rohit/probo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Replace string-based error matching with sentinel error

Browse Source 
Introduced ErrHTTPChallengeRequired as a sentinel error and updated the
renewal flow to use errors.Is() for type-safe error checking instead of
string matching.

Signed-off-by: Bryan Frimin <bryan@getprobo.com>
This commit is contained in:
Bryan Frimin
2025-10-01 12:56:05 +02:00
parent c0d5095f91
commit bb373d475b
2 changed files with 33 additions and 28 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
pkg/certmanager/acme.go
View File

@@ -21,6 +21,7 @@ import (
"crypto/tls" "crypto/tls"
"crypto/x509" "crypto/x509"
"crypto/x509/pkix" "crypto/x509/pkix"
"errors"
"fmt" "fmt"
"net/http" "net/http"
"time" "time"
@@ -57,6 +58,10 @@ type (
} }
) )
// ErrHTTPChallengeRequired indicates that an HTTP-01 challenge needs to be
// completed before the certificate can be issued or renewed.
var ErrHTTPChallengeRequired = errors.New("HTTP challenge required")
func NewACMEService(email string, keyType keys.Type, directoryURL string, insecureTLS bool, logger *log.Logger) (*ACMEService, error) { func NewACMEService(email string, keyType keys.Type, directoryURL string, insecureTLS bool, logger *log.Logger) (*ACMEService, error) {
accountKey, err := keys.Generate(keyType) accountKey, err := keys.Generate(keyType)
if err != nil { if err != nil {
@@ -229,7 +234,7 @@ func (s *ACMEService) ObtainCertificate(
// The challenge token and key auth will be stored and served via HTTP // The challenge token and key auth will be stored and served via HTTP
// The caller is responsible for ensuring the HTTP endpoint is ready // The caller is responsible for ensuring the HTTP endpoint is ready
// before calling CompleteHTTPChallenge // before calling CompleteHTTPChallenge
return nil, fmt.Errorf("HTTP challenge ready: token=%s", challenge.Token) return nil, fmt.Errorf("%w: token=%s", ErrHTTPChallengeRequired, challenge.Token)
} }
func (s *ACMEService) RenewCertificate( func (s *ACMEService) RenewCertificate(

6
pkg/certmanager/renewer.go
View File

@@ -16,8 +16,8 @@ package certmanager
import ( import (
"context" "context"
"errors"
"fmt" "fmt"
"strings"
"time" "time"
"github.com/getprobo/probo/pkg/coredata" "github.com/getprobo/probo/pkg/coredata"
@@ -146,7 +146,8 @@ func (r *Renewer) renewDomain(ctx context.Context, conn pg.Conn, domain *coredat
} }
cert, err := r.acmeService.RenewCertificate(ctx, lockedDomain.Domain) cert, err := r.acmeService.RenewCertificate(ctx, lockedDomain.Domain)
if err != nil && strings.Contains(err.Error(), "HTTP challenge ready") { if err != nil {
if errors.Is(err, ErrHTTPChallengeRequired) {
challenge, err := r.acmeService.GetHTTPChallenge(ctx, lockedDomain.Domain) challenge, err := r.acmeService.GetHTTPChallenge(ctx, lockedDomain.Domain)
if err != nil { if err != nil {
return fmt.Errorf("cannot get HTTP challenge for renewal: %w", err) return fmt.Errorf("cannot get HTTP challenge for renewal: %w", err)
@@ -172,7 +173,6 @@ func (r *Renewer) renewDomain(ctx context.Context, conn pg.Conn, domain *coredat
return nil return nil
} }
if err != nil {
return fmt.Errorf("cannot renew certificate: %w", err) return fmt.Errorf("cannot renew certificate: %w", err)
} }