style: replace em dashes with standard punctuation throughout

mbillow · mbillow · commit bf548a223d7d · 2026-05-10T21:32:39.000-05:00
Replaces all em dashes with context-appropriate alternatives: colons and
semicolons in code comments, hyphens in prose and chart descriptions, pipes
in HTML page titles, and commas in handler doc comments.
diff --git a/README.md b/README.md
@@ -1,12 +1,12 @@
-# PINT — Pouring IPA for Network Trust
+# PINT - Pouring IPA for Network Trust
 
 PINT is a self-service web portal for [Computer Science House](https://csh.rit.edu) that migrates WiFi authentication from EAP-MSCHAPv2 (password-based) to EAP-TLS (certificate-based). Members log in with their CSH Keycloak account and receive a certificate-backed WiFi profile that works on iOS, macOS, and Android. Home router operators can also provision a RADIUS shared secret and download a RadSec client certificate for internet-facing [RFC 6614](https://www.rfc-editor.org/rfc/rfc6614) connectivity.
 
 ## What it does
 
 | Feature | How |
 |---|---|
-| **iOS / macOS WiFi profile** | Generates an Apple mobileconfig (`.mobileconfig`) containing a FreeIPA-issued EAP-TLS client certificate, the WiFi CA, and 802.1X config. Install it and connect — no password needed. |
+| **iOS / macOS WiFi profile** | Generates an Apple mobileconfig (`.mobileconfig`) containing a FreeIPA-issued EAP-TLS client certificate, the WiFi CA, and 802.1X config. Install it and connect - no password needed. |
 | **Android WiFi profile** | Generates a PKCS#12 (`.p12`) bundle with the same certificate for import into Android's WiFi settings. |
 | **Home router (RadSec)** | Members can register a RADIUS shared secret and download a RadSec client certificate (`.p12`) to configure a home router for [RFC 6614 RADIUS over TLS](https://www.rfc-editor.org/rfc/rfc6614) on port 2083. |
 | **CA distribution** | One-tap download of the WiFi CA and RadSec CA certificates for manual trust store installation. |
@@ -91,7 +91,7 @@ The repo includes a FreeIPA stub server that generates a real CA at startup and
 ```bash
 # 1. Copy and edit the dev env file
 cp .env.dev.example .env.dev
-# (edit .env.dev — the stub defaults work as-is for IPA fields)
+# (edit .env.dev - the stub defaults work as-is for IPA fields)
 
 # 2. Build and start everything
 make dev
diff --git a/chart/Chart.yaml b/chart/Chart.yaml
@@ -1,6 +1,6 @@
 apiVersion: v2
 name: pint
-description: Pouring IPA for Network Trust — CSH WiFi EAP-TLS enrollment and home RadSec management
+description: Pouring IPA for Network Trust - CSH WiFi EAP-TLS enrollment and home RadSec management
 type: application
 version: 0.1.0
 appVersion: "0.1.0"
diff --git a/chart/templates/_helpers.tpl b/chart/templates/_helpers.tpl
@@ -67,7 +67,7 @@ app.kubernetes.io/name={{ include "pint.freeradiusFullname" . }},app.kubernetes.
 {{- end }}
 
 {{/*
-Container image references — tag falls back to Chart.appVersion.
+Container image references: tag falls back to Chart.appVersion.
 */}}
 {{- define "pint.image" -}}
 {{ .Values.pint.image.repository }}:{{ default .Chart.AppVersion .Values.pint.image.tag }}
diff --git a/chart/values.yaml b/chart/values.yaml
@@ -27,7 +27,7 @@ envSecret: pint-env
 
 # Names of the K8s Secrets PINT creates and manages at runtime.
 # These are referenced consistently across the Role, PINT env vars, and
-# FreeRADIUS volume mounts — change all three if you rename them.
