refactor: reduce cognitive complexity flagged by SonarCloud - #200
Merged
osanderson merged 1 commit intoAug 29, 2026
Merged
Conversation
Copy link
Copy Markdown
Collaborator
Sorry, something went wrong.
Mechanical extraction, no behavior change, addressing 11 of the 29 open go:S3776 issues (the other 18 are flat validation/checklist functions or large sequential test setups where splitting would just scatter the same logic across files for no readability gain): - storage/contract.go: extract every t.Run closure body in TestGrantStoreContract/TestAccessTokenStoreContract/ TestBackchannelAuthenticationStoreContract into standalone top-level functions, mirroring the Transaction/Session/Nonce contracts already fixed this way. - cmd/conformance-as/config.go: extract resolveClient's three independent string-to-enum switches (client_auth_method, sender_constrain, backchannel_token_delivery_mode) into their own parseXxx helpers. - internal/jose/jwk.go: extract ParseJWK's EC/RSA/OKP cases into their own parse*PublicKey functions. - keys/publicjwks.go: extract the "validate kid, dedup, build, append" tail PublicJWKS's signing and encryption loops both duplicated verbatim into a shared appendPublicJWK helper. - resource/verify.go: extract Verify's DPoP/Bearer credential -resolution switch into its own resolveCredential method. - client/backchannel.go: extract the client-assertion/DPoP signer -resolution block BeginBackchannelAuthentication and PollBackchannelAuthentication both duplicated into a shared resolveClientAuthAndDPoPSigners helper. - client/flow_test.go: extract fakeAS.handleToken's three response -mode branches (reject-plain, nonce-challenge, normal-issue) into their own methods. server/token.go's ExchangeAuthorizationCode was investigated and left unchanged: its token-issuance tail already calls the same shared helpers (issueIDToken, issueRefreshToken, withIdentityClaims, withRequestedUserinfoClaims) that refresh.go and backchannel_token.go reuse — no duplication left to extract, and the remaining complexity is a flat validation checklist. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Copy link
Copy Markdown
|
Sorry, something went wrong.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Addresses 11 of the 29 open go:S3776 (Cognitive Complexity) issues on SonarCloud, via pure mechanical extraction with no behavior change:
The remaining 18 issues are flat validation/checklist functions (e.g. client/client.go, server/server.go, storage/client_repository.go constructors) or large sequential test/harness setups where splitting would just scatter one audit-worthy list across files without improving readability — left as-is per this repo's own "don't refactor for a linter number alone" convention. server/token.go's ExchangeAuthorizationCode was specifically investigated for duplication and found to already reuse shared helpers (issueIDToken, issueRefreshToken, withIdentityClaims, withRequestedUserinfoClaims) with refresh.go/backchannel_token.go — nothing left to extract there.
Test plan
🤖 Generated with Claude Code
https://claude.ai/code/session_013tGG2Ssuq5BDgCMbF8zYb8