[cristim]

Summary

• isPermissionDenied in internal/api/handler_purchases.go uses a deliberate strict (unwrapped) type assertion err.(*clientError) that errorlint flags as needing errors.As.
• Switching to errors.As would change runtime behavior: wrapped backend failures (e.g. fmt.Errorf("permission check failed: %w", authErr)) would be misrouted into the contact_email gate instead of being propagated to the caller, defeating the propagate-vs-fall-through split documented in the block comment (added via PR fix(purchases): admin / cancel-* sessions bypass contact_email gate on email-link cancel #216 feedback).
• Fix: add //nolint:errorlint with a short inline reference to the existing block comment that explains the invariant. No runtime change.

Test plan

• go build ./... passes (exit 0)
• go test ./internal/api/... passes (1652 tests, exit 0)
• Pre-commit hooks pass (gofmt, go vet, gosec, cyclo, etc.)

Summary by CodeRabbit

• Chores
  • Clarified linting intent for permission-denial error handling without changing user-facing behavior.

[cristim]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[coderabbitai]

Important

Review skipped

No new commits to review since the last review.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: d80b29b0-8bdb-443d-ba91-44604d824f10

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

📝 Walkthrough

Walkthrough

The change documents and suppresses linting for the intentional strict *clientError assertion in isPermissionDenied; permission code detection remains unchanged.

Changes

Permission check

Layer / File(s)	Summary
Document strict client error assertion internal/api/handler_purchases.go	The existing unwrapped *clientError assertion is annotated with //nolint:errorlint and an inline explanation; the 403 check remains unchanged.

Estimated code review effort: 1 (Trivial) | ~2 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the change to suppress errorlint on the intentional strict clientError assertion.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/errorlint-purchase-handler

---

_{Comment @coderabbitai help to get the list of available commands.}