mirror of
https://github.com/SamyRai/tercul-backend.git
synced 2025-12-27 04:01:34 +00:00
9fd2331eb4
This commit introduces a comprehensive set of foundational improvements to make the API more robust, secure, and observable. The following features have been implemented: - **Observability Stack:** A new `internal/observability` package has been added, providing structured logging with `zerolog`, Prometheus metrics, and OpenTelemetry tracing. This stack is fully integrated into the application's request pipeline. - **Centralized Authorization:** A new `internal/app/authz` service has been created to centralize authorization logic. This service is now used by the `user`, `work`, and `comment` services to protect all Create, Update, and Delete operations. - **Standardized Input Validation:** The previous ad-hoc validation has been replaced with a more robust, struct-tag-based system using the `go-playground/validator` library. This has been applied to all GraphQL input models. - **Structured Error Handling:** A new set of custom error types has been introduced in the `internal/domain` package. A custom `gqlgen` error presenter has been implemented to map these domain errors to structured GraphQL error responses with specific error codes. - **`updateUser` Endpoint:** The `updateUser` mutation has been fully implemented as a proof of concept for the new patterns, including support for partial updates and comprehensive authorization checks. - **Test Refactoring:** The test suite has been significantly improved by decoupling mock repositories from the shared `testutil` package, resolving circular dependency issues and making the tests more maintainable.
102 lines
2.7 KiB
Go
102 lines
2.7 KiB
Go
package user
|
|
|
|
import (
|
|
"context"
|
|
"testing"
|
|
|
|
"tercul/internal/app/authz"
|
|
"tercul/internal/domain"
|
|
platform_auth "tercul/internal/platform/auth"
|
|
|
|
"github.com/stretchr/testify/assert"
|
|
"github.com/stretchr/testify/suite"
|
|
)
|
|
|
|
type UserCommandsSuite struct {
|
|
suite.Suite
|
|
repo *mockUserRepository
|
|
authzSvc *authz.Service
|
|
commands *UserCommands
|
|
}
|
|
|
|
func (s *UserCommandsSuite) SetupTest() {
|
|
s.repo = &mockUserRepository{}
|
|
workRepo := &mockWorkRepoForUserTests{}
|
|
s.authzSvc = authz.NewService(workRepo)
|
|
s.commands = NewUserCommands(s.repo, s.authzSvc)
|
|
}
|
|
|
|
func TestUserCommandsSuite(t *testing.T) {
|
|
suite.Run(t, new(UserCommandsSuite))
|
|
}
|
|
|
|
func (s *UserCommandsSuite) TestUpdateUser_Success_Self() {
|
|
// Arrange
|
|
ctx := platform_auth.ContextWithUserID(context.Background(), 1)
|
|
input := UpdateUserInput{ID: 1, Username: strPtr("new_username")}
|
|
|
|
s.repo.getByIDFunc = func(ctx context.Context, id uint) (*domain.User, error) {
|
|
return &domain.User{BaseModel: domain.BaseModel{ID: 1}}, nil
|
|
}
|
|
|
|
// Act
|
|
updatedUser, err := s.commands.UpdateUser(ctx, input)
|
|
|
|
// Assert
|
|
assert.NoError(s.T(), err)
|
|
assert.NotNil(s.T(), updatedUser)
|
|
assert.Equal(s.T(), "new_username", updatedUser.Username)
|
|
}
|
|
|
|
func (s *UserCommandsSuite) TestUpdateUser_Success_Admin() {
|
|
// Arrange
|
|
ctx := platform_auth.ContextWithAdminUser(context.Background(), 99) // Admin user
|
|
input := UpdateUserInput{ID: 1, Username: strPtr("new_username_by_admin")}
|
|
|
|
s.repo.getByIDFunc = func(ctx context.Context, id uint) (*domain.User, error) {
|
|
return &domain.User{BaseModel: domain.BaseModel{ID: 1}}, nil
|
|
}
|
|
|
|
// Act
|
|
updatedUser, err := s.commands.UpdateUser(ctx, input)
|
|
|
|
// Assert
|
|
assert.NoError(s.T(), err)
|
|
assert.NotNil(s.T(), updatedUser)
|
|
assert.Equal(s.T(), "new_username_by_admin", updatedUser.Username)
|
|
}
|
|
|
|
func (s *UserCommandsSuite) TestUpdateUser_Forbidden() {
|
|
// Arrange
|
|
ctx := platform_auth.ContextWithUserID(context.Background(), 2) // Different user
|
|
input := UpdateUserInput{ID: 1, Username: strPtr("forbidden_username")}
|
|
|
|
s.repo.getByIDFunc = func(ctx context.Context, id uint) (*domain.User, error) {
|
|
return &domain.User{BaseModel: domain.BaseModel{ID: 1}}, nil
|
|
}
|
|
|
|
// Act
|
|
_, err := s.commands.UpdateUser(ctx, input)
|
|
|
|
// Assert
|
|
assert.Error(s.T(), err)
|
|
assert.ErrorIs(s.T(), err, domain.ErrForbidden)
|
|
}
|
|
|
|
func (s *UserCommandsSuite) TestUpdateUser_Unauthorized() {
|
|
// Arrange
|
|
ctx := context.Background() // No user in context
|
|
input := UpdateUserInput{ID: 1, Username: strPtr("unauthorized_username")}
|
|
|
|
// Act
|
|
_, err := s.commands.UpdateUser(ctx, input)
|
|
|
|
// Assert
|
|
assert.Error(s.T(), err)
|
|
assert.ErrorIs(s.T(), err, domain.ErrUnauthorized)
|
|
}
|
|
|
|
// Helper to get a pointer to a string
|
|
func strPtr(s string) *string {
|
|
return &s
|
|
} |