Update primary error functions to take a context, deprecate old functions (#1358)

* add new error funcs which take a ctx and deprecate existing funcs

* use context where available when writing error events

* remove circular internal/errors pkg dep

* suppress some chatty errors using errors.WithoutEvent()

* convert auth oidc funcs to take context where needed to write events

Co-authored-by: Jim <jlambert@hashicorp.com>

internal/authtoken/authtoken.go

@@ -74,7 +74,7 @@ func (at *AuthToken) encrypt(ctx context.Context, cipher wrapping.Wrapper) error
 	const op = "authtoken.(writableAuthToken).encrypt"
 	// structwrapping doesn't support embedding, so we'll pass in the store.Entry directly
 	if err := structwrapping.WrapStruct(ctx, cipher, at.AuthToken, nil); err != nil {
-		return errors.Wrap(err, op, errors.WithCode(errors.Encrypt))
+		return errors.WrapDeprecated(err, op, errors.WithCode(errors.Encrypt))
 	}
 	at.KeyId = cipher.KeyID()
 	return nil
@@ -85,7 +85,7 @@ func (at *AuthToken) decrypt(ctx context.Context, cipher wrapping.Wrapper) error
 	const op = "authtoken.(AuthToken).decrypt"
 	// structwrapping doesn't support embedding, so we'll pass in the store.Entry directly
 	if err := structwrapping.UnwrapStruct(ctx, cipher, at.AuthToken, nil); err != nil {
-		return errors.Wrap(err, op, errors.WithCode(errors.Decrypt))
+		return errors.WrapDeprecated(err, op, errors.WithCode(errors.Decrypt))
 	}
 	return nil
 }
@@ -102,7 +102,7 @@ func NewAuthTokenId() (string, error) {
 	const op = "authtoken.newAuthTokenId"
 	id, err := db.NewPublicId(AuthTokenPrefix)
 	if err != nil {
-		return "", errors.Wrap(err, op)
+		return "", errors.WrapDeprecated(err, op)
 	}
 	return id, nil
 }
@@ -113,7 +113,7 @@ func newAuthToken(opt ...Option) (*AuthToken, error) {
 	const op = "authtoken.newAuthToken"
 	token, err := base62.Random(tokenLength)
 	if err != nil {
-		return nil, errors.Wrap(err, op, errors.WithCode(errors.Io))
+		return nil, errors.WrapDeprecated(err, op, errors.WithCode(errors.Io))
 	}
 	opts := getOpts(opt...)
 
@@ -139,22 +139,22 @@ func EncryptToken(ctx context.Context, kmsCache *kms.Kms, scopeId, publicId, tok
 
 	marshaledS1Info, err := proto.Marshal(s1Info)
 	if err != nil {
-		return "", errors.Wrap(err, op, errors.WithMsg("marshaling encrypted token"), errors.WithCode(errors.Encode))
+		return "", errors.WrapDeprecated(err, op, errors.WithMsg("marshaling encrypted token"), errors.WithCode(errors.Encode))
 	}
 
 	tokenWrapper, err := kmsCache.GetWrapper(ctx, scopeId, kms.KeyPurposeTokens)
 	if err != nil {
-		return "", errors.Wrap(err, op, errors.WithMsg("unable to get wrapper"))
+		return "", errors.WrapDeprecated(err, op, errors.WithMsg("unable to get wrapper"))
 	}
 
 	blobInfo, err := tokenWrapper.Encrypt(ctx, []byte(marshaledS1Info), []byte(publicId))
 	if err != nil {
-		return "", errors.Wrap(err, op, errors.WithMsg("marshaling token info"), errors.WithCode(errors.Encrypt))
+		return "", errors.WrapDeprecated(err, op, errors.WithMsg("marshaling token info"), errors.WithCode(errors.Encrypt))
 	}
 
 	marshaledBlob, err := proto.Marshal(blobInfo)
 	if err != nil {
-		return "", errors.Wrap(err, op, errors.WithMsg("marshaling encrypted token"), errors.WithCode(errors.Encode))
+		return "", errors.WrapDeprecated(err, op, errors.WithMsg("marshaling encrypted token"), errors.WithCode(errors.Encode))
 	}
 
 	encoded := base58.FastBase58Encoding(marshaledBlob)

