feat: refactor api error calls to use the apierrors package

This change will help produce consistent errors as we move code
out of the api package into smaller sub packages.

Author: Chris Stockton

internal/api/admin.go

@@ -54,17 +54,17 @@ func (a *API) loadUser(w http.ResponseWriter, r *http.Request) (context.Context,
 
 	userID, err := uuid.FromString(chi.URLParam(r, "user_id"))
 	if err != nil {
-		return nil, notFoundError(apierrors.ErrorCodeValidationFailed, "user_id must be an UUID")
+		return nil, apierrors.NewNotFoundError(apierrors.ErrorCodeValidationFailed, "user_id must be an UUID")
 	}
 
 	observability.LogEntrySetField(r, "user_id", userID)
 
 	u, err := models.FindUserByID(db, userID)
 	if err != nil {
 		if models.IsNotFoundError(err) {
-			return nil, notFoundError(apierrors.ErrorCodeUserNotFound, "User not found")
+			return nil, apierrors.NewNotFoundError(apierrors.ErrorCodeUserNotFound, "User not found")
 		}
-		return nil, internalServerError("Database error loading user").WithInternalError(err)
+		return nil, apierrors.NewInternalServerError("Database error loading user").WithInternalError(err)
 	}
 
 	return withUser(ctx, u), nil
@@ -77,17 +77,17 @@ func (a *API) loadFactor(w http.ResponseWriter, r *http.Request) (context.Contex
 	user := getUser(ctx)
 	factorID, err := uuid.FromString(chi.URLParam(r, "factor_id"))
 	if err != nil {
-		return nil, notFoundError(apierrors.ErrorCodeValidationFailed, "factor_id must be an UUID")
+		return nil, apierrors.NewNotFoundError(apierrors.ErrorCodeValidationFailed, "factor_id must be an UUID")
 	}
 
 	observability.LogEntrySetField(r, "factor_id", factorID)
 
 	factor, err := user.FindOwnedFactorByID(db, factorID)
 	if err != nil {
 		if models.IsNotFoundError(err) {
-			return nil, notFoundError(apierrors.ErrorCodeMFAFactorNotFound, "Factor not found")
+			return nil, apierrors.NewNotFoundError(apierrors.ErrorCodeMFAFactorNotFound, "Factor not found")
 		}
-		return nil, internalServerError("Database error loading factor").WithInternalError(err)
+		return nil, apierrors.NewInternalServerError("Database error loading factor").WithInternalError(err)
 	}
 	return withFactor(ctx, factor), nil
 }
@@ -109,19 +109,19 @@ func (a *API) adminUsers(w http.ResponseWriter, r *http.Request) error {
 
 	pageParams, err := paginate(r)
 	if err != nil {
-		return badRequestError(apierrors.ErrorCodeValidationFailed, "Bad Pagination Parameters: %v", err).WithInternalError(err)
+		return apierrors.NewBadRequestError(apierrors.ErrorCodeValidationFailed, "Bad Pagination Parameters: %v", err).WithInternalError(err)
 	}
 
 	sortParams, err := sort(r, map[string]bool{models.CreatedAt: true}, []models.SortField{{Name: models.CreatedAt, Dir: models.Descending}})
 	if err != nil {
-		return badRequestError(apierrors.ErrorCodeValidationFailed, "Bad Sort Parameters: %v", err)
+		return apierrors.NewBadRequestError(apierrors.ErrorCodeValidationFailed, "Bad Sort Parameters: %v", err)
 	}
 
 	filter := r.URL.Query().Get("filter")
 
 	users, err := models.FindUsersInAudience(db, aud, pageParams, sortParams, filter)
 	if err != nil {
-		return internalServerError("Database error finding users").WithInternalError(err)
+		return apierrors.NewInternalServerError("Database error finding users").WithInternalError(err)
 	}
 	addPaginationHeaders(w, r, pageParams)
 
