feat() Map domain errors to gRPC status codes

api/v1/challenge/create.go

@@ -28,7 +28,7 @@ func (store *Store) CreateChallenge(ctx context.Context, req *CreateChallengeReq
 	// 0. Validate request
 	// => Pooler boundaries defaults to 0, with proper ordering
 	if req.Min < 0 || req.Max < 0 || (req.Min > req.Max && req.Max != 0) {
-		return nil, fmt.Errorf("min/max out of bounds: %d/%d", req.Min, req.Max)
+		return nil, errs.ErrValidationFailed{Reason: fmt.Sprintf("min/max out of bounds: %d/%d", req.Min, req.Max)}
 	}
 
 	// 1. Lock R TOTW
@@ -37,13 +37,13 @@ func (store *Store) CreateChallenge(ctx context.Context, req *CreateChallengeReq
 	if err != nil {
 		err := &errs.ErrInternal{Sub: err}
 		logger.Error(ctx, "build TOTW lock", zap.Error(err))
-		return nil, errs.ErrInternalNoSub
+		return nil, errs.ErrLockUnavailable
 	}
 	defer common.LClose(totw)
 	if err := totw.RLock(ctx); err != nil {
 		err := &errs.ErrInternal{Sub: err}
 		logger.Error(ctx, "TOTW R lock", zap.Error(err))
-		return nil, errs.ErrInternalNoSub
+		return nil, errs.ErrLockUnavailable
 	}
 	span.AddEvent("locked TOTW")
 
@@ -55,7 +55,7 @@ func (store *Store) CreateChallenge(ctx context.Context, req *CreateChallengeReq
 			totw.RUnlock(ctx),
 			err,
 		)))
-		return nil, errs.ErrInternalNoSub
+		return nil, errs.ErrLockUnavailable
 	}
 	defer common.LClose(clock)
 	if err := clock.RWLock(ctx); err != nil {
@@ -64,7 +64,7 @@ func (store *Store) CreateChallenge(ctx context.Context, req *CreateChallengeReq
 			totw.RUnlock(ctx),
 			err,
 		)))
-		return nil, errs.ErrInternalNoSub
+		return nil, errs.ErrLockUnavailable
 	}
 	defer func(lock lock.RWLock) {
 		if err := lock.RWUnlock(ctx); err != nil {
@@ -77,7 +77,7 @@ func (store *Store) CreateChallenge(ctx context.Context, req *CreateChallengeReq
 	if err := totw.RUnlock(ctx); err != nil {
 		err := &errs.ErrInternal{Sub: err}
 		logger.Error(ctx, "TOTW R unlock", zap.Error(err))
-		return nil, errs.ErrInternalNoSub
+		return nil, errs.ErrLockUnavailable
 	}
 	span.AddEvent("unlocked TOTW")
 
@@ -96,12 +96,12 @@ func (store *Store) CreateChallenge(ctx context.Context, req *CreateChallengeReq
 		global.Conf.OCI.Insecure, global.Conf.OCI.Username, global.Conf.OCI.Password,
 	)
 	if err != nil {
-		err := &errs.ErrInternal{Sub: err}
+		err := errs.ErrValidationFailed{Reason: err.Error()}
 		logger.Error(ctx, "decoding scenario",
 			zap.String("reference", req.Scenario),
 			zap.Error(err),
 		)
-		return nil, errs.ErrInternalNoSub
+		return nil, err
 	}
 	fschall := &fs.Challenge{
 		ID:         req.Id,

api/v1/challenge/delete.go

@@ -32,13 +32,13 @@ func (store *Store) DeleteChallenge(ctx context.Context, req *DeleteChallengeReq
 	if err != nil {
 		err := &errs.ErrInternal{Sub: err}
 		logger.Error(ctx, "build TOTW lock", zap.Error(err))
-		return nil, errs.ErrInternalNoSub
+		return nil, errs.ErrLockUnavailable
 	}
 	defer common.LClose(totw)
 	if err := totw.RLock(ctx); err != nil {
 		err := &errs.ErrInternal{Sub: err}
 		logger.Error(ctx, "TOTW R lock", zap.Error(err))
-		return nil, errs.ErrInternalNoSub
+		return nil, errs.ErrLockUnavailable
 	}
 	span.AddEvent("locked TOTW")
 
