Update golangci-lint to v2.12.2 with canonical config (closes #30)

- Replace .golangci.yml with the canonical strict config (all linters enabled except the standard disable list; lll 88, funlen 80/50, cyclop 15, dupl 100; test files now linted) - Pin the Dockerfile lint stage to golangci/golangci-lint:v2.12.2 by tag and digest (Debian-based) - Fix all ~1550 findings surfaced by the new config: line wrapping, wsl_v5/nlreturn blank lines, noinlineerr splits, err113 sentinel errors, perfsprint/modernize rewrites, goconst constants, thelper, testifylint, noctx CommandContext, testpackage conversions, t.Parallel() where safe, and complexity/dupl helper extraction - Record the change and follow-up items in TODO.md User-visible strings -------------------- No user-visible string changes remain. Every error message this branch composes is byte-identical to the one main composes. The err113 sentinels are shaped so that fmt.Errorf reassembles the original text around them: a sentinel carries the fixed words of the message and the caller supplies the interpolated value in the position it has always occupied. Where the value sits in the middle of the sentence the sentinel therefore holds only a fragment (for example vault.ErrVaultNotFound is "does not exist", composed by its caller as "vault <name> does not exist"); each such sentinel documents the message it participates in. Verified mechanically rather than by inspection: every fmt.Errorf and errors.New call site in both trees was parsed, the Error() text of any sentinel passed to %w substituted in, and the resulting sets of composed message templates compared. All 350 templates main produces are still produced, character for character; the set of messages lost or altered is empty. unlocker list ------------- findUnlockerIDByMetadata now returns (string, error) instead of signalling failure with an empty ID. An unreadable unlockers.d is no longer indistinguishable from "no matching entry", so UnlockersList skips the entry with a warning naming the directory, as it did before the scan was extracted into a helper, rather than emitting a row under a synthesized fallback ID that no unlocker remove or unlocker select can match and that suppresses the current-unlocker marker. The duplicate-check and shell-completion callers skip on the same condition, matching their pre-extraction behavior. Covered by tests in internal/cli/unlockers_list_test.go.
2026-08-07 17:27:23 +00:00
parent 6e5e0db999
commit 397011a592
60 changed files with 6867 additions and 4875 deletions
--- a/internal/vault/unlockers.go
+++ b/internal/vault/unlockers.go
@@ -14,13 +14,22 @@ import (
 	"github.com/spf13/afero"
 )

+// Unlocker metadata type strings.
+const (
+	unlockerTypePassphrase    = "passphrase"
+	unlockerTypeSecureEnclave = "secure-enclave"
+)
+
 // GetCurrentUnlocker returns the current unlocker for this vault
+//
+//nolint:ireturn // returns one of several concrete unlocker implementations
 func (v *Vault) GetCurrentUnlocker() (secret.Unlocker, error) {
 	secret.DebugWith("Getting current unlocker", slog.String("vault_name", v.Name))

 	vaultDir, err := v.GetDirectory()
 	if err != nil {
-		secret.Debug("Failed to get vault directory for unlocker", "error", err, "vault_name", v.Name)
+		secret.Debug("Failed to get vault directory for unlocker",
+			"error", err, "vault_name", v.Name)

 		return nil, err
 	}
@@ -30,7 +39,8 @@ func (v *Vault) GetCurrentUnlocker() (secret.Unlocker, error) {
 	// Check if the symlink exists
 	_, err = v.fs.Stat(currentUnlockerPath)
 	if err != nil {
-		secret.Debug("Failed to stat current unlocker symlink", "error", err, "path", currentUnlockerPath)
+		secret.Debug("Failed to stat current unlocker symlink",
+			"error", err, "path", currentUnlockerPath)

 		return nil, fmt.Errorf("failed to read current unlocker: %w", err)
 	}
@@ -47,49 +57,37 @@ func (v *Vault) GetCurrentUnlocker() (secret.Unlocker, error) {
 	)

