Step 8 — Test that the walls actually hold

1# a separate database for tests, so your real data is never truncated
2docker run -d --name exp-test-pg \
3  -e POSTGRES_PASSWORD=secret -e POSTGRES_DB=expenses_test \
4  -p 5433:5432 postgres:16
5
6export TEST_DATABASE_URL='postgres://postgres:secret@localhost:5433/expenses_test?sslmode=disable'
7docker exec -i exp-test-pg psql -U postgres -d expenses_test < migrations/001_init.up.sql
8
9touch internal/expense/handler_test.go internal/expense/helpers_test.go
10touch internal/expense/service_test.go internal/user/auth_test.go
11
12# run them
13go test ./... -race -cover
14go test ./internal/expense/ -run TestUserCannotTouch -v
15
16# see what is untested
17go test ./... -coverprofile=c.out && go tool cover -html=c.out

1func TestUserCannotTouchAnotherUsersExpense(t *testing.T) {
2	h := newTestHandler(t)
3
4	tokenA := registerAndLogin(t, h, "a@x.com")
5	tokenB := registerAndLogin(t, h, "b@x.com")
6
7	// A creates an expense
8	id := createExpense(t, h, tokenA, 1200, "food")
9
10	// B tries everything. All of it must be 404 — never 403, never 200.
11	tests := []struct {
12		name   string
13		method string
14		body   string
15	}{
16		{"read", "GET", ""},
17		{"update", "PATCH", `{"note":"stolen"}`},
18		{"delete", "DELETE", ""},
19	}
20
21	for _, tt := range tests {
22		t.Run(tt.name, func(t *testing.T) {
23			req := httptest.NewRequest(tt.method,
24				fmt.Sprintf("/v1/expenses/%d", id), strings.NewReader(tt.body))
25			req.Header.Set("Authorization", "Bearer "+tokenB)
26			rec := httptest.NewRecorder()
27
28			h.ServeHTTP(rec, req)
29
30			if rec.Code != 404 {
31				t.Errorf("%s as another user = %d, want 404 — body %s",
32					tt.method, rec.Code, rec.Body)
33			}
34		})
35	}
36
37	// and A's expense is untouched
38	if got := getExpense(t, h, tokenA, id); got.Note == "stolen" {
39		t.Fatal("user B modified user A's expense")
40	}
41}

1func newTestDB(t *testing.T) *sql.DB {
2	t.Helper()                          // failures point at the CALLER's line
3
4	db, err := sql.Open("pgx", os.Getenv("TEST_DATABASE_URL"))
5	if err != nil {
6		t.Fatal(err)
7	}
8	mustMigrate(t, db)
9
10	t.Cleanup(func() {                  // runs even if the test fails or panics
11		db.Exec("TRUNCATE users, expenses, refresh_tokens RESTART IDENTITY CASCADE")
12		db.Close()
13	})
14	return db
15}

1type fakeRepo struct {
2	items map[int64]*Expense
3	err   error                         // set this to force the failure path
4}
5
6func (f *fakeRepo) GetByID(_ context.Context, id, userID int64) (*Expense, error) {
7	if f.err != nil {
8		return nil, f.err
9	}
10	e, ok := f.items[id]
11	if !ok || e.UserID != userID {
12		return nil, ErrNotFound
13	}
14	return e, nil
15}

1tests := []struct {
2	name string
3	body string
4	want int
5}{
6	{"valid", `{"name":"a","email":"a@b.c","password":"password123"}`, 201},
7	{"duplicate email", `{"name":"a","email":"a@b.c","password":"password123"}`, 409},
8	{"short password", `{"name":"a","email":"c@b.c","password":"short"}`, 422},
9	{"no email", `{"name":"a","password":"password123"}`, 422},
10	{"malformed json", `nope`, 400},
11}

1go test ./... -race -cover
2
3# -race finds data races that only appear under concurrency.
4# Run it in CI, always.