@@ -170,7 +170,7 @@ func (a *API) adminUserUpdate(w http.ResponseWriter, r *http.Request) error {
 		if params.BanDuration != "none" {
 			duration, err = time.ParseDuration(params.BanDuration)
 			if err != nil {
-				return badRequestError(apierrors.ErrorCodeValidationFailed, "invalid format for ban duration: %v", err)
+				return apierrors.NewBadRequestError(apierrors.ErrorCodeValidationFailed, "invalid format for ban duration: %v", err)
 			}
 		}
 		banDuration = &duration
@@ -315,7 +315,7 @@ func (a *API) adminUserUpdate(w http.ResponseWriter, r *http.Request) error {
 	})
 
 	if err != nil {
-		return internalServerError("Error updating user").WithInternalError(err)
+		return apierrors.NewInternalServerError("Error updating user").WithInternalError(err)
 	}
 
 	return sendJSON(w, http.StatusOK, user)
@@ -339,7 +339,7 @@ func (a *API) adminUserCreate(w http.ResponseWriter, r *http.Request) error {
 	}
 
 	if params.Email == "" && params.Phone == "" {
-		return badRequestError(apierrors.ErrorCodeValidationFailed, "Cannot create a user without either an email or phone")
+		return apierrors.NewBadRequestError(apierrors.ErrorCodeValidationFailed, "Cannot create a user without either an email or phone")
 	}
 
 	var providers []string
@@ -349,9 +349,9 @@ func (a *API) adminUserCreate(w http.ResponseWriter, r *http.Request) error {
 			return err
 		}
 		if user, err := models.IsDuplicatedEmail(db, params.Email, aud, nil); err != nil {
-			return internalServerError("Database error checking email").WithInternalError(err)
+			return apierrors.NewInternalServerError("Database error checking email").WithInternalError(err)
 		} else if user != nil {
-			return unprocessableEntityError(apierrors.ErrorCodeEmailExists, DuplicateEmailMsg)
+			return apierrors.NewUnprocessableEntityError(apierrors.ErrorCodeEmailExists, DuplicateEmailMsg)
 		}
 		providers = append(providers, "email")
 	}
@@ -362,21 +362,21 @@ func (a *API) adminUserCreate(w http.ResponseWriter, r *http.Request) error {
 			return err
 		}
 		if exists, err := models.IsDuplicatedPhone(db, params.Phone, aud); err != nil {
-			return internalServerError("Database error checking phone").WithInternalError(err)
+			return apierrors.NewInternalServerError("Database error checking phone").WithInternalError(err)
 		} else if exists {
-			return unprocessableEntityError(apierrors.ErrorCodePhoneExists, "Phone number already registered by another user")
+			return apierrors.NewUnprocessableEntityError(apierrors.ErrorCodePhoneExists, "Phone number already registered by another user")
 		}
 		providers = append(providers, "phone")
 	}
 
 	if params.Password != nil && params.PasswordHash != "" {
-		return badRequestError(apierrors.ErrorCodeValidationFailed, "Only a password or a password hash should be provided")
+		return apierrors.NewBadRequestError(apierrors.ErrorCodeValidationFailed, "Only a password or a password hash should be provided")
 	}
 
 	if (params.Password == nil || *params.Password == "") && params.PasswordHash == "" {
 		password, err := password.Generate(64, 10, 0, false, true)
 		if err != nil {
-			return internalServerError("Error generating password").WithInternalError(err)
+			return apierrors.NewInternalServerError("Error generating password").WithInternalError(err)
 		}
 		params.Password = &password
 	}
@@ -390,18 +390,18 @@ func (a *API) adminUserCreate(w http.ResponseWriter, r *http.Request) error {
 
 	if err != nil {
 		if errors.Is(err, bcrypt.ErrPasswordTooLong) {
-			return badRequestError(apierrors.ErrorCodeValidationFailed, err.Error())
+			return apierrors.NewBadRequestError(apierrors.ErrorCodeValidationFailed, err.Error())
 		}
-		return internalServerError("Error creating user").WithInternalError(err)
+		return apierrors.NewInternalServerError("Error creating user").WithInternalError(err)
 	}
 
