Enforce Go style rules across codebase

Apply five style rules: convert iota string enums to typed
string constants, replace errors.As with errors.AsType,
merge three-group imports into two groups, fix multiline
parameter/argument formatting, and replace fmt.Sprintf URL
construction with net/url.

Signed-off-by: Émile Ré <emile@probo.com>

pkg/server/api/authn/api_key_middleware.go

@@ -62,32 +62,31 @@ func NewAPIKeyMiddleware(svc *iam.Service, tokenSecret string) func(next http.Ha
 					return
 				}
 
-				apiKey, err := svc.APIKeyService.GetAPIKey(ctx, keyID)
-				if err != nil {
-					var (
-						errPersonalAPIKeyNotFound *iam.ErrPersonalAPIKeyNotFound
-						errPersonalAPIKeyExpired  *iam.ErrPersonalAPIKeyExpired
-					)
-
-					if errors.As(err, &errPersonalAPIKeyNotFound) || errors.As(err, &errPersonalAPIKeyExpired) {
-						next.ServeHTTP(w, r)
-						return
-					}
-
-					panic(fmt.Errorf("cannot get personal API key: %w", err))
+			apiKey, err := svc.APIKeyService.GetAPIKey(ctx, keyID)
+			if err != nil {
+				if _, ok := errors.AsType[*iam.ErrPersonalAPIKeyNotFound](err); ok {
+					next.ServeHTTP(w, r)
+					return
 				}
 
-				identity, err := svc.AccountService.GetIdentity(ctx, apiKey.IdentityID)
-				if err != nil {
-					var errIdentityNotFound *iam.ErrIdentityNotFound
-					if errors.As(err, &errIdentityNotFound) {
-						next.ServeHTTP(w, r)
-						return
-					}
-
-					panic(fmt.Errorf("cannot get identity: %w", err))
+				if _, ok := errors.AsType[*iam.ErrPersonalAPIKeyExpired](err); ok {
+					next.ServeHTTP(w, r)
+					return
 				}
 
+				panic(fmt.Errorf("cannot get personal API key: %w", err))
+			}
+
+			identity, err := svc.AccountService.GetIdentity(ctx, apiKey.IdentityID)
+			if err != nil {
+				if _, ok := errors.AsType[*iam.ErrIdentityNotFound](err); ok {
+					next.ServeHTTP(w, r)
+					return
+				}
+
+				panic(fmt.Errorf("cannot get identity: %w", err))
+			}
+
 				ctx = ContextWithAPIKey(ctx, apiKey)
 				ctx = ContextWithIdentity(ctx, identity)
 

pkg/server/api/authn/session_middleware.go

@@ -65,36 +65,37 @@ func NewSessionMiddleware(svc *iam.Service, cookieConfig securecookie.Config) fu
 					return
 				}
 
-				session, err := svc.SessionService.GetSession(ctx, sessionID)
-				if err != nil {
-					var (
-						errSessionNotFound *iam.ErrSessionNotFound
-						errSessionExpired  *iam.ErrSessionExpired
-					)
+			session, err := svc.SessionService.GetSession(ctx, sessionID)
+			if err != nil {
+				if _, ok := errors.AsType[*iam.ErrSessionNotFound](err); ok {
+					securecookie.Clear(w, cookieConfig)
+					next.ServeHTTP(w, r)
 
-					if errors.As(err, &errSessionNotFound) || errors.As(err, &errSessionExpired) {
-						securecookie.Clear(w, cookieConfig)
-						next.ServeHTTP(w, r)
-
-						return
-					}
-
-					panic(fmt.Errorf("cannot get session: %w", err))
+					return
 				}
 
-				identity, err := svc.AccountService.GetIdentity(ctx, session.IdentityID)
-				if err != nil {
-					var errIdentityNotFound *iam.ErrIdentityNotFound
-					if errors.As(err, &errIdentityNotFound) {
-						securecookie.Clear(w, cookieConfig)
-						next.ServeHTTP(w, r)
+				if _, ok := errors.AsType[*iam.ErrSessionExpired](err); ok {
+					securecookie.Clear(w, cookieConfig)
+					next.ServeHTTP(w, r)
 
-						return
-					}
-
-					panic(fmt.Errorf("cannot get identity: %w", err))
+					return
 				}
 