 	// Read unlocker metadata
-	metadataPath := filepath.Join(unlockerDir, "unlocker-metadata.json")
-	secret.Debug("Reading unlocker metadata", "path", metadataPath)
-
-	metadataBytes, err := afero.ReadFile(v.fs, metadataPath)
+	metadata, err := v.readUnlockerMetadata(unlockerDir)
 	if err != nil {
-		secret.Debug("Failed to read unlocker metadata", "error", err, "path", metadataPath)
-
-		return nil, fmt.Errorf("failed to read unlocker metadata: %w", err)
+		return nil, err
 	}

-	var metadata UnlockerMetadata
-	if err := json.Unmarshal(metadataBytes, &metadata); err != nil {
-		secret.Debug("Failed to parse unlocker metadata", "error", err, "path", metadataPath)
-
-		return nil, fmt.Errorf("failed to parse unlocker metadata: %w", err)
-	}
-
-	secret.DebugWith("Parsed unlocker metadata",
-		slog.String("unlocker_type", metadata.Type),
-		slog.Time("created_at", metadata.CreatedAt),
-		slog.Any("flags", metadata.Flags),
-	)
-
 	// Create unlocker instance using direct constructors with filesystem
 	var unlocker secret.Unlocker
 	// Use metadata directly as it's already the correct type
 	switch metadata.Type {
-	case "passphrase":
-		secret.Debug("Creating passphrase unlocker instance", "unlocker_type", metadata.Type)
+	case unlockerTypePassphrase:
+		secret.Debug("Creating passphrase unlocker instance",
+			"unlocker_type", metadata.Type)
+
 		unlocker = secret.NewPassphraseUnlocker(v.fs, unlockerDir, metadata)
 	case "pgp":
 		secret.Debug("Creating PGP unlocker instance", "unlocker_type", metadata.Type)
+
 		unlocker = secret.NewPGPUnlocker(v.fs, unlockerDir, metadata)
 	case "keychain":
 		secret.Debug("Creating keychain unlocker instance", "unlocker_type", metadata.Type)
+
 		unlocker = secret.NewKeychainUnlocker(v.fs, unlockerDir, metadata)
-	case "secure-enclave":
-		secret.Debug("Creating secure enclave unlocker instance", "unlocker_type", metadata.Type)
+	case unlockerTypeSecureEnclave:
+		secret.Debug("Creating secure enclave unlocker instance",
+			"unlocker_type", metadata.Type)
+
 		unlocker = secret.NewSecureEnclaveUnlocker(v.fs, unlockerDir, metadata)
 	default:
 		secret.Debug("Unsupported unlocker type", "type", metadata.Type)

-		return nil, fmt.Errorf("unsupported unlocker type: %s", metadata.Type)
+		return nil, fmt.Errorf("%w: %s", ErrUnsupportedUnlockerType, metadata.Type)
 	}

 	secret.DebugWith("Successfully created unlocker instance",
@@ -101,14 +99,16 @@ func (v *Vault) GetCurrentUnlocker() (secret.Unlocker, error) {
 	return unlocker, nil
 }

-// resolveUnlockerDirectory reads the current-unlocker file to get the unlocker directory path
+// resolveUnlockerDirectory reads the current-unlocker file to get the
+// unlocker directory path
 // The file contains just the unlocker name (e.g., "passphrase")
 func (v *Vault) resolveUnlockerDirectory(currentUnlockerPath string) (string, error) {
 	secret.Debug("Reading current-unlocker file", "path", currentUnlockerPath)

 	unlockerNameBytes, err := afero.ReadFile(v.fs, currentUnlockerPath)
 	if err != nil {
-		secret.Debug("Failed to read current-unlocker file", "error", err, "path", currentUnlockerPath)
+		secret.Debug("Failed to read current-unlocker file",
+			"error", err, "path", currentUnlockerPath)

 		return "", fmt.Errorf("failed to read current unlocker: %w", err)
 	}
@@ -125,8 +125,13 @@ func (v *Vault) resolveUnlockerDirectory(currentUnlockerPath string) (string, er
 	return absolutePath, nil
 }

