fix(barbican): propagate context cancellation and fix data race in tests

- doRequestWithRetry now checks ctx.Err() before wrapping the final
  error, so callers see a context cancellation instead of a generic
  'maximum retry attempts' API error.
- TestEncryptMultiRegion guards shared secretStores/secretCounters
  maps with a sync.Mutex to eliminate the data race detected by
  -race.

Author: devx

barbican/client.go

@@ -686,6 +686,12 @@ func (c *BarbicanClient) doRequestWithRetry(ctx context.Context, method, path st
 		log.WithError(err).WithField("attempt", attempt+1).Debug("Retryable error occurred")
 	}
 
+	// If the context was cancelled or timed out, surface that directly
+	// so callers can distinguish cancellation from server-side failures.
+	if ctx.Err() != nil {
+		return NewTimeoutError("Request cancelled by context", ctx.Err())
+	}
+
 	return NewAPIError("Request failed after maximum retry attempts", 0).
 		WithCause(lastErr).
 		WithDetails(fmt.Sprintf("Failed after %d attempts", c.config.MaxRetries+1))

barbican/keysource_test.go

@@ -10,6 +10,7 @@ import (
 	"net/http"
 	"net/http/httptest"
 	"strings"
+	"sync"
 	"sync/atomic"
 	"testing"
 	"testing/quick"
@@ -843,17 +844,22 @@ func TestEncryptMultiRegion(t *testing.T) {
 	// Create mock servers for different regions
 	secretStores := make(map[string]map[string][]byte) // region -> secretUUID -> payload
 	secretCounters := make(map[string]int)             // region -> counter
+	var mu sync.Mutex // protects secretStores and secretCounters
 
 	createMockServer := func(region string) *httptest.Server {
+		mu.Lock()
 		secretStores[region] = make(map[string][]byte)
 		secretCounters[region] = 0
+		mu.Unlock()
 
 		return httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 			switch r.Method {
 			case "POST":
 				if strings.HasSuffix(r.URL.Path, "/secrets") {
+					mu.Lock()
 					secretCounters[region]++
 					secretUUID := fmt.Sprintf("550e8400-e29b-41d4-a716-%012d", secretCounters[region])
+					mu.Unlock()
 					secretRef := fmt.Sprintf("https://barbican-%s.example.com:9311/v1/secrets/%s", region, secretUUID)
 
 					body, err := io.ReadAll(r.Body)
@@ -874,7 +880,9 @@ func TestEncryptMultiRegion(t *testing.T) {
 						return
 					}
 
+					mu.Lock()
 					secretStores[region][secretUUID] = payload
+					mu.Unlock()
 
 					w.Header().Set("Content-Type", "application/json")
 					w.WriteHeader(http.StatusCreated)