+				panic(fmt.Errorf("cannot get session: %w", err))
+			}
+
+			identity, err := svc.AccountService.GetIdentity(ctx, session.IdentityID)
+			if err != nil {
+				if _, ok := errors.AsType[*iam.ErrIdentityNotFound](err); ok {
+					securecookie.Clear(w, cookieConfig)
+					next.ServeHTTP(w, r)
+
+					return
+				}
+
+				panic(fmt.Errorf("cannot get identity: %w", err))
+			}
+
 				userAgent := r.UserAgent()
 				// TODO: will work well when no layer 7 proxy is in front of the server
 				var ipAddress net.IP

pkg/server/api/authz/authorization.go

@@ -79,13 +79,11 @@ func NewAuthorizeFunc(
 		}
 
 		if err := svc.Authorizer.Authorize(ctx, params); err != nil {
-			var errAssumptionRequired *iam.ErrAssumptionRequired
-			if errors.As(err, &errAssumptionRequired) {
+			if _, ok := errors.AsType[*iam.ErrAssumptionRequired](err); ok {
 				return gqlutils.AssumptionRequired(ctx, err)
 			}
 
-			var errInsufficientPermissions *iam.ErrInsufficientPermissions
-			if errors.As(err, &errInsufficientPermissions) {
+			if _, ok := errors.AsType[*iam.ErrInsufficientPermissions](err); ok {
 				return gqlutils.Forbidden(ctx, err)
 			}
 

pkg/server/api/connect/v1/base_resolvers.go

@@ -152,23 +152,27 @@ func (r *queryResolver) Node(ctx context.Context, id gid.GID) (types.Node, error
 
 	node, err := loadNode(ctx, id)
 	if err != nil {
-		var (
-			errOrganizationNotFound *iam.ErrOrganizationNotFound
-			errIdentityNotFound     *iam.ErrIdentityNotFound
-			errSessionNotFound      *iam.ErrSessionNotFound
-			errProfileNotFound      *iam.ErrProfileNotFound
-			errMembershipNotFound   *iam.ErrMembershipNotFound
-			errInvitationNotFound   *iam.ErrInvitationNotFound
+		if _, ok := errors.AsType[*iam.ErrOrganizationNotFound](err); ok {
+			return nil, gqlutils.NotFound(ctx, err)
+		}
 
-			isNotFoundErr = errors.As(err, &errOrganizationNotFound) ||
-				errors.As(err, &errIdentityNotFound) ||
-				errors.As(err, &errSessionNotFound) ||
-				errors.As(err, &errProfileNotFound) ||
-				errors.As(err, &errMembershipNotFound) ||
-				errors.As(err, &errInvitationNotFound)
-		)
+		if _, ok := errors.AsType[*iam.ErrIdentityNotFound](err); ok {
+			return nil, gqlutils.NotFound(ctx, err)
+		}
 
-		if isNotFoundErr {
+		if _, ok := errors.AsType[*iam.ErrSessionNotFound](err); ok {
+			return nil, gqlutils.NotFound(ctx, err)
+		}
+
+		if _, ok := errors.AsType[*iam.ErrProfileNotFound](err); ok {
+			return nil, gqlutils.NotFound(ctx, err)
+		}
+
+		if _, ok := errors.AsType[*iam.ErrMembershipNotFound](err); ok {
+			return nil, gqlutils.NotFound(ctx, err)
+		}
+
+		if _, ok := errors.AsType[*iam.ErrInvitationNotFound](err); ok {
 			return nil, gqlutils.NotFound(ctx, err)
 		}
 

pkg/server/api/connect/v1/invitation_resolvers.go

@@ -36,16 +36,11 @@ func (r *mutationResolver) InviteUser(ctx context.Context, input types.InviteUse
 		},
 	)
 	if err != nil {
-		var (
-			errOrganizationNotFound *iam.ErrOrganizationNotFound
-			errUserAlreadyExists    *iam.ErrUserAlreadyExists
-		)
-
-		if errors.As(err, &errOrganizationNotFound) {
+		if _, ok := errors.AsType[*iam.ErrOrganizationNotFound](err); ok {
 			return nil, gqlutils.NotFound(ctx, err)
 		}
 
-		if errors.As(err, &errUserAlreadyExists) {
+		if _, ok := errors.AsType[*iam.ErrUserAlreadyExists](err); ok {
 			return nil, gqlutils.Conflict(ctx, err)
 		}
 

pkg/server/api/connect/v1/membership_resolvers.go

@@ -32,8 +32,7 @@ func (r *membershipResolver) LastSession(ctx context.Context, obj *types.Members
 
 	childSession, err := r.iam.SessionService.GetActiveSessionForMembership(ctx, session.ID, obj.ID)
 	if err != nil {
-		var errSessionNotFound *iam.ErrSessionNotFound
-		if errors.As(err, &errSessionNotFound) {
+		if _, ok := errors.AsType[*iam.ErrSessionNotFound](err); ok {
 			return nil, nil
 		}
 

pkg/server/api/connect/v1/organization_resolvers.go

@@ -263,8 +263,7 @@ func (r *organizationResolver) ScimConfiguration(ctx context.Context, obj *types
 
 	config, err := r.iam.OrganizationService.GetSCIMConfiguration(ctx, obj.ID)
 	if err != nil {
-		var notFound *iam.ErrNoSCIMConfigurationFound
-		if errors.As(err, &notFound) {
+		if _, ok := errors.AsType[*iam.ErrNoSCIMConfigurationFound](err); ok {
 			return nil, nil
 		}
 
