feat: 737 add credentials error handling (#1201)

matthiasbruns · web-flow · commit 3af5ed79952f · 2025-11-14T11:23:31.000Z
#### What this PR does / why we need it Credentials error handling from #1191 #### Which issue(s) this PR fixes Contributes: open-component-model/ocm-project#737 --------- Signed-off-by: Matthias Bruns <git@matthiasbruns.com>
diff --git a/bindings/go/credentials/graph.go b/bindings/go/credentials/graph.go
@@ -21,6 +21,12 @@ var ErrNoDirectCredentials = errors.New("no direct credentials found in graph")
 // credentials for the given identity.
 var ErrNoIndirectCredentials = errors.New("no indirect credentials found in graph")
 
+// ErrNotFound is returned when no credentials could be found for the given identity.
+var ErrNotFound = errors.New("credentials not found")
+
+// ErrUnknown is a generic error indicating an unknown failure during credential resolution.
+var ErrUnknown = errors.New("unknown error occurred")
+
 var scheme = runtime.NewScheme()
 
 func init() {
@@ -73,6 +79,7 @@ type Graph struct {
 // falls back to indirect resolution through plugins.
 func (g *Graph) Resolve(ctx context.Context, identity runtime.Identity) (map[string]string, error) {
 	if _, err := identity.ParseType(); err != nil {
+		err = errors.Join(ErrUnknown, err)
 		return nil, fmt.Errorf("to be resolved from the credential graph, a consumer identity type is required: %w", err)
 	}
 
@@ -86,6 +93,13 @@ func (g *Graph) Resolve(ctx context.Context, identity runtime.Identity) (map[str
 	}
 
 	if err != nil {
+		if errors.Is(err, ErrNoDirectCredentials) || errors.Is(err, ErrNoIndirectCredentials) {
+			// not found err
+			err = errors.Join(ErrNotFound, err)
+			return nil, fmt.Errorf("failed to resolve credentials for identity %q: %w", identity.String(), err)
+		}
+
+		err = errors.Join(ErrUnknown, err)
 		return nil, fmt.Errorf("failed to resolve credentials for identity %q: %w", identity.String(), err)
 	}
 
diff --git a/bindings/go/credentials/graph_test.go b/bindings/go/credentials/graph_test.go
@@ -500,7 +500,8 @@ func TestResolutionErrors(t *testing.T) {
 	r.Empty(creds)
 	r.Error(err)
 	r.ErrorIs(err, credentials.ErrNoDirectCredentials)
-	r.ErrorContains(err, fmt.Sprintf("failed to resolve credentials for identity %q: failed to match any node: no direct credentials found in graph", id.String()))
+	r.ErrorContains(err, fmt.Sprintf("failed to resolve credentials for identity %q: credentials not found", id.String()))
+	r.ErrorContains(err, "failed to match any node: no direct credentials found in graph")
 
 	g, err = credentials.ToGraph(t.Context(), &credentialruntime.Config{}, credentials.Options{
 		RepositoryPluginProvider: credentials.GetRepositoryPluginFn(func(ctx context.Context, repoType runtime.Typed) (credentials.RepositoryPlugin, error) {
@@ -516,5 +517,6 @@ func TestResolutionErrors(t *testing.T) {
 	r.Empty(creds)
 	r.Error(err)
 	r.ErrorIs(err, credentials.ErrNoIndirectCredentials)
-	r.ErrorContains(err, fmt.Sprintf("failed to resolve credentials for identity %q: no indirect credentials found in graph", id.String()))
+	r.ErrorContains(err, fmt.Sprintf("failed to resolve credentials for identity %q: credentials not found", id.String()))
+	r.ErrorContains(err, "no indirect credentials found in graph")
 }