+# FreeRADIUS volume mounts - change all three if you rename them.
 secrets:
   radiusClients: pint-radius-clients
   radiusConfig:  pint-radius-config
@@ -37,7 +37,7 @@ service:
   type: ClusterIP
   port: 80
 
-# FreeRADIUS — RadSec server mounted by home routers.
+# FreeRADIUS: RadSec server mounted by home routers.
 freeradius:
   enabled: true
   image:
diff --git a/cmd/pint/main.go b/cmd/pint/main.go
@@ -32,13 +32,13 @@ func main() {
 		log.Fatalf("config: %v", err)
 	}
 
-	// FreeIPA client — authenticate at startup
+	// FreeIPA client: authenticate at startup
 	ipaClient := freeipa.New(cfg.IPAHost, cfg.IPAPrincipal, cfg.IPAPassword, cfg.IPASkipTLSVerify)
 	if err := ipaClient.Login(); err != nil {
 		log.Fatalf("freeipa login: %v", err)
 	}
 
-	// Kubernetes client — try in-cluster first, fall back to kubeconfig
+	// Kubernetes client: try in-cluster first, fall back to kubeconfig
 	restCfg, err := rest.InClusterConfig()
 	if err != nil {
 		restCfg, err = clientcmd.BuildConfigFromFlags("", clientcmd.RecommendedHomeFile)
diff --git a/dev/freeipa-stub/main.go b/dev/freeipa-stub/main.go
@@ -76,7 +76,7 @@ func main() {
 
 // loadOrInitCAs loads persisted CA state from dir, or generates a fresh root +
 // two intermediates and persists them. The wifiCAName and radSecCAName are the
-// FreeIPA CA names PINT will use — they must match PINT_IPA_CA_NAME and
+// FreeIPA CA names PINT will use; they must match PINT_IPA_CA_NAME and
 // PINT_IPA_RADSEC_CA_NAME in .env.dev.
 func loadOrInitCAs(dir, wifiCAName, radSecCAName, rootCAName string) (map[string]*caEntry, error) {
 	root, err := loadOrCreateCA(dir, "root", "PINT Dev Root CA", nil)
@@ -281,7 +281,7 @@ func handleRPC(w http.ResponseWriter, r *http.Request) {
 		}))
 
 	case "cert_revoke":
-		log.Printf("cert_revoke: stub — no-op")
+		log.Printf("cert_revoke: stub, no-op")
 		json.NewEncoder(w).Encode(rpcOK(map[string]interface{}{"result": true}))
 
 	default:
diff --git a/internal/config/config.go b/internal/config/config.go
@@ -19,11 +19,11 @@ type Config struct {
 	IPAServiceAccount       string
 	IPAPassword             string
 	IPACAName               string
-	RadSecCAName            string // PINT_IPA_RADSEC_CA_NAME — FreeIPA intermediate CA for RadSec certs
-	RootCAName              string // PINT_IPA_ROOT_CA_NAME — signing root CA; defaults to "ipa"
-	IPACertProfile          string // PINT_IPA_CERT_PROFILE — FreeIPA profile for WiFi client certs (optional)
-	RadSecClientCertProfile string // PINT_IPA_RADSEC_CLIENT_CERT_PROFILE — FreeIPA profile for RadSec router client certs (optional)
-	RadSecServerCertProfile string // PINT_IPA_RADSEC_SERVER_CERT_PROFILE — FreeIPA profile for FreeRADIUS server cert (optional)
+	RadSecCAName            string // PINT_IPA_RADSEC_CA_NAME:FreeIPA intermediate CA for RadSec certs
+	RootCAName              string // PINT_IPA_ROOT_CA_NAME:signing root CA; defaults to "ipa"
+	IPACertProfile          string // PINT_IPA_CERT_PROFILE:FreeIPA profile for WiFi client certs (optional)
+	RadSecClientCertProfile string // PINT_IPA_RADSEC_CLIENT_CERT_PROFILE:FreeIPA profile for RadSec router client certs (optional)
