fix(auth): satisfy lint for manual auth flow

Author: salmonumbrella

internal/cmd/auth.go

@@ -549,15 +549,15 @@ func (c *AuthAddCmd) Run(ctx context.Context) error {
 			if authURL != "" || authCode != "" {
 				return usage("remote step 1 does not accept --auth-url or --auth-code")
 			}
-			result, err := manualAuthURL(ctx, googleauth.AuthorizeOptions{
+			result, manualErr := manualAuthURL(ctx, googleauth.AuthorizeOptions{
 				Services:     services,
 				Scopes:       scopes,
 				Manual:       true,
 				ForceConsent: c.ForceConsent,
 				Client:       client,
 			})
-			if err != nil {
-				return err
+			if manualErr != nil {
+				return manualErr
 			}
 			if outfmt.IsJSON(ctx) {
 				return outfmt.WriteJSON(os.Stdout, map[string]any{

internal/googleauth/manual_state.go

@@ -33,7 +33,7 @@ var (
 func manualStatePath() (string, error) {
 	dir, err := config.EnsureDir()
 	if err != nil {
-		return "", err
+		return "", fmt.Errorf("ensure config dir: %w", err)
 	}
 
 	return filepath.Join(dir, manualStateFilename), nil
@@ -48,24 +48,35 @@ func loadManualState(client string, scopes []string, forceConsent bool) (string,
 	data, err := os.ReadFile(path) //nolint:gosec // config path
 	if err != nil {
 		if os.IsNotExist(err) {
-			return "", false, nil
+			err = nil
+			return "", false, err
 		}
+
 		return "", false, fmt.Errorf("read manual auth state: %w", err)
 	}
 
 	var st manualState
-	if err := json.Unmarshal(data, &st); err != nil {
+
+	unmarshalErr := json.Unmarshal(data, &st)
+	if unmarshalErr != nil {
 		_ = os.Remove(path)
-		return "", false, nil
+		unmarshalErr = nil
+
+		return "", false, unmarshalErr //nolint:nilerr // invalid state should be treated as a cache miss
 	}
+
 	if st.State == "" {
 		_ = os.Remove(path)
+
 		return "", false, nil
 	}
+
 	if manualStateNowFn().Sub(st.CreatedAt) > manualStateTTL {
 		_ = os.Remove(path)
+
 		return "", false, nil
 	}
+
 	if st.Client != client || st.ForceConsent != forceConsent || !scopesEqual(st.Scopes, scopes) {
 		return "", false, nil
 	}
@@ -84,22 +95,29 @@ func loadManualStateStrict(client string, scopes []string, forceConsent bool) (s
 		if os.IsNotExist(err) {
 			return "", errManualStateMissing
 		}
+
 		return "", fmt.Errorf("read manual auth state: %w", err)
 	}
 
 	var st manualState
 	if err := json.Unmarshal(data, &st); err != nil {
 		_ = os.Remove(path)
+
 		return "", errManualStateMissing
 	}
+
 	if st.State == "" {
 		_ = os.Remove(path)
+
 		return "", errManualStateMissing
 	}
+
 	if manualStateNowFn().Sub(st.CreatedAt) > manualStateTTL {
 		_ = os.Remove(path)
+
 		return "", errManualStateMissing
 	}
+
 	if st.Client != client || st.ForceConsent != forceConsent || !scopesEqual(st.Scopes, scopes) {
 		return "", errManualStateMismatch
 	}
@@ -125,12 +143,14 @@ func saveManualState(client string, scopes []string, forceConsent bool, state st
 	if err != nil {
 		return fmt.Errorf("encode manual auth state: %w", err)
 	}
+
 	data = append(data, '\n')
 
 	tmp := path + ".tmp"
 	if err := os.WriteFile(tmp, data, 0o600); err != nil {
 		return fmt.Errorf("write manual auth state: %w", err)
 	}
+
 	if err := os.Rename(tmp, path); err != nil {
 		return fmt.Errorf("commit manual auth state: %w", err)
 	}
@@ -148,6 +168,7 @@ func clearManualState() error {
 		if os.IsNotExist(err) {
 			return nil
 		}
+
 		return fmt.Errorf("remove manual auth state: %w", err)
 	}
 
@@ -161,6 +182,7 @@ func normalizeScopes(scopes []string) []string {
 
 	out := append([]string(nil), scopes...)
 	sort.Strings(out)
+
 	return out
 }
 
@@ -170,10 +192,12 @@ func scopesEqual(a, b []string) bool {
 	}
 	na := normalizeScopes(a)
 	nb := normalizeScopes(b)
+
 	for i := range na {
 		if na[i] != nb[i] {
 			return false
 		}
 	}
+
 	return true
 }

internal/googleauth/manual_state_test.go

@@ -12,11 +12,13 @@ func TestManualAuthURL_ReusesState(t *testing.T) {
 	origRead := readClientCredentials
 	origEndpoint := oauthEndpoint
 	origState := randomStateFn
+
 	t.Cleanup(func() {
 		readClientCredentials = origRead
 		oauthEndpoint = origEndpoint
 		randomStateFn = origState
 	})
+
 	useTempManualStatePath(t)
 
 	readClientCredentials = func(string) (config.ClientCredentials, error) {
@@ -29,6 +31,7 @@ func TestManualAuthURL_ReusesState(t *testing.T) {
 		if stateCalls == 1 {
 			return "state1", nil
 		}
+
 		return "state2", nil
 	}
 
@@ -39,6 +42,7 @@ func TestManualAuthURL_ReusesState(t *testing.T) {
 	if err != nil {
 		t.Fatalf("ManualAuthURL: %v", err)
 	}
+
 	res2, err := ManualAuthURL(context.Background(), AuthorizeOptions{
 		Scopes: []string{"s1"},
 		Manual: true,
@@ -48,23 +52,28 @@ func TestManualAuthURL_ReusesState(t *testing.T) {
 	}
 
 	state1 := authURLState(t, res1.URL)
+
 	state2 := authURLState(t, res2.URL)
 	if state1 != "state1" || state2 != "state1" {
 		t.Fatalf("expected reused state, got state1=%q state2=%q", state1, state2)
 	}
+
 	if !res2.StateReused {
 		t.Fatalf("expected state_reused true on second call")
 	}
+
 	if stateCalls != 1 {
 		t.Fatalf("expected randomStateFn called once, got %d", stateCalls)
 	}
 }
 
 func authURLState(t *testing.T, rawURL string) string {
 	t.Helper()
+
 	parsed, err := url.Parse(rawURL)
 	if err != nil {
 		t.Fatalf("parse auth URL: %v", err)
 	}
+
 	return parsed.Query().Get("state")
 }