fix: reading a single article follows the same rule as the list: anyone can read an online article, a verified user can also read an offline one, and an unknown or hidden id returns 404

test/not_found_errors_test.go

@@ -3,7 +3,6 @@ package test
 import (
 	"RenewCMS/api/handlers/article"
 	"RenewCMS/api/handlers/auth"
-	"RenewCMS/api/middleware"
 	"RenewCMS/api/pkg/apperr"
 	validator "RenewCMS/api/pkg/validator"
 	domainArticle "RenewCMS/internal/domain/article"
@@ -150,13 +149,9 @@ func newNotFoundErrorsRouter(articleRepo *mockArticleRepo, userRepo *mockUserRep
 
 	r := chi.NewRouter()
 	r.Route("/v1", func(r chi.Router) {
-		r.Group(func(r chi.Router) {
+		r.Route("/article", func(r chi.Router) {
 			r.Use(jwtauth.Verifier(token))
-			r.Use(jwtauth.Authenticator(token))
-			r.Use(middleware.RequireVerifiedUser(getUserUseCase))
-			r.Route("/article", func(r chi.Router) {
-				r.Get("/{id}", articleHandler.GetArticle)
-			})
+			r.Get("/{id}", articleHandler.GetArticle)
 		})
 		r.Route("/auth", func(r chi.Router) {
 			r.Post("/login", authHandler.Login)
@@ -203,7 +198,6 @@ func TestNotFoundErrorsHttp(t *testing.T) {
 	t.Run("Fetching an offline article still answers 404 with the same message", func(t *testing.T) {
 		router := newNotFoundErrorsRouter(newArticleRepo(), newVerifiedUserRepo(), token)
 		req := httptest.NewRequest(http.MethodGet, "/v1/article/2", nil)
-		setJwtCookie(t, req, token, 1)
 		rec := httptest.NewRecorder()
 		router.ServeHTTP(rec, req)
 
@@ -234,14 +228,17 @@ func TestNotFoundErrorsHttp(t *testing.T) {
 		}
 	})
 
-	t.Run("The article route still requires authentication before existence is even checked", func(t *testing.T) {
+	t.Run("An unknown article id answers 404 even without authentication", func(t *testing.T) {
 		router := newNotFoundErrorsRouter(newArticleRepo(), newMockUserRepo(), token)
 		req := httptest.NewRequest(http.MethodGet, "/v1/article/9999", nil)
 		rec := httptest.NewRecorder()
 		router.ServeHTTP(rec, req)
 
-		if rec.Code != http.StatusUnauthorized {
-			t.Fatalf("expected status 401, got %d", rec.Code)
+		if rec.Code != http.StatusNotFound {
+			t.Fatalf("expected status 404, got %d", rec.Code)
+		}
+		if rec.Body.String() != apperr.ArticleNotFoundErrorMessage+"\n" {
+			t.Errorf("unexpected body: %q", rec.Body.String())
 		}
 	})