amadan
console: repair the merge — the SES seam fields belong in the Server struct
The #259 catch-up merge's conflict repair was edited after staging, so the merge commit carried the pre-repair file: the email side's snsVerify/snsCerts fields glued into normalizeSteeringHost's body, breaking the console package's compile on main. This is the repaired version the full local gate actually ran against (build/vet/all-package tests incl. -race console). Caught by roll-console.sh's dirty-tree refusal doing exactly its job; CI is billing-dead and would otherwise have flagged it at merge.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
1 file changed,
+11
−11
internal/console/server.go+11 −11
diff --git a/internal/console/server.go b/internal/console/server.go| index a2bb1ebb9..660aef4c2 100644 |
| --- a/internal/console/server.go |
| +++ b/internal/console/server.go |
| @@ -645,6 +645,17 @@ type Server struct { |
| // steeringHost is cfg.SteeringHost, normalized once here — see |
| // dnsTargets, the one reader. |
| steeringHost string |
| + // snsVerify is the SES ingest door's test seam (sesevents.go) — nil |
| + // means "do the real signature verification", which fetches the signing |
| + // certificate over the network. The seam covers signature verification |
| + // ONLY: it never substitutes for the TopicArn or SigningCertURL checks, |
| + // which every caller — production and test alike — runs for real. |
| + snsVerify func(snsEnvelope) error |
| + // snsCerts caches a verified signing certificate's RSA public key by URL |
| + // (sesevents.go) — otherwise every request bearing the deployment's |
| + // TopicArn, which is not a secret, triggers a fresh outbound HTTPS fetch |
| + // and full chain verification. Zero value is ready to use. |
| + snsCerts snsCertCache |
| } |
| // dnsTargets is what every custom-domain guidance string in this console is |
| @@ -670,17 +681,6 @@ func normalizeSteeringHost(raw string) string { |
| return "" |
| } |
| return h |
| - // snsVerify is the SES ingest door's test seam (sesevents.go) — nil |
| - // means "do the real signature verification", which fetches the signing |
| - // certificate over the network. The seam covers signature verification |
| - // ONLY: it never substitutes for the TopicArn or SigningCertURL checks, |
| - // which every caller — production and test alike — runs for real. |
| - snsVerify func(snsEnvelope) error |
| - // snsCerts caches a verified signing certificate's RSA public key by URL |
| - // (sesevents.go) — otherwise every request bearing the deployment's |
| - // TopicArn, which is not a secret, triggers a fresh outbound HTTPS fetch |
| - // and full chain verification. Zero value is ready to use. |
| - snsCerts snsCertCache |
| } |
| // normalizeDelegationZone lowercases, trims, and shape-validates raw (from |