@@ -50,7 +50,7 @@ func (store *Store) DeleteChallenge(ctx context.Context, req *DeleteChallengeReq
 			totw.RUnlock(ctx),
 			err,
 		)))
-		return nil, errs.ErrInternalNoSub
+		return nil, errs.ErrLockUnavailable
 	}
 	defer common.LClose(clock)
 	if err := clock.RWLock(ctx); err != nil {
@@ -59,7 +59,7 @@ func (store *Store) DeleteChallenge(ctx context.Context, req *DeleteChallengeReq
 			totw.RUnlock(ctx),
 			err,
 		)))
-		return nil, errs.ErrInternalNoSub
+		return nil, errs.ErrLockUnavailable
 	}
 	// don't defer unlock, will do it manually for ASAP challenge availability
 
@@ -91,7 +91,7 @@ func (store *Store) DeleteChallenge(ctx context.Context, req *DeleteChallengeReq
 				zap.Error(clock.RWUnlock(ctx)),
 			)
 		}
-		return nil, err
+		return nil, errs.ErrValidationFailed{Reason: err.Error()}
 	}
 
 	// Reload cache if necessary

api/v1/challenge/query.go

@@ -29,13 +29,13 @@ func (store *Store) QueryChallenge(_ *emptypb.Empty, server ChallengeStore_Query
 	if err != nil {
 		err := &errs.ErrInternal{Sub: err}
 		logger.Error(ctx, "build TOTW lock", zap.Error(err))
-		return errs.ErrInternalNoSub
+		return errs.ErrLockUnavailable
 	}
 	defer common.LClose(totw)
 	if err := totw.RWLock(ctx); err != nil {
 		err := &errs.ErrInternal{Sub: err}
 		logger.Error(ctx, "TOTW RW lock", zap.Error(err))
-		return errs.ErrInternalNoSub
+		return errs.ErrLockUnavailable
 	}
 	span.AddEvent("locked TOTW")
 
@@ -69,13 +69,13 @@ func (store *Store) QueryChallenge(_ *emptypb.Empty, server ChallengeStore_Query
 			// 4.a. Lock R challenge
 			clock, err := common.LockChallenge(ctx, id)
 			if err != nil {
-				cerr <- err
+				cerr <- errs.ErrLockUnavailable
 				relock.Done() // release to avoid dead-lock
 				return
 			}
 			defer common.LClose(clock)
 			if err := clock.RLock(ctx); err != nil {
-				cerr <- err
+				cerr <- errs.ErrLockUnavailable
 				relock.Done() // release to avoid dead-lock
 				return
 			}
@@ -93,7 +93,7 @@ func (store *Store) QueryChallenge(_ *emptypb.Empty, server ChallengeStore_Query
 			// 4.c. Read challenge info
 			fschall, err := fs.LoadChallenge(id)
 			if err != nil {
-				cerr <- err
+				cerr <- errs.ErrValidationFailed{Reason: err.Error()}
 				return
 			}
 
@@ -103,7 +103,7 @@ func (store *Store) QueryChallenge(_ *emptypb.Empty, server ChallengeStore_Query
 			clmIsts := map[string]string{}
 			ists, err := fs.ListInstances(id)
 			if err != nil {
-				cerr <- err
+				cerr <- errs.ErrInternalNoSub
 				return
 			}
 			for _, ist := range ists {

api/v1/challenge/retrieve.go

@@ -29,13 +29,13 @@ func (store *Store) RetrieveChallenge(ctx context.Context, req *RetrieveChalleng
 	if err != nil {
 		err := &errs.ErrInternal{Sub: err}
 		logger.Error(ctx, "build TOTW lock", zap.Error(err))
-		return nil, errs.ErrInternalNoSub
+		return nil, errs.ErrLockUnavailable
 	}
 	defer common.LClose(totw)
 	if err := totw.RLock(ctx); err != nil {
 		err := &errs.ErrInternal{Sub: err}
 		logger.Error(ctx, "TOTW R lock", zap.Error(err))
-		return nil, errs.ErrInternalNoSub
+		return nil, errs.ErrLockUnavailable
 	}
 	span.AddEvent("locked TOTW")
 
