.ReadAll(resp.Body)
 	if err != nil {
-		return fmt.Errorf("failed to read response body: %w", err)
+		return fmt.Errorf("cannot read response body: %w", err)
 	}
 
 	if resp.StatusCode != http.StatusOK {
@@ -252,7 +252,7 @@ func (c *Client) JoinChannel(ctx context.Context, accessToken string, channelID
 	var slackResponse SlackJoinResponse
 
 	if err := json.Unmarshal(responseBody, &slackResponse); err != nil {
-		return fmt.Errorf("failed to parse Slack response: %w (body: %s)", err, string(responseBody))
+		return fmt.Errorf("cannot parse Slack response: %w (body: %s)", err, string(responseBody))
 	}
 
 	if !slackResponse.OK {

pkg/slack/sender.go

@@ -187,14 +187,14 @@ func (s *Sender) sendMessage(ctx context.Context, tx pg.Conn, message *coredata.
 
 	if message.Type == coredata.SlackMessageTypeWelcome {
 		if err := client.JoinChannel(ctx, slackConn.AccessToken, slackConn.Settings.ChannelID); err != nil {
-			s.logger.ErrorCtx(ctx, "failed to join Slack channel", log.Error(err))
+			s.logger.ErrorCtx(ctx, "cannot join Slack channel", log.Error(err))
 		}
 	}
 
 	slackResp, err := client.CreateMessage(ctx, slackConn.AccessToken, slackConn.Settings.ChannelID, message.Body)
 	if err != nil {
-		s.logger.ErrorCtx(ctx, "failed to post message to Slack", log.Error(err))
+		s.logger.ErrorCtx(ctx, "cannot post message to Slack", log.Error(err))
-		return nil, nil, fmt.Errorf("failed to post message to Slack: %w", err)
+		return nil, nil, fmt.Errorf("cannot post message to Slack: %w", err)
 	}
 
 	return &slackResp.Channel, &slackResp.TS, nil
@@ -309,8 +309,8 @@ func (s *Sender) updateMessage(ctx context.Context, tx pg.Conn, updateMessage *c
 	client := NewClient(s.logger)
 
 	if err := client.UpdateMessage(ctx, slackConn.AccessToken, *updateMessage.ChannelID, *updateMessage.MessageTS, updateMessage.Body); err != nil {
-		s.logger.ErrorCtx(ctx, "failed to update message on Slack", log.Error(err))
+		s.logger.ErrorCtx(ctx, "cannot update message on Slack", log.Error(err))
-		return fmt.Errorf("failed to update message on Slack: %w", err)
+		return fmt.Errorf("cannot update message on Slack: %w", err)
 	}
 
 	return nil

pkg/statelesstoken/token.go

@@ -79,7 +79,7 @@ func NewToken[T any](secret string, tokenType string, expirationTime time.Durati
 
 	payloadBytes, err := json.Marshal(payload)
 	if err != nil {
-		return "", fmt.Errorf("failed to marshal token payload: %w", err)
+		return "", fmt.Errorf("cannot marshal token payload: %w", err)
 	}
 
 	encodedPayload := base64.RawURLEncoding.EncodeToString(payloadBytes)
@@ -114,12 +114,12 @@ func ValidateToken[T any](secret string, tokenType string, tokenString string) (
 
 	payloadBytes, err := base64.RawURLEncoding.DecodeString(encodedPayload)
 	if err != nil {
-		return nil, fmt.Errorf("failed to decode token payload: %w", err)
+		return nil, fmt.Errorf("cannot decode token payload: %w", err)
 	}
 
 	var payload Payload[T]
 	if err := json.Unmarshal(payloadBytes, &payload); err != nil {
-		return nil, fmt.Errorf("failed to unmarshal token payload: %w", err)
+		return nil, fmt.Errorf("cannot unmarshal token payload: %w", err)
 	}
 
 	if time.Now().After(payload.ExpiresAt) {

pkg/trust/slack_message_service.go

@@ -189,7 +189,7 @@ func (s *SlackMessageService) UpdateSlackAccessMessage(
 		}
 
 		if err := s.slackClient.UpdateInteractiveMessage(ctx, responseURL, updatedBody); err != nil {
-			return fmt.Errorf("failed to update Slack message: %w", err)
+			return fmt.Errorf("cannot update Slack message: %w", err)
 		}
 
