tabel user

internal/handler/auth_handler.go

@@ -2,6 +2,7 @@ package handler
 
 import (
 	"encoding/json"
+	"errors"
 	"net/http"
 	"strings"
 	"time"
@@ -60,7 +61,11 @@ func (h *AuthHandler) Register(w http.ResponseWriter, r *http.Request) {
 	}
 
 	if err := h.userStore.Create(r.Context(), user); err != nil {
-		http.Error(w, "Username already exists or create failed", http.StatusBadRequest)
+		if errors.Is(err, store.ErrUsernameTaken) {
+			http.Error(w, "Username already exists", http.StatusConflict)
+			return
+		}
+		http.Error(w, "Internal Server Error", http.StatusInternalServerError)
 		return
 	}
 
@@ -106,7 +111,7 @@ func (h *AuthHandler) Login(w http.ResponseWriter, r *http.Request) {
 
 	w.Header().Set("Content-Type", "application/json")
 	w.WriteHeader(http.StatusOK)
-	_ = json.NewEncoder(w).Encode(session)
+	_ = json.NewEncoder(w).Encode(map[string]string{"session_token": session.Token})
 }
 
 func (h *AuthHandler) Logout(w http.ResponseWriter, r *http.Request) {
@@ -136,7 +141,5 @@ func (h *AuthHandler) Logout(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	w.Header().Set("Content-Type", "application/json")
-	w.WriteHeader(http.StatusOK)
-	_ = json.NewEncoder(w).Encode(map[string]string{"message": "logged out"})
+	w.WriteHeader(http.StatusNoContent)
 }

internal/handler/snippet_handler.go

@@ -96,7 +96,13 @@ func (h *SnippetHandler) List(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	snippets, err := h.snippetStore.GetAll(r.Context())
+	userID := middleware.GetUserID(r.Context())
+	if userID == "" {
+		http.Error(w, "Unauthorized", http.StatusUnauthorized)
+		return
+	}
+
+	snippets, err := h.snippetStore.GetByUserID(r.Context(), userID)
 	if err != nil {
 		http.Error(w, "Internal Server Error", http.StatusInternalServerError)
 		return
@@ -145,6 +151,12 @@ func (h *SnippetHandler) Delete(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	userID := middleware.GetUserID(r.Context())
+	if userID == "" {
+		http.Error(w, "Unauthorized", http.StatusUnauthorized)
+		return
+	}
+
 	id := r.PathValue("id")
 	if id == "" {
 		path := strings.TrimPrefix(r.URL.Path, "/snippets/")
@@ -156,6 +168,21 @@ func (h *SnippetHandler) Delete(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	snippet, err := h.snippetStore.GetByID(r.Context(), id)
+	if err != nil {
+		if errors.Is(err, pgx.ErrNoRows) {
+			http.Error(w, "Snippet not found", http.StatusNotFound)
+			return
+		}
+		http.Error(w, "Internal Server Error", http.StatusInternalServerError)
+		return
+	}
+
+	if snippet.UserID != userID {
+		http.Error(w, "Forbidden", http.StatusForbidden)
+		return
+	}
+
 	if err := h.snippetStore.Delete(r.Context(), id); err != nil {
 		http.Error(w, "Internal Server Error", http.StatusInternalServerError)
 		return