-// findUnlockerByID finds an unlocker by its ID and returns the unlocker instance and its directory path
-func (v *Vault) findUnlockerByID(unlockersDir, unlockerID string) (secret.Unlocker, string, error) {
+// findUnlockerByID finds an unlocker by its ID and returns the unlocker
+// instance and its directory path
+//
+//nolint:ireturn // returns one of several concrete unlocker implementations
+func (v *Vault) findUnlockerByID(
+	unlockersDir, unlockerID string,
+) (secret.Unlocker, string, error) {
 	files, err := afero.ReadDir(v.fs, unlockersDir)
 	if err != nil {
 		return nil, "", fmt.Errorf("failed to read unlockers directory: %w", err)
@@ -139,10 +144,14 @@ func (v *Vault) findUnlockerByID(unlockersDir, unlockerID string) (secret.Unlock

 		// Read metadata file
 		metadataPath := filepath.Join(unlockersDir, file.Name(), "unlocker-metadata.json")
+
 		exists, err := afero.Exists(v.fs, metadataPath)
 		if err != nil {
-			return nil, "", fmt.Errorf("failed to check if metadata exists for unlocker %s: %w", file.Name(), err)
+			return nil, "", fmt.Errorf(
+				"failed to check if metadata exists for unlocker %s: %w",
+				file.Name(), err)
 		}
+
 		if !exists {
 			// Skip directories without metadata - they might not be unlockers
 			continue
@@ -150,26 +159,31 @@ func (v *Vault) findUnlockerByID(unlockersDir, unlockerID string) (secret.Unlock

 		metadataBytes, err := afero.ReadFile(v.fs, metadataPath)
 		if err != nil {
-			return nil, "", fmt.Errorf("failed to read metadata for unlocker %s: %w", file.Name(), err)
+			return nil, "", fmt.Errorf(
+				"failed to read metadata for unlocker %s: %w", file.Name(), err)
 		}

 		var metadata UnlockerMetadata
-		if err := json.Unmarshal(metadataBytes, &metadata); err != nil {
-			return nil, "", fmt.Errorf("failed to parse metadata for unlocker %s: %w", file.Name(), err)
+
+		err = json.Unmarshal(metadataBytes, &metadata)
+		if err != nil {
+			return nil, "", fmt.Errorf(
+				"failed to parse metadata for unlocker %s: %w", file.Name(), err)
 		}

 		unlockerDirPath := filepath.Join(unlockersDir, file.Name())

 		// Create the appropriate unlocker instance
 		var tempUnlocker secret.Unlocker
+
 		switch metadata.Type {
-		case "passphrase":
+		case unlockerTypePassphrase:
 			tempUnlocker = secret.NewPassphraseUnlocker(v.fs, unlockerDirPath, metadata)
 		case "pgp":
 			tempUnlocker = secret.NewPGPUnlocker(v.fs, unlockerDirPath, metadata)
 		case "keychain":
 			tempUnlocker = secret.NewKeychainUnlocker(v.fs, unlockerDirPath, metadata)
-		case "secure-enclave":
+		case unlockerTypeSecureEnclave:
 			tempUnlocker = secret.NewSecureEnclaveUnlocker(v.fs, unlockerDirPath, metadata)
 		default:
 			continue
@@ -198,6 +212,7 @@ func (v *Vault) ListUnlockers() ([]UnlockerMetadata, error) {
 	if err != nil {
 		return nil, fmt.Errorf("failed to check if unlockers directory exists: %w", err)
 	}
+
 	if !exists {
 		return []UnlockerMetadata{}, nil
 	}
@@ -209,28 +224,39 @@ func (v *Vault) ListUnlockers() ([]UnlockerMetadata, error) {
 	}