@@ -348,8 +347,7 @@ func (r *organizationResolver) Viewer(ctx context.Context, obj *types.Organizati
 
 	profile, err := r.iam.OrganizationService.GetProfileForIdentityAndOrganization(ctx, identity.ID, obj.ID)
 	if err != nil {
-		var errNotFound *iam.ErrProfileNotFound
-		if errors.As(err, &errNotFound) {
+		if _, ok := errors.AsType[*iam.ErrProfileNotFound](err); ok {
 			return nil, gqlutils.NotFound(ctx, err)
 		}
 

pkg/server/api/connect/v1/profile_resolvers.go

@@ -41,8 +41,7 @@ func (r *mutationResolver) CreateUser(ctx context.Context, input types.CreateUse
 		},
 	)
 	if err != nil {
-		var errAlreadyExists *iam.ErrUserAlreadyExists
-		if errors.As(err, &errAlreadyExists) {
+		if _, ok := errors.AsType[*iam.ErrUserAlreadyExists](err); ok {
 			return nil, gqlutils.Conflict(ctx, err)
 		}
 
@@ -113,16 +112,11 @@ func (r *mutationResolver) RemoveUser(ctx context.Context, input types.RemoveUse
 
 	err := r.iam.OrganizationService.RemoveUser(ctx, input.OrganizationID, input.ProfileID)
 	if err != nil {
-		var (
-			errManagedBySCIM   *iam.ErrUserManagedBySCIM
-			errLastActiveOwner *iam.ErrLastActiveOwner
-		)
-
-		if errors.As(err, &errManagedBySCIM) {
+		if _, ok := errors.AsType[*iam.ErrUserManagedBySCIM](err); ok {
 			return nil, gqlutils.Conflict(ctx, err)
 		}
 
-		if errors.As(err, &errLastActiveOwner) {
+		if _, ok := errors.AsType[*iam.ErrLastActiveOwner](err); ok {
 			return nil, gqlutils.Conflict(ctx, err)
 		}
 
@@ -147,8 +141,7 @@ func (r *profileResolver) Identity(ctx context.Context, obj *types.Profile) (*ty
 
 	identity, err := r.iam.AccountService.GetIdentity(ctx, obj.Identity.ID)
 	if err != nil {
-		var errNotFound *iam.ErrIdentityNotFound
-		if errors.As(err, &errNotFound) {
+		if _, ok := errors.AsType[*iam.ErrIdentityNotFound](err); ok {
 			return nil, gqlutils.NotFound(ctx, err)
 		}
 
@@ -168,8 +161,7 @@ func (r *profileResolver) Organization(ctx context.Context, obj *types.Profile)
 
 	organization, err := r.iam.OrganizationService.GetOrganization(ctx, obj.Organization.ID)
 	if err != nil {
-		var errNotFound *iam.ErrOrganizationNotFound
-		if errors.As(err, &errNotFound) {
+		if _, ok := errors.AsType[*iam.ErrOrganizationNotFound](err); ok {
 			return nil, gqlutils.NotFound(ctx, err)
 		}
 
@@ -189,8 +181,7 @@ func (r *profileResolver) Membership(ctx context.Context, obj *types.Profile) (*
 
 	membership, err := r.iam.AccountService.GetMembershipForOrganization(ctx, obj.Identity.ID, obj.Organization.ID)
 	if err != nil {
-		var errNotFound *iam.ErrMembershipNotFound
-		if errors.As(err, &errNotFound) {
+		if _, ok := errors.AsType[*iam.ErrMembershipNotFound](err); ok {
 			return nil, gqlutils.NotFound(ctx, err)
 		}
 

pkg/server/api/connect/v1/saml_resolvers.go

@@ -44,8 +44,7 @@ func (r *mutationResolver) CreateSAMLConfiguration(ctx context.Context, input ty
 		req,
 	)
 	if err != nil {
-		var errSAMLConfigurationEmailDomainAlreadyExists *iam.ErrSAMLConfigurationEmailDomainAlreadyExists
-		if errors.As(err, &errSAMLConfigurationEmailDomainAlreadyExists) {
+		if _, ok := errors.AsType[*iam.ErrSAMLConfigurationEmailDomainAlreadyExists](err); ok {
 			return nil, gqlutils.Conflict(ctx, err)
 		}
 

pkg/server/api/connect/v1/scim_handler.go

@@ -131,8 +131,7 @@ func (h *SCIMHandler) BearerTokenMiddleware(next http.Handler) http.Handler {
 
