popertots/Crussell
1
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: improve test infrastructure and add ID validation

Browse Source 
- Add TestMain to set test env vars and testdb.TruncateTables for test
  isolation
- Add chi routing context to test helpers for path parameter extraction
- Fix SQL error handling to use errors.Is() instead of ==
- Add validators package with ID validation
- Fix admin test middleware chain (RequireAdmin wrapper)
- Update test user inserts to include phone and date_of_birth fields
- Update service delete test to check soft-delete (is_active=false)
- Update holiday hours test to use new schema (weekday, is_open)
- Add phone number validation tests for UK mobile numbers
This commit is contained in:
popertots
2026-02-23 00:59:32 +00:00
parent 355e8a26c1
commit df3439bd70
30 changed files with 1081 additions and 360 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/handlers/bookings/bookings.go
+68 -39
View File
@@ -5,8 +5,10 @@ import (
"crussell/handlers/notifications"
"crussell/internal/dav"
"crussell/mw"
"crussell/internal/validators"
"database/sql"
"encoding/json"
"errors"
"fmt"
"log"
"net/http"
@@ -624,8 +626,8 @@ func GetAllAdminBookingsHandler(w http.ResponseWriter, r *http.Request) {
// GET /api/admin/bookings/user/{user_id}
func GetAllBookingsByUserHandler(w http.ResponseWriter, r *http.Request) {
userID := chi.URLParam(r, "user_id")
if userID == "" {
http.Error(w, "User ID is required", http.StatusBadRequest)
if userID == "" || !validators.IsValidID(userID) {
http.Error(w, "User not found", http.StatusNotFound)
return
}
@@ -769,8 +771,8 @@ func GetAllBookingsByUserHandler(w http.ResponseWriter, r *http.Request) {
// GET /api/admin/bookings/{id}
func GetAdminBookingHandler(w http.ResponseWriter, r *http.Request) {
bookingID := chi.URLParam(r, "id")
if bookingID == "" {
http.Error(w, "Booking ID is required", http.StatusBadRequest)
if bookingID == "" || !validators.IsValidID(bookingID) {
http.Error(w, "Booking not found", http.StatusNotFound)
return
}
@@ -796,7 +798,7 @@ func GetAdminBookingHandler(w http.ResponseWriter, r *http.Request) {
&booking.User.ReferralCode, &booking.User.Notes,
)
if err != nil {
if err == sql.ErrNoRows {
if errors.Is(err, sql.ErrNoRows) {
http.Error(w, "Booking not found", http.StatusNotFound)
return
}
@@ -1176,11 +1178,12 @@ func CreateBookingHandler(w http.ResponseWriter, r *http.Request) {
http.Error(w, "At least one service is required", http.StatusBadRequest)
return
}
// TODO: reenable start time validation before going live, disabled for testing
// if req.StartTime.Before(time.Now()) {
// http.Error(w, "Start time cannot be in the past", http.StatusBadRequest)
// return
// }
// Validate start time is not in the past
if req.StartTime.Before(time.Now()) {
http.Error(w, "Start time cannot be in the past", http.StatusBadRequest)
return
}
// Get created by from context (if available)
var createdBy *string
@@ -1281,6 +1284,30 @@ func CreateBookingHandler(w http.ResponseWriter, r *http.Request) {
return
}
// Fetch services for the response
booking.Services = []BookingService{}
rows, err := db.DB.Query(r.Context(), `
SELECT bs.booking_id, bs.service_id, bs.override_price, bs.override_duration_minutes,
s.name, s.description, s.price, s.duration_minutes
FROM booking_services bs
JOIN services s ON bs.service_id = s.id
WHERE bs.booking_id = $1
`, booking.ID)
if err == nil {
defer rows.Close()
for rows.Next() {
var bs BookingService
err := rows.Scan(
&bs.BookingID, &bs.ServiceID, &bs.OverridePrice, &bs.OverrideDurationMinutes,
&bs.ServiceName, &bs.ServiceDescription, &bs.Price, &bs.DurationMinutes,
