refactor: standardize API error handling (#1635)

backend/internal/utils/callback_url_util_test.go

@@ -8,6 +8,9 @@ import (
 )
 
 func TestValidateCallbackURLPattern(t *testing.T) {
+	// #nosec G101
+	const wildcardUserinfoPattern = "https://user:*@example.com/callback"
+
 	tests := []struct {
 		name        string
 		pattern     string
@@ -35,7 +38,7 @@ func TestValidateCallbackURLPattern(t *testing.T) {
 		},
 		{
 			name:        "wildcard userinfo",
-			pattern:     "https://user:*@example.com/callback", // #nosec G101 - Test credential
+			pattern:     wildcardUserinfoPattern,
 			shouldError: false,
 		},
 		{

backend/internal/utils/cookie/cookie_names.go

@@ -8,9 +8,9 @@ import (
 
 var AccessTokenCookieName = "__Host-access_token"
 var SessionIdCookieName = "__Host-session"
-var DeviceTokenCookieName = "__Secure-device_token"                     //nolint:gosec
-var DeviceLoginTokenCookieName = "__Secure-device_login_token"          //nolint:gosec
-var ReauthenticationTokenCookieName = "__Secure-reauthentication_token" //nolint:gosec
+var DeviceTokenCookieName = "__Secure-device_token"                     // #nosec G101 -- cookie name, not a credential
+var DeviceLoginTokenCookieName = "__Secure-device_login_token"          // #nosec G101 -- cookie name, not a credential
+var ReauthenticationTokenCookieName = "__Secure-reauthentication_token" // #nosec G101 -- cookie name, not a credential
 
 func init() {
 	if strings.HasPrefix(common.EnvConfig.AppURL, "http://") {

backend/internal/utils/image/profile_picture.go

@@ -2,6 +2,7 @@ package profilepicture
 
 import (
 	"bytes"
+	"errors"
 	"fmt"
 	"image"
 	"image/color"
@@ -19,6 +20,8 @@ import (
 
 const profilePictureSize = 300
 
+var ErrInvalidImage = errors.New("invalid image")
+
 // CreateProfilePicture resizes the profile picture to a square and encodes it as PNG
 func CreateProfilePicture(file io.ReadSeeker) (io.ReadSeeker, error) {
 	// Attempt standard formats first
@@ -30,7 +33,10 @@ func CreateProfilePicture(file io.ReadSeeker) (io.ReadSeeker, error) {
 		// Try WebP
 		webpImg, webpErr := webp.Decode(file)
 		if webpErr != nil {
-			return nil, fmt.Errorf("failed to decode image: %w", err)
+			return nil, fmt.Errorf("%w: %w", ErrInvalidImage, errors.Join(
+				fmt.Errorf("standard formats: %w", err),
+				fmt.Errorf("WebP: %w", webpErr),
+			))
 		}
 
 		img = webpImg