 		config, err := h.iam.SCIMService.ValidateToken(r.Context(), token)
 		if err != nil {
-			var invalidToken *scimservice.ErrSCIMInvalidToken
-			if errors.As(err, &invalidToken) {
+			if _, ok := errors.AsType[*scimservice.ErrSCIMInvalidToken](err); ok {
 				httpserver.RenderError(w, http.StatusUnauthorized, errors.New("invalid token"))
 				return
 			}
@@ -149,8 +148,7 @@ func (h *SCIMHandler) BearerTokenMiddleware(next http.Handler) http.Handler {
 }
 
 func (rc *scimRequestContext) logAndWrapError(err error, logMsg string) error {
-	var scimErr scimerrors.ScimError
-	if errors.As(err, &scimErr) {
+	if scimErr, ok := errors.AsType[scimerrors.ScimError](err); ok {
 		errMsg := scimErr.Detail
 
 		// Don't reference profileID for 404 errors - the resource doesn't exist

pkg/server/api/connect/v1/scim_resolvers.go

@@ -121,8 +121,7 @@ func (r *sCIMBridgeResolver) ScimConfiguration(ctx context.Context, obj *types.S
 
 	scimConfiguration, err := r.iam.GetSCIMConfiguration(ctx, obj.ScimConfiguration.ID)
 	if err != nil {
-		var errNoSCIMConfigurationFound *iam.ErrNoSCIMConfigurationFound
-		if errors.As(err, &errNoSCIMConfigurationFound) {
+		if _, ok := errors.AsType[*iam.ErrNoSCIMConfigurationFound](err); ok {
 			return nil, nil
 		}
 
@@ -183,8 +182,7 @@ func (r *sCIMConfigurationResolver) Organization(ctx context.Context, obj *types
 
 	organization, err := r.iam.OrganizationService.GetOrganization(ctx, obj.Organization.ID)
 	if err != nil {
-		var errOrganizationNotFound *iam.ErrOrganizationNotFound
-		if errors.As(err, &errOrganizationNotFound) {
+		if _, ok := errors.AsType[*iam.ErrOrganizationNotFound](err); ok {
 			return nil, nil
 		}
 
@@ -208,8 +206,7 @@ func (r *sCIMConfigurationResolver) Bridge(ctx context.Context, obj *types.SCIMC
 
 	bridge, err := r.iam.OrganizationService.GetSCIMBridgeByID(ctx, obj.Bridge.ID)
 	if err != nil {
-		var errSCIMBridgeNotFound *iam.ErrSCIMBridgeNotFound
-		if errors.As(err, &errSCIMBridgeNotFound) {
+		if _, ok := errors.AsType[*iam.ErrSCIMBridgeNotFound](err); ok {
 			return nil, nil
 		}
 

pkg/server/api/connect/v1/session_resolvers.go

@@ -22,13 +22,11 @@ import (
 func (r *mutationResolver) SignIn(ctx context.Context, input types.SignInInput) (*types.SignInPayload, error) {
 	identity, err := r.iam.AuthService.CheckCredentials(ctx, input.Email, input.Password)
 	if err != nil {
-		var errInvalidPassword *iam.ErrInvalidPassword
-		if errors.As(err, &errInvalidPassword) {
+		if _, ok := errors.AsType[*iam.ErrInvalidPassword](err); ok {
 			return nil, gqlutils.Invalid(ctx, err)
 		}
 
-		var errInvalidCredentials *iam.ErrInvalidCredentials
-		if errors.As(err, &errInvalidCredentials) {
+		if _, ok := errors.AsType[*iam.ErrInvalidCredentials](err); ok {
 			return nil, &gqlerror.Error{
 				Message: err.Error(),
 				Extensions: map[string]any{
@@ -81,12 +79,11 @@ func (r *mutationResolver) SignIn(ctx context.Context, input types.SignInInput)
 		_, _, err = r.iam.SessionService.OpenPasswordChildSessionForOrganization(ctx, session.ID, *input.OrganizationID)
 		if err != nil {
 			// Here session middleware already took care of expired/nil root session so we only handle membership related errors
-			var (
-				errMembershipNotFound *iam.ErrMembershipNotFound
-				errUserInactive       *iam.ErrUserInactive
-			)
+			if _, ok := errors.AsType[*iam.ErrMembershipNotFound](err); ok {
+				return nil, gqlutils.Forbiddenf(ctx, "forbidden")
+			}
 
-			if errors.As(err, &errMembershipNotFound) || errors.As(err, &errUserInactive) {
+			if _, ok := errors.AsType[*iam.ErrUserInactive](err); ok {
 				return nil, gqlutils.Forbiddenf(ctx, "forbidden")
 			}
 