internal/authtoken/repository.go

@@ -35,11 +35,11 @@ func NewRepository(r db.Reader, w db.Writer, kms *kms.Kms, opt ...Option) (*Repo
 	const op = "authtoken.NewRepository"
 	switch {
 	case r == nil:
-		return nil, errors.New(errors.InvalidParameter, op, "nil db reader")
+		return nil, errors.NewDeprecated(errors.InvalidParameter, op, "nil db reader")
 	case w == nil:
-		return nil, errors.New(errors.InvalidParameter, op, "nil db writer")
+		return nil, errors.NewDeprecated(errors.InvalidParameter, op, "nil db writer")
 	case kms == nil:
-		return nil, errors.New(errors.InvalidParameter, op, "nil kms")
+		return nil, errors.NewDeprecated(errors.InvalidParameter, op, "nil kms")
 	}
 
 	opts := getOpts(opt...)
@@ -63,24 +63,24 @@ func NewRepository(r db.Reader, w db.Writer, kms *kms.Kms, opt ...Option) (*Repo
 func (r *Repository) CreateAuthToken(ctx context.Context, withIamUser *iam.User, withAuthAccountId string, opt ...Option) (*AuthToken, error) {
 	const op = "authtoken.(Repository).CreateAuthToken"
 	if withIamUser == nil || withIamUser.User == nil {
-		return nil, errors.New(errors.InvalidParameter, op, "missing user")
+		return nil, errors.New(ctx, errors.InvalidParameter, op, "missing user")
 	}
 	if withIamUser.GetPublicId() == "" {
-		return nil, errors.New(errors.InvalidParameter, op, "missing user id")
+		return nil, errors.New(ctx, errors.InvalidParameter, op, "missing user id")
 	}
 	if withAuthAccountId == "" {
-		return nil, errors.New(errors.InvalidParameter, op, "missing auth account id")
+		return nil, errors.New(ctx, errors.InvalidParameter, op, "missing auth account id")
 	}
 	at, err := newAuthToken()
 	if err != nil {
-		return nil, errors.Wrap(err, op)
+		return nil, errors.Wrap(ctx, err, op)
 	}
 	at.AuthAccountId = withAuthAccountId
 	opts := getOpts(opt...)
 	if opts.withPublicId == "" {
 		id, err := NewAuthTokenId()
 		if err != nil {
-			return nil, errors.Wrap(err, op)
+			return nil, errors.Wrap(ctx, err, op)
 		}
 		opts.withPublicId = id
 	}
@@ -95,14 +95,14 @@ func (r *Repository) CreateAuthToken(ctx context.Context, withIamUser *iam.User,
 
 	databaseWrapper, err := r.kms.GetWrapper(ctx, withIamUser.GetScopeId(), kms.KeyPurposeDatabase)
 	if err != nil {
-		return nil, errors.Wrap(err, op, errors.WithMsg("unable to get database wrapper"))
+		return nil, errors.Wrap(ctx, err, op, errors.WithMsg("unable to get database wrapper"))
 	}
 
 	// We truncate the expiration time to the nearest second to make testing in different platforms with
 	// different time resolutions easier.
 	expiration, err := ptypes.TimestampProto(time.Now().Add(r.timeToLiveDuration).Truncate(time.Second))
 	if err != nil {
-		return nil, errors.Wrap(err, op, errors.WithCode(errors.InvalidTimeStamp))
+		return nil, errors.Wrap(ctx, err, op, errors.WithCode(errors.InvalidTimeStamp))
 	}
 	at.ExpirationTime = &timestamp.Timestamp{Timestamp: expiration}
 
@@ -115,10 +115,10 @@ func (r *Repository) CreateAuthToken(ctx context.Context, withIamUser *iam.User,
 			acct := allocAuthAccount()
 			acct.PublicId = withAuthAccountId
 			if err := read.LookupByPublicId(ctx, acct); err != nil {
-				return errors.Wrap(err, op, errors.WithMsg("auth account lookup"))
+				return errors.Wrap(ctx, err, op, errors.WithMsg("auth account lookup"))
 			}
 			if acct.GetIamUserId() != withIamUser.GetPublicId() {
-				return errors.New(errors.InvalidParameter, op,
+				return errors.New(ctx, errors.InvalidParameter, op,
 					fmt.Sprintf("auth account %q mismatch with iam user %q", withAuthAccountId, withIamUser.GetPublicId()))
 			}
 			at.ScopeId = acct.GetScopeId()
@@ -127,11 +127,11 @@ func (r *Repository) CreateAuthToken(ctx context.Context, withIamUser *iam.User,
 
