docs: remove project structure, boring and hard to maintain

Dockerfile

@@ -11,7 +11,7 @@ ARG TARGETARCH=amd64
 RUN CGO_ENABLED=0 GOOS=${TARGETOS} GOARCH=${TARGETARCH} go build -ldflags="-s -w" -o /out/goyco ./cmd/goyco
 
 # building the application image
-FROM alpine:3.22
+FROM alpine:3.23
 RUN addgroup -S goyco && adduser -S -G goyco goyco \
   && apk add --no-cache ca-certificates tzdata
 WORKDIR /app

README.md

@@ -354,44 +354,6 @@ It will start the application in development mode. You can also run it as a daem
 
 Then, use `./bin/goyco` to manage the application and notably to seed the database with sample data.
 
-### Project Structure
-
-```bash
-goyco/
-├── bin/ # Compiled binaries (created after build)
-├── cmd/
-│ └── goyco/ # Main CLI application entrypoint
-├── docker/ # Docker Compose & related files
-├── docs/ # Documentation and API specs
-├── internal/
-│ ├── config/ # Configuration management
-│ ├── database/ # Database models and access
-│ ├── dto/ # Data Transfer Objects (DTOs)
-│ ├── e2e/ # End-to-end tests
-│ ├── fuzz/ # Fuzz tests
-│ ├── handlers/ # HTTP handlers
-│ ├── integration/ # Integration tests
-│ ├── middleware/ # HTTP middleware
-│ ├── repositories/ # Data access layer
-│ ├── security/ # Security and auth logic
-│ ├── server/ # HTTP server implementation
-│ ├── services/ # Business logic
-│ ├── static/ # Static web assets
-│ ├── templates/ # HTML templates
-│ ├── testutils/ # Test helpers/utilities
-│ ├── validation/ # Input validation
-│ └── version/ # Version information
-├── scripts/ # Utility/maintenance scripts
-├── services/
-│ └── goyco.service # Systemd service unit example
-├── .env.example # Environment variable example
-├── AUTHORS # Authors file
-├── Dockerfile # Docker build file
-├── LICENSE # License file
-├── Makefile # Project build/test targets
-└── README.md # This file
-```
-
 ### Testing
 
 ```bash
@@ -437,25 +399,10 @@ This will regenerate the swagger documentation and update the `docs/swagger.json
 - [ ] add right management within the app
 - [ ] add an admin backoffice to manage rights, users, content and settings
 - [ ] add a way to run read-only communities
-- [ ] maybe use a css framework instead of raw css
+- [ ] migrate raw CSS to UnoCSS
 - [ ] kubernetes deployment
 - [ ] store configuration in the database
 
-## Contributing
-
-Feedbacks are welcome!
-
-But as it's a personal gitea and you cannot create accounts, feel free to contact me at <sandro@cazzaniga.fr> to get one.
-
-Once you have it, follow the usual workflow:
-
-1. Fork the repository
-2. Create a feature branch
-3. Make your changes
-4. Add tests for new functionality
-5. Ensure all tests pass
-6. Submit a pull request
-
 ## License
 
 This project is licensed under the GNU General Public License v3.0 or later (GPLv3+). See the [LICENSE](LICENSE) file for details.

cmd/goyco/commands/common.go

@@ -8,9 +8,10 @@ import (
 	"os"
 	"sync"
 
-	"gorm.io/gorm"
 	"goyco/internal/config"
 	"goyco/internal/database"
+
+	"gorm.io/gorm"
 )
 
 var ErrHelpRequested = errors.New("help requested")
@@ -118,26 +119,6 @@ func outputJSON(v interface{}) error {
 	return encoder.Encode(v)
 }
 
-func outputMessage(message string, args ...interface{}) {
-	if IsJSONOutput() {
-		outputJSON(map[string]interface{}{
-			"message": fmt.Sprintf(message, args...),
-		})
-	} else {
-		fmt.Printf(message+"\n", args...)
-	}
-}
-
-func outputError(message string, args ...interface{}) {
-	if IsJSONOutput() {
-		outputJSON(map[string]interface{}{
-			"error": fmt.Sprintf(message, args...),
-		})
-	} else {
-		fmt.Fprintf(os.Stderr, message+"\n", args...)
-	}
-}
-
 func outputWarning(message string, args ...interface{}) {
 	if IsJSONOutput() {
 		outputJSON(map[string]interface{}{

cmd/goyco/commands/migrate.go

@@ -5,9 +5,10 @@ import (
 	"fmt"
 	"os"
 
-	"gorm.io/gorm"
 	"goyco/internal/config"
 	"goyco/internal/database"
+
+	"gorm.io/gorm"
 )
 
 func HandleMigrateCommand(cfg *config.Config, name string, args []string) error {
@@ -37,7 +38,7 @@ func runMigrateCommand(db *gorm.DB) error {
 		return fmt.Errorf("run migrations: %w", err)
 	}
 	if IsJSONOutput() {
-		outputJSON(map[string]interface{}{
+		outputJSON(map[string]any{
 			"action": "migrations_applied",
 			"status": "success",
 		})

cmd/goyco/commands/parallel_processor.go

@@ -261,6 +261,7 @@ func processItemsInParallelNoResult[T any](
 ) error {
 	count := len(items)
 	errors := make(chan error, count)
+	completions := make(chan struct{}, count)
 
 	semaphore := make(chan struct{}, maxWorkers)
 	var wg sync.WaitGroup
@@ -288,20 +289,45 @@ func processItemsInParallelNoResult[T any](
 				return
 			}
 
-			if progress != nil {
-				progress.Update(index + 1)
-			}
+			completions <- struct{}{}
 		}(i, item)
 	}
 
 	go func() {
 		wg.Wait()
 		close(errors)
+		close(completions)
 	}()
 
-	for err := range errors {
-		if err != nil {
+	completed := 0
+	firstError := make(chan error, 1)
+
+	go func() {
+		for err := range errors {
+			if err != nil {
+				select {
+				case firstError <- err:
+				default:
+				}
+				return
+			}
+		}
+	}()
+
+	for completed < count {
+		select {
+		case _, ok := <-completions:
+			if !ok {
+				return nil
+			}
+			completed++
+			if progress != nil {
+				progress.Update(completed)
+			}
+		case err := <-firstError:
 			return err
+		case <-ctx.Done():
+			return fmt.Errorf("timeout: %w", ctx.Err())
 		}
 	}
 

cmd/goyco/commands/parallel_processor_test.go

@@ -2,15 +2,15 @@ package commands_test
 
 import (
 	"errors"
-	"fmt"
 	"sync"
 	"testing"
 
-	"golang.org/x/crypto/bcrypt"
 	"goyco/cmd/goyco/commands"
 	"goyco/internal/database"
 	"goyco/internal/repositories"
 	"goyco/internal/testutils"
+
+	"golang.org/x/crypto/bcrypt"
 )
 
 func TestParallelProcessor_CreateUsersInParallel(t *testing.T) {
@@ -25,7 +25,7 @@ func TestParallelProcessor_CreateUsersInParallel(t *testing.T) {
 		wantErr     bool
 	}{
 		{
-			name:  "creates users with deterministic fields",
+			name:  "creates users with required fields",
 			count: successCount,
 			repoFactory: func() repositories.UserRepository {
 				base := testutils.NewMockUserRepository()
@@ -37,14 +37,24 @@ func TestParallelProcessor_CreateUsersInParallel(t *testing.T) {
 				if len(got) != successCount {
 					t.Fatalf("expected %d users, got %d", successCount, len(got))
 				}
+				usernames := make(map[string]bool)
 				for i, user := range got {
-					expectedUsername := fmt.Sprintf("user_%d", i+1)
-					expectedEmail := fmt.Sprintf("user_%d@goyco.local", i+1)
-					if user.Username != expectedUsername {
-						t.Errorf("user %d username mismatch: got %q want %q", i, user.Username, expectedUsername)
+					if user.Username == "" {
+						t.Errorf("user %d expected non-empty username", i)
 					}
-					if user.Email != expectedEmail {
-						t.Errorf("user %d email mismatch: got %q want %q", i, user.Email, expectedEmail)
+					if len(user.Username) < 6 || user.Username[:5] != "user_" {
+						t.Errorf("user %d username should start with 'user_', got %q", i, user.Username)
+					}
+					if usernames[user.Username] {
+						t.Errorf("user %d duplicate username: %q", i, user.Username)
+					}
+					usernames[user.Username] = true
+
+					if user.Email == "" {
+						t.Errorf("user %d expected non-empty email", i)
+					}
+					if len(user.Email) < 20 || user.Email[:5] != "user_" || user.Email[len(user.Email)-12:] != "@goyco.local" {
+						t.Errorf("user %d email should match pattern 'user_*@goyco.local', got %q", i, user.Email)
 					}
 					if !user.EmailVerified {
 						t.Errorf("user %d expected EmailVerified to be true", i)
@@ -83,6 +93,11 @@ func TestParallelProcessor_CreateUsersInParallel(t *testing.T) {
 			t.Parallel()
 			repo := tt.repoFactory()
 			p := commands.NewParallelProcessor()
+			passwordHash, err := bcrypt.GenerateFromPassword([]byte("password123"), bcrypt.DefaultCost)
+			if err != nil {
+				t.Fatalf("failed to generate password hash: %v", err)
+			}
+			p.SetPasswordHash(string(passwordHash))
 			got, gotErr := p.CreateUsersInParallel(repo, tt.count, tt.progress)
 			if gotErr != nil {
 				if !tt.wantErr {

cmd/goyco/commands/seed.go

@@ -35,17 +35,6 @@ func initSeedRand() {
 	})
 }
 
-func generateRandomIdentifier() string {
-	initSeedRand()
-	const length = 12
-	const chars = "abcdefghijklmnopqrstuvwxyz0123456789"
-	identifier := make([]byte, length)
-	for i := range identifier {
-		identifier[i] = chars[seedRandSource.Intn(len(chars))]
-	}
-	return string(identifier)
-}
-
 func HandleSeedCommand(cfg *config.Config, name string, args []string) error {
 	fs := newFlagSet(name, printSeedUsage)
 	if err := parseCommand(fs, args, name); err != nil {
@@ -213,7 +202,7 @@ func seedDatabase(userRepo repositories.UserRepository, postRepo repositories.Po
 		progress.Complete()
 	}
 
-	if err := validateSeedConsistency(postRepo, voteRepo, allUsers, posts); err != nil {
+	if err := validateSeedConsistency(voteRepo, allUsers, posts); err != nil {
 		return fmt.Errorf("seed consistency validation failed: %w", err)
 	}
 
@@ -236,76 +225,93 @@ func seedDatabase(userRepo repositories.UserRepository, postRepo repositories.Po
 	return nil
 }
 
-func findExistingSeedUser(userRepo repositories.UserRepository) (*database.User, error) {
-	user, err := userRepo.GetByUsernamePrefix("seed_admin_")
-	if err != nil {
-		return nil, fmt.Errorf("no existing seed user found")
-	}
-	return user, nil
-}
+const (
+	seedUsername = "seed_admin"
+	seedEmail    = "seed_admin@goyco.local"
+)
 
 func ensureSeedUser(userRepo repositories.UserRepository, passwordHash string) (*database.User, error) {
-	existingUser, err := findExistingSeedUser(userRepo)
-	if err == nil && existingUser != nil {
-		return existingUser, nil
-	}
-
-	randomID := generateRandomIdentifier()
-	seedUsername := fmt.Sprintf("seed_admin_%s", randomID)
-	seedEmail := fmt.Sprintf("seed_admin_%s@goyco.local", randomID)
-
-	const maxRetries = 10
-	for range maxRetries {
-		user := &database.User{
-			Username:      seedUsername,
-			Email:         seedEmail,
-			Password:      passwordHash,
-			EmailVerified: true,
-		}
-
-		if err := userRepo.Create(user); err != nil {
-			randomID = generateRandomIdentifier()
-			seedUsername = fmt.Sprintf("seed_admin_%s", randomID)
-			seedEmail = fmt.Sprintf("seed_admin_%s@goyco.local", randomID)
-			continue
-		}
-
+	if user, err := userRepo.GetByUsername(seedUsername); err == nil {
 		return user, nil
 	}
 
-	return nil, fmt.Errorf("failed to create seed user after %d attempts", maxRetries)
+	user := &database.User{
+		Username:      seedUsername,
+		Email:         seedEmail,
+		Password:      passwordHash,
+		EmailVerified: true,
+	}
+
+	if err := userRepo.Create(user); err != nil {
+		return nil, fmt.Errorf("failed to create seed user: %w", err)
+	}
+
+	return user, nil
 }
 
 func getVoteCounts(voteRepo repositories.VoteRepository, postID uint) (int, int, error) {
 	return voteRepo.GetVoteCountsByPostID(postID)
 }
 
-func validateSeedConsistency(postRepo repositories.PostRepository, voteRepo repositories.VoteRepository, users []database.User, posts []database.Post) error {
-	userIDs := make(map[uint]bool)
+func validateSeedConsistency(voteRepo repositories.VoteRepository, users []database.User, posts []database.Post) error {
+	userIDSet := make(map[uint]struct{}, len(users))
 	for _, user := range users {
-		userIDs[user.ID] = true
+		userIDSet[user.ID] = struct{}{}
+	}
+
+	postIDSet := make(map[uint]struct{}, len(posts))
+	for _, post := range posts {
+		postIDSet[post.ID] = struct{}{}
 	}
 
 	for _, post := range posts {
-		if post.AuthorID == nil {
-			return fmt.Errorf("post %d has no author", post.ID)
-		}
-		if !userIDs[*post.AuthorID] {
-			return fmt.Errorf("post %d has invalid author ID %d", post.ID, *post.AuthorID)
+		if err := validatePost(post, userIDSet); err != nil {
+			return err
 		}
 
 		votes, err := voteRepo.GetByPostID(post.ID)
 		if err != nil {
-			return fmt.Errorf("get votes for post %d: %w", post.ID, err)
+			return fmt.Errorf("failed to retrieve votes for post %d: %w", post.ID, err)
 		}
 
-		for _, vote := range votes {
-			if vote.UserID != nil && !userIDs[*vote.UserID] {
-				return fmt.Errorf("vote %d has invalid user ID %d", vote.ID, *vote.UserID)
-			}
-			if vote.PostID != post.ID {
-				return fmt.Errorf("vote %d has invalid post ID %d (expected %d)", vote.ID, vote.PostID, post.ID)
-			}
+		if err := validateVotesForPost(post.ID, votes, userIDSet, postIDSet); err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
+
+func validatePost(post database.Post, userIDSet map[uint]struct{}) error {
+	if post.AuthorID == nil {
+		return fmt.Errorf("post %d has no author ID", post.ID)
+	}
+
+	if _, exists := userIDSet[*post.AuthorID]; !exists {
+		return fmt.Errorf("post %d references non-existent author ID %d", post.ID, *post.AuthorID)
+	}
+
+	return nil
+}
+
+func validateVotesForPost(postID uint, votes []database.Vote, userIDSet map[uint]struct{}, postIDSet map[uint]struct{}) error {
+	for _, vote := range votes {
+		if vote.PostID != postID {
+			return fmt.Errorf("vote %d references post ID %d but was retrieved for post %d", vote.ID, vote.PostID, postID)
+		}
+
+		if _, exists := postIDSet[vote.PostID]; !exists {
+			return fmt.Errorf("vote %d references non-existent post ID %d", vote.ID, vote.PostID)
+		}
+
+		if vote.UserID != nil {
+			if _, exists := userIDSet[*vote.UserID]; !exists {
+				return fmt.Errorf("vote %d references non-existent user ID %d", vote.ID, *vote.UserID)
+			}
+		}
+
+		if vote.Type != database.VoteUp && vote.Type != database.VoteDown {
+			return fmt.Errorf("vote %d has invalid type %q", vote.ID, vote.Type)
 		}
 	}
 

cmd/goyco/commands/seed_test.go

@@ -47,7 +47,7 @@ func TestSeedCommand(t *testing.T) {
 	var seedUser *database.User
 	regularUserCount := 0
 	for i := range users {
-		if strings.HasPrefix(users[i].Username, "seed_admin_") {
+		if users[i].Username == "seed_admin" {
 			seedUserCount++
 			seedUser = &users[i]
 		} else if strings.HasPrefix(users[i].Username, "user_") {
@@ -63,12 +63,12 @@ func TestSeedCommand(t *testing.T) {
 		t.Fatal("Expected seed user to be created")
 	}
 
-	if !strings.HasPrefix(seedUser.Username, "seed_admin_") {
-		t.Errorf("Expected username to start with 'seed_admin_', got '%s'", seedUser.Username)
+	if seedUser.Username != "seed_admin" {
+		t.Errorf("Expected username to be 'seed_admin', got '%s'", seedUser.Username)
 	}
 
-	if !strings.HasPrefix(seedUser.Email, "seed_admin_") || !strings.HasSuffix(seedUser.Email, "@goyco.local") {
-		t.Errorf("Expected email to start with 'seed_admin_' and end with '@goyco.local', got '%s'", seedUser.Email)
+	if seedUser.Email != "seed_admin@goyco.local" {
+		t.Errorf("Expected email to be 'seed_admin@goyco.local', got '%s'", seedUser.Email)
 	}
 
 	if !seedUser.EmailVerified {
@@ -302,13 +302,13 @@ func TestSeedCommandIdempotency(t *testing.T) {
 
 		seedUserCount := 0
 		for _, user := range users {
-			if strings.HasPrefix(user.Username, "seed_admin_") {
+			if user.Username == "seed_admin" {
 				seedUserCount++
 			}
 		}
 
-		if seedUserCount < 1 {
-			t.Errorf("Expected at least 1 seed user, got %d", seedUserCount)
+		if seedUserCount != 1 {
+			t.Errorf("Expected exactly 1 seed user, got %d", seedUserCount)
 		}
 	})
 
@@ -387,7 +387,7 @@ func TestSeedCommandIdempotency(t *testing.T) {
 
 func findSeedUser(users []database.User) *database.User {
 	for i := range users {
-		if strings.HasPrefix(users[i].Username, "seed_admin_") {
+		if users[i].Username == "seed_admin" {
 			return &users[i]
 		}
 	}
@@ -476,3 +476,58 @@ func TestSeedCommandTransactionRollback(t *testing.T) {
 		}
 	})
 }
+
+func TestEnsureSeedUser(t *testing.T) {
+	db, err := gorm.Open(sqlite.Open(":memory:"), &gorm.Config{})
+	if err != nil {
+		t.Fatalf("Failed to connect to database: %v", err)
+	}
+
+	if err := db.AutoMigrate(&database.User{}); err != nil {
+		t.Fatalf("Failed to migrate database: %v", err)
+	}
+
+	userRepo := repositories.NewUserRepository(db)
+	passwordHash := "test_password_hash"
+
+	firstUser, err := ensureSeedUser(userRepo, passwordHash)
+	if err != nil {
+		t.Fatalf("Failed to create seed user: %v", err)
+	}
+
+	if firstUser.Username != "seed_admin" || firstUser.Email != "seed_admin@goyco.local" || firstUser.Password != passwordHash || !firstUser.EmailVerified {
+		t.Errorf("Invalid seed user: username=%s, email=%s, password matches=%v, emailVerified=%v",
+			firstUser.Username, firstUser.Email, firstUser.Password == passwordHash, firstUser.EmailVerified)
+	}
+
+	secondUser, err := ensureSeedUser(userRepo, "different_password_hash")
+	if err != nil {
+		t.Fatalf("Failed to reuse seed user: %v", err)
+	}
+
+	if firstUser.ID != secondUser.ID {
+		t.Errorf("Expected same user to be reused (ID %d), got different user (ID %d)", firstUser.ID, secondUser.ID)
+	}
+
+	for i := 0; i < 3; i++ {
+		if _, err := ensureSeedUser(userRepo, passwordHash); err != nil {
+			t.Fatalf("Call %d failed: %v", i+1, err)
+		}
+	}
+
+	users, err := userRepo.GetAll(100, 0)
+	if err != nil {
+		t.Fatalf("Failed to get users: %v", err)
+	}
+
+	seedUserCount := 0
+	for _, user := range users {
+		if user.Username == "seed_admin" {
+			seedUserCount++
+		}
+	}
+
+	if seedUserCount != 1 {
+		t.Errorf("Expected exactly 1 seed user, got %d", seedUserCount)
+	}
+}

internal/integration/caching_integration_test.go

@@ -53,25 +53,25 @@ func TestIntegration_Caching(t *testing.T) {
 	router := ctx.Router
 
 	t.Run("Cache_Hit_On_Repeated_Requests", func(t *testing.T) {
-		req1 := httptest.NewRequest("GET", "/api/posts", nil)
-		rec1 := httptest.NewRecorder()
-		router.ServeHTTP(rec1, req1)
+		firstRequest := httptest.NewRequest("GET", "/api/posts", nil)
+		firstRecorder := httptest.NewRecorder()
+		router.ServeHTTP(firstRecorder, firstRequest)
 
 		time.Sleep(10 * time.Millisecond)
 
-		req2 := httptest.NewRequest("GET", "/api/posts", nil)
-		rec2 := httptest.NewRecorder()
-		router.ServeHTTP(rec2, req2)
+		secondRequest := httptest.NewRequest("GET", "/api/posts", nil)
+		secondRecorder := httptest.NewRecorder()
+		router.ServeHTTP(secondRecorder, secondRequest)
 