@@ -113,13 +110,11 @@ func (r *mutationResolver) SignUp(ctx context.Context, input types.SignUpInput)
 		},
 	)
 	if err != nil {
-		var errIdentityAlreadyExists *iam.ErrIdentityAlreadyExists
-		if errors.As(err, &errIdentityAlreadyExists) {
+		if _, ok := errors.AsType[*iam.ErrIdentityAlreadyExists](err); ok {
 			return nil, gqlutils.Invalid(ctx, err)
 		}
 
-		var errSignupDisabled *iam.ErrSignupDisabled
-		if errors.As(err, &errSignupDisabled) {
+		if _, ok := errors.AsType[*iam.ErrSignupDisabled](err); ok {
 			return nil, gqlutils.Forbidden(ctx, err)
 		}
 
@@ -142,8 +137,7 @@ func (r *mutationResolver) SignOut(ctx context.Context) (*types.SignOutPayload,
 
 	err := r.iam.SessionService.CloseSession(ctx, session.ID)
 	if err != nil {
-		var ErrSessionNotFound *iam.ErrSessionNotFound
-		if errors.As(err, &ErrSessionNotFound) {
+		if _, ok := errors.AsType[*iam.ErrSessionNotFound](err); ok {
 			return &types.SignOutPayload{}, nil
 		}
 
@@ -166,8 +160,7 @@ func (r *mutationResolver) ActivateAccount(ctx context.Context, input types.Acti
 		// Sign out any other account before activating a new one
 		err := r.iam.SessionService.CloseSession(ctx, session.ID)
 		if err != nil {
-			var ErrSessionNotFound *iam.ErrSessionNotFound
-			if !errors.As(err, &ErrSessionNotFound) {
+			if _, ok := errors.AsType[*iam.ErrSessionNotFound](err); !ok {
 				r.logger.ErrorCtx(ctx, "cannot close session", log.Error(err))
 				return nil, gqlutils.Internal(ctx)
 			}
@@ -184,17 +177,15 @@ func (r *mutationResolver) ActivateAccount(ctx context.Context, input types.Acti
 		},
 	)
 	if err != nil {
-		var (
-			errInvalidToken       *iam.ErrInvalidToken
-			errInvitationNotFound *iam.ErrInvitationNotFound
-			errInvitationExpired  *iam.ErrInvitationExpired
+		if _, ok := errors.AsType[*iam.ErrInvalidToken](err); ok {
+			return nil, gqlutils.Invalid(ctx, err)
+		}
 
-			isInvalidErr = errors.As(err, &errInvalidToken) ||
-				errors.As(err, &errInvitationNotFound) ||
-				errors.As(err, &errInvitationExpired)
-		)
+		if _, ok := errors.AsType[*iam.ErrInvitationNotFound](err); ok {
+			return nil, gqlutils.Invalid(ctx, err)
+		}
 
-		if isInvalidErr {
+		if _, ok := errors.AsType[*iam.ErrInvitationExpired](err); ok {
 			return nil, gqlutils.Invalid(ctx, err)
 		}
 
@@ -276,8 +267,7 @@ func (r *mutationResolver) ResetPassword(ctx context.Context, input types.ResetP
 		},
 	)
 	if err != nil {
-		var errInvalidToken *iam.ErrInvalidToken
-		if errors.As(err, &errInvalidToken) {
+		if _, ok := errors.AsType[*iam.ErrInvalidToken](err); ok {
 			return nil, gqlutils.Invalid(ctx, err)
 		}
 
@@ -295,25 +285,19 @@ func (r *mutationResolver) ResetPassword(ctx context.Context, input types.ResetP
 func (r *mutationResolver) VerifyEmail(ctx context.Context, input types.VerifyEmailInput) (*types.VerifyEmailPayload, error) {
 	err := r.iam.AccountService.VerifyEmail(ctx, input.Token)
 	if err != nil {
-		var (
-			errInvalidToken              *iam.ErrInvalidToken
-			errIdentityNotFound          *iam.ErrIdentityNotFound
-			errEmailAlreadyVerified      *iam.ErrEmailAlreadyVerified
-			errEmailVerificationMismatch *iam.ErrEmailVerificationMismatch
-
-			isInvalidErr = errors.As(err, &errInvalidToken) ||
-				errors.As(err, &errEmailVerificationMismatch)
-		)
-
-		if isInvalidErr {
+		if _, ok := errors.AsType[*iam.ErrInvalidToken](err); ok {
 			return nil, gqlutils.Invalid(ctx, err)
 		}
 
-		if errors.As(err, &errEmailAlreadyVerified) {
+		if _, ok := errors.AsType[*iam.ErrEmailVerificationMismatch](err); ok {
+			return nil, gqlutils.Invalid(ctx, err)
+		}
+
+		if _, ok := errors.AsType[*iam.ErrEmailAlreadyVerified](err); ok {
 			return nil, gqlutils.Conflict(ctx, err)
 		}
 