+	RadSecServerCertProfile string // PINT_IPA_RADSEC_SERVER_CERT_PROFILE:FreeIPA profile for FreeRADIUS server cert (optional)
 	IPAPrincipal            string // derived: full principal, e.g. pint/host@REALM
 	IPAServiceHostname      string // derived: hostname portion of principal, e.g. host
 	IPASkipTLSVerify        bool
@@ -35,7 +35,7 @@ type Config struct {
 	Namespace             string
 	RadiusClientsSecret   string
 	RadiusConfigSecret    string
-	RadSecCertSecret      string // PINT_RADSEC_CERT_SECRET — K8s Secret storing FreeRADIUS TLS cert+key
+	RadSecCertSecret      string // PINT_RADSEC_CERT_SECRET:K8s Secret storing FreeRADIUS TLS cert+key
 	FreeRADIUSPodSelector string
 
 	// UI
diff --git a/internal/handlers/csrf.go b/internal/handlers/csrf.go
@@ -27,7 +27,7 @@ func CSRFMiddleware() gin.HandlerFunc {
 		}
 		// Refresh cookie on every response (SameSite=Lax, not HttpOnly so JS
 		// can read it if needed, but Secure is intentionally omitted here to
-		// work in local dev over HTTP — set Secure=true behind TLS in prod).
+		// work in local dev over HTTP; set Secure=true behind TLS in prod).
 		c.SetCookie(csrfCookieName, token, 0, "/", "", false, false)
 		c.Set(csrfContextKey, token)
 
@@ -48,6 +48,6 @@ func CSRFMiddleware() gin.HandlerFunc {
 
 func newCSRFToken() string {
 	b := make([]byte, 16)
-	rand.Read(b) //nolint:errcheck — rand.Read never returns an error
+	rand.Read(b) //nolint:errcheck -- rand.Read never returns an error
 	return hex.EncodeToString(b)
 }
diff --git a/internal/handlers/profile.go b/internal/handlers/profile.go
@@ -80,7 +80,7 @@ func GenerateProfileHandler(ipaClient *freeipa.Client, cfg *config.Config, caDER
 	}
 }
 
-// CAHandler serves GET /profile/ca — returns the FreeIPA CA certificate as DER.
+// CAHandler serves GET /profile/ca, returns the FreeIPA CA certificate as DER.
 func CAHandler(caDER []byte) gin.HandlerFunc {
 	return func(c *gin.Context) {
 		c.Header("Content-Disposition", `attachment; filename="csh-ca.cer"`)
diff --git a/internal/handlers/radius.go b/internal/handlers/radius.go
@@ -41,7 +41,7 @@ func RadiusPageHandler(cfg *config.Config, k8s kubernetes.Interface, caChainPEM
 	}
 }
 
-// SaveSecretHandler serves POST /radius/secret — initial enrollment.
+// SaveSecretHandler serves POST /radius/secret (initial enrollment).
 // Renders the page directly with the one-time key and cert PEM.
 func SaveSecretHandler(ipaClient *freeipa.Client, cfg *config.Config, k8s kubernetes.Interface, restCfg *rest.Config, caChainPEM string) gin.HandlerFunc {
 	return func(c *gin.Context) {
@@ -107,7 +107,7 @@ func RegenerateHandler(ipaClient *freeipa.Client, cfg *config.Config, k8s kubern
 	}
 }
 
-// UpdateIPHandler serves POST /radius/update-ip — changes source IP/CIDR only.
+// UpdateIPHandler serves POST /radius/update-ip, changes source IP/CIDR only.
 func UpdateIPHandler(cfg *config.Config, k8s kubernetes.Interface, restCfg *rest.Config) gin.HandlerFunc {
 	return func(c *gin.Context) {
 		username, _ := getUsername(c)
@@ -143,7 +143,7 @@ func UpdateIPHandler(cfg *config.Config, k8s kubernetes.Interface, restCfg *rest
 	}
 }
 
-// DeleteSecretHandler serves POST /radius/delete — revokes cert and removes config.
