Skip to content

Conversation

@magentaqin
Copy link
Contributor

What

This PR hardens the /api/v1/me handler by making its auth handling fully defensive
and adds comprehensive unit tests covering edge cases.

Why

Previously, the handler could panic or return ambiguous responses when:

  • auth claims were missing or of an unexpected type
  • JWT subject was empty
  • the user store returned (nil, nil) (contract violation)

These scenarios can happen due to middleware misconfiguration, adapter bugs,
or future refactors, and should never result in panics or silent 200 responses.

Changes

  • /me handler now:
    • returns 401 unauthorized when claims are missing, invalid, or have empty subject
    • returns 500 internal_error when the user store violates its contract
  • Added unit tests for:
    • successful user retrieval
    • database error
    • missing claims in context
    • invalid claims type
    • empty user ID (JWT subject)
    • (nil, nil) user store response

Testing

  • go test ./services/api/internal/handlers -v

@magentaqin magentaqin merged commit 7b09205 into main Dec 16, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants