Assignment 4: tests, interface refactor, e2e suite

internal/handler/auth_handler.go

@@ -2,22 +2,28 @@ package handler
 
 import (
 	"encoding/json"
+	"errors"
 	"net/http"
 	"strings"
 	"time"
+	"unicode/utf8"
 
 	"5803025048/W04/internal/auth"
+	"5803025048/W04/internal/middleware"
 	"5803025048/W04/internal/models"
 	"5803025048/W04/internal/store"
 	"github.com/google/uuid"
 )
 
+// bcrypt menolak password lebih dari 72 byte.
+const maxPasswordBytes = 72
+
 type AuthHandler struct {
-	userStore    *store.UserStore
-	sessionStore *store.SessionStore
+	userStore    UserStore
+	sessionStore SessionStore
 }
 
-func NewAuthHandler(userStore *store.UserStore, sessionStore *store.SessionStore) *AuthHandler {
+func NewAuthHandler(userStore UserStore, sessionStore SessionStore) *AuthHandler {
 	return &AuthHandler{
 		userStore:    userStore,
 		sessionStore: sessionStore,
@@ -30,26 +36,22 @@ type authRequest struct {
 }
 
 func (h *AuthHandler) Register(w http.ResponseWriter, r *http.Request) {
-	if r.Method != http.MethodPost {
-		http.Error(w, "Method Not Allowed", http.StatusMethodNotAllowed)
-		return
-	}
-
 	var req authRequest
 	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
-		http.Error(w, "Bad Request", http.StatusBadRequest)
+		writeError(w, http.StatusBadRequest, "Bad Request")
 		return
 	}
 
 	req.Username = strings.TrimSpace(req.Username)
-	if len(req.Username) < 3 || len(req.Username) > 32 || req.Password == "" {
-		http.Error(w, "Invalid username or password", http.StatusBadRequest)
+	n := utf8.RuneCountInString(req.Username)
+	if n < 3 || n > 32 || req.Password == "" || len(req.Password) > maxPasswordBytes {
+		writeError(w, http.StatusBadRequest, "Invalid username or password")
 		return
 	}
 
 	hash, err := auth.HashPassword(req.Password)
 	if err != nil {
-		http.Error(w, "Internal Server Error", http.StatusInternalServerError)
+		writeError(w, http.StatusInternalServerError, "Internal Server Error")
 		return
 	}
 
@@ -60,36 +62,41 @@ func (h *AuthHandler) Register(w http.ResponseWriter, r *http.Request) {
 	}
 
 	if err := h.userStore.Create(r.Context(), user); err != nil {
-		http.Error(w, "Username already exists or create failed", http.StatusBadRequest)
+		if errors.Is(err, store.ErrUsernameTaken) {
+			writeError(w, http.StatusConflict, "Username already exists")
+			return
+		}
+		writeError(w, http.StatusInternalServerError, "Internal Server Error")
 		return
 	}
 
-	w.Header().Set("Content-Type", "application/json")
-	w.WriteHeader(http.StatusCreated)
-	_ = json.NewEncoder(w).Encode(user)
+	writeJSON(w, http.StatusCreated, user)
 }
 
 func (h *AuthHandler) Login(w http.ResponseWriter, r *http.Request) {
-	if r.Method != http.MethodPost {
-		http.Error(w, "Method Not Allowed", http.StatusMethodNotAllowed)
-		return
-	}
-
 	var req authRequest
 	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
-		http.Error(w, "Bad Request", http.StatusBadRequest)
+		writeError(w, http.StatusBadRequest, "Bad Request")
 		return
 	}
 
 	user, err := h.userStore.GetByUsername(r.Context(), req.Username)
-	if err != nil || !auth.CheckPassword(req.Password, user.PasswordHash) {
-		http.Error(w, "Invalid credentials", http.StatusUnauthorized)
+	if err != nil {
+		if errors.Is(err, store.ErrNotFound) {
+			writeError(w, http.StatusUnauthorized, "Invalid credentials")
+			return
+		}
+		writeError(w, http.StatusInternalServerError, "Internal Server Error")
+		return
+	}
+	if !auth.CheckPassword(req.Password, user.PasswordHash) {
+		writeError(w, http.StatusUnauthorized, "Invalid credentials")
 		return
 	}
 
 	token, err := auth.GenerateToken()
 	if err != nil {
-		http.Error(w, "Internal Server Error", http.StatusInternalServerError)
+		writeError(w, http.StatusInternalServerError, "Internal Server Error")
 		return
 	}
 
@@ -100,43 +107,33 @@ func (h *AuthHandler) Login(w http.ResponseWriter, r *http.Request) {
 	}
 
 	if err := h.sessionStore.Create(r.Context(), session); err != nil {
-		http.Error(w, "Internal Server Error", http.StatusInternalServerError)
+		writeError(w, http.StatusInternalServerError, "Internal Server Error")
 		return
 	}
 
-	w.Header().Set("Content-Type", "application/json")
-	w.WriteHeader(http.StatusOK)
-	_ = json.NewEncoder(w).Encode(session)
+	writeJSON(w, http.StatusOK, map[string]string{"session_token": session.Token})
 }
 
 func (h *AuthHandler) Logout(w http.ResponseWriter, r *http.Request) {
-	if r.Method != http.MethodPost {
-		http.Error(w, "Method Not Allowed", http.StatusMethodNotAllowed)
+	token, ok := middleware.BearerToken(r)
+	if !ok {
+		writeError(w, http.StatusUnauthorized, "Unauthorized")
 		return
 	}
 
-	authHeader := r.Header.Get("Authorization")
-	if authHeader == "" {
-		http.Error(w, "Unauthorized", http.StatusUnauthorized)
-		return
-	}
-
-	token := authHeader
-	if strings.HasPrefix(strings.ToLower(authHeader), "bearer ") {
-		token = authHeader[7:]
-	}
-	token = strings.TrimSpace(token)
-	if token == "" {
-		http.Error(w, "Unauthorized", http.StatusUnauthorized)
+	if _, err := h.sessionStore.Get(r.Context(), token); err != nil {
+		if errors.Is(err, store.ErrNotFound) {
+			writeError(w, http.StatusUnauthorized, "Unauthorized")
+			return
+		}
+		writeError(w, http.StatusInternalServerError, "Internal Server Error")
 		return
 	}
 
 	if err := h.sessionStore.Delete(r.Context(), token); err != nil {
-		http.Error(w, "Internal Server Error", http.StatusInternalServerError)
+		writeError(w, http.StatusInternalServerError, "Internal Server Error")
 		return
 	}
 
-	w.Header().Set("Content-Type", "application/json")
-	w.WriteHeader(http.StatusOK)
-	_ = json.NewEncoder(w).Encode(map[string]string{"message": "logged out"})
+	w.WriteHeader(http.StatusNoContent)
 }