 			newAuthToken = at.clone()
 			if err := newAuthToken.encrypt(ctx, databaseWrapper); err != nil {
-				return errors.Wrap(err, op)
+				return errors.Wrap(ctx, err, op)
 			}
 			// tokens are not replicated, so they don't need oplog entries.
 			if err := w.Create(ctx, newAuthToken); err != nil {
-				return errors.Wrap(err, op)
+				return errors.Wrap(ctx, err, op)
 			}
 			newAuthToken.CtToken = nil
 
@@ -140,7 +140,7 @@ func (r *Repository) CreateAuthToken(ctx context.Context, withIamUser *iam.User,
 	)
 
 	if err != nil {
-		return nil, errors.Wrap(err, op)
+		return nil, errors.Wrap(ctx, err, op)
 	}
 	return newAuthToken, nil
 }
@@ -151,7 +151,7 @@ func (r *Repository) CreateAuthToken(ctx context.Context, withIamUser *iam.User,
 func (r *Repository) LookupAuthToken(ctx context.Context, id string, opt ...Option) (*AuthToken, error) {
 	const op = "authtoken.(Repository).LookupAuthToken"
 	if id == "" {
-		return nil, errors.New(errors.InvalidPublicId, op, "missing public id")
+		return nil, errors.New(ctx, errors.InvalidPublicId, op, "missing public id")
 	}
 	opts := getOpts(opt...)
 
@@ -163,17 +163,17 @@ func (r *Repository) LookupAuthToken(ctx context.Context, id string, opt ...Opti
 		if errors.IsNotFoundError(err) {
 			return nil, nil
 		}
-		return nil, errors.Wrap(err, op)
+		return nil, errors.Wrap(ctx, err, op)
 	}
 
 	at := atv.toAuthToken()
 	if opts.withTokenValue {
 		databaseWrapper, err := r.kms.GetWrapper(ctx, at.GetScopeId(), kms.KeyPurposeDatabase, kms.WithKeyId(at.GetKeyId()))
 		if err != nil {
-			return nil, errors.Wrap(err, op, errors.WithCode(errors.Encrypt), errors.WithMsg("unable to get database wrapper"))
+			return nil, errors.Wrap(ctx, err, op, errors.WithCode(errors.Encrypt), errors.WithMsg("unable to get database wrapper"))
 		}
 		if err := at.decrypt(ctx, databaseWrapper); err != nil {
-			return nil, errors.Wrap(err, op)
+			return nil, errors.Wrap(ctx, err, op)
 		}
 	}
 
@@ -192,10 +192,10 @@ func (r *Repository) LookupAuthToken(ctx context.Context, id string, opt ...Opti
 func (r *Repository) ValidateToken(ctx context.Context, id, token string, opt ...Option) (*AuthToken, error) {
 	const op = "authtoken.(Repository).ValidateToken"
 	if token == "" {
-		return nil, errors.New(errors.InvalidParameter, op, "missing token")
+		return nil, errors.New(ctx, errors.InvalidParameter, op, "missing token")
 	}
 	if id == "" {
-		return nil, errors.New(errors.InvalidPublicId, op, "missing public id")
+		return nil, errors.New(ctx, errors.InvalidPublicId, op, "missing public id")
 	}
 