 	if params.Id != "" {
 		customId, err := uuid.FromString(params.Id)
 		if err != nil {
-			return badRequestError(apierrors.ErrorCodeValidationFailed, "ID must conform to the uuid v4 format")
+			return apierrors.NewBadRequestError(apierrors.ErrorCodeValidationFailed, "ID must conform to the uuid v4 format")
 		}
 		if customId == uuid.Nil {
-			return badRequestError(apierrors.ErrorCodeValidationFailed, "ID cannot be a nil uuid")
+			return apierrors.NewBadRequestError(apierrors.ErrorCodeValidationFailed, "ID cannot be a nil uuid")
 		}
 		user.ID = customId
 	}
@@ -419,7 +419,7 @@ func (a *API) adminUserCreate(w http.ResponseWriter, r *http.Request) error {
 		if params.BanDuration != "none" {
 			duration, err = time.ParseDuration(params.BanDuration)
 			if err != nil {
-				return badRequestError(apierrors.ErrorCodeValidationFailed, "invalid format for ban duration: %v", err)
+				return apierrors.NewBadRequestError(apierrors.ErrorCodeValidationFailed, "invalid format for ban duration: %v", err)
 			}
 		}
 		banDuration = &duration
@@ -501,7 +501,7 @@ func (a *API) adminUserCreate(w http.ResponseWriter, r *http.Request) error {
 	})
 
 	if err != nil {
-		return internalServerError("Database error creating new user").WithInternalError(err)
+		return apierrors.NewInternalServerError("Database error creating new user").WithInternalError(err)
 	}
 
 	return sendJSON(w, http.StatusOK, user)
@@ -529,7 +529,7 @@ func (a *API) adminUserDelete(w http.ResponseWriter, r *http.Request) error {
 			"user_email": user.Email,
 			"user_phone": user.Phone,
 		}); terr != nil {
-			return internalServerError("Error recording audit log entry").WithInternalError(terr)
+			return apierrors.NewInternalServerError("Error recording audit log entry").WithInternalError(terr)
 		}
 
 		if params.ShouldSoftDelete {
@@ -538,24 +538,24 @@ func (a *API) adminUserDelete(w http.ResponseWriter, r *http.Request) error {
 				return nil
 			}
 			if terr := user.SoftDeleteUser(tx); terr != nil {
-				return internalServerError("Error soft deleting user").WithInternalError(terr)
+				return apierrors.NewInternalServerError("Error soft deleting user").WithInternalError(terr)
 			}
 
 			if terr := user.SoftDeleteUserIdentities(tx); terr != nil {
-				return internalServerError("Error soft deleting user identities").WithInternalError(terr)
+				return apierrors.NewInternalServerError("Error soft deleting user identities").WithInternalError(terr)
 			}
 
 			// hard delete all associated factors
 			if terr := models.DeleteFactorsByUserId(tx, user.ID); terr != nil {
-				return internalServerError("Error deleting user's factors").WithInternalError(terr)
+				return apierrors.NewInternalServerError("Error deleting user's factors").WithInternalError(terr)
 			}
 			// hard delete all associated sessions
 			if terr := models.Logout(tx, user.ID); terr != nil {
-				return internalServerError("Error deleting user's sessions").WithInternalError(terr)
+				return apierrors.NewInternalServerError("Error deleting user's sessions").WithInternalError(terr)
 			}
 		} else {
 			if terr := tx.Destroy(user); terr != nil {
-				return internalServerError("Database error deleting user").WithInternalError(terr)
+				return apierrors.NewInternalServerError("Database error deleting user").WithInternalError(terr)
 			}
 		}
 
@@ -581,7 +581,7 @@ func (a *API) adminUserDeleteFactor(w http.ResponseWriter, r *http.Request) erro
 			return terr
 		}
 		if terr := tx.Destroy(factor); terr != nil {
-			return internalServerError("Database error deleting factor").WithInternalError(terr)
+			return apierrors.NewInternalServerError("Database error deleting factor").WithInternalError(terr)
 		}
 		return nil
 	})
@@ -619,7 +619,7 @@ func (a *API) adminUserUpdateFactor(w http.ResponseWriter, r *http.Request) erro
 		if params.Phone != "" && factor.IsPhoneFactor() {
 			phone, err := validatePhone(params.Phone)
 			if err != nil {
-				return badRequestError(apierrors.ErrorCodeValidationFailed, "Invalid phone number format (E.164 required)")
+				return apierrors.NewBadRequestError(apierrors.ErrorCodeValidationFailed, "Invalid phone number format (E.164 required)")
 			}
 			if terr := factor.UpdatePhone(tx, phone); terr != nil {
 				return terr

internal/api/anonymous.go

@@ -16,7 +16,7 @@ func (a *API) SignupAnonymously(w http.ResponseWriter, r *http.Request) error {
 	aud := a.requestAud(ctx, r)
 
 	if config.DisableSignup {
-		return unprocessableEntityError(apierrors.ErrorCodeSignupDisabled, "Signups not allowed for this instance")
+		return apierrors.NewUnprocessableEntityError(apierrors.ErrorCodeSignupDisabled, "Signups not allowed for this instance")
 	}
 
 	params := &SignupParams{}
@@ -48,7 +48,7 @@ func (a *API) SignupAnonymously(w http.ResponseWriter, r *http.Request) error {
 		return nil
 	})
 	if err != nil {
-		return internalServerError("Database error creating anonymous user").WithInternalError(err)
+		return apierrors.NewInternalServerError("Database error creating anonymous user").WithInternalError(err)
 	}
 
 	metering.RecordLogin("anonymous", newUser.ID)

internal/api/api.go

@@ -157,7 +157,7 @@ func NewAPIWithVersion(globalConfig *conf.GlobalConfiguration, db *storage.Conne
 				}
 				if params.Email == "" && params.Phone == "" {
 					if !api.config.External.AnonymousUsers.Enabled {
-						return unprocessableEntityError(apierrors.ErrorCodeAnonymousProviderDisabled, "Anonymous sign-ins are disabled")
+						return apierrors.NewUnprocessableEntityError(apierrors.ErrorCodeAnonymousProviderDisabled, "Anonymous sign-ins are disabled")
 					}
 					if _, err := api.limitHandler(limitAnonymousSignIns)(w, r); err != nil {
 						return err

internal/api/audit.go

@@ -21,7 +21,7 @@ func (a *API) adminAuditLog(w http.ResponseWriter, r *http.Request) error {
 	// aud := a.requestAud(ctx, r)
 	pageParams, err := paginate(r)
 	if err != nil {
-		return badRequestError(apierrors.ErrorCodeValidationFailed, "Bad Pagination Parameters: %v", err)
+		return apierrors.NewBadRequestError(apierrors.ErrorCodeValidationFailed, "Bad Pagination Parameters: %v", err)
 	}
 
 	var col []string
@@ -32,14 +32,14 @@ func (a *API) adminAuditLog(w http.ResponseWriter, r *http.Request) error {
 		qparts := strings.SplitN(q, ":", 2)
 		col, exists = filterColumnMap[qparts[0]]
 		if !exists || len(qparts) < 2 {
-			return badRequestError(apierrors.ErrorCodeValidationFailed, "Invalid query scope: %s", q)
+			return apierrors.NewBadRequestError(apierrors.ErrorCodeValidationFailed, "Invalid query scope: %s", q)
 		}
 		qval = qparts[1]
 	}
 
 	logs, err := models.FindAuditLogEntries(db, col, qval, pageParams)
 	if err != nil {
-		return internalServerError("Error searching for audit logs").WithInternalError(err)
+		return apierrors.NewInternalServerError("Error searching for audit logs").WithInternalError(err)
 	}
 
 	addPaginationHeaders(w, r, pageParams)

internal/api/auth.go

@@ -37,7 +37,7 @@ func (a *API) requireNotAnonymous(w http.ResponseWriter, r *http.Request) (conte
 	ctx := r.Context()
 	claims := getClaims(ctx)
 	if claims.IsAnonymous {
-		return nil, forbiddenError(apierrors.ErrorCodeNoAuthorization, "Anonymous user not allowed to perform these actions")
+		return nil, apierrors.NewForbiddenError(apierrors.ErrorCodeNoAuthorization, "Anonymous user not allowed to perform these actions")
 	}
 	return ctx, nil
 }
@@ -46,7 +46,7 @@ func (a *API) requireAdmin(ctx context.Context) (context.Context, error) {
 	// Find the administrative user
 	claims := getClaims(ctx)
 	if claims == nil {
-		return nil, forbiddenError(apierrors.ErrorCodeBadJWT, "Invalid token")
+		return nil, apierrors.NewForbiddenError(apierrors.ErrorCodeBadJWT, "Invalid token")
 	}
 
 	adminRoles := a.config.JWT.AdminRoles
@@ -56,14 +56,14 @@ func (a *API) requireAdmin(ctx context.Context) (context.Context, error) {
 		return withAdminUser(ctx, &models.User{Role: claims.Role, Email: storage.NullString(claims.Role)}), nil
 	}
 
-	return nil, forbiddenError(apierrors.ErrorCodeNotAdmin, "User not allowed").WithInternalMessage(fmt.Sprintf("this token needs to have one of the following roles: %v", strings.Join(adminRoles, ", ")))
+	return nil, apierrors.NewForbiddenError(apierrors.ErrorCodeNotAdmin, "User not allowed").WithInternalMessage(fmt.Sprintf("this token needs to have one of the following roles: %v", strings.Join(adminRoles, ", ")))
 }
 
 func (a *API) extractBearerToken(r *http.Request) (string, error) {
 	authHeader := r.Header.Get("Authorization")
 	matches := bearerRegexp.FindStringSubmatch(authHeader)
 	if len(matches) != 2 {
-		return "", httpError(http.StatusUnauthorized, apierrors.ErrorCodeNoAuthorization, "This endpoint requires a Bearer token")
+		return "", apierrors.NewHTTPError(http.StatusUnauthorized, apierrors.ErrorCodeNoAuthorization, "This endpoint requires a Bearer token")
 	}
 
 	return matches[1], nil
@@ -89,7 +89,7 @@ func (a *API) parseJWTClaims(bearer string, r *http.Request) (context.Context, e
 		return nil, fmt.Errorf("missing kid")
 	})
 	if err != nil {
-		return nil, forbiddenError(apierrors.ErrorCodeBadJWT, "invalid JWT: unable to parse or verify signature, %v", err).WithInternalError(err)
+		return nil, apierrors.NewForbiddenError(apierrors.ErrorCodeBadJWT, "invalid JWT: unable to parse or verify signature, %v", err).WithInternalError(err)
 	}
 
 	return withToken(ctx, token), nil
@@ -100,23 +100,23 @@ func (a *API) maybeLoadUserOrSession(ctx context.Context) (context.Context, erro
 	claims := getClaims(ctx)
 
 	if claims == nil {
-		return ctx, forbiddenError(apierrors.ErrorCodeBadJWT, "invalid token: missing claims")
+		return ctx, apierrors.NewForbiddenError(apierrors.ErrorCodeBadJWT, "invalid token: missing claims")
 	}
 
 	if claims.Subject == "" {
-		return nil, forbiddenError(apierrors.ErrorCodeBadJWT, "invalid claim: missing sub claim")
+		return nil, apierrors.NewForbiddenError(apierrors.ErrorCodeBadJWT, "invalid claim: missing sub claim")
 	}
 