@@ -47,7 +47,7 @@ func (store *Store) RetrieveChallenge(ctx context.Context, req *RetrieveChalleng
 			totw.RUnlock(ctx),
 			err,
 		)))
-		return nil, errs.ErrInternalNoSub
+		return nil, errs.ErrLockUnavailable
 	}
 	defer common.LClose(clock)
 	if err := clock.RLock(ctx); err != nil {
@@ -56,7 +56,7 @@ func (store *Store) RetrieveChallenge(ctx context.Context, req *RetrieveChalleng
 			totw.RUnlock(ctx),
 			err,
 		)))
-		return nil, errs.ErrInternalNoSub
+		return nil, errs.ErrLockUnavailable
 	}
 	defer func(lock lock.RWLock) {
 		if err := lock.RUnlock(ctx); err != nil {
@@ -69,7 +69,7 @@ func (store *Store) RetrieveChallenge(ctx context.Context, req *RetrieveChalleng
 	if err := totw.RUnlock(ctx); err != nil {
 		err := &errs.ErrInternal{Sub: err}
 		logger.Error(ctx, "TOTW R unlock", zap.Error(err))
-		return nil, errs.ErrInternalNoSub
+		return nil, errs.ErrLockUnavailable
 	}
 	span.AddEvent("unlocked TOTW")
 
@@ -86,7 +86,7 @@ func (store *Store) RetrieveChallenge(ctx context.Context, req *RetrieveChalleng
 			)
 			return nil, errs.ErrInternalNoSub
 		}
-		return nil, err
+		return nil, errs.ErrValidationFailed{Reason: err.Error()}
 	}
 
 	// 5. For all challenge instances, lock, read, unlock, unlock R ASAP

api/v1/challenge/update.go

@@ -46,13 +46,13 @@ func (store *Store) UpdateChallenge(ctx context.Context, req *UpdateChallengeReq
 	if err != nil {
 		err := &errs.ErrInternal{Sub: err}
 		logger.Error(ctx, "build TOTW lock", zap.Error(err))
-		return nil, errs.ErrInternalNoSub
+		return nil, errs.ErrLockUnavailable
 	}
 	defer common.LClose(totw)
 	if err := totw.RLock(ctx); err != nil {
 		err := &errs.ErrInternal{Sub: err}
 		logger.Error(ctx, "TOTW R lock", zap.Error(err))
-		return nil, errs.ErrInternalNoSub
+		return nil, errs.ErrLockUnavailable
 	}
 	span.AddEvent("locked TOTW")
 
@@ -65,7 +65,7 @@ func (store *Store) UpdateChallenge(ctx context.Context, req *UpdateChallengeReq
 			totw.RUnlock(ctx),
 			err,
 		)))
-		return nil, errs.ErrInternalNoSub
+		return nil, errs.ErrLockUnavailable
 	}
 	defer common.LClose(clock)
 	if err := clock.RWLock(ctx); err != nil {
@@ -74,7 +74,7 @@ func (store *Store) UpdateChallenge(ctx context.Context, req *UpdateChallengeReq
 			totw.RUnlock(ctx),
 			err,
 		)))
-		return nil, errs.ErrInternalNoSub
+		return nil, errs.ErrLockUnavailable
 	}
 	span.AddEvent("locked challenge")
 	defer func(lock lock.RWLock) {
@@ -103,7 +103,7 @@ func (store *Store) UpdateChallenge(ctx context.Context, req *UpdateChallengeReq
 			)
 			return nil, errs.ErrInternalNoSub
 		}
-		return nil, err
+		return nil, errs.ErrValidationFailed{Reason: err.Error()}
 	}
 
 	// Reload cache if necessary
@@ -115,7 +115,7 @@ func (store *Store) UpdateChallenge(ctx context.Context, req *UpdateChallengeReq
 			zap.String("reference", fschall.Scenario),
 			zap.Error(err),
 		)
-		return nil, errs.ErrInternalNoSub
+		return nil, errs.ErrValidationFailed{Reason: err.Error()}
 	}
 
 	// 5. Update challenge until/timeout, pooler, or scenario on filesystem

api/v1/instance/create.go

@@ -3,6 +3,7 @@ package instance
 import (
 	context "context"
 	"errors"
+	"strings"
 	"time"
 
 	"go.opentelemetry.io/otel/metric"
@@ -32,13 +33,13 @@ func (man *Manager) CreateInstance(ctx context.Context, req *CreateInstanceReque
 	if err != nil {
 		err := &errs.ErrInternal{Sub: err}
 		logger.Error(ctx, "build TOTW lock", zap.Error(err))
-		return nil, errs.ErrInternalNoSub
+		return nil, errs.ErrLockUnavailable
 	}
 	defer common.LClose(totw)
 	if err := totw.RLock(ctx); err != nil {
 		err := &errs.ErrInternal{Sub: err}
 		logger.Error(ctx, "TOTW R lock", zap.Error(err))
-		return nil, errs.ErrInternalNoSub
+		return nil, errs.ErrLockUnavailable
 	}
 	span.AddEvent("locked TOTW")
 
