[duplicate-code] Duplicate Code Pattern: HTTP Error Response Helpers Inconsistently Duplicated

[github-actions]

Part of duplicate code analysis: #4711

Summary

The server package has a well-consolidated writeErrorResponse / rejectRequest helper in internal/server/http_helpers.go. However, internal/proxy/handler.go defines a separate writeDIFCForbidden helper that partially overlaps with this pattern, and across the codebase there are ~5 inline httputil.WriteJSONResponse calls with map[string]string{"error": ..., "message": ...} that duplicate what writeErrorResponse does.

Duplication Details

Pattern: Repeated inline JSON error response construction

• Severity: Low

• Occurrences: 3+

• Locations:

  • internal/proxy/handler.go:30–33 — writeDIFCForbidden() (custom variant, different key "message" vs "error")
  • internal/server/http_helpers.go:51–55 — writeErrorResponse() (uses "error" + "message" keys)
  • Various callers in internal/server/ that call httputil.WriteJSONResponse directly with ad-hoc maps

• Code Sample (proxy/handler.go):

  func writeDIFCForbidden(w http.ResponseWriter, message string) {
      httputil.WriteJSONResponse(w, http.StatusForbidden, map[string]string{
          "message": message,
      })
  }

• Code Sample (server/http_helpers.go):

  func writeErrorResponse(w http.ResponseWriter, statusCode int, code, message string) {
      httputil.WriteJSONResponse(w, statusCode, map[string]string{
          "error":   code,
          "message": message,
      })
  }

The "message"-only shape in writeDIFCForbidden diverges from the "error" + "message" shape used elsewhere, creating inconsistency in error response format for API consumers.

Impact Analysis

• Maintainability: Any change to the JSON error response shape requires changes in multiple places.
• Bug Risk: Medium — a client parsing error responses will receive inconsistent shapes ({"message":"..."} from DIFC 403s vs {"error":"...","message":"..."} from all other errors).
• Code Bloat: Minor.

Refactoring Recommendations

1. Move writeErrorResponse to internal/httputil/ so both server and proxy packages can use it.
2. Update writeDIFCForbidden to use the shared helper (adding an "error": "difc_forbidden" field for consistency).
3. Estimated effort: 1 hour.
4. Benefits: consistent error shape for all API consumers, single place to update response format.

Implementation Checklist

• Review duplication findings
• Move/create WriteErrorResponse in internal/httputil/
• Update proxy/handler.go and server/http_helpers.go to use shared helper
• Ensure error response JSON shape is consistent ({"error": ..., "message": ...})
• Verify no functionality broken

Parent Issue

See parent analysis report: #4711
Related to #4711

Generated by Duplicate Code Detector · ● 1M · ◷

• expires on May 5, 2026, 6:23 AM UTC