重构

internal/util/cap/cap.go

@@ -105,10 +105,10 @@ func jwtSign(payload []byte, secret []byte) string {
 func jwtVerify(token string, secret []byte) ([]byte, error) {
 	parts := strings.Split(token, ".")
 	if len(parts) != 3 {
-		return nil, errors.New("invalid token format")
+		return nil, errors.New(errInvalidTokenFormat)
 	}
 	if parts[0] != jwtHeaderB64 {
-		return nil, errors.New("invalid header")
+		return nil, errors.New(errInvalidHeader)
 	}
 
 	sigInput := parts[0] + "." + parts[1]
@@ -122,7 +122,7 @@ func jwtVerify(token string, secret []byte) ([]byte, error) {
 	}
 
 	if !hmac.Equal(expectedSig, actualSig) {
-		return nil, errors.New("signature mismatch")
+		return nil, errors.New(errSignatureMismatch)
 	}
 
 	payload, err := b64urlDecode(parts[1])
@@ -195,25 +195,25 @@ func GenerateChallenge(secret []byte, conf ChallengeConfig, scope string) (*Chal
 func VerifyChallengeSolutions(token string, solutions []int, secret []byte, expectedScope string) (*ChallengePayload, error) {
 	payloadBytes, err := jwtVerify(token, secret)
 	if err != nil {
-		return nil, errors.New("invalid_token")
+		return nil, errors.New(errInvalidToken)
 	}
 
 	var payload ChallengePayload
 	if err := json.Unmarshal(payloadBytes, &payload); err != nil {
-		return nil, errors.New("invalid_token")
+		return nil, errors.New(errInvalidToken)
 	}
 
 	if expectedScope != "" && payload.Scope != expectedScope {
-		return nil, errors.New("scope_mismatch")
+		return nil, errors.New(errScopeMismatch)
 	}
 
 	now := time.Now().UnixNano() / int64(time.Millisecond)
 	if payload.Expires < now {
-		return nil, errors.New("expired")
+		return nil, errors.New(errExpired)
 	}
 
 	if len(solutions) != payload.Count {
-		return nil, errors.New("invalid_solutions")
+		return nil, errors.New(errInvalidSolutions)
 	}
 
 	tokenFnv := fnv1a(token)
@@ -229,7 +229,7 @@ func VerifyChallengeSolutions(token string, solutions []int, secret []byte, expe
 		hashHex := hex.EncodeToString(hashBytes[:])
 
 		if !strings.HasPrefix(hashHex, target) {
-			return nil, errors.New("invalid_solution")
+			return nil, errors.New(errInvalidSolution)
 		}
 	}
 

internal/util/cap/errs.go

@@ -0,0 +1,28 @@
+/*
+Copyright 2026 Arctel.net
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package cap
+
+const (
+	errInvalidTokenFormat = "invalid token format"
+	errInvalidHeader      = "invalid header"
+	errSignatureMismatch  = "signature mismatch"
+	errInvalidToken       = "invalid_token"
+	errScopeMismatch      = "scope_mismatch"
+	errExpired            = "expired"
+	errInvalidSolutions   = "invalid_solutions"
+	errInvalidSolution    = "invalid_solution"
+)