fix(cas-redirection): Avoid returning URL when CAS is not valid

[javirln]

Summary of the two changes made:

• Added a ValidationStatus check after the inline-backend check. If the backend’s status is not CASBackendValidationOK, the handler now returns a 403 ErrorCasBackendErrorReasonInvalid instead of letting GenerateTemporaryCredentials fail with an opaque 500. This mirrors the pattern in attestation.go

[cubic-dev-ai]

3 issues found across 3 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="app/controlplane/internal/service/casredirect.go">

<violation number="1" location="app/controlplane/internal/service/casredirect.go:52">
P2: `casBackendUC` is injected into the struct and constructor but never used by any method. This adds an unnecessary dependency (including to the wire dependency-injection graph) with no benefit. Remove the field, the constructor parameter, and the assignment.

(Based on your team's feedback about removing unused code, methods, and variables.) [FEEDBACK_USED]</violation>

<violation number="2" location="app/controlplane/internal/service/casredirect.go:117">
P3: Grammar error in user-facing error message: "on a invalid state" should be "in an invalid state".</violation>
</file>

<file name="app/controlplane/internal/server/grpc.go">

<violation number="1" location="app/controlplane/internal/server/grpc.go:100">
P1: The new `CASRedirectService/DownloadRedirect` entry in `fullyConfiguredCASBackendRequireRegexp` is unreachable. This regexp is only checked inside a `selector.Server(…).Match(requireRobotAccountMatcher())` block (line 262), but `robotAccountRequireRegexp` does not include `CASRedirectService`. The outer selector never matches this operation, so the inner CAS-backend validation middlewares (`ValidateCASBackend` + `BlockIfCASBackendNotValid`) are never applied to `DownloadRedirect`.

To make this effective, `CASRedirectService/DownloadRedirect` also needs to be added to `robotAccountRequireRegexp`, or the CAS-backend validation needs to be wired through a different middleware path that covers this operation.</violation>
</file>

---

Since this is your first cubic review, here's how it works:

• cubic automatically reviews your code and comments on bugs and improvements
• Teach cubic by replying to its comments. cubic learns from your replies and gets better over time
• Add one-off context when rerunning by tagging @cubic-dev-ai with guidance or docs links (including llms.txt)
• Ask questions if you need clarification on any suggestion

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

[cubic-dev-ai]

1 issue found across 2 files (changes from recent commits).

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="app/controlplane/internal/service/casredirect.go">

<violation number="1" location="app/controlplane/internal/service/casredirect.go:115">
P3: Grammar fix is incomplete: `"in a invalid state"` should be `"in an invalid state"`. The word "invalid" starts with a vowel sound, so the article should be "an".</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}