Octopus Germany: Fix Access Validation Infinite Loop

[r0oland]

fix issue #29041

[sourcery-ai]

Hey - I've found 1 issue, and left some high level feedback:

• Relying on strings.Contains against error messages (especially the generic "Invalid data") is brittle; if possible, prefer checking concrete error types or well-defined error codes from ActiveAgreement so authentication failures can be identified more robustly.
• Instead of using the authErr side flag, consider returning a wrapped sentinel error (e.g., ErrAuthFailed) from the backoff closure and then branching on errors.Is(err, ErrAuthFailed) after Retry so the control flow is clearer and less stateful.

Prompt for AI Agents

Please address the comments from this code review:

## Overall Comments
- Relying on `strings.Contains` against error messages (especially the generic `"Invalid data"`) is brittle; if possible, prefer checking concrete error types or well-defined error codes from `ActiveAgreement` so authentication failures can be identified more robustly.
- Instead of using the `authErr` side flag, consider returning a wrapped sentinel error (e.g., `ErrAuthFailed`) from the backoff closure and then branching on `errors.Is(err, ErrAuthFailed)` after `Retry` so the control flow is clearer and less stateful.

## Individual Comments

### Comment 1
<location path="tariff/octopusde.go" line_range="98-100" />
<code_context>
 		if err := backoff.Retry(func() error {
 			agr, err := t.gqlClient.ActiveAgreement()
 			if err != nil {
+				// Check for authentication errors and mark them as permanent
+				errMsg := err.Error()
+				if strings.Contains(errMsg, "authentication failed") || strings.Contains(errMsg, "Invalid data") {
+					authErr = true
+					return backoff.Permanent(err)
</code_context>
<issue_to_address>
**issue (bug_risk):** String-based auth error detection is brittle and may misclassify errors.

Relying on `err.Error()` substrings like "authentication failed" or a generic "Invalid data" makes this logic fragile and easy to break if messages change or collide with other errors. Where possible, use a typed error (e.g. `var ErrAuth`), a client error code, or another stable discriminator instead of message text to avoid misclassifying auth failures.
</issue_to_address>

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}

[naltatis]

Hi @r0oland. Please pick descriptive PR title.

[andig]

what does "configuration error" mean here?

[andig]

Suggested change

	func isAuthError(err error) bool {
	func (t *OctopusDe) isAuthError(err error) bool {

[andig]

Suggested change

	errMsg := err.Error()
	return strings.Contains(errMsg, "authentication failed")
	return strings.Contains(err.Error(), "authentication failed")

[andig]

this is already after the retry. Just test for permanent error here and return if permanent?