+// DeleteSecretHandler serves POST /radius/delete, revokes cert and removes config.
 func DeleteSecretHandler(cfg *config.Config, k8s kubernetes.Interface, restCfg *rest.Config, ipaClient *freeipa.Client) gin.HandlerFunc {
 	return func(c *gin.Context) {
 		username, _ := getUsername(c)
@@ -164,7 +164,7 @@ func DeleteSecretHandler(cfg *config.Config, k8s kubernetes.Interface, restCfg *
 	}
 }
 
-// RadSecCAHandler serves GET /radius/ca — streams the full RadSec CA chain as PEM.
+// RadSecCAHandler serves GET /radius/ca, streams the full RadSec CA chain as PEM.
 func RadSecCAHandler(caChainPEM string) gin.HandlerFunc {
 	return func(c *gin.Context) {
 		c.Header("Content-Disposition", `attachment; filename="csh-radsec-ca-chain.pem"`)
@@ -263,7 +263,7 @@ func issueClientCredentials(ipaClient *freeipa.Client, cfg *config.Config, usern
 }
 
 // revokeExistingCert revokes the cert identified by client.CertSerial.
-// Errors are logged but not returned — revocation failure should not block deletion or reissuance.
+// Errors are logged but not returned; revocation failure should not block deletion or reissuance.
 func revokeExistingCert(ipaClient *freeipa.Client, client *radius.RadiusClient, caName string, reason int) {
 	if client == nil || client.CertSerial == "" {
 		return
diff --git a/internal/radius/config.go b/internal/radius/config.go
@@ -13,7 +13,7 @@ var safeUsername = regexp.MustCompile(`^[a-zA-Z0-9_-]+$`)
 // Each client block includes proto = tls for RadSec (RFC 6614) support.
 func RenderClientsConf(clients []RadiusClient) string {
 	var b strings.Builder
-	b.WriteString("# Auto-generated by PINT — do not edit manually\n\n")
+	b.WriteString("# Auto-generated by PINT - do not edit manually\n\n")
 
 	for _, c := range clients {
 		if !safeUsername.MatchString(c.Username) {
diff --git a/internal/radius/reload.go b/internal/radius/reload.go
@@ -26,9 +26,9 @@ func WriteRadiusConfig(ctx context.Context, k8s kubernetes.Interface, namespace,
 }
 
 // WriteRadSecServerCert writes all FreeRADIUS TLS material to the named K8s Secret:
-//   - tls.crt / tls.key  — server cert presented to RadSec clients and EAP supplicants
-//   - ca.pem             — RadSec CA chain; verifies connecting router client certificates
-//   - wifi-ca.pem        — WiFi CA cert; verifies EAP-TLS user certificates
+//   - tls.crt / tls.key: server cert presented to RadSec clients and EAP supplicants
+//   - ca.pem: RadSec CA chain; verifies connecting router client certificates
+//   - wifi-ca.pem: WiFi CA cert; verifies EAP-TLS user certificates
 func WriteRadSecServerCert(ctx context.Context, k8s kubernetes.Interface, namespace, secretName string, certPEM, keyPEM, caPEM, wifiCAPEM []byte) error {
 	return upsertSecret(ctx, k8s, &corev1.Secret{
 		ObjectMeta: metav1.ObjectMeta{Name: secretName, Namespace: namespace},
diff --git a/ipa/README.md b/ipa/README.md
@@ -82,4 +82,4 @@ PINT_IPA_RADSEC_CLIENT_CERT_PROFILE=pint_radsec_client
 PINT_IPA_RADSEC_SERVER_CERT_PROFILE=pint_radsec_server
 ```
 
-All three are optional — omitting them causes PINT to request certificates without specifying a profile, which uses the CA's default.
