fix: remove the unused user use cases, fix the specs that no longer match the code, include api/middleware and api/pkg/claims in mutation testing, log failures that password reset requests currently ignore, and reject user_id claims that don't fit a user id

test/claims_test.go

@@ -2,6 +2,7 @@ package test
 
 import (
 	"RenewCMS/api/pkg/claims"
+	"math"
 	"net/http"
 	"net/http/httptest"
 	"testing"
@@ -65,3 +66,88 @@ func TestClaimsTokenVersion(t *testing.T) {
 		}
 	})
 }
+
+func TestClaimsUserId(t *testing.T) {
+	token := jwtauth.New("HS256", []byte("test-secret"), nil)
+
+	t.Run("returns the numeric user_id claim", func(t *testing.T) {
+		req := requestWithJwtClaims(t, token, map[string]any{"user_id": uint32(7)})
+
+		got, ok := claims.UserId(req)
+		if !ok {
+			t.Fatalf("expected ok true")
+		}
+		if got != 7 {
+			t.Errorf("expected 7, got %d", got)
+		}
+	})
+
+	t.Run("returns ok false when the user_id key is missing", func(t *testing.T) {
+		req := requestWithJwtClaims(t, token, map[string]any{"role": "user"})
+
+		_, ok := claims.UserId(req)
+		if ok {
+			t.Errorf("expected ok false")
+		}
+	})
+
+	t.Run("returns ok false when user_id is not numeric", func(t *testing.T) {
+		req := requestWithJwtClaims(t, token, map[string]any{"user_id": "one"})
+
+		_, ok := claims.UserId(req)
+		if ok {
+			t.Errorf("expected ok false")
+		}
+	})
+
+	t.Run("returns ok false when user_id is negative", func(t *testing.T) {
+		req := requestWithJwtClaims(t, token, map[string]any{"user_id": -1.0})
+
+		_, ok := claims.UserId(req)
+		if ok {
+			t.Errorf("expected ok false")
+		}
+	})
+
+	t.Run("returns ok false when user_id has a fractional part", func(t *testing.T) {
+		req := requestWithJwtClaims(t, token, map[string]any{"user_id": 7.5})
+
+		_, ok := claims.UserId(req)
+		if ok {
+			t.Errorf("expected ok false")
+		}
+	})
+
+	t.Run("returns ok true when user_id is exactly zero", func(t *testing.T) {
+		req := requestWithJwtClaims(t, token, map[string]any{"user_id": float64(0)})
+
+		got, ok := claims.UserId(req)
+		if !ok {
+			t.Fatalf("expected ok true")
+		}
+		if got != 0 {
+			t.Errorf("expected 0, got %d", got)
+		}
+	})
+
+	t.Run("returns ok true when user_id is exactly the uint32 max", func(t *testing.T) {
+		req := requestWithJwtClaims(t, token, map[string]any{"user_id": float64(math.MaxUint32)})
+
+		got, ok := claims.UserId(req)
+		if !ok {
+			t.Fatalf("expected ok true")
+		}
+		if got != math.MaxUint32 {
+			t.Errorf("expected %d, got %d", uint32(math.MaxUint32), got)
+		}
+	})
+
+	t.Run("returns ok false when user_id is one past the uint32 max", func(t *testing.T) {
+		req := requestWithJwtClaims(t, token, map[string]any{"user_id": float64(4294967296)})
+
+		_, ok := claims.UserId(req)
+		if ok {
+			t.Errorf("expected ok false")
+		}
+	})
+}