Part of duplicate code analysis: #2049

Summary

parseLabelAgentResponse in internal/guard/wasm.go contains two back-to-back identical 7-line blocks that handle the failure cases for the "success" and "ok" boolean fields in the WASM label_agent response. The blocks are byte-for-byte identical — any future fix or logging change must be applied twice or bugs will diverge.

Duplication Details

Pattern: Identical failure-extraction blocks

• Severity: Medium
• Occurrences: 2 (in the same function)
• Location: internal/guard/wasm.go (lines 422–435)

// Block 1 — success == false
if success, ok := raw["success"].(bool); ok && !success {
    if message, msgOK := raw["error"].(string); msgOK && strings.TrimSpace(message) != "" {
        logWasm.Printf("label_agent response indicated failure: error=%s, response=%s", message, string(resultJSON))
        return nil, fmt.Errorf("label_agent rejected policy: %s", message)
    }
    logWasm.Printf("label_agent response indicated non-success status: response=%s", string(resultJSON))
    return nil, fmt.Errorf("label_agent returned non-success status")
}

// Block 2 — ok == false  (IDENTICAL body)
if okValue, ok := raw["ok"].(bool); ok && !okValue {
    if message, msgOK := raw["error"].(string); msgOK && strings.TrimSpace(message) != "" {
        logWasm.Printf("label_agent response indicated failure: error=%s, response=%s", message, string(resultJSON))
        return nil, fmt.Errorf("label_agent rejected policy: %s", message)
    }
    logWasm.Printf("label_agent response indicated non-success status: response=%s", string(resultJSON))
    return nil, fmt.Errorf("label_agent returned non-success status")
}

Impact Analysis

• Maintainability: Any change to error message format, log fields, or error wrapping must be applied to both blocks. Easy to miss.
• Bug Risk: If one block is updated and the other is not, error messages become inconsistent for success-style vs ok-style WASM responses.
• Code Bloat: 7 lines of identical logic carried twice inside a single function.

Refactoring Recommendations

1. Extract a checkBoolFailure helper in internal/guard/wasm.go:

   // checkBoolFailure returns a non-nil error if the given raw response map
   // contains field `key` set to false, extracting the "error" message if present.
   func checkBoolFailure(raw map[string]interface{}, resultJSON []byte, key string) error {
       val, ok := raw[key].(bool)
       if !ok || val {
           return nil // field absent or true — not a failure
       }
       if message, msgOK := raw["error"].(string); msgOK && strings.TrimSpace(message) != "" {
           logWasm.Printf("label_agent response indicated failure: error=%s, response=%s", message, string(resultJSON))
           return fmt.Errorf("label_agent rejected policy: %s", message)
       }
       logWasm.Printf("label_agent response indicated non-success status: response=%s", string(resultJSON))
       return fmt.Errorf("label_agent returned non-success status")
   }

   Then in parseLabelAgentResponse:

   if err := checkBoolFailure(raw, resultJSON, "success"); err != nil {
       return nil, err
   }
   if err := checkBoolFailure(raw, resultJSON, "ok"); err != nil {
       return nil, err
   }

   • Estimated effort: < 30 min
   • Benefits: Single source of truth for failure extraction logic; future log-format changes need only one edit.

Implementation Checklist

• Review duplication findings
• Extract checkBoolFailure helper
• Verify both success and ok paths still tested
• Confirm no behavioral change (pure refactor)

Parent Issue

See parent analysis report: #2049
Related to #2049

Generated by Duplicate Code Detector · ◷

• expires on Mar 24, 2026, 3:02 AM UTC