From 53188b9d403dedc5d7db15baec75167c85109981 Mon Sep 17 00:00:00 2001 From: Cristian Magherusan-Stanciu Date: Fri, 10 Jul 2026 12:59:09 +0200 Subject: [PATCH] fix(api): suppress errorlint on intentionally strict clientError assertion The type assertion in isPermissionDenied is deliberately strict (unwrapped) to distinguish a direct 403 from the auth service from a wrapped error that represents an outer failure mode (e.g. fmt.Errorf("permission check failed: %w", authErr)). Switching to errors.As would silently route wrapped backend failures into the contact_email gate, which is exactly the misclassification the propagate-vs-fall-through split guards against. Add a //nolint:errorlint directive with a short reference to the existing block comment that explains the invariant, so the linter passes without changing the runtime semantics. --- internal/api/handler_purchases.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/internal/api/handler_purchases.go b/internal/api/handler_purchases.go index 09a11a762..fb801218b 100644 --- a/internal/api/handler_purchases.go +++ b/internal/api/handler_purchases.go @@ -1393,7 +1393,7 @@ func (h *Handler) tryResolveActorEmail(ctx context.Context, req *events.LambdaFu // failures into the contact_email gate — exactly the misclassification // the propagate-vs-fall-through split is meant to prevent. func isPermissionDenied(err error) bool { - ce, ok := err.(*clientError) + ce, ok := err.(*clientError) //nolint:errorlint // strict (unwrapped) assertion is deliberate; see comment above return ok && ce.code == 403 }