-		if errors.As(err, &errIdentityNotFound) {
+		if _, ok := errors.AsType[*iam.ErrIdentityNotFound](err); ok {
 			return nil, gqlutils.NotFound(ctx, err)
 		}
 
@@ -342,16 +326,11 @@ func (r *mutationResolver) ChangePassword(ctx context.Context, input types.Chang
 		},
 	)
 	if err != nil {
-		var (
-			errInvalidPassword  *iam.ErrInvalidPassword
-			errIdentityNotFound *iam.ErrIdentityNotFound
-		)
-
-		if errors.As(err, &errInvalidPassword) {
+		if _, ok := errors.AsType[*iam.ErrInvalidPassword](err); ok {
 			return nil, gqlutils.Invalid(ctx, err)
 		}
 
-		if errors.As(err, &errIdentityNotFound) {
+		if _, ok := errors.AsType[*iam.ErrIdentityNotFound](err); ok {
 			return nil, gqlutils.NotFound(ctx, err)
 		}
 
@@ -378,16 +357,11 @@ func (r *mutationResolver) ChangeEmail(ctx context.Context, input types.ChangeEm
 		},
 	)
 	if err != nil {
-		var (
-			errInvalidPassword  *iam.ErrInvalidPassword
-			errIdentityNotFound *iam.ErrIdentityNotFound
-		)
-
-		if errors.As(err, &errInvalidPassword) {
+		if _, ok := errors.AsType[*iam.ErrInvalidPassword](err); ok {
 			return nil, gqlutils.Invalid(ctx, err)
 		}
 
-		if errors.As(err, &errIdentityNotFound) {
+		if _, ok := errors.AsType[*iam.ErrIdentityNotFound](err); ok {
 			return nil, gqlutils.NotFound(ctx, err)
 		}
 
@@ -407,34 +381,28 @@ func (r *mutationResolver) AssumeOrganizationSession(ctx context.Context, input
 
 	childSession, membership, err := r.iam.SessionService.AssumeOrganizationSession(ctx, rootSession.ID, input.OrganizationID, input.Continue)
 	if err != nil {
-		var (
-			errMembershipNotFound             *iam.ErrMembershipNotFound
-			errPasswordAuthenticationRequired *iam.ErrPasswordAuthenticationRequired
-			errSAMLAuthenticationRequired     *iam.ErrSAMLAuthenticationRequired
-		)
-
-		switch {
-		case errors.As(err, &errMembershipNotFound):
+		if _, ok := errors.AsType[*iam.ErrMembershipNotFound](err); ok {
 			return nil, gqlutils.NotFound(ctx, err)
+		}
 
-		case errors.As(err, &errPasswordAuthenticationRequired):
+		if errPasswordAuthenticationRequired, ok := errors.AsType[*iam.ErrPasswordAuthenticationRequired](err); ok {
 			return &types.AssumeOrganizationSessionPayload{
 				Result: types.PasswordRequired{
 					Reason: types.ReauthenticationReason(errPasswordAuthenticationRequired.Reason),
 				},
 			}, nil
+		}
 
-		case errors.As(err, &errSAMLAuthenticationRequired):
+		if errSAMLAuthenticationRequired, ok := errors.AsType[*iam.ErrSAMLAuthenticationRequired](err); ok {
 			return &types.AssumeOrganizationSessionPayload{
 				Result: types.SAMLAuthenticationRequired{
 					Reason: types.ReauthenticationReason(errSAMLAuthenticationRequired.Reason),
 				},
 			}, nil
-
-		default:
-			r.logger.ErrorCtx(ctx, "cannot assume organization session", log.Error(err))
-			return nil, gqlutils.Internal(ctx)
 		}
+
+		r.logger.ErrorCtx(ctx, "cannot assume organization session", log.Error(err))
+		return nil, gqlutils.Internal(ctx)
 	}
 
 	return &types.AssumeOrganizationSessionPayload{
@@ -455,8 +423,7 @@ func (r *mutationResolver) RevokeSession(ctx context.Context, input types.Revoke
 
 	err := r.iam.SessionService.RevokeSession(ctx, identity.ID, input.SessionID)
 	if err != nil {
-		var ErrSessionExpired *iam.ErrSessionExpired
-		if errors.As(err, &ErrSessionExpired) {
+		if _, ok := errors.AsType[*iam.ErrSessionExpired](err); ok {
 			return &types.RevokeSessionPayload{Success: true}, nil
 		}
 

pkg/server/api/mcp/mcputils/recovery.go

@@ -55,13 +55,11 @@ func NewRecoverFunc(logger *log.Logger) mcpgenmcp.RecoverFunc {
 // those. Unknown errors are logged and replaced with a generic internal error
 // to avoid leaking implementation details to the client.
 func sanitizeError(ctx context.Context, logger *log.Logger, err error) error {
-	var permissionDeniedErr *iam.ErrInsufficientPermissions
-	if errors.As(err, &permissionDeniedErr) {
+	if _, ok := errors.AsType[*iam.ErrInsufficientPermissions](err); ok {
 		return fmt.Errorf("permission denied")
 	}
 