+All three are optional; omitting them causes PINT to request certificates without specifying a profile, which uses the CA's default.
diff --git a/templates/dashboard.html b/templates/dashboard.html
@@ -1,6 +1,6 @@
 <!-- templates/dashboard.html -->
 {{template "layout.html" .}}
-{{define "title"}}Dashboard — PINT{{end}}
+{{define "title"}}Dashboard | PINT{{end}}
 {{define "content"}}
 <h2 class="mb-4"><span class="mdi mdi-hand-wave"></span> Welcome, {{if .FullName}}{{.FullName}}{{else}}{{.Username}}{{end}}!</h2>
 
diff --git a/templates/index.html b/templates/index.html
@@ -1,13 +1,13 @@
 <!-- templates/index.html -->
 {{template "layout.html" .}}
-{{define "title"}}PINT — CSH WiFi{{end}}
+{{define "title"}}PINT | CSH WiFi{{end}}
 {{define "content"}}
 <div class="row justify-content-center mt-5">
     <div class="col-md-6 text-center">
         <h1 class="display-4"><span class="mdi mdi-beer"></span> PINT</h1>
         <p class="lead">Pouring IPA for Network Trust</p>
         <hr>
-        <p>Get your personal EAP-TLS certificate for the CSH WiFi network — no more passwords.</p>
+        <p>Get your personal EAP-TLS certificate for the CSH WiFi network. No more passwords.</p>
         <a href="/auth/login?referer=/dashboard" class="btn btn-primary btn-lg mt-3">
             <span class="mdi mdi-login"></span> Login with CSH
         </a>
diff --git a/templates/layout.html b/templates/layout.html
@@ -4,7 +4,7 @@
 <head>
     <meta charset="UTF-8">
     <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no">
-    <title>PINT — {{block "title" .}}CSH WiFi{{end}}</title>
+    <title>PINT | {{block "title" .}}CSH WiFi{{end}}</title>
     <link rel="stylesheet" href="https://s3.csh.rit.edu/csh-material-bootstrap/4.3.1/dist/csh-material-bootstrap.min.css" media="screen">
     <link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/@mdi/font@7.4.47/css/materialdesignicons.min.css">
 </head>
diff --git a/templates/profile.html b/templates/profile.html
@@ -1,6 +1,6 @@
 <!-- templates/profile.html -->
 {{template "layout.html" .}}
-{{define "title"}}WiFi Profile — PINT{{end}}
+{{define "title"}}WiFi Profile | PINT{{end}}
 {{define "content"}}
 <h2><span class="mdi mdi-wifi-lock"></span> Your WiFi Profile</h2>
 <p class="text-muted">Certificates are generated fresh on each download and are valid for 5 years.</p>
diff --git a/templates/radius.html b/templates/radius.html
@@ -1,6 +1,6 @@
 <!-- templates/radius.html -->
 {{template "layout.html" .}}
-{{define "title"}}Home RadSec — PINT{{end}}
+{{define "title"}}Home RadSec | PINT{{end}}
 {{define "content"}}
 
 {{if .Client}}
@@ -19,12 +19,12 @@
           <dt class="col-sm-4"><span class="mdi mdi-ethernet"></span> Auth Port</dt>
           <dd class="col-sm-8"><code>2083</code></dd>
           <dt class="col-sm-4"><span class="mdi mdi-shield-lock"></span> Protocol</dt>
-          <dd class="col-sm-8">RadSec (RADIUS over TLS — RFC 6614)</dd>
+          <dd class="col-sm-8">RadSec (RADIUS over TLS, RFC 6614)</dd>
           <dt class="col-sm-4"><span class="mdi mdi-ip-network"></span> Source IP / CIDR</dt>
           {{if .IPCIDR}}