-		if rec1.Code != rec2.Code {
+		if firstRecorder.Code != secondRecorder.Code {
 			t.Error("Cached responses should have same status code")
 		}
 
-		if rec1.Body.String() != rec2.Body.String() {
+		if firstRecorder.Body.String() != secondRecorder.Body.String() {
 			t.Error("Cached responses should have same body")
 		}
 
-		if rec2.Header().Get("X-Cache") != "HIT" {
+		if secondRecorder.Header().Get("X-Cache") != "HIT" {
 			t.Log("Cache may not be enabled for this path or response may not be cacheable")
 		}
 	})
@@ -80,9 +80,9 @@ func TestIntegration_Caching(t *testing.T) {
 		ctx.Suite.EmailSender.Reset()
 		user := createUserWithCleanup(t, ctx, "cache_post_user", "cache_post@example.com")
 
-		req1 := httptest.NewRequest("GET", "/api/posts", nil)
-		rec1 := httptest.NewRecorder()
-		router.ServeHTTP(rec1, req1)
+		firstRequest := httptest.NewRequest("GET", "/api/posts", nil)
+		firstRecorder := httptest.NewRecorder()
+		router.ServeHTTP(firstRecorder, firstRequest)
 
 		time.Sleep(10 * time.Millisecond)
 
@@ -92,12 +92,12 @@ func TestIntegration_Caching(t *testing.T) {
 			"content": "Test content",
 		}
 		body, _ := json.Marshal(postBody)
-		req2 := httptest.NewRequest("POST", "/api/posts", bytes.NewBuffer(body))
-		req2.Header.Set("Content-Type", "application/json")
-		req2.Header.Set("Authorization", "Bearer "+user.Token)
-		req2 = testutils.WithUserContext(req2, middleware.UserIDKey, user.User.ID)
-		rec2 := httptest.NewRecorder()
-		router.ServeHTTP(rec2, req2)
+		secondRequest := httptest.NewRequest("POST", "/api/posts", bytes.NewBuffer(body))
+		secondRequest.Header.Set("Content-Type", "application/json")
+		secondRequest.Header.Set("Authorization", "Bearer "+user.Token)
+		secondRequest = testutils.WithUserContext(secondRequest, middleware.UserIDKey, user.User.ID)
+		secondRecorder := httptest.NewRecorder()
+		router.ServeHTTP(secondRecorder, secondRequest)
 
 		time.Sleep(10 * time.Millisecond)
 
@@ -105,17 +105,17 @@ func TestIntegration_Caching(t *testing.T) {
 		rec3 := httptest.NewRecorder()
 		router.ServeHTTP(rec3, req3)
 
-		if rec1.Body.String() == rec3.Body.String() && rec1.Code == http.StatusOK && rec3.Code == http.StatusOK {
+		if firstRecorder.Body.String() == rec3.Body.String() && firstRecorder.Code == http.StatusOK && rec3.Code == http.StatusOK {
 			t.Log("Cache invalidation may not be working or cache may not be enabled")
 		}
 	})
 
 	t.Run("Cache_Headers_Present", func(t *testing.T) {
-		req := httptest.NewRequest("GET", "/api/posts", nil)
-		rec := httptest.NewRecorder()
-		router.ServeHTTP(rec, req)
+		request := httptest.NewRequest("GET", "/api/posts", nil)
+		recorder := httptest.NewRecorder()
+		router.ServeHTTP(recorder, request)
 
-		if rec.Header().Get("Cache-Control") == "" && rec.Header().Get("X-Cache") == "" {
+		if recorder.Header().Get("Cache-Control") == "" && recorder.Header().Get("X-Cache") == "" {
 			t.Log("Cache headers may not be present for all responses")
 		}
 	})
@@ -126,18 +126,18 @@ func TestIntegration_Caching(t *testing.T) {
 
 		post := testutils.CreatePostWithRepo(t, ctx.Suite.PostRepo, user.User.ID, "Cache Delete Post", "https://example.com/cache-delete")
 
-		req1 := httptest.NewRequest("GET", "/api/posts", nil)
-		rec1 := httptest.NewRecorder()
-		router.ServeHTTP(rec1, req1)
+		firstRequest := httptest.NewRequest("GET", "/api/posts", nil)
+		firstRecorder := httptest.NewRecorder()
+		router.ServeHTTP(firstRecorder, firstRequest)
 
 		time.Sleep(10 * time.Millisecond)
 
-		req2 := httptest.NewRequest("DELETE", "/api/posts/"+fmt.Sprintf("%d", post.ID), nil)
-		req2.Header.Set("Authorization", "Bearer "+user.Token)
-		req2 = testutils.WithUserContext(req2, middleware.UserIDKey, user.User.ID)
-		req2 = testutils.WithURLParams(req2, map[string]string{"id": fmt.Sprintf("%d", post.ID)})
-		rec2 := httptest.NewRecorder()
-		router.ServeHTTP(rec2, req2)
+		secondRequest := httptest.NewRequest("DELETE", "/api/posts/"+fmt.Sprintf("%d", post.ID), nil)
+		secondRequest.Header.Set("Authorization", "Bearer "+user.Token)
+		secondRequest = testutils.WithUserContext(secondRequest, middleware.UserIDKey, user.User.ID)
+		secondRequest = testutils.WithURLParams(secondRequest, map[string]string{"id": fmt.Sprintf("%d", post.ID)})
+		secondRecorder := httptest.NewRecorder()
+		router.ServeHTTP(secondRecorder, secondRequest)
 
 		time.Sleep(10 * time.Millisecond)
 
@@ -145,7 +145,7 @@ func TestIntegration_Caching(t *testing.T) {
 		rec3 := httptest.NewRecorder()
 		router.ServeHTTP(rec3, req3)
 
-		if rec1.Body.String() == rec3.Body.String() && rec1.Code == http.StatusOK && rec3.Code == http.StatusOK {
+		if firstRecorder.Body.String() == rec3.Body.String() && firstRecorder.Code == http.StatusOK && rec3.Code == http.StatusOK {
 			t.Log("Cache invalidation may not be working or cache may not be enabled")
 		}
 	})

internal/integration/complete_api_endpoints_integration_test.go

@@ -1,15 +1,14 @@
 package integration
 
 import (
-	"bytes"
-	"encoding/json"
 	"fmt"
 	"net/http"
-	"net/http/httptest"
 	"net/url"
+	"strings"
 	"testing"
+	"time"
 
-	"goyco/internal/middleware"
+	"goyco/internal/services"
 	"goyco/internal/testutils"
 )
 
@@ -20,17 +19,8 @@ func TestIntegration_CompleteAPIEndpoints(t *testing.T) {
 		ctx.Suite.EmailSender.Reset()
 		user := createAuthenticatedUser(t, ctx.AuthService, ctx.Suite.UserRepo, "logout_user", "logout@example.com")
 
-		reqBody := map[string]string{}
-		body, _ := json.Marshal(reqBody)
-		req := httptest.NewRequest("POST", "/api/auth/logout", bytes.NewBuffer(body))
-		req.Header.Set("Content-Type", "application/json")
-		req.Header.Set("Authorization", "Bearer "+user.Token)
-		req = testutils.WithUserContext(req, middleware.UserIDKey, user.User.ID)
-		rec := httptest.NewRecorder()
-
-		ctx.Router.ServeHTTP(rec, req)
-
-		assertStatus(t, rec, http.StatusOK)
+		request := makePostRequest(t, ctx.Router, "/api/auth/logout", map[string]any{}, user, nil)
+		assertStatus(t, request, http.StatusOK)
 	})
 
 	t.Run("Auth_Revoke_Token_Endpoint", func(t *testing.T) {
@@ -42,52 +32,23 @@ func TestIntegration_CompleteAPIEndpoints(t *testing.T) {
 			t.Fatalf("Failed to login: %v", err)
 		}
 
-		reqBody := map[string]string{
-			"refresh_token": loginResult.RefreshToken,
-		}
-		body, _ := json.Marshal(reqBody)
-		req := httptest.NewRequest("POST", "/api/auth/revoke", bytes.NewBuffer(body))
-		req.Header.Set("Content-Type", "application/json")
-		req.Header.Set("Authorization", "Bearer "+user.Token)
-		req = testutils.WithUserContext(req, middleware.UserIDKey, user.User.ID)
-		rec := httptest.NewRecorder()
-
-		ctx.Router.ServeHTTP(rec, req)
-
-		assertStatus(t, rec, http.StatusOK)
+		request := makePostRequest(t, ctx.Router, "/api/auth/revoke", map[string]any{"refresh_token": loginResult.RefreshToken}, user, nil)
+		assertStatus(t, request, http.StatusOK)
 	})
 
 	t.Run("Auth_Revoke_All_Tokens_Endpoint", func(t *testing.T) {
 		ctx.Suite.EmailSender.Reset()
 		user := createAuthenticatedUser(t, ctx.AuthService, ctx.Suite.UserRepo, "revoke_all_user", "revoke_all@example.com")
 
-		reqBody := map[string]string{}
-		body, _ := json.Marshal(reqBody)
-		req := httptest.NewRequest("POST", "/api/auth/revoke-all", bytes.NewBuffer(body))
-		req.Header.Set("Content-Type", "application/json")
-		req.Header.Set("Authorization", "Bearer "+user.Token)
-		req = testutils.WithUserContext(req, middleware.UserIDKey, user.User.ID)
-		rec := httptest.NewRecorder()
-
-		ctx.Router.ServeHTTP(rec, req)
-
-		assertStatus(t, rec, http.StatusOK)
+		request := makePostRequest(t, ctx.Router, "/api/auth/revoke-all", map[string]any{}, user, nil)
+		assertStatus(t, request, http.StatusOK)
 	})
 
 	t.Run("Auth_Resend_Verification_Endpoint", func(t *testing.T) {
 		ctx.Suite.EmailSender.Reset()
 
-		reqBody := map[string]string{
-			"email": "resend@example.com",
-		}
-		body, _ := json.Marshal(reqBody)
-		req := httptest.NewRequest("POST", "/api/auth/resend-verification", bytes.NewBuffer(body))
-		req.Header.Set("Content-Type", "application/json")
-		rec := httptest.NewRecorder()
-
-		ctx.Router.ServeHTTP(rec, req)
-
-		assertStatusRange(t, rec, http.StatusOK, http.StatusNotFound)
+		request := makePostRequestWithJSON(t, ctx.Router, "/api/auth/resend-verification", map[string]any{"email": "resend@example.com"})
+		assertStatusRange(t, request, http.StatusOK, http.StatusNotFound)
 	})
 
 	t.Run("Auth_Confirm_Email_Endpoint", func(t *testing.T) {
@@ -99,36 +60,20 @@ func TestIntegration_CompleteAPIEndpoints(t *testing.T) {
 			token = "test-token"
 		}
 
-		req := httptest.NewRequest("GET", "/api/auth/confirm?token="+url.QueryEscape(token), nil)
-		rec := httptest.NewRecorder()
-
-		ctx.Router.ServeHTTP(rec, req)
-
-		assertStatusRange(t, rec, http.StatusOK, http.StatusBadRequest)
+		request := makeGetRequest(t, ctx.Router, "/api/auth/confirm?token="+url.QueryEscape(token))
+		assertStatusRange(t, request, http.StatusOK, http.StatusBadRequest)
 	})
 
 	t.Run("Auth_Update_Email_Endpoint", func(t *testing.T) {
 		ctx.Suite.EmailSender.Reset()
 		user := createAuthenticatedUser(t, ctx.AuthService, ctx.Suite.UserRepo, "update_email_api_user", "update_email_api@example.com")
 
-		reqBody := map[string]string{
-			"email": "newemail@example.com",
-		}
-		body, _ := json.Marshal(reqBody)
-		req := httptest.NewRequest("PUT", "/api/auth/email", bytes.NewBuffer(body))
-		req.Header.Set("Content-Type", "application/json")
-		req.Header.Set("Authorization", "Bearer "+user.Token)
-		req = testutils.WithUserContext(req, middleware.UserIDKey, user.User.ID)
-		rec := httptest.NewRecorder()
+		request := makePutRequest(t, ctx.Router, "/api/auth/email", map[string]any{"email": "newemail@example.com"}, user, nil)
 
-		ctx.Router.ServeHTTP(rec, req)
-
-		response := assertJSONResponse(t, rec, http.StatusOK)
-		if response != nil {
-			if data, ok := response["data"].(map[string]any); ok {
-				if email, ok := data["email"].(string); ok && email != "newemail@example.com" {
-					t.Errorf("Expected email to be updated, got %s", email)
-				}
+		response := assertJSONResponse(t, request, http.StatusOK)
+		if data, ok := getDataFromResponse(response); ok {
+			if email, ok := data["email"].(string); ok && email != "newemail@example.com" {
+				t.Errorf("Expected email to be updated, got %s", email)
 			}
 		}
 	})
@@ -137,24 +82,12 @@ func TestIntegration_CompleteAPIEndpoints(t *testing.T) {
 		ctx.Suite.EmailSender.Reset()
 		user := createAuthenticatedUser(t, ctx.AuthService, ctx.Suite.UserRepo, "update_username_api_user", "update_username_api@example.com")
 
-		reqBody := map[string]string{
-			"username": "new_username",
-		}
-		body, _ := json.Marshal(reqBody)
-		req := httptest.NewRequest("PUT", "/api/auth/username", bytes.NewBuffer(body))
-		req.Header.Set("Content-Type", "application/json")
-		req.Header.Set("Authorization", "Bearer "+user.Token)
-		req = testutils.WithUserContext(req, middleware.UserIDKey, user.User.ID)
-		rec := httptest.NewRecorder()
+		request := makePutRequest(t, ctx.Router, "/api/auth/username", map[string]any{"username": "new_username"}, user, nil)
 
-		ctx.Router.ServeHTTP(rec, req)
-
-		response := assertJSONResponse(t, rec, http.StatusOK)
-		if response != nil {
-			if data, ok := response["data"].(map[string]any); ok {
-				if username, ok := data["username"].(string); ok && username != "new_username" {
-					t.Errorf("Expected username to be updated, got %s", username)
-				}
+		response := assertJSONResponse(t, request, http.StatusOK)
+		if data, ok := getDataFromResponse(response); ok {
+			if username, ok := data["username"].(string); ok && username != "new_username" {
+				t.Errorf("Expected username to be updated, got %s", username)
 			}
 		}
 	})
@@ -163,19 +96,12 @@ func TestIntegration_CompleteAPIEndpoints(t *testing.T) {
 		ctx.Suite.EmailSender.Reset()
 		user := createAuthenticatedUser(t, ctx.AuthService, ctx.Suite.UserRepo, "users_list_user", "users_list@example.com")
 
-		req := httptest.NewRequest("GET", "/api/users", nil)
-		req.Header.Set("Authorization", "Bearer "+user.Token)
-		req = testutils.WithUserContext(req, middleware.UserIDKey, user.User.ID)
-		rec := httptest.NewRecorder()
+		request := makeAuthenticatedGetRequest(t, ctx.Router, "/api/users", user, nil)
 
-		ctx.Router.ServeHTTP(rec, req)
-
-		response := assertJSONResponse(t, rec, http.StatusOK)
-		if response != nil {
-			if data, ok := response["data"].(map[string]any); ok {
-				if _, exists := data["users"]; !exists {
-					t.Error("Expected users in response")
-				}
+		response := assertJSONResponse(t, request, http.StatusOK)
+		if data, ok := getDataFromResponse(response); ok {
+			if _, exists := data["users"]; !exists {
+				t.Error("Expected users in response")
 			}
 		}
 	})
@@ -184,21 +110,13 @@ func TestIntegration_CompleteAPIEndpoints(t *testing.T) {
 		ctx.Suite.EmailSender.Reset()
 		user := createAuthenticatedUser(t, ctx.AuthService, ctx.Suite.UserRepo, "users_get_user", "users_get@example.com")
 
-		req := httptest.NewRequest("GET", fmt.Sprintf("/api/users/%d", user.User.ID), nil)
-		req.Header.Set("Authorization", "Bearer "+user.Token)
-		req = testutils.WithUserContext(req, middleware.UserIDKey, user.User.ID)
-		req = testutils.WithURLParams(req, map[string]string{"id": fmt.Sprintf("%d", user.User.ID)})
-		rec := httptest.NewRecorder()
+		request := makeAuthenticatedGetRequest(t, ctx.Router, fmt.Sprintf("/api/users/%d", user.User.ID), user, map[string]string{"id": fmt.Sprintf("%d", user.User.ID)})
 
-		ctx.Router.ServeHTTP(rec, req)
-
-		response := assertJSONResponse(t, rec, http.StatusOK)
-		if response != nil {
-			if data, ok := response["data"].(map[string]any); ok {
-				if userData, ok := data["user"].(map[string]any); ok {
-					if id, ok := userData["id"].(float64); ok && uint(id) != user.User.ID {
-						t.Errorf("Expected user ID %d, got %.0f", user.User.ID, id)
-					}
+		response := assertJSONResponse(t, request, http.StatusOK)
+		if data, ok := getDataFromResponse(response); ok {
+			if userData, ok := data["user"].(map[string]any); ok {
+				if id, ok := userData["id"].(float64); ok && uint(id) != user.User.ID {
+					t.Errorf("Expected user ID %d, got %.0f", user.User.ID, id)
 				}
 			}
 		}
@@ -210,24 +128,16 @@ func TestIntegration_CompleteAPIEndpoints(t *testing.T) {
 
 		testutils.CreatePostWithRepo(t, ctx.Suite.PostRepo, user.User.ID, "User Posts Test", "https://example.com/user-posts")
 
-		req := httptest.NewRequest("GET", fmt.Sprintf("/api/users/%d/posts", user.User.ID), nil)
-		req.Header.Set("Authorization", "Bearer "+user.Token)
-		req = testutils.WithUserContext(req, middleware.UserIDKey, user.User.ID)
-		req = testutils.WithURLParams(req, map[string]string{"id": fmt.Sprintf("%d", user.User.ID)})
-		rec := httptest.NewRecorder()
+		request := makeAuthenticatedGetRequest(t, ctx.Router, fmt.Sprintf("/api/users/%d/posts", user.User.ID), user, map[string]string{"id": fmt.Sprintf("%d", user.User.ID)})
 
-		ctx.Router.ServeHTTP(rec, req)
-
-		response := assertJSONResponse(t, rec, http.StatusOK)
-		if response != nil {
-			if data, ok := response["data"].(map[string]any); ok {
-				if posts, ok := data["posts"].([]any); ok {
-					if len(posts) == 0 {
-						t.Error("Expected at least one post in response")
-					}
-				} else {
-					t.Error("Expected posts array in response")
+		response := assertJSONResponse(t, request, http.StatusOK)
+		if data, ok := getDataFromResponse(response); ok {
+			if posts, ok := data["posts"].([]any); ok {
+				if len(posts) == 0 {
+					t.Error("Expected at least one post in response")
 				}
+			} else {
+				t.Error("Expected posts array in response")
 			}
 		}
 	})
@@ -236,26 +146,16 @@ func TestIntegration_CompleteAPIEndpoints(t *testing.T) {
 		ctx.Suite.EmailSender.Reset()
 		user := createAuthenticatedUser(t, ctx.AuthService, ctx.Suite.UserRepo, "users_create_admin", "users_create_admin@example.com")
 
-		reqBody := map[string]string{
+		request := makePostRequest(t, ctx.Router, "/api/users", map[string]any{
 			"username": "created_user",
 			"email":    "created@example.com",
 			"password": "SecurePass123!",
-		}
-		body, _ := json.Marshal(reqBody)
-		req := httptest.NewRequest("POST", "/api/users", bytes.NewBuffer(body))
-		req.Header.Set("Content-Type", "application/json")
-		req.Header.Set("Authorization", "Bearer "+user.Token)
-		req = testutils.WithUserContext(req, middleware.UserIDKey, user.User.ID)
-		rec := httptest.NewRecorder()
+		}, user, nil)
 
-		ctx.Router.ServeHTTP(rec, req)
-
-		response := assertJSONResponse(t, rec, http.StatusCreated)
-		if response != nil {
-			if data, ok := response["data"].(map[string]any); ok {
-				if _, exists := data["user"]; !exists {
-					t.Error("Expected user in response")
-				}
+		response := assertJSONResponse(t, request, http.StatusCreated)
+		if data, ok := getDataFromResponse(response); ok {
+			if _, exists := data["user"]; !exists {
+				t.Error("Expected user in response")
 			}
 		}
 	})
@@ -266,27 +166,16 @@ func TestIntegration_CompleteAPIEndpoints(t *testing.T) {
 
 		post := testutils.CreatePostWithRepo(t, ctx.Suite.PostRepo, user.User.ID, "Update Test Post", "https://example.com/update-test")
 
-		reqBody := map[string]string{
+		request := makePutRequest(t, ctx.Router, fmt.Sprintf("/api/posts/%d", post.ID), map[string]any{
 			"title":   "Updated Title",
 			"content": "Updated content",
-		}
-		body, _ := json.Marshal(reqBody)
-		req := httptest.NewRequest("PUT", fmt.Sprintf("/api/posts/%d", post.ID), bytes.NewBuffer(body))
-		req.Header.Set("Content-Type", "application/json")
-		req.Header.Set("Authorization", "Bearer "+user.Token)
-		req = testutils.WithUserContext(req, middleware.UserIDKey, user.User.ID)
-		req = testutils.WithURLParams(req, map[string]string{"id": fmt.Sprintf("%d", post.ID)})
-		rec := httptest.NewRecorder()
+		}, user, map[string]string{"id": fmt.Sprintf("%d", post.ID)})
 
-		ctx.Router.ServeHTTP(rec, req)
-
-		response := assertJSONResponse(t, rec, http.StatusOK)
-		if response != nil {
-			if data, ok := response["data"].(map[string]any); ok {
-				if postData, ok := data["post"].(map[string]any); ok {
-					if title, ok := postData["title"].(string); ok && title != "Updated Title" {
-						t.Errorf("Expected title 'Updated Title', got '%s'", title)
-					}
+		response := assertJSONResponse(t, request, http.StatusOK)
+		if data, ok := getDataFromResponse(response); ok {
+			if postData, ok := data["post"].(map[string]any); ok {
+				if title, ok := postData["title"].(string); ok && title != "Updated Title" {
+					t.Errorf("Expected title 'Updated Title', got '%s'", title)
 				}
 			}
 		}
@@ -298,20 +187,11 @@ func TestIntegration_CompleteAPIEndpoints(t *testing.T) {
 
 		post := testutils.CreatePostWithRepo(t, ctx.Suite.PostRepo, user.User.ID, "Delete Test Post", "https://example.com/delete-test")
 
-		req := httptest.NewRequest("DELETE", fmt.Sprintf("/api/posts/%d", post.ID), nil)
-		req.Header.Set("Authorization", "Bearer "+user.Token)
-		req = testutils.WithUserContext(req, middleware.UserIDKey, user.User.ID)
-		req = testutils.WithURLParams(req, map[string]string{"id": fmt.Sprintf("%d", post.ID)})
-		rec := httptest.NewRecorder()
+		request := makeDeleteRequest(t, ctx.Router, fmt.Sprintf("/api/posts/%d", post.ID), user, map[string]string{"id": fmt.Sprintf("%d", post.ID)})
+		assertStatus(t, request, http.StatusOK)
 
-		ctx.Router.ServeHTTP(rec, req)
-
-		assertStatus(t, rec, http.StatusOK)
-
-		getReq := httptest.NewRequest("GET", fmt.Sprintf("/api/posts/%d", post.ID), nil)
-		getRec := httptest.NewRecorder()
-		ctx.Router.ServeHTTP(getRec, getReq)
-		assertStatus(t, getRec, http.StatusNotFound)
+		getRequest := makeGetRequest(t, ctx.Router, fmt.Sprintf("/api/posts/%d", post.ID))
+		assertStatus(t, getRequest, http.StatusNotFound)
 	})
 
 	t.Run("Votes_Get_All_Endpoint", func(t *testing.T) {
@@ -319,35 +199,17 @@ func TestIntegration_CompleteAPIEndpoints(t *testing.T) {
 		user := createAuthenticatedUser(t, ctx.AuthService, ctx.Suite.UserRepo, "votes_get_all_user", "votes_get_all@example.com")
 
 		post := testutils.CreatePostWithRepo(t, ctx.Suite.PostRepo, user.User.ID, "Votes Test Post", "https://example.com/votes-test")
+		makePostRequest(t, ctx.Router, fmt.Sprintf("/api/posts/%d/vote", post.ID), map[string]any{"type": "up"}, user, map[string]string{"id": fmt.Sprintf("%d", post.ID)})
+		request := makeAuthenticatedGetRequest(t, ctx.Router, fmt.Sprintf("/api/posts/%d/votes", post.ID), user, map[string]string{"id": fmt.Sprintf("%d", post.ID)})
 
-		voteBody := map[string]string{"type": "up"}
-		voteBodyBytes, _ := json.Marshal(voteBody)
-		voteReq := httptest.NewRequest("POST", fmt.Sprintf("/api/posts/%d/vote", post.ID), bytes.NewBuffer(voteBodyBytes))
-		voteReq.Header.Set("Content-Type", "application/json")
-		voteReq.Header.Set("Authorization", "Bearer "+user.Token)
-		voteReq = testutils.WithUserContext(voteReq, middleware.UserIDKey, user.User.ID)
-		voteReq = testutils.WithURLParams(voteReq, map[string]string{"id": fmt.Sprintf("%d", post.ID)})
-		voteRec := httptest.NewRecorder()
-		ctx.Router.ServeHTTP(voteRec, voteReq)
-
-		req := httptest.NewRequest("GET", fmt.Sprintf("/api/posts/%d/votes", post.ID), nil)
-		req.Header.Set("Authorization", "Bearer "+user.Token)
-		req = testutils.WithUserContext(req, middleware.UserIDKey, user.User.ID)
-		req = testutils.WithURLParams(req, map[string]string{"id": fmt.Sprintf("%d", post.ID)})
-		rec := httptest.NewRecorder()
-
-		ctx.Router.ServeHTTP(rec, req)
-
-		response := assertJSONResponse(t, rec, http.StatusOK)
-		if response != nil {
-			if data, ok := response["data"].(map[string]any); ok {
-				if votes, ok := data["votes"].([]any); ok {
-					if len(votes) == 0 {
-						t.Error("Expected at least one vote in response")
-					}
-				} else {
-					t.Error("Expected votes array in response")
+		response := assertJSONResponse(t, request, http.StatusOK)
+		if data, ok := getDataFromResponse(response); ok {
+			if votes, ok := data["votes"].([]any); ok {
+				if len(votes) == 0 {
+					t.Error("Expected at least one vote in response")
 				}
+			} else {
+				t.Error("Expected votes array in response")
 			}
 		}
 	})
@@ -358,49 +220,461 @@ func TestIntegration_CompleteAPIEndpoints(t *testing.T) {
 
 		post := testutils.CreatePostWithRepo(t, ctx.Suite.PostRepo, user.User.ID, "Vote Remove Test", "https://example.com/vote-remove")
 
-		voteBody := map[string]string{"type": "up"}
-		voteBodyBytes, _ := json.Marshal(voteBody)
-		voteReq := httptest.NewRequest("POST", fmt.Sprintf("/api/posts/%d/vote", post.ID), bytes.NewBuffer(voteBodyBytes))
-		voteReq.Header.Set("Content-Type", "application/json")
-		voteReq.Header.Set("Authorization", "Bearer "+user.Token)
-		voteReq = testutils.WithUserContext(voteReq, middleware.UserIDKey, user.User.ID)
-		voteReq = testutils.WithURLParams(voteReq, map[string]string{"id": fmt.Sprintf("%d", post.ID)})
-		voteRec := httptest.NewRecorder()
-		ctx.Router.ServeHTTP(voteRec, voteReq)
+		makePostRequest(t, ctx.Router, fmt.Sprintf("/api/posts/%d/vote", post.ID), map[string]any{"type": "up"}, user, map[string]string{"id": fmt.Sprintf("%d", post.ID)})
 
-		req := httptest.NewRequest("DELETE", fmt.Sprintf("/api/posts/%d/vote", post.ID), nil)
-		req.Header.Set("Authorization", "Bearer "+user.Token)
-		req = testutils.WithUserContext(req, middleware.UserIDKey, user.User.ID)
-		req = testutils.WithURLParams(req, map[string]string{"id": fmt.Sprintf("%d", post.ID)})
-		rec := httptest.NewRecorder()
-
-		ctx.Router.ServeHTTP(rec, req)
-
-		assertStatus(t, rec, http.StatusOK)
+		request := makeDeleteRequest(t, ctx.Router, fmt.Sprintf("/api/posts/%d/vote", post.ID), user, map[string]string{"id": fmt.Sprintf("%d", post.ID)})
+		assertStatus(t, request, http.StatusOK)
 	})
 
 	t.Run("API_Info_Endpoint", func(t *testing.T) {
-		req := httptest.NewRequest("GET", "/api", nil)
-		rec := httptest.NewRecorder()
+		request := makeGetRequest(t, ctx.Router, "/api")
 
-		ctx.Router.ServeHTTP(rec, req)
-
-		response := assertJSONResponse(t, rec, http.StatusOK)
-		if response != nil {
-			if data, ok := response["data"].(map[string]any); ok {
-				if _, exists := data["endpoints"]; !exists {
-					t.Error("Expected endpoints in API info")
-				}
+		response := assertJSONResponse(t, request, http.StatusOK)
+		if data, ok := getDataFromResponse(response); ok {
+			if _, exists := data["endpoints"]; !exists {
+				t.Error("Expected endpoints in API info")
 			}
 		}
 	})
 
 	t.Run("Swagger_Documentation_Endpoint", func(t *testing.T) {
-		req := httptest.NewRequest("GET", "/swagger/index.html", nil)
-		rec := httptest.NewRecorder()
+		request := makeGetRequest(t, ctx.Router, "/swagger/index.html")
+		assertStatusRange(t, request, http.StatusOK, http.StatusNotFound)
+	})
 
-		ctx.Router.ServeHTTP(rec, req)
+	t.Run("Search_Endpoint_Edge_Cases", func(t *testing.T) {
+		ctx.Suite.EmailSender.Reset()
+		user := createAuthenticatedUser(t, ctx.AuthService, ctx.Suite.UserRepo, uniqueTestUsername(t, "search_edge"), uniqueTestEmail(t, "search_edge"))
 
-		assertStatusRange(t, rec, http.StatusOK, http.StatusNotFound)
+		testutils.CreatePostWithRepo(t, ctx.Suite.PostRepo, user.User.ID, "Searchable Post One", "https://example.com/one")
+		testutils.CreatePostWithRepo(t, ctx.Suite.PostRepo, user.User.ID, "Searchable Post Two", "https://example.com/two")
+		testutils.CreatePostWithRepo(t, ctx.Suite.PostRepo, user.User.ID, "Different Content", "https://example.com/three")
+
+		t.Run("Empty_Search_Results", func(t *testing.T) {
+			request := makeGetRequest(t, ctx.Router, "/api/posts/search?q=nonexistentterm12345")
+
+			response := assertJSONResponse(t, request, http.StatusOK)
+			if data, ok := getDataFromResponse(response); ok {
+				if posts, ok := data["posts"].([]any); ok {
+					if len(posts) != 0 {
+						t.Errorf("Expected empty search results, got %d posts", len(posts))
+					}
+				}
+				if count, ok := data["count"].(float64); ok && count != 0 {
+					t.Errorf("Expected count 0, got %.0f", count)
+				}
+			}
+		})
+
+		t.Run("Search_With_Pagination", func(t *testing.T) {
+			request := makeGetRequest(t, ctx.Router, "/api/posts/search?q=Searchable&limit=1&offset=0")
+
+			response := assertJSONResponse(t, request, http.StatusOK)
+			var firstPostID any
+			if data, ok := getDataFromResponse(response); ok {
+				if posts, ok := data["posts"].([]any); ok {
+					if len(posts) > 1 {
+						t.Errorf("Expected at most 1 post with limit=1, got %d", len(posts))
+					}
+					if len(posts) > 0 {
+						if post, ok := posts[0].(map[string]any); ok {
+							firstPostID = post["id"]
+						}
+					}
+				}
+				if limit, ok := data["limit"].(float64); ok && limit != 1 {
+					t.Errorf("Expected limit 1 in response, got %.0f", limit)
+				}
+				if offset, ok := data["offset"].(float64); ok && offset != 0 {
+					t.Errorf("Expected offset 0 in response, got %.0f", offset)
+				}
+			}
+
+			secondRequest := makeGetRequest(t, ctx.Router, "/api/posts/search?q=Searchable&limit=1&offset=1")
+
+			secondResponse := assertJSONResponse(t, secondRequest, http.StatusOK)
+			if data, ok := getDataFromResponse(secondResponse); ok {
+				if posts, ok := data["posts"].([]any); ok {
+					if len(posts) > 1 {
+						t.Errorf("Expected at most 1 post with limit=1 and offset=1, got %d", len(posts))
+					}
+					if len(posts) > 0 && firstPostID != nil {
+						if post, ok := posts[0].(map[string]any); ok {
+							if post["id"] == firstPostID {
+								t.Error("Expected different post with offset=1, got same post as offset=0")
+							}
+						}
+					}
+				}
+			}
+		})
+
+		t.Run("Search_With_Special_Characters", func(t *testing.T) {
+			specialQueries := []string{
+				"Searchable%20Post",
+				"Searchable'Post",
+				"Searchable\"Post",
+				"Searchable;Post",
+				"Searchable--Post",
+			}
+
+			for _, query := range specialQueries {
+				request := makeGetRequest(t, ctx.Router, "/api/posts/search?q="+url.QueryEscape(query))
+				assertStatusRange(t, request, http.StatusOK, http.StatusBadRequest)
+			}
+		})
+
+		t.Run("Search_Empty_Query", func(t *testing.T) {
+			request := makeGetRequest(t, ctx.Router, "/api/posts/search?q=")
+
+			response := assertJSONResponse(t, request, http.StatusOK)
+			if data, ok := getDataFromResponse(response); ok {
+				if posts, ok := data["posts"].([]any); ok {
+					if len(posts) != 0 {
+						t.Errorf("Expected empty results for empty query, got %d posts", len(posts))
+					}
+				}
+				if count, ok := data["count"].(float64); ok && count != 0 {
+					t.Errorf("Expected count 0 for empty query, got %.0f", count)
+				}
+			}
+		})
+
+		t.Run("Search_With_Very_Long_Query", func(t *testing.T) {
+			longQuery := strings.Repeat("a", 1000)
+			request := makeGetRequest(t, ctx.Router, "/api/posts/search?q="+url.QueryEscape(longQuery))
+			assertStatusRange(t, request, http.StatusOK, http.StatusBadRequest)
+		})
+
+		t.Run("Search_Case_Insensitive", func(t *testing.T) {
+			request := makeGetRequest(t, ctx.Router, "/api/posts/search?q=SEARCHABLE")
+
+			response := assertJSONResponse(t, request, http.StatusOK)
+			if data, ok := getDataFromResponse(response); ok {
+				if posts, ok := data["posts"].([]any); ok {
+					if len(posts) == 0 {
+						t.Error("Expected case-insensitive search to find posts")
+					}
+				}
+			}
+		})
+	})
+
+	t.Run("Title_Fetch_Endpoint_Edge_Cases", func(t *testing.T) {
+		ctx.Suite.EmailSender.Reset()
+
+		t.Run("Missing_URL_Parameter", func(t *testing.T) {
+			request := makeGetRequest(t, ctx.Router, "/api/posts/title")
+			assertErrorResponse(t, request, http.StatusBadRequest)
+		})
+
+		t.Run("Empty_URL_Parameter", func(t *testing.T) {
+			request := makeGetRequest(t, ctx.Router, "/api/posts/title?url=")
+			assertErrorResponse(t, request, http.StatusBadRequest)
+		})
+
+		t.Run("Invalid_URL_Format", func(t *testing.T) {
+			invalidURLs := []string{
+				"not-a-url",
+				"://invalid",
+				"http://",
+				"https://",
+			}
+
+			for _, invalidURL := range invalidURLs {
+				ctx.Suite.TitleFetcher.SetError(services.ErrUnsupportedScheme)
+				request := makeGetRequest(t, ctx.Router, "/api/posts/title?url="+url.QueryEscape(invalidURL))
+				assertErrorResponse(t, request, http.StatusBadRequest)
+			}
+		})
+
+		t.Run("Unsupported_URL_Schemes", func(t *testing.T) {
+			unsupportedSchemes := []string{
+				"ftp://example.com",
+				"file:///etc/passwd",
+				"javascript:alert(1)",
+				"data:text/html,<script>alert(1)</script>",
+			}
+
+			for _, schemeURL := range unsupportedSchemes {
+				request := makeGetRequest(t, ctx.Router, "/api/posts/title?url="+url.QueryEscape(schemeURL))
+				assertErrorResponse(t, request, http.StatusBadRequest)
+			}
+		})
+
+		t.Run("SSRF_Protection_Localhost", func(t *testing.T) {
+			ssrfURLs := []string{
+				"http://localhost",
+				"http://127.0.0.1",
+				"http://127.0.0.1:8080",
+				"http://[::1]",
+				"http://0.0.0.0",
+			}
+
+			for _, ssrfURL := range ssrfURLs {
+				ctx.Suite.TitleFetcher.SetError(services.ErrSSRFBlocked)
+				request := makeGetRequest(t, ctx.Router, "/api/posts/title?url="+url.QueryEscape(ssrfURL))
+				assertStatusRange(t, request, http.StatusBadRequest, http.StatusBadGateway)
+			}
+		})
+
+		t.Run("SSRF_Protection_Private_IPs", func(t *testing.T) {
+			privateIPs := []string{
+				"http://192.168.1.1",
+				"http://10.0.0.1",
+				"http://172.16.0.1",
+			}
+
+			for _, privateIP := range privateIPs {
+				ctx.Suite.TitleFetcher.SetError(services.ErrSSRFBlocked)
+				request := makeGetRequest(t, ctx.Router, "/api/posts/title?url="+url.QueryEscape(privateIP))
+				assertStatusRange(t, request, http.StatusBadRequest, http.StatusBadGateway)
+			}
+		})
+
+		t.Run("Title_Fetch_Error_Handling", func(t *testing.T) {
+			ctx.Suite.TitleFetcher.SetError(services.ErrTitleNotFound)
+
+			request := makeGetRequest(t, ctx.Router, "/api/posts/title?url=https://example.com/notitle")
+			assertErrorResponse(t, request, http.StatusBadRequest)
+		})
+
+		t.Run("Valid_URL_Success", func(t *testing.T) {
+			ctx.Suite.TitleFetcher.SetTitle("Valid Title")
+
+			request := makeGetRequest(t, ctx.Router, "/api/posts/title?url=https://example.com/valid")
+
+			response := assertJSONResponse(t, request, http.StatusOK)
+			if data, ok := getDataFromResponse(response); ok {
+				if title, ok := data["title"].(string); ok {
+					if title != "Valid Title" {
+						t.Errorf("Expected title 'Valid Title', got '%s'", title)
+					}
+				} else {
+					t.Error("Expected title in response data")
+				}
+			}
+		})
+	})
+
+	t.Run("Get_User_Vote_Edge_Cases", func(t *testing.T) {
+		ctx.Suite.EmailSender.Reset()
+		user := createAuthenticatedUser(t, ctx.AuthService, ctx.Suite.UserRepo, uniqueTestUsername(t, "vote_edge"), uniqueTestEmail(t, "vote_edge"))
+		secondUser := createAuthenticatedUser(t, ctx.AuthService, ctx.Suite.UserRepo, uniqueTestUsername(t, "vote_edge2"), uniqueTestEmail(t, "vote_edge2"))
+
+		post := testutils.CreatePostWithRepo(t, ctx.Suite.PostRepo, user.User.ID, "Vote Edge Test Post", "https://example.com/vote-edge")
+
+		t.Run("Get_Vote_When_User_Has_Voted", func(t *testing.T) {
+			voteRequest := makePostRequest(t, ctx.Router, fmt.Sprintf("/api/posts/%d/vote", post.ID), map[string]any{"type": "up"}, user, map[string]string{"id": fmt.Sprintf("%d", post.ID)})
+			assertStatus(t, voteRequest, http.StatusOK)
+
+			request := makeAuthenticatedGetRequest(t, ctx.Router, fmt.Sprintf("/api/posts/%d/vote", post.ID), user, map[string]string{"id": fmt.Sprintf("%d", post.ID)})
+
+			response := assertJSONResponse(t, request, http.StatusOK)
+			if data, ok := getDataFromResponse(response); ok {
+				if hasVote, ok := data["has_vote"].(bool); !ok || !hasVote {
+					t.Error("Expected has_vote to be true when user has voted")
+				}
+				if vote, ok := data["vote"]; !ok || vote == nil {
+					t.Error("Expected vote object when user has voted")
+				}
+			}
+		})
+
+		t.Run("Get_Vote_When_User_Has_Not_Voted", func(t *testing.T) {
+			request := makeAuthenticatedGetRequest(t, ctx.Router, fmt.Sprintf("/api/posts/%d/vote", post.ID), secondUser, map[string]string{"id": fmt.Sprintf("%d", post.ID)})
+
+			response := assertJSONResponse(t, request, http.StatusOK)
+			if data, ok := getDataFromResponse(response); ok {
+				if hasVote, ok := data["has_vote"].(bool); ok {
+					if hasVote {
+						t.Error("Expected has_vote to be false when user has not voted")
+					}
+				} else {
+					t.Error("Expected has_vote field in response")
+				}
+			}
+		})
+
+		t.Run("Get_Vote_Invalid_Post_ID", func(t *testing.T) {
+			request := makeAuthenticatedGetRequest(t, ctx.Router, "/api/posts/999999/vote", user, map[string]string{"id": "999999"})
+
+			if request.Code != http.StatusOK && request.Code != http.StatusNotFound {
+				t.Errorf("Expected status 200 or 404 for invalid post ID, got %d", request.Code)
+			}
+		})
+
+		t.Run("Get_Vote_Unauthenticated", func(t *testing.T) {
+			request := makeGetRequest(t, ctx.Router, fmt.Sprintf("/api/posts/%d/vote", post.ID))
+			assertErrorResponse(t, request, http.StatusUnauthorized)
+		})
+
+		t.Run("Get_Vote_Response_Structure", func(t *testing.T) {
+			request := makeAuthenticatedGetRequest(t, ctx.Router, fmt.Sprintf("/api/posts/%d/vote", post.ID), user, map[string]string{"id": fmt.Sprintf("%d", post.ID)})
+
+			response := assertJSONResponse(t, request, http.StatusOK)
+			if success, ok := response["success"].(bool); !ok || !success {
+				t.Error("Expected success field to be true")
+			}
+			if data, ok := getDataFromResponse(response); ok {
+				if _, exists := data["has_vote"]; !exists {
+					t.Error("Expected has_vote field in response data")
+				}
+				if _, exists := data["is_anonymous"]; !exists {
+					t.Error("Expected is_anonymous field in response data")
+				}
+			} else {
+				t.Error("Expected data field in response")
+			}
+		})
+	})
+
+	t.Run("Refresh_Token_Edge_Cases", func(t *testing.T) {
+		ctx.Suite.EmailSender.Reset()
+		refreshUser := createAuthenticatedUser(t, ctx.AuthService, ctx.Suite.UserRepo, uniqueTestUsername(t, "refresh_edge"), uniqueTestEmail(t, "refresh_edge"))
+
+		t.Run("Refresh_With_Expired_Token", func(t *testing.T) {
+			loginResult, err := ctx.AuthService.Login(refreshUser.User.Username, "SecurePass123!")