-	var assumptionRequiredErr *iam.ErrAssumptionRequired
-	if errors.As(err, &assumptionRequiredErr) {
+	if _, ok := errors.AsType[*iam.ErrAssumptionRequired](err); ok {
 		return fmt.Errorf("assumption required")
 	}
 
@@ -77,13 +75,11 @@ func sanitizeError(ctx context.Context, logger *log.Logger, err error) error {
 		return fmt.Errorf("resource is in use")
 	}
 
-	var validationErrors validator.ValidationErrors
-	if errors.As(err, &validationErrors) {
+	if validationErrors, ok := errors.AsType[validator.ValidationErrors](err); ok {
 		return validationErrors
 	}
 
-	var validationError *validator.ValidationError
-	if errors.As(err, &validationError) {
+	if validationError, ok := errors.AsType[*validator.ValidationError](err); ok {
 		return validationError
 	}
 

pkg/server/api/mcp/v1/middleware.go

@@ -15,9 +15,8 @@
 package mcp_v1
 
 import (
-	"net/http"
-
 	"errors"
+	"net/http"
 
 	"go.gearno.de/kit/httpserver"
 	"go.gearno.de/kit/log"

pkg/server/api/mcp/v1/schema.resolvers.go

@@ -2435,8 +2435,7 @@ func (r *Resolver) ListUsersTool(ctx context.Context, req *mcp.CallToolRequest,
 func (r *Resolver) GetUserTool(ctx context.Context, req *mcp.CallToolRequest, input *types.GetUserInput) (*mcp.CallToolResult, types.GetUserOutput, error) {
 	profile, err := r.iamSvc.OrganizationService.GetProfile(ctx, input.ID)
 	if err != nil {
-		var errNotFound *iam.ErrProfileNotFound
-		if errors.As(err, &errNotFound) {
+		if _, ok := errors.AsType[*iam.ErrProfileNotFound](err); ok {
 			return nil, types.GetUserOutput{}, fmt.Errorf("user not found: %w", err)
 		}
 
@@ -2472,8 +2471,7 @@ func (r *Resolver) CreateUserTool(ctx context.Context, req *mcp.CallToolRequest,
 		ContractEndDate:          contractEnd,
 	})
 	if err != nil {
-		var errAlreadyExists *iam.ErrUserAlreadyExists
-		if errors.As(err, &errAlreadyExists) {
+		if _, ok := errors.AsType[*iam.ErrUserAlreadyExists](err); ok {
 			return nil, types.CreateUserOutput{}, fmt.Errorf("user with email already exists: %w", err)
 		}
 
@@ -2491,16 +2489,11 @@ func (r *Resolver) InviteUserTool(ctx context.Context, req *mcp.CallToolRequest,
 		ProfileID:      input.ProfileID,
 	})
 	if err != nil {
-		var (
-			errOrgNotFound *iam.ErrOrganizationNotFound
-			errUserExists  *iam.ErrUserAlreadyExists
-		)
-
-		if errors.As(err, &errOrgNotFound) {
+		if _, ok := errors.AsType[*iam.ErrOrganizationNotFound](err); ok {
 			return nil, types.InviteUserOutput{}, fmt.Errorf("organization not found: %w", err)
 		}
 
-		if errors.As(err, &errUserExists) {
+		if _, ok := errors.AsType[*iam.ErrUserAlreadyExists](err); ok {
 			return nil, types.InviteUserOutput{}, fmt.Errorf("user already in organization: %w", err)
 		}
 
@@ -2574,16 +2567,11 @@ func (r *Resolver) RemoveUserTool(ctx context.Context, req *mcp.CallToolRequest,
 
 	err := r.iamSvc.OrganizationService.RemoveUser(ctx, input.OrganizationID, input.ProfileID)
 	if err != nil {
-		var (
-			errManagedBySCIM *iam.ErrUserManagedBySCIM
-			errLastOwner     *iam.ErrLastActiveOwner
-		)
-
-		if errors.As(err, &errManagedBySCIM) {
+		if _, ok := errors.AsType[*iam.ErrUserManagedBySCIM](err); ok {
 			return nil, types.RemoveUserOutput{}, fmt.Errorf("user is managed by SCIM and cannot be removed: %w", err)
 		}
 