           <dd class="col-sm-8 mb-0"><code>{{.IPCIDR}}</code></dd>
           {{else}}
-          <dd class="col-sm-8 mb-0"><span class="text-warning"><span class="mdi mdi-alert"></span> Not set — any IP accepted</span></dd>
+          <dd class="col-sm-8 mb-0"><span class="text-warning"><span class="mdi mdi-alert"></span> Not set: any IP accepted</span></dd>
           {{end}}
         </dl>
       </div>
@@ -236,7 +236,7 @@ <h4><span class="mdi mdi-router-wireless-settings"></span> Set Up Home RadSec</h
       <dt class="col-sm-4">Auth Port</dt>
       <dd class="col-sm-8"><code>2083</code></dd>
       <dt class="col-sm-4">Protocol</dt>
-      <dd class="col-sm-8">RadSec (RADIUS over TLS — RFC 6614)</dd>
+      <dd class="col-sm-8">RadSec (RADIUS over TLS, RFC 6614)</dd>
     </dl>
     <p>Broadcast the CSH WiFi SSID from your home router. PINT will generate a shared secret, private key, and client certificate so your router can authenticate users against the CSH RADIUS server.</p>
     <form method="POST" action="/radius/secret">

Original file line number	Diff line number	Diff line change
`@@ -32,13 +32,13 @@ func main() {`
`32`	`32`	`log.Fatalf("config: %v", err)`
`33`	`33`	`}`
`34`	`34`
`35`		`- // FreeIPA client — authenticate at startup`
	`35`	`+ // FreeIPA client: authenticate at startup`
`36`	`36`	`ipaClient := freeipa.New(cfg.IPAHost, cfg.IPAPrincipal, cfg.IPAPassword, cfg.IPASkipTLSVerify)`
`37`	`37`	`if err := ipaClient.Login(); err != nil {`
`38`	`38`	`log.Fatalf("freeipa login: %v", err)`
`39`	`39`	`}`
`40`	`40`
`41`		`- // Kubernetes client — try in-cluster first, fall back to kubeconfig`
	`41`	`+ // Kubernetes client: try in-cluster first, fall back to kubeconfig`
`42`	`42`	`restCfg, err := rest.InClusterConfig()`
`43`	`43`	`if err != nil {`
`44`	`44`	`restCfg, err = clientcmd.BuildConfigFromFlags("", clientcmd.RecommendedHomeFile)`
Original file line number	Diff line number	Diff line change
`@@ -27,7 +27,7 @@ func CSRFMiddleware() gin.HandlerFunc {`
`27`	`27`	`}`
`28`	`28`	`// Refresh cookie on every response (SameSite=Lax, not HttpOnly so JS`
`29`	`29`	`// can read it if needed, but Secure is intentionally omitted here to`
`30`		`- // work in local dev over HTTP — set Secure=true behind TLS in prod).`
	`30`	`+ // work in local dev over HTTP; set Secure=true behind TLS in prod).`
`31`	`31`	`c.SetCookie(csrfCookieName, token, 0, "/", "", false, false)`
`32`	`32`	`c.Set(csrfContextKey, token)`
`33`	`33`
`@@ -48,6 +48,6 @@ func CSRFMiddleware() gin.HandlerFunc {`
`48`	`48`
`49`	`49`	`func newCSRFToken() string {`
`50`	`50`	`b := make([]byte, 16)`
`51`		`- rand.Read(b) //nolint:errcheck — rand.Read never returns an error`
	`51`	`+ rand.Read(b) //nolint:errcheck -- rand.Read never returns an error`
`52`	`52`	`return hex.EncodeToString(b)`
`53`	`53`	`}`
Original file line number	Diff line number	Diff line change
`@@ -80,7 +80,7 @@ func GenerateProfileHandler(ipaClient freeipa.Client, cfg config.Config, caDER`
`80`	`80`	`}`
`81`	`81`	`}`
`82`	`82`
`83`		`-// CAHandler serves GET /profile/ca — returns the FreeIPA CA certificate as DER.`
	`83`	`+// CAHandler serves GET /profile/ca, returns the FreeIPA CA certificate as DER.`
