[duplicate-code] Duplicate Code Pattern: Repeated WriteJSONResponse 403 bodies in proxy/handler.go

[github-actions]

Part of duplicate code analysis: #3050

Summary

In internal/proxy/handler.go, httputil.WriteJSONResponse is called with http.StatusForbidden (403) in 3 separate locations. Two of these (lines 155 and 228) use an identical map[string]string{"message": ...} body shape and are separated by only ~75 lines of code. The third (line 71) uses a GraphQL-specific shape. Unlike the internal/server package — which has a writeErrorResponse helper — the proxy package has no equivalent abstraction.

Duplication Details

Pattern: Inline httputil.WriteJSONResponse 403 response in proxy handler

• Severity: Low

• Occurrences: 2 near-identical blocks (+ 1 structurally similar)

• Locations:

  • internal/proxy/handler.go line 71 (GraphQL shape — different body)
  • internal/proxy/handler.go lines 155–158 (DIFC write blocked — {"message": "..."})
  • internal/proxy/handler.go lines 227–230 (DIFC strict mode — {"message": "..."})

• Code Sample (lines 155–158):

httputil.WriteJSONResponse(w, http.StatusForbidden, map[string]string{
    "message": fmt.Sprintf("DIFC policy violation: %s", evalResult.Reason),
})

• Code Sample (lines 227–230, structurally identical):

httputil.WriteJSONResponse(w, http.StatusForbidden, map[string]string{
    "message": fmt.Sprintf("DIFC policy violation: %d of %d items not accessible",
        filtered.GetFilteredCount(), filtered.TotalCount),
})

Impact Analysis

• Maintainability: If the HTTP response shape for DIFC policy violations changes (e.g. adding a code field), two call sites must be updated.
• Bug Risk: Low — the current impact is cosmetic inconsistency rather than a correctness risk.
• Code Bloat: ~8 lines, minor.

Refactoring Recommendations

1. Add a writeDIFCForbidden helper in internal/proxy/handler.go (or a new http_helpers.go within the proxy package):

   func writeDIFCForbidden(w http.ResponseWriter, message string) {
       httputil.WriteJSONResponse(w, http.StatusForbidden, map[string]string{
           "message": message,
       })
   }

   Callers become:

   writeDIFCForbidden(w, fmt.Sprintf("DIFC policy violation: %s", evalResult.Reason))

2. Alternative: Move the helper to internal/httputil if it may be needed by other packages.

3. This is a low-priority polish item — consider batching with any future proxy refactoring.

Implementation Checklist

• Review findings
• Add writeDIFCForbidden helper (or equivalent)
• Replace 2 inline call sites (lines 155 and 228)
• Run make agent-finished to verify

Parent Issue

See parent analysis report: #3050
Related to #3050

Generated by Duplicate Code Detector · ◷

• expires on Apr 9, 2026, 6:02 AM UTC