Skip to content

refactore authorization #68

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
khanzadimahdi merged 1 commit into from
Jan 18, 2026
Merged

refactore authorization #68

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
97 changes: 49 additions & 48 deletions infrastructure/ioc/providers/blog.go
View file
Open in desktop

Large diffs are not rendered by default.

17 changes: 3 additions & 14 deletions presentation/http/api/dashboard/article/create.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,31 +6,20 @@ import (

"github.com/khanzadimahdi/testproject/application/auth"
createarticle "github.com/khanzadimahdi/testproject/application/dashboard/article/createArticle"
"github.com/khanzadimahdi/testproject/domain"
"github.com/khanzadimahdi/testproject/domain/permission"
)

type createHandler struct {
useCase *createarticle.UseCase
authorizer domain.Authorizer
useCase *createarticle.UseCase
}

func NewCreateHandler(useCase *createarticle.UseCase, a domain.Authorizer) *createHandler {
func NewCreateHandler(useCase *createarticle.UseCase) *createHandler {
return &createHandler{
useCase: useCase,
authorizer: a,
useCase: useCase,
}
}

func (h *createHandler) ServeHTTP(rw http.ResponseWriter, r *http.Request) {
userUUID := auth.FromContext(r.Context()).UUID
if ok, err := h.authorizer.Authorize(userUUID, permission.ArticlesCreate); err != nil {
rw.WriteHeader(http.StatusInternalServerError)
return
} else if !ok {
rw.WriteHeader(http.StatusForbidden)
return
}

var request createarticle.Request
if err := json.NewDecoder(r.Body).Decode(&request); err != nil {
Expand Down
100 changes: 2 additions & 98 deletions presentation/http/api/dashboard/article/create_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,6 @@ package article
import (
"bytes"
"encoding/json"
"errors"
"net/http"
"net/http/httptest"
"os"
Expand All @@ -16,7 +15,6 @@ import (
"github.com/khanzadimahdi/testproject/domain"
"github.com/khanzadimahdi/testproject/domain/article"
"github.com/khanzadimahdi/testproject/domain/author"
"github.com/khanzadimahdi/testproject/domain/permission"
"github.com/khanzadimahdi/testproject/domain/user"
"github.com/khanzadimahdi/testproject/infrastructure/repository/mocks/articles"
"github.com/khanzadimahdi/testproject/infrastructure/validator"
Expand All @@ -30,7 +28,6 @@ func TestCreateHandler(t *testing.T) {

var (
articleRepository articles.MockArticlesRepository
authorizer domain.MockAuthorizer
requestValidator validator.MockValidator

r = createarticle.Request{
Expand Down Expand Up @@ -61,16 +58,13 @@ func TestCreateHandler(t *testing.T) {
au = "article-uuid"
)

authorizer.On("Authorize", r.AuthorUUID, permission.ArticlesCreate).Once().Return(true, nil)
defer authorizer.AssertExpectations(t)

requestValidator.On("Validate", &r).Once().Return(nil)
defer requestValidator.AssertExpectations(t)

articleRepository.On("Save", &a).Once().Return(au, nil)
defer articleRepository.AssertExpectations(t)

handler := NewCreateHandler(createarticle.NewUseCase(&articleRepository, &requestValidator), &authorizer)
handler := NewCreateHandler(createarticle.NewUseCase(&articleRepository, &requestValidator))

var payload bytes.Buffer
err := json.NewEncoder(&payload).Encode(r)
Expand All @@ -90,73 +84,26 @@ func TestCreateHandler(t *testing.T) {
assert.Equal(t, http.StatusCreated, response.Code)
})

t.Run("unauthorized", func(t *testing.T) {
t.Parallel()

var (
articleRepository articles.MockArticlesRepository
authorizer domain.MockAuthorizer
requestValidator validator.MockValidator

r = createarticle.Request{
Title: "test title",
Excerpt: "test excerpt",
Body: "test body",
AuthorUUID: "test-author-uuid",
Tags: []string{"tag1", "tag2"},
}

u = user.User{
UUID: r.AuthorUUID,
}
)

authorizer.On("Authorize", r.AuthorUUID, permission.ArticlesCreate).Once().Return(false, nil)
defer authorizer.AssertExpectations(t)

handler := NewCreateHandler(createarticle.NewUseCase(&articleRepository, &requestValidator), &authorizer)

var payload bytes.Buffer
err := json.NewEncoder(&payload).Encode(r)
assert.NoError(t, err)

request := httptest.NewRequest(http.MethodGet, "/", &payload)
request = request.WithContext(auth.ToContext(request.Context(), &u))
response := httptest.NewRecorder()

handler.ServeHTTP(response, request)

requestValidator.AssertNotCalled(t, "Validate")
articleRepository.AssertNotCalled(t, "Save")