@@ -50,7 +51,7 @@ func (man *Manager) CreateInstance(ctx context.Context, req *CreateInstanceReque
 			totw.RUnlock(ctx),
 			err,
 		)))
-		return nil, errs.ErrInternalNoSub
+		return nil, errs.ErrLockUnavailable
 	}
 	defer common.LClose(clock)
 	if err := clock.RLock(ctx); err != nil {
@@ -59,7 +60,7 @@ func (man *Manager) CreateInstance(ctx context.Context, req *CreateInstanceReque
 			totw.RUnlock(ctx),
 			err,
 		)))
-		return nil, errs.ErrInternalNoSub
+		return nil, errs.ErrLockUnavailable
 	}
 
 	// 3. Unlock R TOTW
@@ -71,7 +72,7 @@ func (man *Manager) CreateInstance(ctx context.Context, req *CreateInstanceReque
 				err,
 			)),
 		)
-		return nil, errs.ErrInternalNoSub
+		return nil, errs.ErrLockUnavailable
 	}
 	span.AddEvent("unlocked TOTW")
 
@@ -86,7 +87,7 @@ func (man *Manager) CreateInstance(ctx context.Context, req *CreateInstanceReque
 			)
 			return nil, errs.ErrInternalNoSub
 		}
-		return nil, err
+		return nil, errs.ErrValidationFailed{Reason: err.Error()}
 	}
 	// Reload cache if necessary
 	if _, err := scenario.DecodeOCI(ctx,
@@ -103,7 +104,7 @@ func (man *Manager) CreateInstance(ctx context.Context, req *CreateInstanceReque
 		if err := clock.RUnlock(ctx); err != nil {
 			logger.Error(ctx, "unlocking R challenge", zap.Error(err))
 		}
-		return nil, errors.New("challenge is already expired")
+		return nil, errs.ErrChallengeExpired
 	}
 	if _, err := fs.FindInstance(req.ChallengeId, req.SourceId); err == nil {
 		if err := clock.RUnlock(ctx); err != nil {
@@ -285,6 +286,13 @@ func (man *Manager) CreateInstance(ctx context.Context, req *CreateInstanceReque
 	ctx = global.WithIdentity(ctx, id)
 	logger.Info(ctx, "creating new instance")
 
+	if fschall.Max != 0 && len(ists) >= int(fschall.Max) {
+		if err := clock.RUnlock(ctx); err != nil {
+			logger.Error(ctx, "unlock R challenge", zap.Error(err))
+		}
+		return nil, errs.ErrPoolExhausted
+	}
+
 	// No need to refine lock -> instance is unique per the identity.
 	// We MUST NOT release the clock until the instance is up & running,
 	// elseway the challenge could be deleted even if we are working on it.
@@ -298,7 +306,7 @@ func (man *Manager) CreateInstance(ctx context.Context, req *CreateInstanceReque
 				err,
 			)),
 		)
-		return nil, errs.ErrInternalNoSub
+		return nil, errs.ErrProvisioningFailed{Sub: err}
 	}
 	if err := iac.Additional(ctx, stack, fschall.Additional, req.Additional); err != nil {
 		logger.Error(ctx, "configuring additionals on stack",
@@ -307,20 +315,29 @@ func (man *Manager) CreateInstance(ctx context.Context, req *CreateInstanceReque
 				err,
 			)),
 		)
-		return nil, errs.ErrInternalNoSub
+		return nil, errs.ErrProvisioningFailed{Sub: err}
 	}
 
 	sr, err := stack.Up(ctx)
 	if err != nil {
-		err := &errs.ErrInternal{Sub: err}
+		var perr error
+		switch {
+		case errors.Is(err, context.Canceled),
+			strings.Contains(err.Error(), "update canceled"),
+			strings.Contains(err.Error(), "preview canceled"):
+			perr = errs.ErrPulumiCanceled
+		default:
+			perr = errs.ErrProvisioningFailed{Sub: err}
+		}
+
 		logger.Error(ctx, "stack up",
 			zap.Error(multierr.Combine(
 				clock.RUnlock(ctx),
 				fs.Wash(fschall.Directory, id),
-				err,
+				perr,
 			)),
 		)
-		return nil, errs.ErrInternalNoSub
+		return nil, perr
 	}
 
 	now := time.Now()
@@ -339,7 +356,7 @@ func (man *Manager) CreateInstance(ctx context.Context, req *CreateInstanceReque
 				err,
 			)),
 		)
-		return nil, errs.ErrInternalNoSub
+		return nil, errs.ErrProvisioningFailed{Sub: err}
 	}
 
 	// Save fsist