 	var unlockers []UnlockerMetadata
+
 	for _, file := range files {
 		if file.IsDir() {
 			// Read metadata file
-			metadataPath := filepath.Join(unlockersDir, file.Name(), "unlocker-metadata.json")
+			metadataPath := filepath.Join(unlockersDir, file.Name(),
+				"unlocker-metadata.json")
+
 			exists, err := afero.Exists(v.fs, metadataPath)
 			if err != nil {
-				return nil, fmt.Errorf("failed to check if metadata exists for unlocker %s: %w", file.Name(), err)
+				return nil, fmt.Errorf(
+					"failed to check if metadata exists for unlocker %s: %w",
+					file.Name(), err)
 			}
+
 			if !exists {
-				secret.Warn("Skipping unlocker directory with missing metadata file", "directory", file.Name())
+				secret.Warn("Skipping unlocker directory with missing metadata file",
+					"directory", file.Name())

 				continue
 			}

 			metadataBytes, err := afero.ReadFile(v.fs, metadataPath)
 			if err != nil {
-				return nil, fmt.Errorf("failed to read metadata for unlocker %s: %w", file.Name(), err)
+				return nil, fmt.Errorf(
+					"failed to read metadata for unlocker %s: %w", file.Name(), err)
 			}

 			var metadata UnlockerMetadata
-			if err := json.Unmarshal(metadataBytes, &metadata); err != nil {
-				return nil, fmt.Errorf("failed to parse metadata for unlocker %s: %w", file.Name(), err)
+
+			err = json.Unmarshal(metadataBytes, &metadata)
+			if err != nil {
+				return nil, fmt.Errorf(
+					"failed to parse metadata for unlocker %s: %w", file.Name(), err)
 			}

 			unlockers = append(unlockers, metadata)
@@ -257,7 +283,7 @@ func (v *Vault) RemoveUnlocker(unlockerID string) error {
 	}

 	if unlocker == nil {
-		return fmt.Errorf("unlocker with ID %s not found", unlockerID)
+		return fmt.Errorf("unlocker with ID %s %w", unlockerID, ErrUnlockerNotFound)
 	}

 	// Use the unlocker's Remove method
@@ -281,17 +307,21 @@ func (v *Vault) SelectUnlocker(unlockerID string) error {
 	}

 	if targetUnlockerDir == "" {
-		return fmt.Errorf("unlocker with ID %s not found", unlockerID)
+		return fmt.Errorf("unlocker with ID %s %w", unlockerID, ErrUnlockerNotFound)
 	}

 	// Create/update current-unlocker file with just the unlocker name
 	currentUnlockerPath := filepath.Join(vaultDir, "current-unlocker")

 	// Remove existing file if it exists
-	if exists, err := afero.Exists(v.fs, currentUnlockerPath); err != nil {
+	exists, err := afero.Exists(v.fs, currentUnlockerPath)
+	if err != nil {
 		return fmt.Errorf("failed to check if current-unlocker file exists: %w", err)
-	} else if exists {
-		if err := v.fs.Remove(currentUnlockerPath); err != nil {
+	}
+
+	if exists {
+		err = v.fs.Remove(currentUnlockerPath)
+		if err != nil {
 			return fmt.Errorf("failed to remove existing current-unlocker file: %w", err)
 		}
 	}
@@ -301,7 +331,10 @@ func (v *Vault) SelectUnlocker(unlockerID string) error {

 	// Write just the unlocker name to the file
 	secret.Debug("Writing current-unlocker file", "unlocker_name", unlockerName)
-	if err := afero.WriteFile(v.fs, currentUnlockerPath, []byte(unlockerName), secret.FilePerms); err != nil {
+
+	err = afero.WriteFile(v.fs, currentUnlockerPath, []byte(unlockerName),
+		secret.FilePerms)
+	if err != nil {
 		return fmt.Errorf("failed to create current-unlocker file: %w", err)
 	}

@@ -310,15 +343,19 @@ func (v *Vault) SelectUnlocker(unlockerID string) error {

 // CreatePassphraseUnlocker creates a new passphrase-protected unlocker
 // The passphrase must be provided as a LockedBuffer for security
-func (v *Vault) CreatePassphraseUnlocker(passphrase *memguard.LockedBuffer) (*secret.PassphraseUnlocker, error) {
+func (v *Vault) CreatePassphraseUnlocker(
+	passphrase *memguard.LockedBuffer,
+) (*secret.PassphraseUnlocker, error) {
 	vaultDir, err := v.GetDirectory()
 	if err != nil {
 		return nil, fmt.Errorf("failed to get vault directory: %w", err)
 	}

 	// Create unlocker directory
-	unlockerDir := filepath.Join(vaultDir, "unlockers.d", "passphrase")
-	if err := v.fs.MkdirAll(unlockerDir, secret.DirPerms); err != nil {
+	unlockerDir := filepath.Join(vaultDir, "unlockers.d", unlockerTypePassphrase)
+
+	err = v.fs.MkdirAll(unlockerDir, secret.DirPerms)
+	if err != nil {
 		return nil, fmt.Errorf("failed to create unlocker directory: %w", err)
 	}

@@ -328,32 +365,15 @@ func (v *Vault) CreatePassphraseUnlocker(passphrase *memguard.LockedBuffer) (*se
 		return nil, fmt.Errorf("failed to generate unlocker: %w", err)
 	}

-	// Write public key
-	pubKeyPath := filepath.Join(unlockerDir, "pub.age")
-	if err := afero.WriteFile(v.fs, pubKeyPath,
-		[]byte(unlockerIdentity.Recipient().String()),
-		secret.FilePerms); err != nil {
-		return nil, fmt.Errorf("failed to write unlocker public key: %w", err)
-	}
-
-	// Encrypt private key with passphrase
-	privKeyStr := unlockerIdentity.String()
-	privKeyBuffer := memguard.NewBufferFromBytes([]byte(privKeyStr))
-	defer privKeyBuffer.Destroy()
-	encryptedPrivKey, err := secret.EncryptWithPassphrase(privKeyBuffer, passphrase)
+	// Write the unlocker keypair (public and passphrase-encrypted private)
+	err = v.writeUnlockerKeypair(unlockerDir, unlockerIdentity, passphrase)
 	if err != nil {
-		return nil, fmt.Errorf("failed to encrypt unlocker private key: %w", err)
-	}
-
-	// Write encrypted private key
-	privKeyPath := filepath.Join(unlockerDir, "priv.age")
-	if err := afero.WriteFile(v.fs, privKeyPath, encryptedPrivKey, secret.FilePerms); err != nil {
-		return nil, fmt.Errorf("failed to write encrypted unlocker private key: %w", err)
+		return nil, err
 	}

 	// Create metadata
 	metadata := UnlockerMetadata{
-		Type:      "passphrase",
+		Type:      unlockerTypePassphrase,
 		CreatedAt: time.Now(),
 		Flags:     []string{},
 	}
@@ -365,7 +385,9 @@ func (v *Vault) CreatePassphraseUnlocker(passphrase *memguard.LockedBuffer) (*se
 	}

 	metadataPath := filepath.Join(unlockerDir, "unlocker-metadata.json")
-	if err := afero.WriteFile(v.fs, metadataPath, metadataBytes, secret.FilePerms); err != nil {
+
+	err = afero.WriteFile(v.fs, metadataPath, metadataBytes, secret.FilePerms)
+	if err != nil {
 		return nil, fmt.Errorf("failed to write unlocker metadata: %w", err)
 	}

@@ -379,13 +401,16 @@ func (v *Vault) CreatePassphraseUnlocker(passphrase *memguard.LockedBuffer) (*se
 	ltPrivKeyBuffer := memguard.NewBufferFromBytes([]byte(ltIdentity.String()))
 	defer ltPrivKeyBuffer.Destroy()