assert.Len(t, response.Body.Bytes(), 0)
assert.Equal(t, http.StatusForbidden, response.Code)
})

t.Run("validation failed", func(t *testing.T) {
t.Parallel()

var (
articleRepository articles.MockArticlesRepository
authorizer domain.MockAuthorizer
requestValidator validator.MockValidator

u = user.User{
UUID: "test-author-uuid",
}
)

authorizer.On("Authorize", u.UUID, permission.ArticlesCreate).Once().Return(true, nil)
defer authorizer.AssertExpectations(t)

requestValidator.On("Validate", &createarticle.Request{AuthorUUID: u.UUID}).Once().Return(domain.ValidationErrors{
"body": "body is required",
"excerpt": "excerpt is required",
"title": "title is required",
})
defer requestValidator.AssertExpectations(t)

handler := NewCreateHandler(createarticle.NewUseCase(&articleRepository, &requestValidator), &authorizer)
handler := NewCreateHandler(createarticle.NewUseCase(&articleRepository, &requestValidator))

request := httptest.NewRequest(http.MethodGet, "/", bytes.NewBufferString("{}"))
request = request.WithContext(auth.ToContext(request.Context(), &u))
Expand All @@ -173,47 +120,4 @@ func TestCreateHandler(t *testing.T) {
assert.JSONEq(t, string(expected), response.Body.String())
assert.Equal(t, http.StatusBadRequest, response.Code)
})

t.Run("error", func(t *testing.T) {
t.Parallel()

var (
articleRepository articles.MockArticlesRepository
authorizer domain.MockAuthorizer
requestValidator validator.MockValidator

r = createarticle.Request{
Title: "test title",
Excerpt: "test excerpt",
Body: "test body",
AuthorUUID: "test-author-uuid",
Tags: []string{"tag1", "tag2"},
}

u = user.User{
UUID: r.AuthorUUID,
}
)

authorizer.On("Authorize", r.AuthorUUID, permission.ArticlesCreate).Once().Return(false, errors.New("unexpected error"))
defer authorizer.AssertExpectations(t)

handler := NewCreateHandler(createarticle.NewUseCase(&articleRepository, &requestValidator), &authorizer)

var payload bytes.Buffer
err := json.NewEncoder(&payload).Encode(r)
assert.NoError(t, err)

request := httptest.NewRequest(http.MethodGet, "/", &payload)
request = request.WithContext(auth.ToContext(request.Context(), &u))
response := httptest.NewRecorder()

handler.ServeHTTP(response, request)

requestValidator.AssertNotCalled(t, "Validate")
articleRepository.AssertNotCalled(t, "Save")

assert.Len(t, response.Body.Bytes(), 0)
assert.Equal(t, http.StatusInternalServerError, response.Code)
})
}
20 changes: 3 additions & 17 deletions presentation/http/api/dashboard/article/delete.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,34 +3,20 @@ package article
import (
"net/http"

"github.com/khanzadimahdi/testproject/application/auth"
deletearticle "github.com/khanzadimahdi/testproject/application/dashboard/article/deleteArticle"
"github.com/khanzadimahdi/testproject/domain"
"github.com/khanzadimahdi/testproject/domain/permission"
)

type deleteHandler struct {
useCase *deletearticle.UseCase
authorizer domain.Authorizer
useCase *deletearticle.UseCase
}

func NewDeleteHandler(useCase *deletearticle.UseCase, a domain.Authorizer) *deleteHandler {
func NewDeleteHandler(useCase *deletearticle.UseCase) *deleteHandler {
return &deleteHandler{
useCase: useCase,
authorizer: a,
useCase: useCase,
}
}

func (h *deleteHandler) ServeHTTP(rw http.ResponseWriter, r *http.Request) {
userUUID := auth.FromContext(r.Context()).UUID
if ok, err := h.authorizer.Authorize(userUUID, permission.ArticlesDelete); err != nil {
rw.WriteHeader(http.StatusInternalServerError)
return
} else if !ok {
rw.WriteHeader(http.StatusForbidden)
return
}

UUID := r.PathValue("uuid")
request := &deletearticle.Request{
ArticleUUID: UUID,
Expand Down
77 changes: 1 addition & 76 deletions presentation/http/api/dashboard/article/delete_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,18 +1,13 @@
package article

import (
"errors"
"net/http"
"net/http/httptest"
"testing"

"github.com/stretchr/testify/assert"

"github.com/khanzadimahdi/testproject/application/auth"
deletearticle "github.com/khanzadimahdi/testproject/application/dashboard/article/deleteArticle"
"github.com/khanzadimahdi/testproject/domain"
"github.com/khanzadimahdi/testproject/domain/permission"
"github.com/khanzadimahdi/testproject/domain/user"
"github.com/khanzadimahdi/testproject/infrastructure/repository/mocks/articles"
)

