fix: remove the unused user use cases, fix the specs that no longer match the code, include api/middleware and api/pkg/claims in mutation testing, log failures that password reset requests currently ignore, and reject user_id claims that don't fit a user id

test/request_password_reset_test.go

@@ -3,10 +3,22 @@ package test
 import (
 	"RenewCMS/internal/domain/user"
 	"RenewCMS/internal/infrastructure/useCases"
+	"bytes"
+	"log"
+	"os"
+	"strings"
 	"testing"
 	"time"
 )
 
+func captureRequestPasswordResetLog(t *testing.T) *bytes.Buffer {
+	t.Helper()
+	var buf bytes.Buffer
+	log.SetOutput(&buf)
+	t.Cleanup(func() { log.SetOutput(os.Stderr) })
+	return &buf
+}
+
 func newRequestPasswordResetTestUserRepo() *mockUserRepo {
 	repo := newMockUserRepo()
 	repo.users[3] = user.User{ID: 3, Email: "alice@example.com"}
@@ -79,6 +91,7 @@ func TestRequestPasswordResetUseCase(t *testing.T) {
 		mailRepo := newMockMailRepo()
 		mailRepo.fail.failNext("Send")
 		uc := useCases.NewRequestPasswordResetUseCase(repo, &stubHasher{}, mailRepo, "https://cms.example.com")
+		logBuf := captureRequestPasswordResetLog(t)
 
 		err := uc.RequestPasswordReset("alice@example.com")
 		if err != nil {
@@ -87,12 +100,19 @@ func TestRequestPasswordResetUseCase(t *testing.T) {
 		if repo.updatePasswordResetCodeCalls != 1 {
 			t.Errorf("expected UpdatePasswordResetCode to be called once, got %d", repo.updatePasswordResetCodeCalls)
 		}
+		if logBuf.Len() == 0 {
+			t.Fatalf("expected a failure to be logged")
+		}
+		if !strings.Contains(strings.ToLower(logBuf.String()), "send") && !strings.Contains(strings.ToLower(logBuf.String()), "mail") {
+			t.Errorf("expected the log to identify a mail-send failure, got %q", logBuf.String())
+		}
 	})
 
-	t.Run("The use case swallows a hash failure and returns nil without storing or sending", func(t *testing.T) {
+	t.Run("The use case logs and swallows a hashing failure", func(t *testing.T) {
 		repo := newRequestPasswordResetTestUserRepo()
 		mailRepo := newMockMailRepo()
 		uc := useCases.NewRequestPasswordResetUseCase(repo, &stubHasher{hashErr: errStubHashFailure}, mailRepo, "https://cms.example.com")
+		logBuf := captureRequestPasswordResetLog(t)
 
 		err := uc.RequestPasswordReset("alice@example.com")
 		if err != nil {
@@ -104,13 +124,20 @@ func TestRequestPasswordResetUseCase(t *testing.T) {
 		if len(mailRepo.SentEmails) != 0 {
 			t.Errorf("expected no email to be sent, got %d", len(mailRepo.SentEmails))
 		}
+		if logBuf.Len() == 0 {
+			t.Fatalf("expected a failure to be logged")
+		}
+		if !strings.Contains(strings.ToLower(logBuf.String()), "hash") {
+			t.Errorf("expected the log to identify a hashing failure, got %q", logBuf.String())
+		}
 	})
 
-	t.Run("The use case swallows a store failure and returns nil without sending", func(t *testing.T) {
+	t.Run("The use case logs and swallows a repository failure while storing the reset code", func(t *testing.T) {
 		repo := newRequestPasswordResetTestUserRepo()
 		repo.fail.failNext("UpdatePasswordResetCode")
 		mailRepo := newMockMailRepo()
 		uc := useCases.NewRequestPasswordResetUseCase(repo, &stubHasher{}, mailRepo, "https://cms.example.com")
+		logBuf := captureRequestPasswordResetLog(t)
 
 		err := uc.RequestPasswordReset("alice@example.com")
 		if err != nil {
@@ -119,6 +146,12 @@ func TestRequestPasswordResetUseCase(t *testing.T) {
 		if len(mailRepo.SentEmails) != 0 {
 			t.Errorf("expected no email to be sent, got %d", len(mailRepo.SentEmails))
 		}
+		if logBuf.Len() == 0 {
+			t.Fatalf("expected a failure to be logged")
+		}
+		if !strings.Contains(strings.ToLower(logBuf.String()), "updatepasswordresetcode") && !strings.Contains(strings.ToLower(logBuf.String()), "store") {
+			t.Errorf("expected the log to identify a storage failure, got %q", logBuf.String())
+		}
 	})
 
 	t.Run("An unverified user can request a password reset exactly like a verified one", func(t *testing.T) {