+			if err != nil {
+				t.Fatalf("Failed to login: %v", err)
+			}
+
+			refreshToken, err := ctx.Suite.RefreshTokenRepo.GetByTokenHash(testutils.HashVerificationToken(loginResult.RefreshToken))
+			if err != nil {
+				t.Fatalf("Failed to get refresh token: %v", err)
+			}
+
+			refreshToken.ExpiresAt = time.Now().Add(-1 * time.Hour)
+			if err := ctx.Suite.DB.Model(refreshToken).Update("expires_at", refreshToken.ExpiresAt).Error; err != nil {
+				t.Fatalf("Failed to expire refresh token: %v", err)
+			}
+
+			request := makePostRequestWithJSON(t, ctx.Router, "/api/auth/refresh", map[string]any{"refresh_token": loginResult.RefreshToken})
+			assertErrorResponse(t, request, http.StatusUnauthorized)
+		})
+
+		t.Run("Refresh_With_Revoked_Token", func(t *testing.T) {
+			loginResult, err := ctx.AuthService.Login(refreshUser.User.Username, "SecurePass123!")
+			if err != nil {
+				t.Fatalf("Failed to login: %v", err)
+			}
+
+			if err := ctx.AuthService.RevokeRefreshToken(loginResult.RefreshToken); err != nil {
+				t.Fatalf("Failed to revoke refresh token: %v", err)
+			}
+
+			request := makePostRequestWithJSON(t, ctx.Router, "/api/auth/refresh", map[string]any{"refresh_token": loginResult.RefreshToken})
+			assertErrorResponse(t, request, http.StatusUnauthorized)
+		})
+
+		t.Run("Refresh_With_Empty_Token", func(t *testing.T) {
+			request := makePostRequestWithJSON(t, ctx.Router, "/api/auth/refresh", map[string]any{"refresh_token": ""})
+			assertErrorResponse(t, request, http.StatusBadRequest)
+		})
+
+		t.Run("Refresh_With_Missing_Token_Field", func(t *testing.T) {
+			request := makePostRequestWithJSON(t, ctx.Router, "/api/auth/refresh", map[string]any{})
+			assertErrorResponse(t, request, http.StatusBadRequest)
+		})
+
+		t.Run("Refresh_Token_Rotation", func(t *testing.T) {
+			loginResult, err := ctx.AuthService.Login(refreshUser.User.Username, "SecurePass123!")
+			if err != nil {
+				t.Fatalf("Failed to login: %v", err)
+			}
+
+			originalRefreshToken := loginResult.RefreshToken
+
+			request := makePostRequestWithJSON(t, ctx.Router, "/api/auth/refresh", map[string]any{"refresh_token": originalRefreshToken})
+
+			response := assertJSONResponse(t, request, http.StatusOK)
+			if data, ok := getDataFromResponse(response); ok {
+				if newAccessToken, ok := data["access_token"].(string); ok {
+					if newAccessToken == "" {
+						t.Error("Expected new access token in refresh response")
+					}
+
+					if newRefreshToken, ok := data["refresh_token"].(string); ok {
+						if newRefreshToken != "" && newRefreshToken == originalRefreshToken {
+							t.Log("Refresh token rotation may not be implemented (same token returned)")
+						}
+					}
+				}
+			}
+		})
+
+		t.Run("Refresh_After_Account_Lock", func(t *testing.T) {
+			lockedUser := createAuthenticatedUser(t, ctx.AuthService, ctx.Suite.UserRepo, uniqueTestUsername(t, "refresh_lock"), uniqueTestEmail(t, "refresh_lock"))
+
+			loginResult, err := ctx.AuthService.Login(lockedUser.User.Username, "SecurePass123!")
+			if err != nil {
+				t.Fatalf("Failed to login: %v", err)
+			}
+
+			lockedUser.User.Locked = true
+			if err := ctx.Suite.UserRepo.Update(lockedUser.User); err != nil {
+				t.Fatalf("Failed to lock user: %v", err)
+			}
+
+			request := makePostRequestWithJSON(t, ctx.Router, "/api/auth/refresh", map[string]any{"refresh_token": loginResult.RefreshToken})
+
+			assertStatusRange(t, request, http.StatusUnauthorized, http.StatusForbidden)
+		})
+
+		t.Run("Refresh_With_Invalid_Token_Format", func(t *testing.T) {
+			request := makePostRequestWithJSON(t, ctx.Router, "/api/auth/refresh", map[string]any{"refresh_token": "invalid-token-format-12345"})
+			assertErrorResponse(t, request, http.StatusUnauthorized)
+		})
+	})
+
+	t.Run("Pagination_Edge_Cases", func(t *testing.T) {
+		ctx.Suite.EmailSender.Reset()
+		paginationUser := createAuthenticatedUser(t, ctx.AuthService, ctx.Suite.UserRepo, uniqueTestUsername(t, "pagination_edge"), uniqueTestEmail(t, "pagination_edge"))
+
+		for i := 0; i < 5; i++ {
+			testutils.CreatePostWithRepo(t, ctx.Suite.PostRepo, paginationUser.User.ID, fmt.Sprintf("Pagination Post %d", i), fmt.Sprintf("https://example.com/pag%d", i))
+		}
+
+		t.Run("Negative_Limit", func(t *testing.T) {
+			request := makeGetRequest(t, ctx.Router, "/api/posts?limit=-1")
+			assertStatusRange(t, request, http.StatusOK, http.StatusBadRequest)
+		})
+
+		t.Run("Negative_Offset", func(t *testing.T) {
+			request := makeGetRequest(t, ctx.Router, "/api/posts?offset=-1")
+			assertStatusRange(t, request, http.StatusOK, http.StatusBadRequest)
+		})
+
+		t.Run("Very_Large_Limit", func(t *testing.T) {
+			request := makeGetRequest(t, ctx.Router, "/api/posts?limit=10000")
+			assertStatusRange(t, request, http.StatusOK, http.StatusBadRequest)
+		})
+
+		t.Run("Very_Large_Offset", func(t *testing.T) {
+			request := makeGetRequest(t, ctx.Router, "/api/posts?offset=10000")
+
+			response := assertJSONResponse(t, request, http.StatusOK)
+			if data, ok := getDataFromResponse(response); ok {
+				if posts, ok := data["posts"].([]any); ok {
+					if len(posts) > 0 {
+						t.Logf("Large offset returned %d posts (may be expected)", len(posts))
+					}
+				}
+			}
+		})
+
+		t.Run("Invalid_Pagination_Parameters", func(t *testing.T) {
+			invalidParams := []string{
+				"limit=abc",
+				"offset=xyz",
+				"limit=",
+				"offset=",
+			}
+
+			for _, param := range invalidParams {
+				request := makeGetRequest(t, ctx.Router, "/api/posts?"+param)
+				assertStatus(t, request, http.StatusOK)
+			}
+		})
 	})
 }

internal/integration/compression_static_metadata_integration_test.go

@@ -1,17 +1,12 @@
 package integration
 
 import (
-	"bytes"
 	"compress/gzip"
-	"encoding/json"
 	"io"
 	"net/http"
 	"net/http/httptest"
 	"strings"
 	"testing"
-
-	"goyco/internal/middleware"
-	"goyco/internal/testutils"
 )
 
 func TestIntegration_Compression(t *testing.T) {
@@ -19,16 +14,16 @@ func TestIntegration_Compression(t *testing.T) {
 	router := ctx.Router
 
 	t.Run("Response_Compression_Gzip", func(t *testing.T) {
-		req := httptest.NewRequest("GET", "/api/posts", nil)
-		req.Header.Set("Accept-Encoding", "gzip")
-		rec := httptest.NewRecorder()
+		request := httptest.NewRequest("GET", "/api/posts", nil)
+		request.Header.Set("Accept-Encoding", "gzip")
+		recorder := httptest.NewRecorder()
 
-		router.ServeHTTP(rec, req)
+		router.ServeHTTP(recorder, request)
 
-		contentEncoding := rec.Header().Get("Content-Encoding")
+		contentEncoding := recorder.Header().Get("Content-Encoding")
 		if contentEncoding != "" && strings.Contains(contentEncoding, "gzip") {
-			assertHeaderContains(t, rec, "Content-Encoding", "gzip")
-			reader, err := gzip.NewReader(rec.Body)
+			assertHeaderContains(t, recorder, "Content-Encoding", "gzip")
+			reader, err := gzip.NewReader(recorder.Body)
 			if err != nil {
 				t.Fatalf("Failed to create gzip reader: %v", err)
 			}
@@ -48,14 +43,14 @@ func TestIntegration_Compression(t *testing.T) {
 	})
 
 	t.Run("Compression_Headers_Present", func(t *testing.T) {
-		req := httptest.NewRequest("GET", "/api/posts", nil)
-		req.Header.Set("Accept-Encoding", "gzip, deflate")
-		rec := httptest.NewRecorder()
+		request := httptest.NewRequest("GET", "/api/posts", nil)
+		request.Header.Set("Accept-Encoding", "gzip, deflate")
+		recorder := httptest.NewRecorder()
 
-		router.ServeHTTP(rec, req)
+		router.ServeHTTP(recorder, request)
 
-		if rec.Header().Get("Vary") != "" {
-			assertHeaderContains(t, rec, "Vary", "Accept-Encoding")
+		if recorder.Header().Get("Vary") != "" {
+			assertHeaderContains(t, recorder, "Vary", "Accept-Encoding")
 		} else {
 			t.Log("Vary header may not always be present")
 		}
@@ -67,25 +62,19 @@ func TestIntegration_StaticFiles(t *testing.T) {
 	router := ctx.Router
 
 	t.Run("Robots_Txt_Served", func(t *testing.T) {
-		req := httptest.NewRequest("GET", "/robots.txt", nil)
-		rec := httptest.NewRecorder()
+		request := makeGetRequest(t, router, "/robots.txt")
 
-		router.ServeHTTP(rec, req)
+		assertStatus(t, request, http.StatusOK)
 
-		assertStatus(t, rec, http.StatusOK)
-
-		if !strings.Contains(rec.Body.String(), "User-agent") {
+		if !strings.Contains(request.Body.String(), "User-agent") {
 			t.Error("Expected robots.txt content")
 		}
 	})
 
 	t.Run("Static_Files_Security_Headers", func(t *testing.T) {
-		req := httptest.NewRequest("GET", "/robots.txt", nil)
-		rec := httptest.NewRecorder()
+		request := makeGetRequest(t, router, "/robots.txt")
 
-		router.ServeHTTP(rec, req)
-
-		if rec.Header().Get("X-Content-Type-Options") == "" {
+		if request.Header().Get("X-Content-Type-Options") == "" {
 			t.Log("Security headers may not be applied to all static files")
 		}
 	})
@@ -101,32 +90,22 @@ func TestIntegration_URLMetadata(t *testing.T) {
 
 		ctx.Suite.TitleFetcher.SetTitle("Fetched Title")
 
-		postBody := map[string]string{
+		postBody := map[string]any{
 			"title":   "Test Post",
 			"url":     "https://example.com/metadata-test",
 			"content": "Test content",
 		}
-		body, _ := json.Marshal(postBody)
-		req := httptest.NewRequest("POST", "/api/posts", bytes.NewBuffer(body))
-		req.Header.Set("Content-Type", "application/json")
-		req.Header.Set("Authorization", "Bearer "+user.Token)
-		req = testutils.WithUserContext(req, middleware.UserIDKey, user.User.ID)
-		rec := httptest.NewRecorder()
+		request := makePostRequest(t, router, "/api/posts", postBody, user, nil)
 
-		router.ServeHTTP(rec, req)
-
-		assertStatus(t, rec, http.StatusCreated)
+		assertStatus(t, request, http.StatusCreated)
 	})
 
 	t.Run("URL_Metadata_Endpoint", func(t *testing.T) {
 		ctx.Suite.TitleFetcher.SetTitle("Endpoint Title")
 
-		req := httptest.NewRequest("GET", "/api/posts/title?url=https://example.com/test", nil)
-		rec := httptest.NewRecorder()
+		request := makeGetRequest(t, router, "/api/posts/title?url=https://example.com/test")
 
-		router.ServeHTTP(rec, req)
-
-		response := assertJSONResponse(t, rec, http.StatusOK)
+		response := assertJSONResponse(t, request, http.StatusOK)
 		if response != nil {
 			if data, ok := response["data"].(map[string]any); ok {
 				if _, exists := data["title"]; !exists {

internal/integration/csrf_integration_test.go

@@ -14,6 +14,26 @@ func TestIntegration_CSRF_Protection(t *testing.T) {
 	ctx := setupPageHandlerTestContext(t)
 	router := ctx.Router
 
+	getCSRFToken := func(t *testing.T, path string, cookies ...*http.Cookie) *http.Cookie {
+		t.Helper()
+
+		request := httptest.NewRequest("GET", path, nil)
+		for _, c := range cookies {
+			request.AddCookie(c)
+		}
+		recorder := httptest.NewRecorder()
+		router.ServeHTTP(recorder, request)
+
+		for _, cookie := range recorder.Result().Cookies() {
+			if cookie.Name == "csrf_token" {
+				return cookie
+			}
+		}
+
+		t.Fatalf("Expected CSRF cookie to be set for %s", path)
+		return nil
+	}
+
 	t.Run("CSRF_Blocks_Form_Without_Token", func(t *testing.T) {
 		requestBody := url.Values{}
 		requestBody.Set("username", "testuser")
@@ -35,30 +55,13 @@ func TestIntegration_CSRF_Protection(t *testing.T) {
 	})
 
 	t.Run("CSRF_Allows_Form_With_Valid_Token", func(t *testing.T) {
-		getRequest := httptest.NewRequest("GET", "/register", nil)
-		getRecorder := httptest.NewRecorder()
-		router.ServeHTTP(getRecorder, getRequest)
-
-		cookies := getRecorder.Result().Cookies()
-		var csrfCookie *http.Cookie
-		for _, cookie := range cookies {
-			if cookie.Name == "csrf_token" {
-				csrfCookie = cookie
-				break
-			}
-		}
-
-		if csrfCookie == nil {
-			t.Fatal("Expected CSRF cookie to be set")
-		}
-
-		csrfToken := csrfCookie.Value
+		csrfCookie := getCSRFToken(t, "/register")
 
 		requestBody := url.Values{}
 		requestBody.Set("username", "csrf_user")
 		requestBody.Set("email", "csrf@example.com")
 		requestBody.Set("password", "SecurePass123!")