 	var user *models.User
 	if claims.Subject != "" {
 		userId, err := uuid.FromString(claims.Subject)
 		if err != nil {
-			return ctx, badRequestError(apierrors.ErrorCodeBadJWT, "invalid claim: sub claim must be a UUID").WithInternalError(err)
+			return ctx, apierrors.NewBadRequestError(apierrors.ErrorCodeBadJWT, "invalid claim: sub claim must be a UUID").WithInternalError(err)
 		}
 		user, err = models.FindUserByID(db, userId)
 		if err != nil {
 			if models.IsNotFoundError(err) {
-				return ctx, forbiddenError(apierrors.ErrorCodeUserNotFound, "User from sub claim in JWT does not exist")
+				return ctx, apierrors.NewForbiddenError(apierrors.ErrorCodeUserNotFound, "User from sub claim in JWT does not exist")
 			}
 			return ctx, err
 		}
@@ -127,12 +127,12 @@ func (a *API) maybeLoadUserOrSession(ctx context.Context) (context.Context, erro
 	if claims.SessionId != "" && claims.SessionId != uuid.Nil.String() {
 		sessionId, err := uuid.FromString(claims.SessionId)
 		if err != nil {
-			return ctx, forbiddenError(apierrors.ErrorCodeBadJWT, "invalid claim: session_id claim must be a UUID").WithInternalError(err)
+			return ctx, apierrors.NewForbiddenError(apierrors.ErrorCodeBadJWT, "invalid claim: session_id claim must be a UUID").WithInternalError(err)
 		}
 		session, err = models.FindSessionByID(db, sessionId, false)
 		if err != nil {
 			if models.IsNotFoundError(err) {
-				return ctx, forbiddenError(apierrors.ErrorCodeSessionNotFound, "Session from session_id claim in JWT does not exist").WithInternalError(err).WithInternalMessage(fmt.Sprintf("session id (%s) doesn't exist", sessionId))
+				return ctx, apierrors.NewForbiddenError(apierrors.ErrorCodeSessionNotFound, "Session from session_id claim in JWT does not exist").WithInternalError(err).WithInternalMessage(fmt.Sprintf("session id (%s) doesn't exist", sessionId))
 			}
 			return ctx, err
 		}

internal/api/auth_test.go

@@ -185,7 +185,7 @@ func (ts *AuthTestSuite) TestMaybeLoadUserOrSession() {
 				},
 				Role: "authenticated",
 			},
-			ExpectedError: forbiddenError(apierrors.ErrorCodeBadJWT, "invalid claim: missing sub claim"),
+			ExpectedError: apierrors.NewForbiddenError(apierrors.ErrorCodeBadJWT, "invalid claim: missing sub claim"),
 			ExpectedUser:  nil,
 		},
 		{
@@ -207,7 +207,7 @@ func (ts *AuthTestSuite) TestMaybeLoadUserOrSession() {
 				},
 				Role: "authenticated",
 			},
-			ExpectedError: badRequestError(apierrors.ErrorCodeBadJWT, "invalid claim: sub claim must be a UUID"),
+			ExpectedError: apierrors.NewBadRequestError(apierrors.ErrorCodeBadJWT, "invalid claim: sub claim must be a UUID"),
 			ExpectedUser:  nil,
 		},
 		{
@@ -256,7 +256,7 @@ func (ts *AuthTestSuite) TestMaybeLoadUserOrSession() {
 				Role:      "authenticated",
 				SessionId: "73bf9ee0-9e8c-453b-b484-09cb93e2f341",
 			},
-			ExpectedError:   forbiddenError(apierrors.ErrorCodeSessionNotFound, "Session from session_id claim in JWT does not exist").WithInternalError(models.SessionNotFoundError{}).WithInternalMessage("session id (73bf9ee0-9e8c-453b-b484-09cb93e2f341) doesn't exist"),
+			ExpectedError:   apierrors.NewForbiddenError(apierrors.ErrorCodeSessionNotFound, "Session from session_id claim in JWT does not exist").WithInternalError(models.SessionNotFoundError{}).WithInternalMessage("session id (73bf9ee0-9e8c-453b-b484-09cb93e2f341) doesn't exist"),
 			ExpectedUser:    u,
 			ExpectedSession: nil,
 		},