Step 5 — Expenses, locked to their owner

1touch internal/expense/expense.go internal/expense/repository.go
2touch internal/expense/service.go internal/expense/handler.go
3
4go build ./... && go run ./cmd/api
5
6# create one
7curl -s -X POST localhost:8080/v1/expenses -H "Authorization: Bearer $TOKEN" \
8  -d '{"amount_cents":1250,"category":"food","note":"lunch","spent_on":"2026-09-08"}' | jq
9
10# the cross-user check — register a second user first
11B=$(curl -s -X POST localhost:8080/v1/auth/register \
12  -d '{"name":"B","email":"b@x.c","password":"password123"}' >/dev/null; \
13    curl -s -X POST localhost:8080/v1/auth/login \
14  -d '{"email":"b@x.c","password":"password123"}' | jq -r .access_token)
15
16# all three MUST be 404
17curl -si -H "Authorization: Bearer $B" localhost:8080/v1/expenses/1 | head -1
18curl -si -X PATCH -H "Authorization: Bearer $B" localhost:8080/v1/expenses/1 -d '{"note":"x"}' | head -1
19curl -si -X DELETE -H "Authorization: Bearer $B" localhost:8080/v1/expenses/1 | head -1

1// WRONG — two statements, and a check somebody will forget to write
2e, err := repo.GetByID(ctx, expenseID)
3if e.UserID != userID {
4	return ErrForbidden
5}
6
7// RIGHT — one query. Not yours and not there give the same answer.
8err = db.QueryRowContext(ctx,
9	`SELECT id, amount_cents, category FROM expenses WHERE id = $1 AND user_id = $2`,
10	expenseID, userID).Scan(&e.ID, &e.AmountCents, &e.Category)

1package expense
2
3type Expense struct {
4	ID          int64     `json:"id"`
5	UserID      int64     `json:"-"`              // internal; the client knows who it is
6	AmountCents int64     `json:"amount_cents"`
7	Category    string    `json:"category"`
8	Note        string    `json:"note"`
9	SpentOn     time.Time `json:"spent_on"`
10	CreatedAt   time.Time `json:"created_at"`
11}
12
13type CreateRequest struct {
14	AmountCents int64  `json:"amount_cents"`
15	Category    string `json:"category"`
16	Note        string `json:"note"`
17	SpentOn     string `json:"spent_on"`          // "2026-09-08"
18}
19
20// UpdateRequest uses pointers so "not sent" and "sent as empty" are different.
21type UpdateRequest struct {
22	AmountCents *int64  `json:"amount_cents"`
23	Category    *string `json:"category"`
24	Note        *string `json:"note"`
25}

1// Notice: EVERY method takes userID. There is no way to call one without it.
2func (r *Repository) GetByID(ctx context.Context, id, userID int64) (*Expense, error) {
3	var e Expense
4	err := r.db.QueryRowContext(ctx,
5		`SELECT id, user_id, amount_cents, category, note, spent_on, created_at
6		   FROM expenses WHERE id = $1 AND user_id = $2`,
7		id, userID,
8	).Scan(&e.ID, &e.UserID, &e.AmountCents, &e.Category, &e.Note, &e.SpentOn, &e.CreatedAt)
9
10	if errors.Is(err, sql.ErrNoRows) {
11		return nil, ErrNotFound        // covers both "not there" and "not yours"
12	}
13	if err != nil {
14		return nil, err
15	}
16	return &e, nil
17}
18
19func (r *Repository) Delete(ctx context.Context, id, userID int64) error {
20	res, err := r.db.ExecContext(ctx,
21		`DELETE FROM expenses WHERE id = $1 AND user_id = $2`, id, userID)
22	if err != nil {
23		return err
24	}
25	if n, _ := res.RowsAffected(); n == 0 {
26		return ErrNotFound
27	}
28	return nil
29}

1func (s *Service) Create(ctx context.Context, userID int64, req CreateRequest) (*Expense, error) {
2	if req.AmountCents <= 0 {
3		return nil, fmt.Errorf("%w: amount must be more than zero", ErrValidation)
4	}
5	if strings.TrimSpace(req.Category) == "" {
6		return nil, fmt.Errorf("%w: category is required", ErrValidation)
7	}
8
9	spentOn, err := time.Parse("2006-01-02", req.SpentOn)
10	if err != nil {
11		return nil, fmt.Errorf("%w: spent_on must look like 2026-09-08", ErrValidation)
12	}
13	if spentOn.After(time.Now()) {
14		return nil, fmt.Errorf("%w: cannot record a future expense", ErrValidation)
15	}
16
17	e := &Expense{
18		UserID:      userID,                    // from the token, never from the body
19		AmountCents: req.AmountCents,
20		Category:    strings.ToLower(strings.TrimSpace(req.Category)),
21		Note:        req.Note,
22		SpentOn:     spentOn,
23	}
24	return e, s.repo.Create(ctx, e)
25}

1func (h *Handler) get(w http.ResponseWriter, r *http.Request) {
2	userID, ok := middleware.UserID(r.Context())
3	if !ok {
4		httpx.Error(w, 401, "unauthorized")
5		return
6	}
7
8	id, err := strconv.ParseInt(r.PathValue("id"), 10, 64)
9	if err != nil {
10		httpx.Error(w, 400, "invalid id")
11		return
12	}
13
14	e, err := h.svc.GetByID(r.Context(), id, userID)   // both ids, always
15	if err != nil {
16		httpx.FromError(w, err)                        // ErrNotFound becomes 404
17		return
18	}
19
20	httpx.JSON(w, 200, e)
21}

1func (s *Service) Update(ctx context.Context, id, userID int64, req UpdateRequest) (*Expense, error) {
2	e, err := s.repo.GetByID(ctx, id, userID)     // scoped read first
3	if err != nil {
4		return nil, err
5	}
6
7	if req.AmountCents != nil {
8		if *req.AmountCents <= 0 {
9			return nil, fmt.Errorf("%w: amount must be more than zero", ErrValidation)
10		}
11		e.AmountCents = *req.AmountCents
12	}
13	if req.Category != nil {
14		e.Category = strings.ToLower(*req.Category)
15	}
16	if req.Note != nil {
17		e.Note = *req.Note                        // "" is a real value here
18	}
19
20	return e, s.repo.Update(ctx, e, userID)
21}

1# as user A
2A=$(login a@x.com); ID=$(create_expense $A)
3
4# as user B — all three must be 404
5curl -si -H "Authorization: Bearer $B" localhost:8080/v1/expenses/$ID | head -1
6curl -si -X PATCH -H "Authorization: Bearer $B" localhost:8080/v1/expenses/$ID | head -1
7curl -si -X DELETE -H "Authorization: Bearer $B" localhost:8080/v1/expenses/$ID | head -1