)
if err != nil {
break
}
booking.Services = append(booking.Services, bs)
}
}
// Return created booking
w.Header().Set("Content-Type", "application/json")
w.WriteHeader(http.StatusCreated)
@@ -1294,8 +1321,8 @@ func CreateBookingHandler(w http.ResponseWriter, r *http.Request) {
// PUT /api/bookings/{id}
func EditBookingHandler(w http.ResponseWriter, r *http.Request) {
bookingID := chi.URLParam(r, "id")
if bookingID == "" {
http.Error(w, "Booking ID is required", http.StatusBadRequest)
if bookingID == "" || !validators.IsValidID(bookingID) {
http.Error(w, "Booking not found", http.StatusNotFound)
return
}
@@ -1350,7 +1377,7 @@ func EditBookingHandler(w http.ResponseWriter, r *http.Request) {
)
if err != nil {
if err == sql.ErrNoRows {
if errors.Is(err, sql.ErrNoRows) {
http.Error(w, "Booking not found or access denied", http.StatusNotFound)
return
}
@@ -1372,8 +1399,8 @@ func EditBookingHandler(w http.ResponseWriter, r *http.Request) {
// PUT /api/bookings/{id}/progress
func ProgressBookingHandler(w http.ResponseWriter, r *http.Request) {
bookingID := chi.URLParam(r, "id")
if bookingID == "" {
http.Error(w, "Booking ID is required", http.StatusBadRequest)
if bookingID == "" || !validators.IsValidID(bookingID) {
http.Error(w, "Booking not found", http.StatusNotFound)
return
}
@@ -1420,7 +1447,7 @@ func ProgressBookingHandler(w http.ResponseWriter, r *http.Request) {
)
if err != nil {
if err == sql.ErrNoRows {
if errors.Is(err, sql.ErrNoRows) {
http.Error(w, "Booking not found", http.StatusNotFound)
return
}
@@ -1460,12 +1487,12 @@ func ProgressBookingHandler(w http.ResponseWriter, r *http.Request) {
// Add loyalty stamp when booking completed - max 1 per day per user
_, err = db.DB.Exec(r.Context(),
`UPDATE users
`UPDATE users
SET loyalty_stamps = loyalty_stamps + 1
WHERE id = $1
WHERE id = $1
AND NOT EXISTS (
SELECT 1 FROM bookings b
WHERE b.user_id = users.id
WHERE b.user_id = users.id
AND b.status = 'completed'
AND b.updated_at >= CURRENT_DATE - INTERVAL '1 day'
AND b.id != $2
@@ -1497,8 +1524,8 @@ func ProgressBookingHandler(w http.ResponseWriter, r *http.Request) {
// POST /api/bookings/{id}/confirm
func ConfirmBookingHandler(w http.ResponseWriter, r *http.Request) {
bookingID := chi.URLParam(r, "id")
if bookingID == "" {
http.Error(w, "Booking ID is required", http.StatusBadRequest)
if bookingID == "" || !validators.IsValidID(bookingID) {
http.Error(w, "Booking not found", http.StatusNotFound)
return
}
@@ -1555,7 +1582,7 @@ func ConfirmBookingHandler(w http.ResponseWriter, r *http.Request) {
)
if err != nil {
if err == sql.ErrNoRows {
if errors.Is(err, sql.ErrNoRows) {
http.Error(w, "Booking not found or already confirmed", http.StatusNotFound)
return
}
@@ -1651,8 +1678,8 @@ func ConfirmBookingHandler(w http.ResponseWriter, r *http.Request) {
// POST /api/admin/bookings/{id}/cancel
func CancelBookingHandler(w http.ResponseWriter, r *http.Request) {
bookingID := chi.URLParam(r, "id")
if bookingID == "" {
http.Error(w, "Booking ID is required", http.StatusBadRequest)
if bookingID == "" || !validators.IsValidID(bookingID) {
http.Error(w, "Booking not found", http.StatusNotFound)
return
}
@@ -1685,7 +1712,7 @@ func CancelBookingHandler(w http.ResponseWriter, r *http.Request) {
)
if err != nil {
if err == sql.ErrNoRows {
if errors.Is(err, sql.ErrNoRows) {
http.Error(w, "Booking not found or cannot be cancelled", http.StatusNotFound)
return
}
@@ -1714,8 +1741,8 @@ func CancelBookingHandler(w http.ResponseWriter, r *http.Request) {
// DELETE /api/bookings/{id}
func DeleteBookingHandler(w http.ResponseWriter, r *http.Request) {
bookingID := chi.URLParam(r, "id")