-		requestBody.Set("csrf_token", csrfToken)
+		requestBody.Set("csrf_token", csrfCookie.Value)
 
 		request := httptest.NewRequest("POST", "/register", strings.NewReader(requestBody.Encode()))
 		request.Header.Set("Content-Type", "application/x-www-form-urlencoded")
@@ -91,22 +94,7 @@ func TestIntegration_CSRF_Protection(t *testing.T) {
 	})
 
 	t.Run("CSRF_Blocks_Mismatched_Token", func(t *testing.T) {
-		getRequest := httptest.NewRequest("GET", "/register", nil)
-		getRecorder := httptest.NewRecorder()
-		router.ServeHTTP(getRecorder, getRequest)
-
-		cookies := getRecorder.Result().Cookies()
-		var csrfCookie *http.Cookie
-		for _, cookie := range cookies {
-			if cookie.Name == "csrf_token" {
-				csrfCookie = cookie
-				break
-			}
-		}
-
-		if csrfCookie == nil {
-			t.Fatal("Expected CSRF cookie to be set")
-		}
+		csrfCookie := getCSRFToken(t, "/register")
 
 		requestBody := url.Values{}
 		requestBody.Set("username", "mismatch_user")
@@ -141,24 +129,7 @@ func TestIntegration_CSRF_Protection(t *testing.T) {
 	})
 
 	t.Run("CSRF_Token_In_Header", func(t *testing.T) {
-		getRequest := httptest.NewRequest("GET", "/register", nil)
-		getRecorder := httptest.NewRecorder()
-		router.ServeHTTP(getRecorder, getRequest)
-
-		cookies := getRecorder.Result().Cookies()
-		var csrfCookie *http.Cookie
-		for _, cookie := range cookies {
-			if cookie.Name == "csrf_token" {
-				csrfCookie = cookie
-				break
-			}
-		}
-
-		if csrfCookie == nil {
-			t.Fatal("Expected CSRF cookie to be set")
-		}
-
-		csrfToken := csrfCookie.Value
+		csrfCookie := getCSRFToken(t, "/register")
 
 		requestBody := url.Values{}
 		requestBody.Set("username", "header_user")
@@ -167,7 +138,7 @@ func TestIntegration_CSRF_Protection(t *testing.T) {
 
 		request := httptest.NewRequest("POST", "/register", strings.NewReader(requestBody.Encode()))
 		request.Header.Set("Content-Type", "application/x-www-form-urlencoded")
-		request.Header.Set("X-CSRF-Token", csrfToken)
+		request.Header.Set("X-CSRF-Token", csrfCookie.Value)
 		request.AddCookie(csrfCookie)
 		recorder := httptest.NewRecorder()
 
@@ -182,35 +153,18 @@ func TestIntegration_CSRF_Protection(t *testing.T) {
 		ctx.Suite.EmailSender.Reset()
 		user := createUserWithCleanup(t, ctx, "csrf_form_user", "csrf_form@example.com")
 
-		getRequest := httptest.NewRequest("GET", "/posts/new", nil)
-		getRequest.AddCookie(&http.Cookie{Name: "auth_token", Value: user.Token})
-		getRecorder := httptest.NewRecorder()
-		router.ServeHTTP(getRecorder, getRequest)
-
-		cookies := getRecorder.Result().Cookies()
-		var csrfCookie *http.Cookie
-		for _, cookie := range cookies {
-			if cookie.Name == "csrf_token" {
-				csrfCookie = cookie
-				break
-			}
-		}
-
-		if csrfCookie == nil {
-			t.Fatal("Expected CSRF cookie to be set")
-		}
-
-		csrfToken := csrfCookie.Value
+		authCookie := &http.Cookie{Name: "auth_token", Value: user.Token}
+		csrfCookie := getCSRFToken(t, "/posts/new", authCookie)
 
 		requestBody := url.Values{}
 		requestBody.Set("title", "CSRF Test Post")
 		requestBody.Set("url", "https://example.com/csrf-test")
 		requestBody.Set("content", "Test content")
-		requestBody.Set("csrf_token", csrfToken)
+		requestBody.Set("csrf_token", csrfCookie.Value)
 
 		request := httptest.NewRequest("POST", "/posts", strings.NewReader(requestBody.Encode()))
 		request.Header.Set("Content-Type", "application/x-www-form-urlencoded")
-		request.AddCookie(&http.Cookie{Name: "auth_token", Value: user.Token})
+		request.AddCookie(authCookie)
 		request.AddCookie(csrfCookie)
 		recorder := httptest.NewRecorder()
 

internal/integration/data_consistency_integration_test.go

@@ -19,27 +19,18 @@ func TestIntegration_DataConsistency(t *testing.T) {
 		ctx.Suite.EmailSender.Reset()
 		user := createAuthenticatedUser(t, ctx.AuthService, ctx.Suite.UserRepo, "consistency_user", "consistency@example.com")
 
-		postBody := map[string]string{
+		request := makePostRequest(t, ctx.Router, "/api/posts", map[string]any{
 			"title":   "Consistency Test Post",
 			"url":     "https://example.com/consistency",
 			"content": "Test content",
-		}
-		body, _ := json.Marshal(postBody)
+		}, user, nil)
 
-		req := httptest.NewRequest("POST", "/api/posts", bytes.NewBuffer(body))
-		req.Header.Set("Content-Type", "application/json")
-		req.Header.Set("Authorization", "Bearer "+user.Token)
-		req = testutils.WithUserContext(req, middleware.UserIDKey, user.User.ID)
-		rec := httptest.NewRecorder()
-
-		ctx.Router.ServeHTTP(rec, req)
-
-		createResponse := assertJSONResponse(t, rec, http.StatusCreated)
+		createResponse := assertJSONResponse(t, request, http.StatusCreated)
 		if createResponse == nil {
 			return
 		}
 
-		postData, ok := createResponse["data"].(map[string]any)
+		postData, ok := getDataFromResponse(createResponse)
 		if !ok {
 			t.Fatal("Response missing data")
 		}
@@ -53,16 +44,14 @@ func TestIntegration_DataConsistency(t *testing.T) {
 		createdURL := postData["url"]
 		createdContent := postData["content"]
 
-		getReq := httptest.NewRequest("GET", fmt.Sprintf("/api/posts/%.0f", postID), nil)
-		getRec := httptest.NewRecorder()
-		ctx.Router.ServeHTTP(getRec, getReq)
+		getRequest := makeGetRequest(t, ctx.Router, fmt.Sprintf("/api/posts/%.0f", postID))
 
-		getResponse := assertJSONResponse(t, getRec, http.StatusOK)
+		getResponse := assertJSONResponse(t, getRequest, http.StatusOK)
 		if getResponse == nil {
 			return
 		}
 
-		getPostData, ok := getResponse["data"].(map[string]any)
+		getPostData, ok := getDataFromResponse(getResponse)
 		if !ok {
 			t.Fatal("Get response missing data")
 		}
@@ -96,32 +85,17 @@ func TestIntegration_DataConsistency(t *testing.T) {
 
 		post := testutils.CreatePostWithRepo(t, ctx.Suite.PostRepo, user.User.ID, "Vote Consistency Post", "https://example.com/vote-consistency")
 
-		voteBody := map[string]string{"type": "up"}
-		body, _ := json.Marshal(voteBody)
+		voteRequest := makePostRequest(t, ctx.Router, fmt.Sprintf("/api/posts/%d/vote", post.ID), map[string]any{"type": "up"}, user, map[string]string{"id": fmt.Sprintf("%d", post.ID)})
+		assertStatus(t, voteRequest, http.StatusOK)
 
-		voteReq := httptest.NewRequest("POST", fmt.Sprintf("/api/posts/%d/vote", post.ID), bytes.NewBuffer(body))
-		voteReq.Header.Set("Content-Type", "application/json")
-		voteReq.Header.Set("Authorization", "Bearer "+user.Token)
-		voteReq = testutils.WithUserContext(voteReq, middleware.UserIDKey, user.User.ID)
-		voteReq = testutils.WithURLParams(voteReq, map[string]string{"id": fmt.Sprintf("%d", post.ID)})
-		voteRec := httptest.NewRecorder()
-		ctx.Router.ServeHTTP(voteRec, voteReq)
+		getVotesRequest := makeAuthenticatedGetRequest(t, ctx.Router, fmt.Sprintf("/api/posts/%d/votes", post.ID), user, map[string]string{"id": fmt.Sprintf("%d", post.ID)})
 
-		assertStatus(t, voteRec, http.StatusOK)
-
-		getVotesReq := httptest.NewRequest("GET", fmt.Sprintf("/api/posts/%d/votes", post.ID), nil)
-		getVotesReq.Header.Set("Authorization", "Bearer "+user.Token)
-		getVotesReq = testutils.WithUserContext(getVotesReq, middleware.UserIDKey, user.User.ID)
-		getVotesReq = testutils.WithURLParams(getVotesReq, map[string]string{"id": fmt.Sprintf("%d", post.ID)})
-		getVotesRec := httptest.NewRecorder()
-		ctx.Router.ServeHTTP(getVotesRec, getVotesReq)
-
-		votesResponse := assertJSONResponse(t, getVotesRec, http.StatusOK)
+		votesResponse := assertJSONResponse(t, getVotesRequest, http.StatusOK)
 		if votesResponse == nil {
 			return
 		}
 
-		votesData, ok := votesResponse["data"].(map[string]any)
+		votesData, ok := getDataFromResponse(votesResponse)
 		if !ok {
 			t.Fatal("Votes response missing data")
 		}
@@ -172,32 +146,21 @@ func TestIntegration_DataConsistency(t *testing.T) {
 
 		post := testutils.CreatePostWithRepo(t, ctx.Suite.PostRepo, user.User.ID, "Original Title", "https://example.com/original")
 
-		updateBody := map[string]string{
+		updateRequest := makePutRequest(t, ctx.Router, fmt.Sprintf("/api/posts/%d", post.ID), map[string]any{
 			"title":   "Updated Title",
 			"content": "Updated content",
-		}
-		body, _ := json.Marshal(updateBody)
+		}, user, map[string]string{"id": fmt.Sprintf("%d", post.ID)})
 
-		updateReq := httptest.NewRequest("PUT", fmt.Sprintf("/api/posts/%d", post.ID), bytes.NewBuffer(body))
-		updateReq.Header.Set("Content-Type", "application/json")
-		updateReq.Header.Set("Authorization", "Bearer "+user.Token)
-		updateReq = testutils.WithUserContext(updateReq, middleware.UserIDKey, user.User.ID)
-		updateReq = testutils.WithURLParams(updateReq, map[string]string{"id": fmt.Sprintf("%d", post.ID)})
-		updateRec := httptest.NewRecorder()
-		ctx.Router.ServeHTTP(updateRec, updateReq)
+		assertStatus(t, updateRequest, http.StatusOK)
 
-		assertStatus(t, updateRec, http.StatusOK)
+		getRequest := makeGetRequest(t, ctx.Router, fmt.Sprintf("/api/posts/%d", post.ID))
 
-		getReq := httptest.NewRequest("GET", fmt.Sprintf("/api/posts/%d", post.ID), nil)
-		getRec := httptest.NewRecorder()
-		ctx.Router.ServeHTTP(getRec, getReq)
-
-		getResponse := assertJSONResponse(t, getRec, http.StatusOK)
+		getResponse := assertJSONResponse(t, getRequest, http.StatusOK)
 		if getResponse == nil {
 			return
 		}
 
-		getPostData, ok := getResponse["data"].(map[string]any)
+		getPostData, ok := getDataFromResponse(getResponse)
 		if !ok {
 			t.Fatal("Get response missing data")
 		}
@@ -215,18 +178,12 @@ func TestIntegration_DataConsistency(t *testing.T) {
 		ctx.Suite.EmailSender.Reset()
 		user := createAuthenticatedUser(t, ctx.AuthService, ctx.Suite.UserRepo, "user_posts_consistency", "user_posts_consistency@example.com")
 
-		post1 := testutils.CreatePostWithRepo(t, ctx.Suite.PostRepo, user.User.ID, "Post 1", "https://example.com/post1")
-		post2 := testutils.CreatePostWithRepo(t, ctx.Suite.PostRepo, user.User.ID, "Post 2", "https://example.com/post2")
+		firstPost := testutils.CreatePostWithRepo(t, ctx.Suite.PostRepo, user.User.ID, "Post 1", "https://example.com/post1")
+		secondPost := testutils.CreatePostWithRepo(t, ctx.Suite.PostRepo, user.User.ID, "Post 2", "https://example.com/post2")
 
-		req := httptest.NewRequest("GET", fmt.Sprintf("/api/users/%d/posts", user.User.ID), nil)
-		req.Header.Set("Authorization", "Bearer "+user.Token)
-		req = testutils.WithUserContext(req, middleware.UserIDKey, user.User.ID)
-		req = testutils.WithURLParams(req, map[string]string{"id": fmt.Sprintf("%d", user.User.ID)})
-		rec := httptest.NewRecorder()
+		request := makeAuthenticatedGetRequest(t, ctx.Router, fmt.Sprintf("/api/users/%d/posts", user.User.ID), user, map[string]string{"id": fmt.Sprintf("%d", user.User.ID)})
 
-		ctx.Router.ServeHTTP(rec, req)
-
-		response := assertJSONResponse(t, rec, http.StatusOK)
+		response := assertJSONResponse(t, request, http.StatusOK)
 		if response == nil {
 			return
 		}
@@ -245,26 +202,26 @@ func TestIntegration_DataConsistency(t *testing.T) {
 			t.Errorf("Expected at least 2 posts, got %d", len(posts))
 		}
 
-		foundPost1 := false
-		foundPost2 := false
+		foundFirstPost := false
+		foundSecondPost := false
 		for _, post := range posts {
 			if postMap, ok := post.(map[string]any); ok {
 				if postID, ok := postMap["id"].(float64); ok {
-					if uint(postID) == post1.ID {
-						foundPost1 = true
+					if uint(postID) == firstPost.ID {
+						foundFirstPost = true
 					}
-					if uint(postID) == post2.ID {
-						foundPost2 = true
+					if uint(postID) == secondPost.ID {
+						foundSecondPost = true
 					}
 				}
 			}
 		}
 
-		if !foundPost1 {
+		if !foundFirstPost {
 			t.Error("Post 1 not found in user posts")
 		}
 
-		if !foundPost2 {
+		if !foundSecondPost {
 			t.Error("Post 2 not found in user posts")
 		}
 	})
@@ -275,20 +232,20 @@ func TestIntegration_DataConsistency(t *testing.T) {
 
 		post := testutils.CreatePostWithRepo(t, ctx.Suite.PostRepo, user.User.ID, "Delete Consistency Post", "https://example.com/delete-consistency")
 
-		deleteReq := httptest.NewRequest("DELETE", fmt.Sprintf("/api/posts/%d", post.ID), nil)
-		deleteReq.Header.Set("Authorization", "Bearer "+user.Token)
-		deleteReq = testutils.WithUserContext(deleteReq, middleware.UserIDKey, user.User.ID)
-		deleteReq = testutils.WithURLParams(deleteReq, map[string]string{"id": fmt.Sprintf("%d", post.ID)})
-		deleteRec := httptest.NewRecorder()
-		ctx.Router.ServeHTTP(deleteRec, deleteReq)
+		deleteRequest := httptest.NewRequest("DELETE", fmt.Sprintf("/api/posts/%d", post.ID), nil)
+		deleteRequest.Header.Set("Authorization", "Bearer "+user.Token)
+		deleteRequest = testutils.WithUserContext(deleteRequest, middleware.UserIDKey, user.User.ID)
+		deleteRequest = testutils.WithURLParams(deleteRequest, map[string]string{"id": fmt.Sprintf("%d", post.ID)})
+		deleteRecorder := httptest.NewRecorder()
+		ctx.Router.ServeHTTP(deleteRecorder, deleteRequest)
 
-		assertStatus(t, deleteRec, http.StatusOK)
+		assertStatus(t, deleteRecorder, http.StatusOK)
 
-		getReq := httptest.NewRequest("GET", fmt.Sprintf("/api/posts/%d", post.ID), nil)
-		getRec := httptest.NewRecorder()
-		ctx.Router.ServeHTTP(getRec, getReq)
+		getRequest := httptest.NewRequest("GET", fmt.Sprintf("/api/posts/%d", post.ID), nil)
+		getRecorder := httptest.NewRecorder()
+		ctx.Router.ServeHTTP(getRecorder, getRequest)
 
-		assertStatus(t, getRec, http.StatusNotFound)
+		assertStatus(t, getRecorder, http.StatusNotFound)
 	})
 
 	t.Run("Vote_Removal_Consistency", func(t *testing.T) {
@@ -300,33 +257,33 @@ func TestIntegration_DataConsistency(t *testing.T) {
 		voteBody := map[string]string{"type": "up"}
 		body, _ := json.Marshal(voteBody)
 
-		voteReq := httptest.NewRequest("POST", fmt.Sprintf("/api/posts/%d/vote", post.ID), bytes.NewBuffer(body))
-		voteReq.Header.Set("Content-Type", "application/json")
-		voteReq.Header.Set("Authorization", "Bearer "+user.Token)
-		voteReq = testutils.WithUserContext(voteReq, middleware.UserIDKey, user.User.ID)
-		voteReq = testutils.WithURLParams(voteReq, map[string]string{"id": fmt.Sprintf("%d", post.ID)})
-		voteRec := httptest.NewRecorder()
-		ctx.Router.ServeHTTP(voteRec, voteReq)
+		voteRequest := httptest.NewRequest("POST", fmt.Sprintf("/api/posts/%d/vote", post.ID), bytes.NewBuffer(body))
+		voteRequest.Header.Set("Content-Type", "application/json")
+		voteRequest.Header.Set("Authorization", "Bearer "+user.Token)
+		voteRequest = testutils.WithUserContext(voteRequest, middleware.UserIDKey, user.User.ID)
+		voteRequest = testutils.WithURLParams(voteRequest, map[string]string{"id": fmt.Sprintf("%d", post.ID)})
+		voteRecorder := httptest.NewRecorder()
+		ctx.Router.ServeHTTP(voteRecorder, voteRequest)
 
-		assertStatus(t, voteRec, http.StatusOK)
+		assertStatus(t, voteRecorder, http.StatusOK)
 
-		removeVoteReq := httptest.NewRequest("DELETE", fmt.Sprintf("/api/posts/%d/vote", post.ID), nil)
-		removeVoteReq.Header.Set("Authorization", "Bearer "+user.Token)
-		removeVoteReq = testutils.WithUserContext(removeVoteReq, middleware.UserIDKey, user.User.ID)
-		removeVoteReq = testutils.WithURLParams(removeVoteReq, map[string]string{"id": fmt.Sprintf("%d", post.ID)})
-		removeVoteRec := httptest.NewRecorder()
-		ctx.Router.ServeHTTP(removeVoteRec, removeVoteReq)
+		removeVoteRequest := httptest.NewRequest("DELETE", fmt.Sprintf("/api/posts/%d/vote", post.ID), nil)
+		removeVoteRequest.Header.Set("Authorization", "Bearer "+user.Token)
+		removeVoteRequest = testutils.WithUserContext(removeVoteRequest, middleware.UserIDKey, user.User.ID)
+		removeVoteRequest = testutils.WithURLParams(removeVoteRequest, map[string]string{"id": fmt.Sprintf("%d", post.ID)})
+		removeVoteRecorder := httptest.NewRecorder()
+		ctx.Router.ServeHTTP(removeVoteRecorder, removeVoteRequest)
 
-		assertStatus(t, removeVoteRec, http.StatusOK)
+		assertStatus(t, removeVoteRecorder, http.StatusOK)
 
-		getVotesReq := httptest.NewRequest("GET", fmt.Sprintf("/api/posts/%d/votes", post.ID), nil)
-		getVotesReq.Header.Set("Authorization", "Bearer "+user.Token)
-		getVotesReq = testutils.WithUserContext(getVotesReq, middleware.UserIDKey, user.User.ID)
-		getVotesReq = testutils.WithURLParams(getVotesReq, map[string]string{"id": fmt.Sprintf("%d", post.ID)})
-		getVotesRec := httptest.NewRecorder()
-		ctx.Router.ServeHTTP(getVotesRec, getVotesReq)
+		getVotesRequest := httptest.NewRequest("GET", fmt.Sprintf("/api/posts/%d/votes", post.ID), nil)
+		getVotesRequest.Header.Set("Authorization", "Bearer "+user.Token)
+		getVotesRequest = testutils.WithUserContext(getVotesRequest, middleware.UserIDKey, user.User.ID)