 	retAT, err := r.LookupAuthToken(ctx, id, withTokenValue())
@@ -204,7 +204,7 @@ func (r *Repository) ValidateToken(ctx context.Context, id, token string, opt ..
 		if errors.IsNotFoundError(err) {
 			return nil, nil
 		}
-		return nil, errors.Wrap(err, op)
+		return nil, errors.Wrap(ctx, err, op)
 	}
 	if retAT == nil {
 		return nil, nil
@@ -213,11 +213,11 @@ func (r *Repository) ValidateToken(ctx context.Context, id, token string, opt ..
 	// If the token is too old or stale invalidate it and return nothing.
 	exp, err := ptypes.Timestamp(retAT.GetExpirationTime().GetTimestamp())
 	if err != nil {
-		return nil, errors.Wrap(err, op, errors.WithMsg("expiration time"), errors.WithCode(errors.InvalidTimeStamp))
+		return nil, errors.Wrap(ctx, err, op, errors.WithMsg("expiration time"), errors.WithCode(errors.InvalidTimeStamp))
 	}
 	lastAccessed, err := ptypes.Timestamp(retAT.GetApproximateLastAccessTime().GetTimestamp())
 	if err != nil {
-		return nil, errors.Wrap(err, op, errors.WithMsg("last accessed time"), errors.WithCode(errors.InvalidTimeStamp))
+		return nil, errors.Wrap(ctx, err, op, errors.WithMsg("last accessed time"), errors.WithCode(errors.InvalidTimeStamp))
 	}
 
 	now := time.Now()
@@ -234,13 +234,13 @@ func (r *Repository) ValidateToken(ctx context.Context, id, token string, opt ..
 				delAt := retAT.clone()
 				// tokens are not replicated, so they don't need oplog entries.
 				if _, err := w.Delete(ctx, delAt); err != nil {
-					return errors.Wrap(err, op, errors.WithMsg("delete auth token"))
+					return errors.Wrap(ctx, err, op, errors.WithMsg("delete auth token"))
 				}
 				retAT = nil
 				return nil
 			})
 		if err != nil {
-			return nil, errors.Wrap(err, op)
+			return nil, errors.Wrap(ctx, err, op)
 		}
 		return nil, nil
 	}
@@ -271,10 +271,10 @@ func (r *Repository) ValidateToken(ctx context.Context, id, token string, opt ..
 					[]string{"ApproximateLastAccessTime"},
 				)
 				if err != nil {
-					return errors.Wrap(err, op)
+					return errors.Wrap(ctx, err, op)
 				}
 				if rowsUpdated > 1 {
-					return errors.New(errors.MultipleRecords, op, "more than 1 resource would have been updated")
+					return errors.New(ctx, errors.MultipleRecords, op, "more than 1 resource would have been updated")
 				}
 				return nil
 			},
@@ -282,7 +282,7 @@ func (r *Repository) ValidateToken(ctx context.Context, id, token string, opt ..
 	}
 
 	if err != nil {
-		return nil, errors.Wrap(err, op, errors.WithMsg(id))
+		return nil, errors.Wrap(ctx, err, op, errors.WithMsg(id))
 	}
 	return retAT, nil
 }
@@ -292,7 +292,7 @@ func (r *Repository) ValidateToken(ctx context.Context, id, token string, opt ..
 func (r *Repository) ListAuthTokens(ctx context.Context, withScopeIds []string, opt ...Option) ([]*AuthToken, error) {
 	const op = "authtoken.(Repository).ListAuthTokens"
 	if len(withScopeIds) == 0 {
-		return nil, errors.New(errors.InvalidParameter, op, "missing scope id")
+		return nil, errors.New(ctx, errors.InvalidParameter, op, "missing scope id")
 	}
 	opts := getOpts(opt...)
 
@@ -300,7 +300,7 @@ func (r *Repository) ListAuthTokens(ctx context.Context, withScopeIds []string,
 	// to convert them before returning them
 	var atvs []*authTokenView
 	if err := r.reader.SearchWhere(ctx, &atvs, "auth_account_id in (select public_id from auth_account where scope_id in (?))", []interface{}{withScopeIds}, db.WithLimit(opts.withLimit)); err != nil {
-		return nil, errors.Wrap(err, op)
+		return nil, errors.Wrap(ctx, err, op)
 	}
 	authTokens := make([]*AuthToken, 0, len(atvs))
 	for _, atv := range atvs {
@@ -317,7 +317,7 @@ func (r *Repository) ListAuthTokens(ctx context.Context, withScopeIds []string,
 func (r *Repository) DeleteAuthToken(ctx context.Context, id string, opt ...Option) (int, error) {
 	const op = "authtoken.(Repository).DeleteAuthToken"
 	if id == "" {
-		return db.NoRowsAffected, errors.New(errors.InvalidPublicId, op, "missing public id")
+		return db.NoRowsAffected, errors.New(ctx, errors.InvalidPublicId, op, "missing public id")
 	}
 
