fix(sdk): fix linting violations in DPoP transport (DSPX-3397)

- Fix errcheck: use comma-ok for type assertion in dpop_transport_test.go
- Fix govet shadow: rename inner ok vars (isStr, athOK, jtiOK) to avoid
  shadowing outer ok declaration in TestDPoPTransport_AddsProofToRequests
- Fix nestif in RoundTrip: extract 401 nonce-retry into retryWithNonce method
- Fix nestif in sdk.go New: extract DPoP key selection into pickDPoPKey helper

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Signed-off-by: Dave Mihalcik <dmihalcik@virtru.com>

Author: dmihalcik-virtru

sdk/auth/dpop_transport.go

@@ -78,38 +78,12 @@ func (t *DPoPTransport) RoundTrip(req *http.Request) (*http.Response, error) {
 
 	// Handle DPoP-Nonce challenge (RFC 9449 §8)
 	if resp.StatusCode == http.StatusUnauthorized {
-		if newNonce := resp.Header.Get("DPoP-Nonce"); newNonce != "" {
-			// Check if this was a retry with a nonce already
-			if nonce != "" {
-				// Already tried with a nonce, don't retry again
-				return resp, nil
-			}
-
-			// Cache the new nonce
-			t.setCachedNonce(origin, newNonce)
-
-			// Close the failed response body
-			resp.Body.Close()
-
-			// Clone the original request again for retry
-			req3 := cloneRequest(req)
-
-			// Reset body using GetBody if available
-			if req.GetBody != nil {
-				body, err := req.GetBody()
-				if err != nil {
-					return nil, fmt.Errorf("failed to reset request body for retry: %w", err)
-				}
-				req3.Body = body
-			}
-
-			// Regenerate proof with nonce
-			if err := t.addDPoPProof(req3, base, newNonce, isTokenRequest); err != nil {
-				return nil, fmt.Errorf("failed to add DPoP proof with nonce: %w", err)
-			}
-
-			// Retry the request
-			return base.RoundTrip(req3)
+		retryResp, retried, err := t.retryWithNonce(req, base, resp, origin, nonce, isTokenRequest)
+		if err != nil {
+			return nil, err
+		}
+		if retried {
+			return retryResp, nil
 		}
 	}
 
@@ -123,6 +97,38 @@ func (t *DPoPTransport) RoundTrip(req *http.Request) (*http.Response, error) {
 	return resp, nil
 }
 
+// retryWithNonce handles a DPoP-Nonce server challenge. It returns the retried
+// response and true when a retry was performed, or the original response and
+// false when no retry was needed (missing nonce header or nonce already used).
+func (t *DPoPTransport) retryWithNonce(
+	req *http.Request, base http.RoundTripper,
+	resp *http.Response, origin, nonce string, isTokenRequest bool,
+) (*http.Response, bool, error) {
+	newNonce := resp.Header.Get("DPoP-Nonce")
+	if newNonce == "" || nonce != "" {
+		return resp, false, nil
+	}
+
+	t.setCachedNonce(origin, newNonce)
+	resp.Body.Close()
+
+	req3 := cloneRequest(req)
+	if req.GetBody != nil {
+		body, err := req.GetBody()
+		if err != nil {
+			return nil, false, fmt.Errorf("failed to reset request body for retry: %w", err)
+		}
+		req3.Body = body
+	}
+
+	if err := t.addDPoPProof(req3, base, newNonce, isTokenRequest); err != nil {
+		return nil, false, fmt.Errorf("failed to add DPoP proof with nonce: %w", err)
+	}
+
+	retryResp, err := base.RoundTrip(req3)
+	return retryResp, true, err
+}
+
 // addDPoPProof generates and adds DPoP proof to the request headers.
 func (t *DPoPTransport) addDPoPProof(req *http.Request, base http.RoundTripper, nonce string, isTokenRequest bool) error {
 	// Normalize the htu (RFC 9449 HTTP URI Normalization)

sdk/auth/dpop_transport_test.go

@@ -98,14 +98,14 @@ func TestDPoPTransport_AddsProofToRequests(t *testing.T) {
 		htu, ok := token.Get("htu")
 		if !ok {
 			t.Error("htu claim missing")
-		} else if htuStr, ok := htu.(string); !ok {
+		} else if htuStr, isStr := htu.(string); !isStr {
 			t.Errorf("htu claim not a string: %v", htu)
 		} else if htuStr == "" {
 			t.Error("htu claim is empty")
 		}
 
 		// Check ath claim (access token hash)
-		if ath, ok := token.Get("ath"); !ok {
+		if ath, athOK := token.Get("ath"); !athOK {
 			t.Error("ath claim missing")
 		} else {
 			expectedHash := sha256.Sum256([]byte("test-access-token"))
@@ -116,7 +116,7 @@ func TestDPoPTransport_AddsProofToRequests(t *testing.T) {
 		}
 
 		// Check jti claim
-		if jti, ok := token.Get("jti"); !ok || jti == "" {
+		if jti, jtiOK := token.Get("jti"); !jtiOK || jti == "" {
 			t.Error("jti claim missing or empty")
 		}
 
@@ -269,7 +269,10 @@ func TestDPoPTransport_URINormalization(t *testing.T) {
 				}
 
 				// The htu should have normalized the URL
-				htuStr := htu.(string)
+				htuStr, isStr := htu.(string)
+				if !isStr {
+					t.Fatalf("htu claim is not a string: %T", htu)
+				}
 				if !strings.Contains(htuStr, "/path") {
 					t.Errorf("htu = %s, want to contain normalized path", htuStr)
 				}

sdk/sdk.go

@@ -206,13 +206,9 @@ func New(platformEndpoint string, opts ...Option) (*SDK, error) {
 	httpClient := cfg.httpClient
 	if accessTokenSource != nil {
 		var dpopKey jwk.Key
-		if cfg.dpopJWK != nil {
-			dpopKey = cfg.dpopJWK
-		} else if cfg.dpopKey != nil {
-			dpopKey, err = getDPoPJWK(cfg.dpopKey)
-			if err != nil {
-				return nil, fmt.Errorf("failed to create DPoP JWK: %w", err)
-			}
+		dpopKey, err = pickDPoPKey(cfg)
+		if err != nil {
+			return nil, err
 		}
 		if dpopKey != nil {
 			httpClient = auth.NewDPoPHTTPClient(cfg.httpClient, dpopKey, accessTokenSource, cfg.tokenEndpoint)
@@ -286,6 +282,20 @@ func getDPoPJWK(dpopKey *ocrypto.RsaKeyPair) (jwk.Key, error) {
 	return key, nil
 }
 
+func pickDPoPKey(cfg *config) (jwk.Key, error) {
+	if cfg.dpopJWK != nil {
+		return cfg.dpopJWK, nil
+	}
+	if cfg.dpopKey != nil {
+		key, err := getDPoPJWK(cfg.dpopKey)
+		if err != nil {
+			return nil, fmt.Errorf("failed to create DPoP JWK: %w", err)
+		}
+		return key, nil
+	}
+	return nil, nil //nolint:nilnil // nil key means DPoP not configured; caller checks for nil
+}
+
 func buildIDPTokenSource(c *config) (auth.AccessTokenSource, error) {
 	if c.customAccessTokenSource != nil {
 		return c.customAccessTokenSource, nil