+		getVotesRequest = testutils.WithURLParams(getVotesRequest, map[string]string{"id": fmt.Sprintf("%d", post.ID)})
+		getVotesRecorder := httptest.NewRecorder()
+		ctx.Router.ServeHTTP(getVotesRecorder, getVotesRequest)
 
-		votesResponse := assertJSONResponse(t, getVotesRec, http.StatusOK)
+		votesResponse := assertJSONResponse(t, getVotesRecorder, http.StatusOK)
 		if votesResponse == nil {
 			return
 		}

internal/integration/email_integration_test.go

@@ -1,14 +1,10 @@
 package integration
 
 import (
-	"bytes"
-	"encoding/json"
 	"net/http"
-	"net/http/httptest"
 	"testing"
 
 	"goyco/internal/database"
-	"goyco/internal/middleware"
 	"goyco/internal/testutils"
 )
 
@@ -19,19 +15,14 @@ func TestIntegration_EmailService(t *testing.T) {
 	t.Run("Registration_Email_Sent", func(t *testing.T) {
 		ctx.Suite.EmailSender.Reset()
 
-		reqBody := map[string]string{
+		reqBody := map[string]any{
 			"username": "email_reg_user",
 			"email":    "email_reg@example.com",
 			"password": "SecurePass123!",
 		}
-		body, _ := json.Marshal(reqBody)
-		req := httptest.NewRequest("POST", "/api/auth/register", bytes.NewBuffer(body))
-		req.Header.Set("Content-Type", "application/json")
-		rec := httptest.NewRecorder()
+		request := makePostRequestWithJSON(t, router, "/api/auth/register", reqBody)
 
-		router.ServeHTTP(rec, req)
-
-		assertStatus(t, rec, http.StatusCreated)
+		assertStatus(t, request, http.StatusCreated)
 
 		token := ctx.Suite.EmailSender.VerificationToken()
 		if token == "" {
@@ -52,15 +43,10 @@ func TestIntegration_EmailService(t *testing.T) {
 			t.Fatalf("Failed to create user: %v", err)
 		}
 
-		reqBody := map[string]string{
+		reqBody := map[string]any{
 			"username_or_email": "email_reset_user",
 		}
-		body, _ := json.Marshal(reqBody)
-		req := httptest.NewRequest("POST", "/api/auth/forgot-password", bytes.NewBuffer(body))
-		req.Header.Set("Content-Type", "application/json")
-		rec := httptest.NewRecorder()
-
-		router.ServeHTTP(rec, req)
+		makePostRequestWithJSON(t, router, "/api/auth/forgot-password", reqBody)
 
 		token := ctx.Suite.EmailSender.PasswordResetToken()
 		if token == "" {
@@ -72,17 +58,9 @@ func TestIntegration_EmailService(t *testing.T) {
 		ctx.Suite.EmailSender.Reset()
 		user := createAuthenticatedUser(t, ctx.AuthService, ctx.Suite.UserRepo, "email_del_user", "email_del@example.com")
 
-		reqBody := map[string]string{}
-		body, _ := json.Marshal(reqBody)
-		req := httptest.NewRequest("DELETE", "/api/auth/account", bytes.NewBuffer(body))
-		req.Header.Set("Content-Type", "application/json")
-		req.Header.Set("Authorization", "Bearer "+user.Token)
-		req = testutils.WithUserContext(req, middleware.UserIDKey, user.User.ID)
-		rec := httptest.NewRecorder()
+		request := makeDeleteRequest(t, router, "/api/auth/account", user, nil)
 
-		router.ServeHTTP(rec, req)
-
-		assertStatus(t, rec, http.StatusOK)
+		assertStatus(t, request, http.StatusOK)
 
 		token := ctx.Suite.EmailSender.DeletionToken()
 		if token == "" {
@@ -94,17 +72,10 @@ func TestIntegration_EmailService(t *testing.T) {
 		ctx.Suite.EmailSender.Reset()
 		user := createAuthenticatedUser(t, ctx.AuthService, ctx.Suite.UserRepo, "email_change_user", "email_change@example.com")
 
-		reqBody := map[string]string{
+		reqBody := map[string]any{
 			"email": "newemail@example.com",
 		}
-		body, _ := json.Marshal(reqBody)
-		req := httptest.NewRequest("PUT", "/api/auth/email", bytes.NewBuffer(body))
-		req.Header.Set("Content-Type", "application/json")
-		req.Header.Set("Authorization", "Bearer "+user.Token)
-		req = testutils.WithUserContext(req, middleware.UserIDKey, user.User.ID)
-		rec := httptest.NewRecorder()
-
-		router.ServeHTTP(rec, req)
+		makePutRequest(t, router, "/api/auth/email", reqBody, user, nil)
 
 		token := ctx.Suite.EmailSender.VerificationToken()
 		if token == "" {
@@ -115,17 +86,12 @@ func TestIntegration_EmailService(t *testing.T) {
 	t.Run("Email_Template_Content", func(t *testing.T) {
 		ctx.Suite.EmailSender.Reset()
 
-		reqBody := map[string]string{
+		reqBody := map[string]any{
 			"username": "template_user",
 			"email":    "template@example.com",
 			"password": "SecurePass123!",
 		}
-		body, _ := json.Marshal(reqBody)
-		req := httptest.NewRequest("POST", "/api/auth/register", bytes.NewBuffer(body))
-		req.Header.Set("Content-Type", "application/json")
-		rec := httptest.NewRecorder()
-
-		router.ServeHTTP(rec, req)
+		makePostRequestWithJSON(t, router, "/api/auth/register", reqBody)
 
 		token := ctx.Suite.EmailSender.VerificationToken()
 		if token == "" {

internal/integration/end_to_end_journeys_integration_test.go

@@ -152,9 +152,9 @@ func TestIntegration_EndToEndUserJourneys(t *testing.T) {
 
 		if data, ok := getDataFromResponse(votesResponse); ok {
 			if votes, ok := data["votes"].([]any); ok && len(votes) > 0 {
-				unvoteRec := makeDeleteRequest(t, ctx.Router, fmt.Sprintf("/api/posts/%d/vote", post.ID), user, map[string]string{"id": fmt.Sprintf("%d", post.ID)})
+				unvoteRequest := makeDeleteRequest(t, ctx.Router, fmt.Sprintf("/api/posts/%d/vote", post.ID), user, map[string]string{"id": fmt.Sprintf("%d", post.ID)})
 
-				assertStatus(t, unvoteRec, http.StatusOK)
+				assertStatus(t, unvoteRequest, http.StatusOK)
 			}
 		}
 	})

internal/integration/error_propagation_integration_test.go

@@ -2,7 +2,6 @@ package integration
 
 import (
 	"bytes"
-	"encoding/json"
 	"fmt"
 	"net/http"
 	"net/http/httptest"
@@ -19,58 +18,46 @@ func TestIntegration_ErrorPropagation(t *testing.T) {
 		ctx.Suite.EmailSender.Reset()
 		user := createAuthenticatedUser(t, ctx.AuthService, ctx.Suite.UserRepo, "json_error_user", "json_error@example.com")
 
-		req := httptest.NewRequest("POST", "/api/posts", bytes.NewBuffer([]byte("invalid json{")))
-		req.Header.Set("Content-Type", "application/json")
-		req.Header.Set("Authorization", "Bearer "+user.Token)
-		req = testutils.WithUserContext(req, middleware.UserIDKey, user.User.ID)
-		rec := httptest.NewRecorder()
+		request := httptest.NewRequest("POST", "/api/posts", bytes.NewBuffer([]byte("invalid json{")))
+		request.Header.Set("Content-Type", "application/json")
+		request.Header.Set("Authorization", "Bearer "+user.Token)
+		request = testutils.WithUserContext(request, middleware.UserIDKey, user.User.ID)
+		recorder := httptest.NewRecorder()
 
-		ctx.Router.ServeHTTP(rec, req)
+		ctx.Router.ServeHTTP(recorder, request)
 
-		assertErrorResponse(t, rec, http.StatusBadRequest)
+		assertErrorResponse(t, recorder, http.StatusBadRequest)
 	})
 
 	t.Run("Validation_Error_Propagation", func(t *testing.T) {
 		ctx.Suite.EmailSender.Reset()
 
-		reqBody := map[string]string{
+		reqBody := map[string]any{
 			"username": "",
 			"email":    "invalid-email",
 			"password": "weak",
 		}
-		body, _ := json.Marshal(reqBody)
-		req := httptest.NewRequest("POST", "/api/auth/register", bytes.NewBuffer(body))
-		req.Header.Set("Content-Type", "application/json")
-		rec := httptest.NewRecorder()
+		request := makePostRequestWithJSON(t, ctx.Router, "/api/auth/register", reqBody)
 
-		ctx.Router.ServeHTTP(rec, req)
-
-		assertErrorResponse(t, rec, http.StatusBadRequest)
+		assertErrorResponse(t, request, http.StatusBadRequest)
 	})
 
 	t.Run("Database_Error_Propagation", func(t *testing.T) {
 		ctx.Suite.EmailSender.Reset()
 		user := createAuthenticatedUser(t, ctx.AuthService, ctx.Suite.UserRepo, "db_error_user", "db_error@example.com")
 
-		reqBody := map[string]string{
+		reqBody := map[string]any{
 			"title":   "Test Post",
 			"url":     "https://example.com/test",
 			"content": "Test content",
 		}
-		body, _ := json.Marshal(reqBody)
 
-		req := httptest.NewRequest("POST", "/api/posts", bytes.NewBuffer(body))
-		req.Header.Set("Content-Type", "application/json")
-		req.Header.Set("Authorization", "Bearer "+user.Token)
-		req = testutils.WithUserContext(req, middleware.UserIDKey, user.User.ID)
-		rec := httptest.NewRecorder()
+		request := makePostRequest(t, ctx.Router, "/api/posts", reqBody, user, nil)
 
-		ctx.Router.ServeHTTP(rec, req)
-
-		if rec.Code == http.StatusInternalServerError {
-			assertErrorResponse(t, rec, http.StatusInternalServerError)
+		if request.Code == http.StatusInternalServerError {
+			assertErrorResponse(t, request, http.StatusInternalServerError)
 		} else {
-			assertStatus(t, rec, http.StatusCreated)
+			assertStatus(t, request, http.StatusCreated)
 		}
 	})
 
@@ -78,34 +65,23 @@ func TestIntegration_ErrorPropagation(t *testing.T) {
 		ctx.Suite.EmailSender.Reset()
 		user := createAuthenticatedUser(t, ctx.AuthService, ctx.Suite.UserRepo, "notfound_error_user", "notfound_error@example.com")
 
-		req := httptest.NewRequest("GET", "/api/posts/999999", nil)
-		req.Header.Set("Authorization", "Bearer "+user.Token)
-		req = testutils.WithUserContext(req, middleware.UserIDKey, user.User.ID)
-		req = testutils.WithURLParams(req, map[string]string{"id": "999999"})
-		rec := httptest.NewRecorder()
+		request := makeAuthenticatedGetRequest(t, ctx.Router, "/api/posts/999999", user, map[string]string{"id": "999999"})
 
-		ctx.Router.ServeHTTP(rec, req)
-
-		assertErrorResponse(t, rec, http.StatusNotFound)
+		assertErrorResponse(t, request, http.StatusNotFound)
 	})
 
 	t.Run("Unauthorized_Error_Propagation", func(t *testing.T) {
 		ctx.Suite.EmailSender.Reset()
 
-		reqBody := map[string]string{
+		reqBody := map[string]any{
 			"title":   "Test Post",
 			"url":     "https://example.com/test",
 			"content": "Test content",
 		}
-		body, _ := json.Marshal(reqBody)
 
-		req := httptest.NewRequest("POST", "/api/posts", bytes.NewBuffer(body))
-		req.Header.Set("Content-Type", "application/json")
-		rec := httptest.NewRecorder()
+		request := makePostRequestWithJSON(t, ctx.Router, "/api/posts", reqBody)
 
-		ctx.Router.ServeHTTP(rec, req)
-
-		assertErrorResponse(t, rec, http.StatusUnauthorized)
+		assertErrorResponse(t, request, http.StatusUnauthorized)
 	})
 
 	t.Run("Forbidden_Error_Propagation", func(t *testing.T) {
@@ -115,78 +91,58 @@ func TestIntegration_ErrorPropagation(t *testing.T) {
 
 		post := testutils.CreatePostWithRepo(t, ctx.Suite.PostRepo, owner.User.ID, "Forbidden Post", "https://example.com/forbidden")
 
-		updateBody := map[string]string{
+		updateBody := map[string]any{
 			"title":   "Updated Title",
 			"content": "Updated content",
 		}
-		body, _ := json.Marshal(updateBody)
 
-		req := httptest.NewRequest("PUT", fmt.Sprintf("/api/posts/%d", post.ID), bytes.NewBuffer(body))
-		req.Header.Set("Content-Type", "application/json")
-		req.Header.Set("Authorization", "Bearer "+otherUser.Token)
-		req = testutils.WithUserContext(req, middleware.UserIDKey, otherUser.User.ID)
-		req = testutils.WithURLParams(req, map[string]string{"id": fmt.Sprintf("%d", post.ID)})
-		rec := httptest.NewRecorder()
+		request := makePutRequest(t, ctx.Router, fmt.Sprintf("/api/posts/%d", post.ID), updateBody, otherUser, map[string]string{"id": fmt.Sprintf("%d", post.ID)})
 
-		ctx.Router.ServeHTTP(rec, req)
-
-		assertErrorResponse(t, rec, http.StatusForbidden)
+		assertErrorResponse(t, request, http.StatusForbidden)
 	})
 
 	t.Run("Service_Error_Propagation", func(t *testing.T) {
 		ctx.Suite.EmailSender.Reset()
 
-		reqBody := map[string]string{
+		reqBody := map[string]any{
 			"username": "existing_user",
 			"email":    "existing@example.com",
 			"password": "SecurePass123!",
 		}
-		body, _ := json.Marshal(reqBody)
 
-		req := httptest.NewRequest("POST", "/api/auth/register", bytes.NewBuffer(body))
-		req.Header.Set("Content-Type", "application/json")
-		rec := httptest.NewRecorder()
-		ctx.Router.ServeHTTP(rec, req)
+		request := makePostRequestWithJSON(t, ctx.Router, "/api/auth/register", reqBody)
 
-		assertStatus(t, rec, http.StatusCreated)
+		assertStatus(t, request, http.StatusCreated)
 
-		req = httptest.NewRequest("POST", "/api/auth/register", bytes.NewBuffer(body))
-		req.Header.Set("Content-Type", "application/json")
-		rec = httptest.NewRecorder()
-		ctx.Router.ServeHTTP(rec, req)
+		request = makePostRequestWithJSON(t, ctx.Router, "/api/auth/register", reqBody)
 
-		assertStatusRange(t, rec, http.StatusBadRequest, http.StatusConflict)
-		assertErrorResponse(t, rec, rec.Code)
+		assertStatusRange(t, request, http.StatusBadRequest, http.StatusConflict)
+		assertErrorResponse(t, request, request.Code)
 	})
 
 	t.Run("Middleware_Error_Propagation", func(t *testing.T) {
 		ctx.Suite.EmailSender.Reset()
 
-		req := httptest.NewRequest("POST", "/api/posts", bytes.NewBuffer([]byte("{}")))
-		req.Header.Set("Content-Type", "application/json")
-		req.Header.Set("Authorization", "Bearer expired.invalid.token")
-		rec := httptest.NewRecorder()
+		request := httptest.NewRequest("POST", "/api/posts", bytes.NewBuffer([]byte("{}")))
+		request.Header.Set("Content-Type", "application/json")
+		request.Header.Set("Authorization", "Bearer expired.invalid.token")
+		recorder := httptest.NewRecorder()
 
-		ctx.Router.ServeHTTP(rec, req)
+		ctx.Router.ServeHTTP(recorder, request)
 
-		assertErrorResponse(t, rec, http.StatusUnauthorized)
+		assertErrorResponse(t, recorder, http.StatusUnauthorized)
 	})
 
 	t.Run("Handler_Error_Response_Format", func(t *testing.T) {
 		ctx.Suite.EmailSender.Reset()
 
-		req := httptest.NewRequest("GET", "/api/nonexistent", nil)
-		rec := httptest.NewRecorder()
+		request := makeGetRequest(t, ctx.Router, "/api/nonexistent")
 
-		ctx.Router.ServeHTTP(rec, req)
-
-		if rec.Code == http.StatusNotFound {
-			if rec.Header().Get("Content-Type") == "application/json" {
-				assertErrorResponse(t, rec, http.StatusNotFound)
-			} else {
-				if rec.Body.Len() == 0 {
-					t.Error("Expected error response body")
-				}
+		if request.Code == http.StatusNotFound {
+			if request.Header().Get("Content-Type") == "application/json" {
+				assertErrorResponse(t, request, http.StatusNotFound)
+			} else if request.Body.Len() == 0 {
+				t.Error("Expected error response body")
 			}
 		}
 	})

internal/integration/helpers.go

@@ -377,15 +377,11 @@ func assertCookieCleared(t *testing.T, recorder *httptest.ResponseRecorder, name
 	}
 }
 
-func assertHeader(t *testing.T, recorder *httptest.ResponseRecorder, name, expectedValue string) {
+func assertHeader(t *testing.T, recorder *httptest.ResponseRecorder, name string) {
 	t.Helper()
 	actualValue := recorder.Header().Get(name)
-	if expectedValue == "" {
-		if actualValue == "" {
-			t.Errorf("Expected header %s to be present", name)
-		}
-	} else if actualValue != expectedValue {
-		t.Errorf("Expected header %s=%s, got %s", name, expectedValue, actualValue)
+	if actualValue == "" {
+		t.Errorf("Expected header %s to be present", name)
 	}
 }
 

internal/integration/password_reset_integration_test.go

@@ -1,8 +1,6 @@
 package integration
 
 import (
-	"bytes"
-	"encoding/json"
 	"net/http"
 	"net/http/httptest"
 	"net/url"
@@ -32,17 +30,12 @@ func TestIntegration_PasswordReset_CompleteFlow(t *testing.T) {
 			t.Fatalf("Failed to create user: %v", err)
 		}
 
-		reqBody := map[string]string{
+		reqBody := map[string]any{
 			"username_or_email": "reset_user",
 		}
-		body, _ := json.Marshal(reqBody)
-		req := httptest.NewRequest("POST", "/api/auth/forgot-password", bytes.NewBuffer(body))
-		req.Header.Set("Content-Type", "application/json")
-		rec := httptest.NewRecorder()
+		request := makePostRequestWithJSON(t, router, "/api/auth/forgot-password", reqBody)
 
-		router.ServeHTTP(rec, req)
-
-		response := assertJSONResponse(t, rec, http.StatusOK)
+		response := assertJSONResponse(t, request, http.StatusOK)
 		if response != nil {
 			if success, ok := response["success"].(bool); !ok || !success {
 				t.Error("Expected success=true")
@@ -77,18 +70,13 @@ func TestIntegration_PasswordReset_CompleteFlow(t *testing.T) {
 			t.Fatal("Expected password reset token")
 		}
 
-		reqBody := map[string]string{
+		reqBody := map[string]any{
 			"token":        resetToken,
 			"new_password": "NewPassword123!",
 		}
-		body, _ := json.Marshal(reqBody)
-		req := httptest.NewRequest("POST", "/api/auth/reset-password", bytes.NewBuffer(body))
-		req.Header.Set("Content-Type", "application/json")
-		rec := httptest.NewRecorder()
+		request := makePostRequestWithJSON(t, router, "/api/auth/reset-password", reqBody)
 
-		router.ServeHTTP(rec, req)
-
-		assertStatus(t, rec, http.StatusOK)
+		assertStatus(t, request, http.StatusOK)
 
 		loginResult, err := ctx.AuthService.Login("reset_complete_user", "NewPassword123!")