 	at, err := r.LookupAuthToken(ctx, id)
@@ -325,7 +325,7 @@ func (r *Repository) DeleteAuthToken(ctx context.Context, id string, opt ...Opti
 		if errors.IsNotFoundError(err) {
 			return db.NoRowsAffected, nil
 		}
-		return db.NoRowsAffected, errors.Wrap(err, op)
+		return db.NoRowsAffected, errors.Wrap(ctx, err, op)
 	}
 	if at == nil {
 		return db.NoRowsAffected, nil
@@ -341,17 +341,17 @@ func (r *Repository) DeleteAuthToken(ctx context.Context, id string, opt ...Opti
 			// tokens are not replicated, so they don't need oplog entries.
 			rowsDeleted, err = w.Delete(ctx, deleteAT)
 			if err != nil {
-				return errors.Wrap(err, op)
+				return errors.Wrap(ctx, err, op)
 			}
 			if rowsDeleted > 1 {
-				return errors.New(errors.MultipleRecords, op, "more than 1 resource would have been deleted")
+				return errors.New(ctx, errors.MultipleRecords, op, "more than 1 resource would have been deleted")
 			}
 			return nil
 		},
 	)
 
 	if err != nil {
-		return db.NoRowsAffected, errors.Wrap(err, op, errors.WithMsg(id))
+		return db.NoRowsAffected, errors.Wrap(ctx, err, op, errors.WithMsg(id))
 	}
 
 	return rowsDeleted, nil
@@ -366,7 +366,7 @@ func (r *Repository) DeleteAuthToken(ctx context.Context, id string, opt ...Opti
 func (r *Repository) IssueAuthToken(ctx context.Context, tokenRequestId string) (*AuthToken, error) {
 	const op = "authtoken.(Repository).IssueAuthToken"
 	if tokenRequestId == "" {
-		return nil, errors.New(errors.InvalidParameter, op, "missing token request id")
+		return nil, errors.New(ctx, errors.InvalidParameter, op, "missing token request id")
 	}
 
 	var at *AuthToken
@@ -383,16 +383,16 @@ func (r *Repository) IssueAuthToken(ctx context.Context, tokenRequestId string)
 			// trigger to set ApproximateLastAccessTime to the commit timestamp.
 			rowsUpdated, err := w.Update(ctx, at, []string{"Status"}, []string{"ApproximateLastAccessTime"}, db.WithWhere("status = ?", PendingStatus))
 			if err != nil {
-				return errors.Wrap(err, op)
+				return errors.Wrap(ctx, err, op)
 			}
 			if rowsUpdated == 0 {
-				return errors.New(errors.RecordNotFound, op, "pending auth token not found")
+				return errors.New(ctx, errors.RecordNotFound, op, "pending auth token not found")
 			}
 			if rowsUpdated > 1 {
-				return errors.New(errors.Internal, op, fmt.Sprintf("should have updated 1 row and we attempted to update %d rows", rowsUpdated))
+				return errors.New(ctx, errors.Internal, op, fmt.Sprintf("should have updated 1 row and we attempted to update %d rows", rowsUpdated))
 			}
 			if at.Status != string(IssuedStatus) {
-				return errors.New(errors.Internal, op, "updated auth token status != issued")
+				return errors.New(ctx, errors.Internal, op, "updated auth token status != issued")
 			}
 
 			// we need a new repo, that's using the same reader/writer as this TxHandler
@@ -403,10 +403,10 @@ func (r *Repository) IssueAuthToken(ctx context.Context, tokenRequestId string)
 			}
 			at, err = txRepo.LookupAuthToken(ctx, at.PublicId, withTokenValue())
 			if err != nil {
-				return errors.Wrap(err, op)
+				return errors.Wrap(ctx, err, op)
 			}
 			if at == nil {
-				return errors.New(errors.RecordNotFound, op, "issued auth token not found")
+				return errors.New(ctx, errors.RecordNotFound, op, "issued auth token not found")
 			}
 			return nil
 		})
@@ -433,7 +433,7 @@ func (r *Repository) CloseExpiredPendingTokens(ctx context.Context) (int, error)
 			var err error
 			tokensClosed, err = w.Exec(ctx, sql, args)
 			if err != nil {
-				return errors.Wrap(err, op)
+				return errors.Wrap(ctx, err, op)
 			}
 			return nil
 		},