Expand All @@ -24,24 +19,16 @@ func TestDeleteHandler(t *testing.T) {

var (
articleRepository articles.MockArticlesRepository
authorizer domain.MockAuthorizer

r = deletearticle.Request{ArticleUUID: "article-uuid"}
u = user.User{
UUID: "user-uuid",
}
)

authorizer.On("Authorize", u.UUID, permission.ArticlesDelete).Once().Return(true, nil)
defer authorizer.AssertExpectations(t)

articleRepository.On("Delete", r.ArticleUUID).Return(nil)
defer articleRepository.AssertExpectations(t)

handler := NewDeleteHandler(deletearticle.NewUseCase(&articleRepository), &authorizer)
handler := NewDeleteHandler(deletearticle.NewUseCase(&articleRepository))

request := httptest.NewRequest(http.MethodPost, "/", nil)
request = request.WithContext(auth.ToContext(request.Context(), &u))
request.SetPathValue("uuid", r.ArticleUUID)
response := httptest.NewRecorder()

Expand All @@ -50,66 +37,4 @@ func TestDeleteHandler(t *testing.T) {
assert.Len(t, response.Body.Bytes(), 0)
assert.Equal(t, http.StatusNoContent, response.Code)
})

t.Run("unauthorized", func(t *testing.T) {
t.Parallel()

var (
articleRepository articles.MockArticlesRepository
authorizer domain.MockAuthorizer

r = deletearticle.Request{ArticleUUID: "article-uuid"}
u = user.User{
UUID: "user-uuid",
}
)

authorizer.On("Authorize", u.UUID, permission.ArticlesDelete).Once().Return(false, nil)
defer authorizer.AssertExpectations(t)

handler := NewDeleteHandler(deletearticle.NewUseCase(&articleRepository), &authorizer)

request := httptest.NewRequest(http.MethodPost, "/", nil)
request = request.WithContext(auth.ToContext(request.Context(), &u))
request.SetPathValue("uuid", r.ArticleUUID)
response := httptest.NewRecorder()

handler.ServeHTTP(response, request)

articleRepository.AssertNotCalled(t, "Delete")

assert.Len(t, response.Body.Bytes(), 0)
assert.Equal(t, http.StatusForbidden, response.Code)
})

t.Run("error", func(t *testing.T) {
t.Parallel()

var (
articleRepository articles.MockArticlesRepository
authorizer domain.MockAuthorizer

r = deletearticle.Request{ArticleUUID: "article-uuid"}
u = user.User{
UUID: "user-uuid",
}
)

authorizer.On("Authorize", u.UUID, permission.ArticlesDelete).Once().Return(false, errors.New("unexpected error"))
defer authorizer.AssertExpectations(t)

handler := NewDeleteHandler(deletearticle.NewUseCase(&articleRepository), &authorizer)

request := httptest.NewRequest(http.MethodPost, "/", nil)
request = request.WithContext(auth.ToContext(request.Context(), &u))
request.SetPathValue("uuid", r.ArticleUUID)
response := httptest.NewRecorder()

handler.ServeHTTP(response, request)

articleRepository.AssertNotCalled(t, "Delete")

assert.Len(t, response.Body.Bytes(), 0)
assert.Equal(t, http.StatusInternalServerError, response.Code)
})
}
20 changes: 3 additions & 17 deletions presentation/http/api/dashboard/article/index.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,34 +6,20 @@ import (
"strconv"
"unsafe"

"github.com/khanzadimahdi/testproject/application/auth"
getarticles "github.com/khanzadimahdi/testproject/application/dashboard/article/getArticles"
"github.com/khanzadimahdi/testproject/domain"
"github.com/khanzadimahdi/testproject/domain/permission"
)

type indexHandler struct {
useCase *getarticles.UseCase
authorizer domain.Authorizer
useCase *getarticles.UseCase
}

func NewIndexHandler(useCase *getarticles.UseCase, a domain.Authorizer) *indexHandler {
func NewIndexHandler(useCase *getarticles.UseCase) *indexHandler {
return &indexHandler{
useCase: useCase,
authorizer: a,
useCase: useCase,
}
}

func (h *indexHandler) ServeHTTP(rw http.ResponseWriter, r *http.Request) {
userUUID := auth.FromContext(r.Context()).UUID
if ok, err := h.authorizer.Authorize(userUUID, permission.ArticlesIndex); err != nil {
rw.WriteHeader(http.StatusInternalServerError)
return
} else if !ok {
rw.WriteHeader(http.StatusForbidden)
return
}

var page uint = 1
if r.URL.Query().Has("page") {
parsedPage, err := strconv.ParseUint(r.URL.Query().Get("page"), 10, int(unsafe.Sizeof(page)))
Expand Down
Loading
Loading