fix: reading a single article follows the same rule as the list: anyone can read an online article, a verified user can also read an offline one, and an unknown or hidden id returns 404

api/handlers/article/articleHandler.go

@@ -53,7 +53,12 @@ func (h *Handler) GetArticle(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	article, err := h.GetUseCase.GetOnlineArticle(id)
+	var article domain.Article
+	if h.callerIsVerified(r) {
+		article, err = h.GetUseCase.GetArticle(id)
+	} else {
+		article, err = h.GetUseCase.GetOnlineArticle(id)
+	}
 	if err != nil {
 		if errors.Is(err, domain.ErrArticleNotFound) {
 			http.Error(w, apperr.ArticleNotFoundErrorMessage, http.StatusNotFound)

api/router.go

@@ -36,11 +36,11 @@ func NewArticleRouter(container *UseCases) http.Handler {
 
 	r.Group(func(r chi.Router) {
 		r.Get("/", articleHandler.ListArticles)
+		r.Get("/{id}", articleHandler.GetArticle)
 	})
 	r.Group(func(r chi.Router) {
 		r.Use(jwtauth.Authenticator(container.Token))
 		r.Use(middleware.RequireVerifiedUser(container.GetUserUseCase))
-		r.Get("/{id}", articleHandler.GetArticle)
 		r.Post("/", articleHandler.PostArticle)
 		r.Delete("/{id}", articleHandler.DeleteArticle)
 		r.Patch("/{id}", articleHandler.UpdateArticleBody)