-		if errors.As(err, &errLastOwner) {
+		if _, ok := errors.AsType[*iam.ErrLastActiveOwner](err); ok {
 			return nil, types.RemoveUserOutput{}, fmt.Errorf("cannot remove last active owner: %w", err)
 		}
 
@@ -5189,8 +5177,7 @@ func (r *Resolver) GetSCIMConfigurationTool(ctx context.Context, req *mcp.CallTo
 
 	config, err := r.iamSvc.OrganizationService.GetSCIMConfiguration(ctx, input.OrganizationID)
 	if err != nil {
-		var errNotFound *iam.ErrNoSCIMConfigurationFound
-		if errors.As(err, &errNotFound) {
+		if _, ok := errors.AsType[*iam.ErrNoSCIMConfigurationFound](err); ok {
 			return nil, types.GetSCIMConfigurationOutput{}, fmt.Errorf("SCIM configuration not found")
 		}
 
@@ -5255,8 +5242,7 @@ func (r *Resolver) GetSCIMBridgeTool(ctx context.Context, req *mcp.CallToolReque
 
 	bridge, err := r.iamSvc.OrganizationService.GetSCIMBridgeByID(ctx, input.ID)
 	if err != nil {
-		var errNotFound *iam.ErrSCIMBridgeNotFound
-		if errors.As(err, &errNotFound) {
+		if _, ok := errors.AsType[*iam.ErrSCIMBridgeNotFound](err); ok {
 			return nil, types.GetSCIMBridgeOutput{}, fmt.Errorf("SCIM bridge %s not found", input.ID)
 		}
 

pkg/server/api/trust/v1/auth_resolvers.go

@@ -7,8 +7,8 @@ package trust_v1
 
 import (
 	"context"
-	"errors"
 
+	"errors"
 	"go.gearno.de/kit/log"
 	"go.probo.inc/probo/pkg/baseurl"
 	"go.probo.inc/probo/pkg/coredata"
@@ -58,13 +58,11 @@ func (r *mutationResolver) VerifyMagicLink(ctx context.Context, input types.Veri
 
 	email, err := r.iam.AuthService.GetMagicLinkEmail(ctx, input.Token)
 	if err != nil {
-		var errExpiredToken *iam.ErrExpiredToken
-		if errors.As(err, &errExpiredToken) {
+		if _, ok := errors.AsType[*iam.ErrExpiredToken](err); ok {
 			return nil, gqlutils.Invalid(ctx, err)
 		}
 
-		var errInvalidToken *iam.ErrInvalidToken
-		if errors.As(err, &errInvalidToken) {
+		if _, ok := errors.AsType[*iam.ErrInvalidToken](err); ok {
 			return nil, gqlutils.Invalid(ctx, err)
 		}
 
@@ -81,15 +79,13 @@ func (r *mutationResolver) VerifyMagicLink(ctx context.Context, input types.Veri
 
 		identity, session, continueURL, err = r.iam.AuthService.OpenSessionWithMagicLink(ctx, input.Token)
 		if err != nil {
-			var errExpiredToken *iam.ErrExpiredToken
-			if errors.As(err, &errExpiredToken) {
-				return nil, gqlutils.Invalid(ctx, err)
-			}
+		if _, ok := errors.AsType[*iam.ErrExpiredToken](err); ok {
+			return nil, gqlutils.Invalid(ctx, err)
+		}
 
-			var errInvalidToken *iam.ErrInvalidToken
-			if errors.As(err, &errInvalidToken) {
-				return nil, gqlutils.Invalid(ctx, err)
-			}
+		if _, ok := errors.AsType[*iam.ErrInvalidToken](err); ok {
+			return nil, gqlutils.Invalid(ctx, err)
+		}
 
 			r.logger.ErrorCtx(ctx, "cannot open session with magic link", log.Error(err))
 
@@ -105,15 +101,13 @@ func (r *mutationResolver) VerifyMagicLink(ctx context.Context, input types.Veri
 
 		identity, session, continueURL, err = r.iam.AuthService.OpenSessionWithMagicLink(ctx, input.Token)
 		if err != nil {
-			var errExpiredToken *iam.ErrExpiredToken
-			if errors.As(err, &errExpiredToken) {
-				return nil, gqlutils.Invalid(ctx, err)
-			}
+		if _, ok := errors.AsType[*iam.ErrExpiredToken](err); ok {
+			return nil, gqlutils.Invalid(ctx, err)
+		}
 
-			var errInvalidToken *iam.ErrInvalidToken
-			if errors.As(err, &errInvalidToken) {
-				return nil, gqlutils.Invalid(ctx, err)
-			}
+		if _, ok := errors.AsType[*iam.ErrInvalidToken](err); ok {
+			return nil, gqlutils.Invalid(ctx, err)
+		}
 
 			r.logger.ErrorCtx(ctx, "cannot open session with magic link", log.Error(err))