fix: remove the unused user use cases, fix the specs that no longer match the code, include api/middleware and api/pkg/claims in mutation testing, log failures that password reset requests currently ignore, and reject user_id claims that don't fit a user id

test/verified_account_required_http_test.go

@@ -196,6 +196,8 @@ func TestVerifiedAccountRequiredHttp(t *testing.T) {
 		{"a validly signed jwt cookie whose claims carry no user_id key at all", map[string]any{"role": "user"}},
 		{`a validly signed jwt cookie whose user_id claim is the string "one"`, map[string]any{"user_id": "one"}},
 		{"a validly signed jwt cookie whose user_id claim is the number 999, which does not match any user", map[string]any{"user_id": uint32(999)}},
+		{"a validly signed jwt cookie whose user_id claim is the number -1", map[string]any{"user_id": -1.0}},
+		{"a validly signed jwt cookie whose user_id claim is the number 4294967296 (one past the uint32 max)", map[string]any{"user_id": float64(4294967296)}},
 	}
 	for _, tc := range unresolvableTokenCases {
 		t.Run("A token that resolves to no usable account still answers 401, never 403: "+tc.name, func(t *testing.T) {
@@ -217,6 +219,28 @@ func TestVerifiedAccountRequiredHttp(t *testing.T) {
 		})
 	}
 
+	t.Run("A fractional user_id claim is never truncated into impersonating a different real user", func(t *testing.T) {
+		articleRepo := newMockArticleRepo()
+		userRepo := newMockUserRepo()
+		userRepo.users[7] = domainUser.User{ID: 7, IsVerified: true}
+		router := newVerifiedAccountRequiredRouter(articleRepo, userRepo, newMockImageRepo(), token)
+
+		req := newVerifiedAccountRequiredRequest(http.MethodPost, "/v1/article/", `{"title": "Valid Title", "body": "Some content"}`)
+		req.AddCookie(mintVerifiedAccountRequiredCookie(t, token, map[string]any{"user_id": 7.5}))
+		rec := httptest.NewRecorder()
+		router.ServeHTTP(rec, req)
+
+		if rec.Code != http.StatusUnauthorized {
+			t.Fatalf("expected status 401, got %d, body %q", rec.Code, rec.Body.String())
+		}
+		if rec.Body.String() != apperr.UnauthorizedErrorMessage+"\n" {
+			t.Errorf("unexpected body: %q", rec.Body.String())
+		}
+		if len(articleRepo.articles) != 0 {
+			t.Errorf("expected no article to be created, got %+v", articleRepo.articles)
+		}
+	})
+
 	noCookieCases := []struct {
 		method string
 		path   string