 		if err != nil {
@@ -120,14 +108,14 @@ func TestIntegration_PasswordReset_CompleteFlow(t *testing.T) {
 		reqBody := url.Values{}
 		reqBody.Set("username_or_email", "page_reset_user")
 		reqBody.Set("csrf_token", csrfToken)
-		req := httptest.NewRequest("POST", "/forgot-password", strings.NewReader(reqBody.Encode()))
-		req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
-		req.AddCookie(&http.Cookie{Name: "csrf_token", Value: csrfToken})
-		rec := httptest.NewRecorder()
+		request := httptest.NewRequest("POST", "/forgot-password", strings.NewReader(reqBody.Encode()))
+		request.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+		request.AddCookie(&http.Cookie{Name: "csrf_token", Value: csrfToken})
+		recorder := httptest.NewRecorder()
 
-		pageRouter.ServeHTTP(rec, req)
+		pageRouter.ServeHTTP(recorder, request)
 
-		assertStatusRange(t, rec, http.StatusOK, http.StatusSeeOther)
+		assertStatusRange(t, recorder, http.StatusOK, http.StatusSeeOther)
 
 		resetToken := pageCtx.Suite.EmailSender.PasswordResetToken()
 		if resetToken == "" {
@@ -166,33 +154,23 @@ func TestIntegration_PasswordReset_CompleteFlow(t *testing.T) {
 			t.Fatalf("Failed to update user: %v", err)
 		}
 
-		reqBody := map[string]string{
+		reqBody := map[string]any{
 			"token":        resetToken,
 			"new_password": "NewPassword123!",
 		}
-		body, _ := json.Marshal(reqBody)
-		req := httptest.NewRequest("POST", "/api/auth/reset-password", bytes.NewBuffer(body))
-		req.Header.Set("Content-Type", "application/json")
-		rec := httptest.NewRecorder()
+		request := makePostRequestWithJSON(t, router, "/api/auth/reset-password", reqBody)
 
-		router.ServeHTTP(rec, req)
-
-		assertErrorResponse(t, rec, http.StatusBadRequest)
+		assertErrorResponse(t, request, http.StatusBadRequest)
 	})
 
 	t.Run("PasswordReset_InvalidToken", func(t *testing.T) {
-		reqBody := map[string]string{
+		reqBody := map[string]any{
 			"token":        "invalid-token",
 			"new_password": "NewPassword123!",
 		}
-		body, _ := json.Marshal(reqBody)
-		req := httptest.NewRequest("POST", "/api/auth/reset-password", bytes.NewBuffer(body))
-		req.Header.Set("Content-Type", "application/json")
-		rec := httptest.NewRecorder()
+		request := makePostRequestWithJSON(t, router, "/api/auth/reset-password", reqBody)
 
-		router.ServeHTTP(rec, req)
-
-		assertErrorResponse(t, rec, http.StatusBadRequest)
+		assertErrorResponse(t, request, http.StatusBadRequest)
 	})
 
 	t.Run("PasswordReset_WeakPassword", func(t *testing.T) {
@@ -214,18 +192,13 @@ func TestIntegration_PasswordReset_CompleteFlow(t *testing.T) {
 
 		resetToken := ctx.Suite.EmailSender.PasswordResetToken()
 
-		reqBody := map[string]string{
+		reqBody := map[string]any{
 			"token":        resetToken,
 			"new_password": "123",
 		}
-		body, _ := json.Marshal(reqBody)
-		req := httptest.NewRequest("POST", "/api/auth/reset-password", bytes.NewBuffer(body))
-		req.Header.Set("Content-Type", "application/json")
-		rec := httptest.NewRecorder()
+		request := makePostRequestWithJSON(t, router, "/api/auth/reset-password", reqBody)
 
-		router.ServeHTTP(rec, req)
-
-		assertErrorResponse(t, rec, http.StatusBadRequest)
+		assertErrorResponse(t, request, http.StatusBadRequest)
 	})
 
 	t.Run("PasswordReset_EmailIntegration", func(t *testing.T) {
@@ -243,17 +216,12 @@ func TestIntegration_PasswordReset_CompleteFlow(t *testing.T) {
 			t.Fatalf("Failed to create user: %v", err)
 		}
 
-		reqBody := map[string]string{
+		reqBody := map[string]any{
 			"username_or_email": "email_reset@example.com",
 		}
-		body, _ := json.Marshal(reqBody)
-		req := httptest.NewRequest("POST", "/api/auth/forgot-password", bytes.NewBuffer(body))
-		req.Header.Set("Content-Type", "application/json")
-		rec := httptest.NewRecorder()
+		request := makePostRequestWithJSON(t, freshCtx.Router, "/api/auth/forgot-password", reqBody)
 
-		freshCtx.Router.ServeHTTP(rec, req)
-
-		assertStatus(t, rec, http.StatusOK)
+		assertStatus(t, request, http.StatusOK)
 
 		resetToken := freshCtx.Suite.EmailSender.PasswordResetToken()
 		if resetToken == "" {

internal/integration/ratelimit_integration_test.go

@@ -51,24 +51,24 @@ func TestIntegration_RateLimiting(t *testing.T) {
 		router, _ := setupRateLimitRouter(t, rateLimitConfig)
 
 		for i := 0; i < 2; i++ {
-			req := httptest.NewRequest("POST", "/api/auth/login", bytes.NewBufferString(`{"username":"test","password":"test"}`))
-			req.Header.Set("Content-Type", "application/json")
-			rec := httptest.NewRecorder()
-			router.ServeHTTP(rec, req)
+			request := httptest.NewRequest("POST", "/api/auth/login", bytes.NewBufferString(`{"username":"test","password":"test"}`))
+			request.Header.Set("Content-Type", "application/json")
+			recorder := httptest.NewRecorder()
+			router.ServeHTTP(recorder, request)
 		}
 
-		req := httptest.NewRequest("POST", "/api/auth/login", bytes.NewBufferString(`{"username":"test","password":"test"}`))
-		req.Header.Set("Content-Type", "application/json")
-		rec := httptest.NewRecorder()
+		request := httptest.NewRequest("POST", "/api/auth/login", bytes.NewBufferString(`{"username":"test","password":"test"}`))
+		request.Header.Set("Content-Type", "application/json")
+		recorder := httptest.NewRecorder()
 
-		router.ServeHTTP(rec, req)
+		router.ServeHTTP(recorder, request)
 
-		assertErrorResponse(t, rec, http.StatusTooManyRequests)
+		assertErrorResponse(t, recorder, http.StatusTooManyRequests)
 
-		assertHeader(t, rec, "Retry-After", "")
+		assertHeader(t, recorder, "Retry-After")
 
 		var response map[string]any
-		if err := json.NewDecoder(rec.Body).Decode(&response); err == nil {
+		if err := json.NewDecoder(recorder.Body).Decode(&response); err == nil {
 			if _, exists := response["retry_after"]; !exists {
 				t.Error("Expected retry_after in response")
 			}
@@ -81,17 +81,17 @@ func TestIntegration_RateLimiting(t *testing.T) {
 		router, _ := setupRateLimitRouter(t, rateLimitConfig)
 
 		for i := 0; i < 5; i++ {
-			req := httptest.NewRequest("GET", "/api/posts", nil)
-			rec := httptest.NewRecorder()
-			router.ServeHTTP(rec, req)
+			request := httptest.NewRequest("GET", "/api/posts", nil)
+			recorder := httptest.NewRecorder()
+			router.ServeHTTP(recorder, request)
 		}
 
-		req := httptest.NewRequest("GET", "/api/posts", nil)
-		rec := httptest.NewRecorder()
+		request := httptest.NewRequest("GET", "/api/posts", nil)
+		recorder := httptest.NewRecorder()
 
-		router.ServeHTTP(rec, req)
+		router.ServeHTTP(recorder, request)
 
-		assertErrorResponse(t, rec, http.StatusTooManyRequests)
+		assertErrorResponse(t, recorder, http.StatusTooManyRequests)
 	})
 
 	t.Run("Health_RateLimit_Enforced", func(t *testing.T) {
@@ -100,17 +100,17 @@ func TestIntegration_RateLimiting(t *testing.T) {
 		router, _ := setupRateLimitRouter(t, rateLimitConfig)
 
 		for i := 0; i < 3; i++ {
-			req := httptest.NewRequest("GET", "/health", nil)
-			rec := httptest.NewRecorder()
-			router.ServeHTTP(rec, req)
+			request := httptest.NewRequest("GET", "/health", nil)
+			recorder := httptest.NewRecorder()
+			router.ServeHTTP(recorder, request)
 		}
 
-		req := httptest.NewRequest("GET", "/health", nil)
-		rec := httptest.NewRecorder()
+		request := httptest.NewRequest("GET", "/health", nil)
+		recorder := httptest.NewRecorder()
 
-		router.ServeHTTP(rec, req)
+		router.ServeHTTP(recorder, request)
 
-		assertErrorResponse(t, rec, http.StatusTooManyRequests)
+		assertErrorResponse(t, recorder, http.StatusTooManyRequests)
 	})
 
 	t.Run("Metrics_RateLimit_Enforced", func(t *testing.T) {
@@ -119,17 +119,17 @@ func TestIntegration_RateLimiting(t *testing.T) {
 		router, _ := setupRateLimitRouter(t, rateLimitConfig)
 
 		for i := 0; i < 2; i++ {
-			req := httptest.NewRequest("GET", "/metrics", nil)
-			rec := httptest.NewRecorder()
-			router.ServeHTTP(rec, req)
+			request := httptest.NewRequest("GET", "/metrics", nil)
+			recorder := httptest.NewRecorder()
+			router.ServeHTTP(recorder, request)
 		}
 
-		req := httptest.NewRequest("GET", "/metrics", nil)
-		rec := httptest.NewRecorder()
+		request := httptest.NewRequest("GET", "/metrics", nil)
+		recorder := httptest.NewRecorder()
 
-		router.ServeHTTP(rec, req)
+		router.ServeHTTP(recorder, request)
 
-		assertErrorResponse(t, rec, http.StatusTooManyRequests)
+		assertErrorResponse(t, recorder, http.StatusTooManyRequests)
 	})
 
 	t.Run("RateLimit_Different_Endpoints_Independent", func(t *testing.T) {
@@ -139,17 +139,17 @@ func TestIntegration_RateLimiting(t *testing.T) {
 		router, _ := setupRateLimitRouter(t, rateLimitConfig)
 
 		for i := 0; i < 2; i++ {
-			req := httptest.NewRequest("POST", "/api/auth/login", bytes.NewBufferString(`{"username":"test","password":"test"}`))
-			req.Header.Set("Content-Type", "application/json")
-			rec := httptest.NewRecorder()
-			router.ServeHTTP(rec, req)
+			request := httptest.NewRequest("POST", "/api/auth/login", bytes.NewBufferString(`{"username":"test","password":"test"}`))
+			request.Header.Set("Content-Type", "application/json")
+			recorder := httptest.NewRecorder()
+			router.ServeHTTP(recorder, request)
 		}
 
-		req := httptest.NewRequest("GET", "/api/posts", nil)
-		rec := httptest.NewRecorder()
-		router.ServeHTTP(rec, req)
+		request := httptest.NewRequest("GET", "/api/posts", nil)
+		recorder := httptest.NewRecorder()
+		router.ServeHTTP(recorder, request)
 
-		assertStatus(t, rec, http.StatusOK)
+		assertStatus(t, recorder, http.StatusOK)
 	})
 
 	t.Run("RateLimit_With_Authentication", func(t *testing.T) {
@@ -166,20 +166,20 @@ func TestIntegration_RateLimiting(t *testing.T) {
 		user := createAuthenticatedUser(t, authService, suite.UserRepo, uniqueTestUsername(t, "ratelimit_auth"), uniqueTestEmail(t, "ratelimit_auth"))
 
 		for i := 0; i < 3; i++ {
-			req := httptest.NewRequest("GET", "/api/auth/me", nil)
-			req.Header.Set("Authorization", "Bearer "+user.Token)
-			req = testutils.WithUserContext(req, middleware.UserIDKey, user.User.ID)
-			rec := httptest.NewRecorder()
-			router.ServeHTTP(rec, req)
+			request := httptest.NewRequest("GET", "/api/auth/me", nil)
+			request.Header.Set("Authorization", "Bearer "+user.Token)
+			request = testutils.WithUserContext(request, middleware.UserIDKey, user.User.ID)
+			recorder := httptest.NewRecorder()
+			router.ServeHTTP(recorder, request)
 		}
 
-		req := httptest.NewRequest("GET", "/api/auth/me", nil)
-		req.Header.Set("Authorization", "Bearer "+user.Token)
-		req = testutils.WithUserContext(req, middleware.UserIDKey, user.User.ID)
-		rec := httptest.NewRecorder()
+		request := httptest.NewRequest("GET", "/api/auth/me", nil)
+		request.Header.Set("Authorization", "Bearer "+user.Token)
+		request = testutils.WithUserContext(request, middleware.UserIDKey, user.User.ID)
+		recorder := httptest.NewRecorder()
 
-		router.ServeHTTP(rec, req)
+		router.ServeHTTP(recorder, request)
 
-		assertErrorResponse(t, rec, http.StatusTooManyRequests)
+		assertErrorResponse(t, recorder, http.StatusTooManyRequests)
 	})
 }

internal/integration/router_integration_test.go

@@ -17,16 +17,13 @@ func TestIntegration_Router_FullMiddlewareChain(t *testing.T) {
 	router := ctx.Router
 
 	t.Run("SecurityHeaders_Present", func(t *testing.T) {
-		request := httptest.NewRequest("GET", "/health", nil)
-		recorder := httptest.NewRecorder()
+		request := makeGetRequest(t, router, "/health")
 
-		router.ServeHTTP(recorder, request)
+		assertStatus(t, request, http.StatusOK)
 
-		assertStatus(t, recorder, http.StatusOK)
-
-		assertHeader(t, recorder, "X-Content-Type-Options", "")
-		assertHeader(t, recorder, "X-Frame-Options", "")
-		assertHeader(t, recorder, "X-XSS-Protection", "")
+		assertHeader(t, request, "X-Content-Type-Options")
+		assertHeader(t, request, "X-Frame-Options")
+		assertHeader(t, request, "X-XSS-Protection")
 	})
 
 	t.Run("CORS_Headers_Present", func(t *testing.T) {
@@ -36,16 +33,13 @@ func TestIntegration_Router_FullMiddlewareChain(t *testing.T) {
 
 		router.ServeHTTP(recorder, request)
 
-		assertHeader(t, recorder, "Access-Control-Allow-Origin", "")
+		assertHeader(t, recorder, "Access-Control-Allow-Origin")
 	})
 
 	t.Run("Logging_Middleware_Executes", func(t *testing.T) {
-		request := httptest.NewRequest("GET", "/health", nil)
-		recorder := httptest.NewRecorder()
+		request := makeGetRequest(t, router, "/health")
 
-		router.ServeHTTP(recorder, request)
-
-		if recorder.Code == 0 {
+		if request.Code == 0 {
 			t.Error("Expected logging middleware to execute")
 		}
 	})
@@ -67,13 +61,10 @@ func TestIntegration_Router_FullMiddlewareChain(t *testing.T) {
 	})
 
 	t.Run("DBMonitoring_Active", func(t *testing.T) {
-		request := httptest.NewRequest("GET", "/health", nil)
-		recorder := httptest.NewRecorder()
-
-		router.ServeHTTP(recorder, request)
+		request := makeGetRequest(t, router, "/health")
 
 		var response map[string]any
-		if err := json.NewDecoder(recorder.Body).Decode(&response); err == nil {
+		if err := json.NewDecoder(request.Body).Decode(&response); err == nil {
 			if data, ok := response["data"].(map[string]any); ok {
 				if _, exists := data["database_stats"]; !exists {
 					t.Error("Expected database_stats in health response")
@@ -83,12 +74,9 @@ func TestIntegration_Router_FullMiddlewareChain(t *testing.T) {
 	})
 
 	t.Run("Metrics_Middleware_Executes", func(t *testing.T) {
-		request := httptest.NewRequest("GET", "/metrics", nil)
-		recorder := httptest.NewRecorder()
+		request := makeGetRequest(t, router, "/metrics")
 
-		router.ServeHTTP(recorder, request)
-
-		response := assertJSONResponse(t, recorder, http.StatusOK)
+		response := assertJSONResponse(t, request, http.StatusOK)
 		if response != nil {
 			if data, ok := response["data"].(map[string]any); ok {
 				if _, exists := data["database"]; !exists {
@@ -99,34 +87,25 @@ func TestIntegration_Router_FullMiddlewareChain(t *testing.T) {
 	})
 
 	t.Run("StaticFiles_Served", func(t *testing.T) {
-		request := httptest.NewRequest("GET", "/robots.txt", nil)
-		recorder := httptest.NewRecorder()
+		request := makeGetRequest(t, router, "/robots.txt")
 
-		router.ServeHTTP(recorder, request)
+		assertStatus(t, request, http.StatusOK)
 
-		assertStatus(t, recorder, http.StatusOK)
-
-		if !strings.Contains(recorder.Body.String(), "User-agent") {
+		if !strings.Contains(request.Body.String(), "User-agent") {
 			t.Error("Expected robots.txt content")
 		}
 	})
 
 	t.Run("API_Routes_Accessible", func(t *testing.T) {
-		request := httptest.NewRequest("GET", "/api/posts", nil)
-		recorder := httptest.NewRecorder()
+		request := makeGetRequest(t, router, "/api/posts")
 
-		router.ServeHTTP(recorder, request)
-
-		assertStatus(t, recorder, http.StatusOK)
+		assertStatus(t, request, http.StatusOK)
 	})
 
 	t.Run("Health_Endpoint_Accessible", func(t *testing.T) {
-		request := httptest.NewRequest("GET", "/health", nil)
-		recorder := httptest.NewRecorder()
+		request := makeGetRequest(t, router, "/health")
 
-		router.ServeHTTP(recorder, request)
-
-		response := assertJSONResponse(t, recorder, http.StatusOK)
+		response := assertJSONResponse(t, request, http.StatusOK)
 		if response != nil {
 			if success, ok := response["success"].(bool); !ok || !success {
 				t.Error("Expected success=true in health response")
@@ -135,14 +114,11 @@ func TestIntegration_Router_FullMiddlewareChain(t *testing.T) {
 	})
 
 	t.Run("Middleware_Order_Correct", func(t *testing.T) {
-		request := httptest.NewRequest("GET", "/api/posts", nil)
-		recorder := httptest.NewRecorder()
+		request := makeGetRequest(t, router, "/api/posts")
 
-		router.ServeHTTP(recorder, request)
+		assertHeader(t, request, "X-Content-Type-Options")
 
-		assertHeader(t, recorder, "X-Content-Type-Options", "")
-
-		if recorder.Code == 0 {
+		if request.Code == 0 {
 			t.Error("Response should have status code")
 		}
 	})
@@ -160,15 +136,11 @@ func TestIntegration_Router_FullMiddlewareChain(t *testing.T) {
 	})
 
 	t.Run("Cache_Middleware_Active", func(t *testing.T) {
-		firstRequest := httptest.NewRequest("GET", "/api/posts", nil)
-		firstRecorder := httptest.NewRecorder()
-		router.ServeHTTP(firstRecorder, firstRequest)
+		firstRequest := makeGetRequest(t, router, "/api/posts")
 
-		secondRequest := httptest.NewRequest("GET", "/api/posts", nil)
-		secondRecorder := httptest.NewRecorder()
-		router.ServeHTTP(secondRecorder, secondRequest)
+		secondRequest := makeGetRequest(t, router, "/api/posts")
 
-		if firstRecorder.Code != secondRecorder.Code {
+		if firstRequest.Code != secondRequest.Code {
 			t.Error("Cached responses should have same status")
 		}
 	})
@@ -177,14 +149,9 @@ func TestIntegration_Router_FullMiddlewareChain(t *testing.T) {
 		ctx.Suite.EmailSender.Reset()
 		user := createUserWithCleanup(t, ctx, "auth_middleware_user", "auth_middleware@example.com")
 
-		request := httptest.NewRequest("GET", "/api/auth/me", nil)
-		request.Header.Set("Authorization", "Bearer "+user.Token)
-		request = testutils.WithUserContext(request, middleware.UserIDKey, user.User.ID)