 		return nil
@@ -437,12 +437,12 @@ func (s *SlackMessageService) buildAccessRequestMessage(
 
 	var buf bytes.Buffer
 	if err := accessRequestTemplate.Execute(&buf, templateData); err != nil {
-		return nil, fmt.Errorf("failed to execute template: %w", err)
+		return nil, fmt.Errorf("cannot execute template: %w", err)
 	}
 
 	var body map[string]any
 	if err := json.NewDecoder(&buf).Decode(&body); err != nil {
-		return nil, fmt.Errorf("failed to parse template JSON: %w", err)
+		return nil, fmt.Errorf("cannot parse template JSON: %w", err)
 	}
 
 	return body, nil

pkg/trust/trust_center_access_service.go

@@ -436,7 +436,7 @@ func (s *TrustCenterAccessService) AcceptByIDs(
 			}
 
 			if err := s.sendAccessEmail(ctx, tx, access); err != nil {
-				return fmt.Errorf("failed to send access email: %w", err)
+				return fmt.Errorf("cannot send access email: %w", err)
 			}
 		}
 

pkg/watermarkpdf/watermarkpdf.go

@@ -57,14 +57,14 @@ func AddConfidentialWithTimestamp(pdfData []byte, email string) ([]byte, error)
 
 	textImage, err := generateTextImage(watermarkLines)
 	if err != nil {
-		return nil, fmt.Errorf("failed to generate watermark image: %w", err)
+		return nil, fmt.Errorf("cannot generate watermark image: %w", err)
 	}
 
 	// Apply rotation before pdfcpu scaling instead of using pdfcpu's rotation API
 	// to ensure the scaled watermark covers the full page properly
 	imageData, err := rotateImage(textImage, watermarkRotationDegree)
 	if err != nil {
-		return nil, fmt.Errorf("failed to rotate image: %w", err)
+		return nil, fmt.Errorf("cannot rotate image: %w", err)
 	}
 
 	imageReader := bytes.NewReader(imageData)
@@ -75,13 +75,13 @@ func AddConfidentialWithTimestamp(pdfData []byte, email string) ([]byte, error)
 	)
 	watermarkConf, err := api.ImageWatermarkForReader(imageReader, desc, true, false, types.POINTS)
 	if err != nil {
-		return nil, fmt.Errorf("failed to create watermark from reader: %w", err)
+		return nil, fmt.Errorf("cannot create watermark from reader: %w", err)
 	}
 
 	var buf bytes.Buffer
 	err = api.AddWatermarks(reader, &buf, nil, watermarkConf, nil)
 	if err != nil {
-		return nil, fmt.Errorf("failed to add watermark: %w", err)
+		return nil, fmt.Errorf("cannot add watermark: %w", err)
 	}
 
 	return buf.Bytes(), nil
@@ -104,7 +104,7 @@ func generateTextImage(lines []string) (*image.RGBA, error) {
 
 	ttf, err := opentype.Parse(goregular.TTF)
 	if err != nil {
-		return nil, fmt.Errorf("failed to parse font: %w", err)
+		return nil, fmt.Errorf("cannot parse font: %w", err)
 	}
 
 	face, err := opentype.NewFace(ttf, &opentype.FaceOptions{
@@ -113,7 +113,7 @@ func generateTextImage(lines []string) (*image.RGBA, error) {
 		Hinting: font.HintingFull,
 	})
 	if err != nil {
-		return nil, fmt.Errorf("failed to create font face: %w", err)
+		return nil, fmt.Errorf("cannot create font face: %w", err)
 	}
 
 	d := &font.Drawer{
@@ -176,7 +176,7 @@ func rotateImage(src image.Image, angleDegrees float64) ([]byte, error) {
 
 	var buf bytes.Buffer
 	if err := png.Encode(&buf, dst); err != nil {
-		return nil, fmt.Errorf("failed to encode rotated image: %w", err)
+		return nil, fmt.Errorf("cannot encode rotated image: %w", err)
 	}
 
 	return buf.Bytes(), nil