`84`	`84`	`func CAHandler(caDER []byte) gin.HandlerFunc {`
`85`	`85`	`return func(c *gin.Context) {`
`86`	`86`	c.Header("Content-Disposition", `attachment; filename="csh-ca.cer"`)
Original file line number	Diff line number	Diff line change
`@@ -41,7 +41,7 @@ func RadiusPageHandler(cfg *config.Config, k8s kubernetes.Interface, caChainPEM`
`41`	`41`	`}`
`42`	`42`	`}`
`43`	`43`
`44`		`-// SaveSecretHandler serves POST /radius/secret — initial enrollment.`
	`44`	`+// SaveSecretHandler serves POST /radius/secret (initial enrollment).`
`45`	`45`	`// Renders the page directly with the one-time key and cert PEM.`
`46`	`46`	`func SaveSecretHandler(ipaClient freeipa.Client, cfg config.Config, k8s kubernetes.Interface, restCfg *rest.Config, caChainPEM string) gin.HandlerFunc {`
`47`	`47`	`return func(c *gin.Context) {`
`@@ -107,7 +107,7 @@ func RegenerateHandler(ipaClient freeipa.Client, cfg config.Config, k8s kubern`
`107`	`107`	`}`
`108`	`108`	`}`
`109`	`109`
`110`		`-// UpdateIPHandler serves POST /radius/update-ip — changes source IP/CIDR only.`
	`110`	`+// UpdateIPHandler serves POST /radius/update-ip, changes source IP/CIDR only.`
`111`	`111`	`func UpdateIPHandler(cfg config.Config, k8s kubernetes.Interface, restCfg rest.Config) gin.HandlerFunc {`
`112`	`112`	`return func(c *gin.Context) {`
`113`	`113`	`username, _ := getUsername(c)`
`@@ -143,7 +143,7 @@ func UpdateIPHandler(cfg config.Config, k8s kubernetes.Interface, restCfg rest`
`143`	`143`	`}`
`144`	`144`	`}`
`145`	`145`
`146`		`-// DeleteSecretHandler serves POST /radius/delete — revokes cert and removes config.`
	`146`	`+// DeleteSecretHandler serves POST /radius/delete, revokes cert and removes config.`
`147`	`147`	`func DeleteSecretHandler(cfg config.Config, k8s kubernetes.Interface, restCfg rest.Config, ipaClient *freeipa.Client) gin.HandlerFunc {`
`148`	`148`	`return func(c *gin.Context) {`
`149`	`149`	`username, _ := getUsername(c)`
`@@ -164,7 +164,7 @@ func DeleteSecretHandler(cfg config.Config, k8s kubernetes.Interface, restCfg `
`164`	`164`	`}`
`165`	`165`	`}`
`166`	`166`
`167`		`-// RadSecCAHandler serves GET /radius/ca — streams the full RadSec CA chain as PEM.`
	`167`	`+// RadSecCAHandler serves GET /radius/ca, streams the full RadSec CA chain as PEM.`
`168`	`168`	`func RadSecCAHandler(caChainPEM string) gin.HandlerFunc {`
`169`	`169`	`return func(c *gin.Context) {`
`170`	`170`	c.Header("Content-Disposition", `attachment; filename="csh-radsec-ca-chain.pem"`)
`@@ -263,7 +263,7 @@ func issueClientCredentials(ipaClient freeipa.Client, cfg config.Config, usern`
`263`	`263`	`}`
`264`	`264`
`265`	`265`	`// revokeExistingCert revokes the cert identified by client.CertSerial.`
`266`		`-// Errors are logged but not returned — revocation failure should not block deletion or reissuance.`
	`266`	`+// Errors are logged but not returned; revocation failure should not block deletion or reissuance.`
`267`	`267`	`func revokeExistingCert(ipaClient freeipa.Client, client radius.RadiusClient, caName string, reason int) {`
`268`	`268`	`if client == nil \|\| client.CertSerial == "" {`
`269`	`269`	`return`