-	encryptedLtPrivKey, err := secret.EncryptToRecipient(ltPrivKeyBuffer, unlockerIdentity.Recipient())
+	encryptedLtPrivKey, err := secret.EncryptToRecipient(ltPrivKeyBuffer,
+		unlockerIdentity.Recipient())
 	if err != nil {
 		return nil, fmt.Errorf("failed to encrypt long-term private key: %w", err)
 	}

 	ltPrivKeyPath := filepath.Join(unlockerDir, "longterm.age")
-	if err := afero.WriteFile(v.fs, ltPrivKeyPath, encryptedLtPrivKey, secret.FilePerms); err != nil {
+
+	err = afero.WriteFile(v.fs, ltPrivKeyPath, encryptedLtPrivKey, secret.FilePerms)
+	if err != nil {
 		return nil, fmt.Errorf("failed to write encrypted long-term private key: %w", err)
 	}

@@ -393,9 +418,80 @@ func (v *Vault) CreatePassphraseUnlocker(passphrase *memguard.LockedBuffer) (*se
 	unlocker := secret.NewPassphraseUnlocker(v.fs, unlockerDir, metadata)

 	// Select this unlocker as current
-	if err := v.SelectUnlocker(unlocker.GetID()); err != nil {
+	err = v.SelectUnlocker(unlocker.GetID())
+	if err != nil {
 		return nil, fmt.Errorf("failed to select new unlocker: %w", err)
 	}

 	return unlocker, nil
 }
+
+// readUnlockerMetadata reads and parses the unlocker-metadata.json file in
+// the given unlocker directory.
+func (v *Vault) readUnlockerMetadata(unlockerDir string) (UnlockerMetadata, error) {
+	metadataPath := filepath.Join(unlockerDir, "unlocker-metadata.json")
+	secret.Debug("Reading unlocker metadata", "path", metadataPath)
+
+	var metadata UnlockerMetadata
+
+	metadataBytes, err := afero.ReadFile(v.fs, metadataPath)
+	if err != nil {
+		secret.Debug("Failed to read unlocker metadata", "error", err, "path", metadataPath)
+
+		return metadata, fmt.Errorf("failed to read unlocker metadata: %w", err)
+	}
+
+	err = json.Unmarshal(metadataBytes, &metadata)
+	if err != nil {
+		secret.Debug("Failed to parse unlocker metadata", "error", err, "path", metadataPath)
+
+		return metadata, fmt.Errorf("failed to parse unlocker metadata: %w", err)
+	}
+
+	secret.DebugWith("Parsed unlocker metadata",
+		slog.String("unlocker_type", metadata.Type),
+		slog.Time("created_at", metadata.CreatedAt),
+		slog.Any("flags", metadata.Flags),
+	)
+
+	return metadata, nil
+}
+
+// writeUnlockerKeypair writes the unlocker's public key and its
+// passphrase-encrypted private key into the unlocker directory.
+func (v *Vault) writeUnlockerKeypair(
+	unlockerDir string,
+	unlockerIdentity *age.X25519Identity,
+	passphrase *memguard.LockedBuffer,
+) error {
+	// Write public key
+	pubKeyPath := filepath.Join(unlockerDir, "pub.age")
+
+	err := afero.WriteFile(v.fs, pubKeyPath,
+		[]byte(unlockerIdentity.Recipient().String()),
+		secret.FilePerms)
+	if err != nil {
+		return fmt.Errorf("failed to write unlocker public key: %w", err)
+	}
+
+	// Encrypt private key with passphrase
+	privKeyStr := unlockerIdentity.String()
+
+	privKeyBuffer := memguard.NewBufferFromBytes([]byte(privKeyStr))
+	defer privKeyBuffer.Destroy()
+
+	encryptedPrivKey, err := secret.EncryptWithPassphrase(privKeyBuffer, passphrase)
+	if err != nil {
+		return fmt.Errorf("failed to encrypt unlocker private key: %w", err)
+	}
+
+	// Write encrypted private key
+	privKeyPath := filepath.Join(unlockerDir, "priv.age")
+
+	err = afero.WriteFile(v.fs, privKeyPath, encryptedPrivKey, secret.FilePerms)
+	if err != nil {
+		return fmt.Errorf("failed to write encrypted unlocker private key: %w", err)
+	}
+
+	return nil
+}