if bookingID == "" {
http.Error(w, "Booking ID is required", http.StatusBadRequest)
if bookingID == "" || !validators.IsValidID(bookingID) {
http.Error(w, "Booking not found", http.StatusNotFound)
return
}
@@ -1765,7 +1792,7 @@ func DeleteBookingHandler(w http.ResponseWriter, r *http.Request) {
var originalStatus string
err = tx.QueryRow(r.Context(), "SELECT status FROM bookings WHERE id = $1 AND user_id = $2", bookingID, userID).Scan(&originalStatus)
if err != nil {
if err == sql.ErrNoRows {
if errors.Is(err, sql.ErrNoRows) {
http.Error(w, "Booking not found or access denied", http.StatusNotFound)
return
}
@@ -1859,7 +1886,7 @@ func DeleteBookingHandler(w http.ResponseWriter, r *http.Request) {
var originalStatus string
err = tx.QueryRow(r.Context(), "SELECT status FROM bookings WHERE id = $1 AND user_id = $2", bookingID, userID).Scan(&originalStatus)
if err != nil {
if err == sql.ErrNoRows {
if errors.Is(err, sql.ErrNoRows) {
http.Error(w, "Booking not found or access denied", http.StatusNotFound)
return
}
@@ -1918,8 +1945,8 @@ func DeleteBookingHandler(w http.ResponseWriter, r *http.Request) {
// GET /api/bookings/{id}
func GetBookingHandler(w http.ResponseWriter, r *http.Request) {
bookingID := chi.URLParam(r, "id")
if bookingID == "" {
http.Error(w, "Booking ID is required", http.StatusBadRequest)
if bookingID == "" || !validators.IsValidID(bookingID) {
http.Error(w, "Booking not found", http.StatusNotFound)
return
}
@@ -1948,7 +1975,7 @@ func GetBookingHandler(w http.ResponseWriter, r *http.Request) {
&booking.Notes, &booking.CreatedAt, &booking.UpdatedAt, &createdBy,
)
if err != nil {
if err == sql.ErrNoRows {
if errors.Is(err, sql.ErrNoRows) {
http.Error(w, "Booking not found or access denied", http.StatusNotFound)
return
}
@@ -2130,31 +2157,33 @@ func GetBookingHandler(w http.ResponseWriter, r *http.Request) {
// GET /api/bookings/{id}/calendar - returns standalone .ics file
func GetBookingCalendarHandler(w http.ResponseWriter, r *http.Request) {
bookingID := chi.URLParam(r, "id")
if bookingID == "" {
http.Error(w, "Booking ID is required", http.StatusBadRequest)
if bookingID == "" || !validators.IsValidID(bookingID) {
http.Error(w, "Booking not found", http.StatusNotFound)
return
}
// Check auth first (security by design - don't reveal if booking exists to unauthenticated users)
userID, ok := r.Context().Value(mw.UserIDKey).(string)
if !ok || userID == "" {
http.Error(w, "Authentication required", http.StatusUnauthorized)
http.Error(w, "Booking not found", http.StatusNotFound)
return
}
// Now check if booking exists and belongs to user
var bookingIDDB, userIDDB, status, notes, createdBy string
var startTime, createdAt, updatedAt time.Time
var durationMinutes int
err := db.DB.QueryRow(r.Context(), `
SELECT id, user_id, start_time, status, COALESCE(notes, ''), created_by, created_at, updated_at,
COALESCE((SELECT SUM(COALESCE(bs.override_duration_minutes, s.duration_minutes))
FROM booking_services bs JOIN services s ON bs.service_id = s.id
SELECT id, user_id, start_time, status, COALESCE(notes, ''), COALESCE(created_by, ''), created_at, updated_at,
COALESCE((SELECT SUM(COALESCE(bs.override_duration_minutes, s.duration_minutes))
FROM booking_services bs JOIN services s ON bs.service_id = s.id
WHERE bs.booking_id = bookings.id), 60)
FROM bookings
WHERE id = $1 AND user_id = $2
`, bookingID, userID).Scan(&bookingIDDB, &userIDDB, &startTime, &status, &notes, &createdBy, &createdAt, &updatedAt, &durationMinutes)
if err != nil {
if err == sql.ErrNoRows {
if errors.Is(err, sql.ErrNoRows) {
http.Error(w, "Booking not found", http.StatusNotFound)
return
}