fix: reading a single article follows the same rule as the list: anyone can read an online article, a verified user can also read an offline one, and an unknown or hidden id returns 404

test/verified_account_required_http_test.go

@@ -42,10 +42,10 @@ func newVerifiedAccountRequiredRouter(articleRepo *mockArticleRepo, userRepo *mo
 		r.Route("/article", func(r chi.Router) {
 			r.Use(jwtauth.Verifier(token))
 			r.Get("/", articleHandler.ListArticles)
+			r.Get("/{id}", articleHandler.GetArticle)
 			r.Group(func(r chi.Router) {
 				r.Use(jwtauth.Authenticator(token))
 				r.Use(middleware.RequireVerifiedUser(getUserUseCase))
-				r.Get("/{id}", articleHandler.GetArticle)
 				r.Post("/", articleHandler.PostArticle)
 				r.Delete("/{id}", articleHandler.DeleteArticle)
 				r.Patch("/{id}", articleHandler.UpdateArticleBody)
@@ -97,7 +97,6 @@ func TestVerifiedAccountRequiredHttp(t *testing.T) {
 		path   string
 		body   string
 	}{
-		{http.MethodGet, "/v1/article/1", ""},
 		{http.MethodPost, "/v1/article/", `{"title": "Valid Title", "body": "Some content"}`},
 		{http.MethodDelete, "/v1/article/1", ""},
 		{http.MethodPatch, "/v1/article/1", `{"body": "Updated"}`},
@@ -222,7 +221,6 @@ func TestVerifiedAccountRequiredHttp(t *testing.T) {
 		method string
 		path   string
 	}{
-		{http.MethodGet, "/v1/article/1"},
 		{http.MethodPost, "/v1/article/"},
 	}
 	for _, tc := range noCookieCases {