-		recorder := httptest.NewRecorder()
+		request := makeAuthenticatedGetRequest(t, router, "/api/auth/me", user, nil)
 
-		router.ServeHTTP(recorder, request)
-
-		assertStatus(t, recorder, http.StatusOK)
+		assertStatus(t, request, http.StatusOK)
 	})
 
 	t.Run("RateLimit_Middleware_Integration", func(t *testing.T) {
@@ -192,20 +159,13 @@ func TestIntegration_Router_FullMiddlewareChain(t *testing.T) {
 		rateLimitRouter := rateLimitCtx.Router
 
 		for range 3 {
-			request := httptest.NewRequest("POST", "/api/auth/login", bytes.NewBufferString(`{"username":"test","password":"test"}`))
-			request.Header.Set("Content-Type", "application/json")
-			recorder := httptest.NewRecorder()
-
-			rateLimitRouter.ServeHTTP(recorder, request)
+			request := makePostRequestWithJSON(t, rateLimitRouter, "/api/auth/login", map[string]any{"username": "test", "password": "test"})
+			_ = request
 		}
 
-		request := httptest.NewRequest("POST", "/api/auth/login", bytes.NewBufferString(`{"username":"test","password":"test"}`))
-		request.Header.Set("Content-Type", "application/json")
-		recorder := httptest.NewRecorder()
+		request := makePostRequestWithJSON(t, rateLimitRouter, "/api/auth/login", map[string]any{"username": "test", "password": "test"})
 
-		rateLimitRouter.ServeHTTP(recorder, request)
-
-		if recorder.Code == http.StatusTooManyRequests {
+		if request.Code == http.StatusTooManyRequests {
 			t.Log("Rate limiting is working")
 		}
 	})

internal/server/router_test.go

@@ -3,6 +3,7 @@ package server
 import (
 	"net/http"
 	"net/http/httptest"
+	"strings"
 	"testing"
 
 	"goyco/internal/config"
@@ -105,9 +106,9 @@ func defaultRateLimitConfig() config.RateLimitConfig {
 	return testutils.AppTestConfig.RateLimit
 }
 
-func TestAPIRootRouting(t *testing.T) {
+func createDefaultRouterConfig() RouterConfig {
 	authHandler, postHandler, voteHandler, userHandler, apiHandler, authService := setupTestHandlers()
-	router := NewRouter(RouterConfig{
+	return RouterConfig{
 		APIHandler:      apiHandler,
 		AuthHandler:     authHandler,
 		PostHandler:     postHandler,
@@ -115,7 +116,15 @@ func TestAPIRootRouting(t *testing.T) {
 		UserHandler:     userHandler,
 		AuthService:     authService,
 		RateLimitConfig: defaultRateLimitConfig(),
-	})
+	}
+}
+
+func createTestRouter(cfg RouterConfig) http.Handler {
+	return NewRouter(cfg)
+}
+
+func TestAPIRootRouting(t *testing.T) {
+	router := createTestRouter(createDefaultRouterConfig())
 
 	testCases := []struct {
 		name       string
@@ -141,23 +150,23 @@ func TestAPIRootRouting(t *testing.T) {
 }
 
 func TestProtectedRoutesRequireAuth(t *testing.T) {
-	authHandler, postHandler, voteHandler, userHandler, apiHandler, authService := setupTestHandlers()
-	router := NewRouter(RouterConfig{
-		APIHandler:      apiHandler,
-		AuthHandler:     authHandler,
-		PostHandler:     postHandler,
-		VoteHandler:     voteHandler,
-		UserHandler:     userHandler,
-		AuthService:     authService,
-		RateLimitConfig: defaultRateLimitConfig(),
-	})
+	router := createTestRouter(createDefaultRouterConfig())
 
 	protectedRoutes := []struct {
 		method string
 		path   string
 	}{
 		{http.MethodGet, "/api/auth/me"},
+		{http.MethodPost, "/api/auth/logout"},
+		{http.MethodPost, "/api/auth/revoke"},
+		{http.MethodPost, "/api/auth/revoke-all"},
+		{http.MethodPut, "/api/auth/email"},
+		{http.MethodPut, "/api/auth/username"},
+		{http.MethodPut, "/api/auth/password"},
+		{http.MethodDelete, "/api/auth/account"},
 		{http.MethodPost, "/api/posts"},
+		{http.MethodPut, "/api/posts/1"},
+		{http.MethodDelete, "/api/posts/1"},
 		{http.MethodPost, "/api/posts/1/vote"},
 		{http.MethodDelete, "/api/posts/1/vote"},
 		{http.MethodGet, "/api/posts/1/vote"},
@@ -183,17 +192,9 @@ func TestProtectedRoutesRequireAuth(t *testing.T) {
 }
 
 func TestRouterWithDebugMode(t *testing.T) {
-	authHandler, postHandler, voteHandler, userHandler, apiHandler, authService := setupTestHandlers()
-	router := NewRouter(RouterConfig{
-		Debug:           true,
-		APIHandler:      apiHandler,
-		AuthHandler:     authHandler,
-		PostHandler:     postHandler,
-		VoteHandler:     voteHandler,
-		UserHandler:     userHandler,
-		AuthService:     authService,
-		RateLimitConfig: defaultRateLimitConfig(),
-	})
+	cfg := createDefaultRouterConfig()
+	cfg.Debug = true
+	router := createTestRouter(cfg)
 
 	request := httptest.NewRequest(http.MethodGet, "/api", nil)
 	recorder := httptest.NewRecorder()
@@ -206,16 +207,9 @@ func TestRouterWithDebugMode(t *testing.T) {
 }
 
 func TestRouterWithCacheDisabled(t *testing.T) {
-	authHandler, postHandler, voteHandler, userHandler, apiHandler, authService := setupTestHandlers()
-	router := NewRouter(RouterConfig{
-		DisableCache: true,
-		APIHandler:   apiHandler,
-		AuthHandler:  authHandler,
-		PostHandler:  postHandler,
-		VoteHandler:  voteHandler,
-		UserHandler:  userHandler,
-		AuthService:  authService,
-	})
+	cfg := createDefaultRouterConfig()
+	cfg.DisableCache = true
+	router := createTestRouter(cfg)
 
 	request := httptest.NewRequest(http.MethodGet, "/api", nil)
 	recorder := httptest.NewRecorder()
@@ -228,17 +222,9 @@ func TestRouterWithCacheDisabled(t *testing.T) {
 }
 
 func TestRouterWithCompressionDisabled(t *testing.T) {
-	authHandler, postHandler, voteHandler, userHandler, apiHandler, authService := setupTestHandlers()
-	router := NewRouter(RouterConfig{
-		DisableCompression: true,
-		APIHandler:         apiHandler,
-		AuthHandler:        authHandler,
-		PostHandler:        postHandler,
-		VoteHandler:        voteHandler,
-		UserHandler:        userHandler,
-		AuthService:        authService,
-		RateLimitConfig:    defaultRateLimitConfig(),
-	})
+	cfg := createDefaultRouterConfig()
+	cfg.DisableCompression = true
+	router := createTestRouter(cfg)
 
 	request := httptest.NewRequest(http.MethodGet, "/api", nil)
 	recorder := httptest.NewRecorder()
@@ -251,19 +237,9 @@ func TestRouterWithCompressionDisabled(t *testing.T) {
 }
 
 func TestRouterWithCustomDBMonitor(t *testing.T) {
-	authHandler, postHandler, voteHandler, userHandler, apiHandler, authService := setupTestHandlers()
-	customDBMonitor := middleware.NewInMemoryDBMonitor()
-
-	router := NewRouter(RouterConfig{
-		DBMonitor:       customDBMonitor,
-		APIHandler:      apiHandler,
-		AuthHandler:     authHandler,
-		PostHandler:     postHandler,
-		VoteHandler:     voteHandler,
-		UserHandler:     userHandler,
-		AuthService:     authService,
-		RateLimitConfig: defaultRateLimitConfig(),
-	})
+	cfg := createDefaultRouterConfig()
+	cfg.DBMonitor = middleware.NewInMemoryDBMonitor()
+	router := createTestRouter(cfg)
 
 	request := httptest.NewRequest(http.MethodGet, "/api", nil)
 	recorder := httptest.NewRecorder()
@@ -296,18 +272,9 @@ func TestRouterWithPageHandler(t *testing.T) {
 }
 
 func TestRouterWithStaticDir(t *testing.T) {
-	authHandler, postHandler, voteHandler, userHandler, apiHandler, authService := setupTestHandlers()
-
-	router := NewRouter(RouterConfig{
-		StaticDir:       "/custom/static/path",
-		APIHandler:      apiHandler,
-		AuthHandler:     authHandler,
-		PostHandler:     postHandler,
-		VoteHandler:     voteHandler,
-		UserHandler:     userHandler,
-		AuthService:     authService,
-		RateLimitConfig: defaultRateLimitConfig(),
-	})
+	cfg := createDefaultRouterConfig()
+	cfg.StaticDir = "/custom/static/path"
+	router := createTestRouter(cfg)
 
 	request := httptest.NewRequest(http.MethodGet, "/api", nil)
 	recorder := httptest.NewRecorder()
@@ -320,18 +287,9 @@ func TestRouterWithStaticDir(t *testing.T) {
 }
 
 func TestRouterWithEmptyStaticDir(t *testing.T) {
-	authHandler, postHandler, voteHandler, userHandler, apiHandler, authService := setupTestHandlers()
-
-	router := NewRouter(RouterConfig{
-		StaticDir:       "",
-		APIHandler:      apiHandler,
-		AuthHandler:     authHandler,
-		PostHandler:     postHandler,
-		VoteHandler:     voteHandler,
-		UserHandler:     userHandler,
-		AuthService:     authService,
-		RateLimitConfig: defaultRateLimitConfig(),
-	})
+	cfg := createDefaultRouterConfig()
+	cfg.StaticDir = ""
+	router := createTestRouter(cfg)
 
 	request := httptest.NewRequest(http.MethodGet, "/api", nil)
 	recorder := httptest.NewRecorder()
@@ -344,20 +302,11 @@ func TestRouterWithEmptyStaticDir(t *testing.T) {
 }
 
 func TestRouterWithAllFeaturesDisabled(t *testing.T) {
-	authHandler, postHandler, voteHandler, userHandler, apiHandler, authService := setupTestHandlers()
-
-	router := NewRouter(RouterConfig{
-		Debug:              true,
-		DisableCache:       true,
-		DisableCompression: true,
-		APIHandler:         apiHandler,
-		AuthHandler:        authHandler,
-		PostHandler:        postHandler,
-		VoteHandler:        voteHandler,
-		UserHandler:        userHandler,
-		AuthService:        authService,
-		RateLimitConfig:    defaultRateLimitConfig(),
-	})
+	cfg := createDefaultRouterConfig()
+	cfg.Debug = true
+	cfg.DisableCache = true
+	cfg.DisableCompression = true
+	router := createTestRouter(cfg)
 
 	request := httptest.NewRequest(http.MethodGet, "/api", nil)
 	recorder := httptest.NewRecorder()
@@ -370,15 +319,9 @@ func TestRouterWithAllFeaturesDisabled(t *testing.T) {
 }
 
 func TestRouterWithoutAPIHandler(t *testing.T) {
-	authHandler, postHandler, voteHandler, userHandler, _, authService := setupTestHandlers()
-	router := NewRouter(RouterConfig{
-		AuthHandler:     authHandler,
-		PostHandler:     postHandler,
-		VoteHandler:     voteHandler,
-		UserHandler:     userHandler,
-		AuthService:     authService,
-		RateLimitConfig: defaultRateLimitConfig(),
-	})
+	cfg := createDefaultRouterConfig()
+	cfg.APIHandler = nil
+	router := createTestRouter(cfg)
 
 	request := httptest.NewRequest(http.MethodGet, "/api", nil)
 	recorder := httptest.NewRecorder()
@@ -391,17 +334,7 @@ func TestRouterWithoutAPIHandler(t *testing.T) {
 }
 
 func TestRouterWithoutPageHandler(t *testing.T) {
-	authHandler, postHandler, voteHandler, userHandler, apiHandler, authService := setupTestHandlers()
-
-	router := NewRouter(RouterConfig{
-		APIHandler:      apiHandler,
-		AuthHandler:     authHandler,
-		PostHandler:     postHandler,
-		VoteHandler:     voteHandler,
-		UserHandler:     userHandler,
-		AuthService:     authService,
-		RateLimitConfig: defaultRateLimitConfig(),
-	})
+	router := createTestRouter(createDefaultRouterConfig())
 
 	request := httptest.NewRequest(http.MethodGet, "/", nil)
 	recorder := httptest.NewRecorder()
@@ -414,17 +347,7 @@ func TestRouterWithoutPageHandler(t *testing.T) {
 }
 
 func TestSwaggerRoute(t *testing.T) {
-	authHandler, postHandler, voteHandler, userHandler, apiHandler, authService := setupTestHandlers()
-
-	router := NewRouter(RouterConfig{
-		APIHandler:      apiHandler,
-		AuthHandler:     authHandler,
-		PostHandler:     postHandler,
-		VoteHandler:     voteHandler,
-		UserHandler:     userHandler,
-		AuthService:     authService,
-		RateLimitConfig: defaultRateLimitConfig(),
-	})
+	router := createTestRouter(createDefaultRouterConfig())
 
 	request := httptest.NewRequest(http.MethodGet, "/swagger/", nil)
 	recorder := httptest.NewRecorder()
@@ -437,18 +360,9 @@ func TestSwaggerRoute(t *testing.T) {
 }
 
 func TestStaticFileRoute(t *testing.T) {
-	authHandler, postHandler, voteHandler, userHandler, apiHandler, authService := setupTestHandlers()
-
-	router := NewRouter(RouterConfig{
-		StaticDir:       "../../internal/static/",
-		APIHandler:      apiHandler,
-		AuthHandler:     authHandler,
-		PostHandler:     postHandler,
-		VoteHandler:     voteHandler,
-		UserHandler:     userHandler,
-		AuthService:     authService,
-		RateLimitConfig: defaultRateLimitConfig(),
-	})
+	cfg := createDefaultRouterConfig()
+	cfg.StaticDir = "../../internal/static/"
+	router := createTestRouter(cfg)
 
 	request := httptest.NewRequest(http.MethodGet, "/static/css/main.css", nil)
 	recorder := httptest.NewRecorder()
@@ -461,17 +375,7 @@ func TestStaticFileRoute(t *testing.T) {
 }
 
 func TestRouterConfiguration(t *testing.T) {
-	authHandler, postHandler, voteHandler, userHandler, apiHandler, authService := setupTestHandlers()
-
-	router := NewRouter(RouterConfig{
-		APIHandler:      apiHandler,
-		AuthHandler:     authHandler,
-		PostHandler:     postHandler,
-		VoteHandler:     voteHandler,
-		UserHandler:     userHandler,
-		AuthService:     authService,
-		RateLimitConfig: defaultRateLimitConfig(),
-	})
+	router := createTestRouter(createDefaultRouterConfig())
 
 	if router == nil {
 		t.Error("Router should not be nil")
@@ -487,29 +391,484 @@ func TestRouterConfiguration(t *testing.T) {
 	}
 }
 
-func TestRouterMiddlewareIntegration(t *testing.T) {
-	authHandler, postHandler, voteHandler, userHandler, apiHandler, authService := setupTestHandlers()
+func TestAllRoutesExist(t *testing.T) {
+	router := createTestRouter(createDefaultRouterConfig())
 
-	router := NewRouter(RouterConfig{
-		APIHandler:      apiHandler,
-		AuthHandler:     authHandler,
-		PostHandler:     postHandler,
-		VoteHandler:     voteHandler,
-		UserHandler:     userHandler,
-		AuthService:     authService,
-		RateLimitConfig: defaultRateLimitConfig(),
-	})
-
-	if router == nil {
-		t.Error("Router should not be nil")
+	publicRoutes := []struct {
+		method      string
+		path        string
+		description string
+	}{
+		{http.MethodGet, "/api", "API info"},
+		{http.MethodGet, "/health", "Health check"},
+		{http.MethodGet, "/metrics", "Metrics"},
+		{http.MethodGet, "/robots.txt", "Robots.txt"},
+		{http.MethodGet, "/api/posts", "Get posts"},
+		{http.MethodGet, "/api/posts/search", "Search posts"},
+		{http.MethodGet, "/api/posts/title", "Fetch title from URL"},
+		{http.MethodGet, "/api/posts/1", "Get post by ID"},
+		{http.MethodPost, "/api/auth/register", "Register"},
+		{http.MethodPost, "/api/auth/login", "Login"},
+		{http.MethodPost, "/api/auth/refresh", "Refresh token"},
+		{http.MethodGet, "/api/auth/confirm", "Confirm email"},
+		{http.MethodPost, "/api/auth/resend-verification", "Resend verification"},
+		{http.MethodPost, "/api/auth/forgot-password", "Forgot password"},
+		{http.MethodPost, "/api/auth/reset-password", "Reset password"},
+		{http.MethodPost, "/api/auth/account/confirm", "Confirm account deletion"},
 	}
 
-	request := httptest.NewRequest(http.MethodGet, "/api", nil)
-	recorder := httptest.NewRecorder()
+	protectedRoutes := []struct {
+		method      string
+		path        string
+		description string
+	}{
+		{http.MethodGet, "/api/auth/me", "Get current user"},
+		{http.MethodPost, "/api/auth/logout", "Logout"},
+		{http.MethodPost, "/api/auth/revoke", "Revoke token"},
+		{http.MethodPost, "/api/auth/revoke-all", "Revoke all tokens"},
+		{http.MethodPut, "/api/auth/email", "Update email"},
+		{http.MethodPut, "/api/auth/username", "Update username"},
+		{http.MethodPut, "/api/auth/password", "Update password"},
+		{http.MethodDelete, "/api/auth/account", "Delete account"},
+		{http.MethodPost, "/api/posts", "Create post"},
+		{http.MethodPut, "/api/posts/1", "Update post"},
+		{http.MethodDelete, "/api/posts/1", "Delete post"},
+		{http.MethodPost, "/api/posts/1/vote", "Cast vote"},
+		{http.MethodDelete, "/api/posts/1/vote", "Remove vote"},
+		{http.MethodGet, "/api/posts/1/vote", "Get user vote"},
+		{http.MethodGet, "/api/posts/1/votes", "Get post votes"},
+		{http.MethodGet, "/api/users", "Get users"},
+		{http.MethodPost, "/api/users", "Create user"},
+		{http.MethodGet, "/api/users/1", "Get user by ID"},
+		{http.MethodGet, "/api/users/1/posts", "Get user posts"},
+	}
 
-	router.ServeHTTP(recorder, request)
+	for _, route := range publicRoutes {
+		t.Run(route.description+" "+route.method+" "+route.path, func(t *testing.T) {
+			invalidMethod := http.MethodPatch
+			switch route.method {
+			case http.MethodGet:
+				invalidMethod = http.MethodDelete
+			case http.MethodPost:
+				invalidMethod = http.MethodGet
+			}
+			request := httptest.NewRequest(invalidMethod, route.path, nil)
+			recorder := httptest.NewRecorder()
 
-	if recorder.Code == 0 {
-		t.Error("Router should return a status code")
+			router.ServeHTTP(recorder, request)
+
+			routeExists := recorder.Code == http.StatusMethodNotAllowed
+
+			if !routeExists {
+				request = httptest.NewRequest(route.method, route.path, nil)
+				recorder = httptest.NewRecorder()
+				router.ServeHTTP(recorder, request)
+
+				if recorder.Code == http.StatusNotFound && route.path != "/api/posts/1" && route.path != "/robots.txt" {
+					t.Errorf("Route %s %s should exist, got 404", route.method, route.path)
+				}
+			}
+		})
+	}
+
+	for _, route := range protectedRoutes {
+		t.Run(route.description+" "+route.method+" "+route.path, func(t *testing.T) {
+			request := httptest.NewRequest(route.method, route.path, nil)
+			recorder := httptest.NewRecorder()
+
+			router.ServeHTTP(recorder, request)
+
+			if recorder.Code == http.StatusNotFound {
+				t.Errorf("Route %s %s should exist, got 404", route.method, route.path)
+			}
+			if recorder.Code != http.StatusUnauthorized {
+				t.Errorf("Protected route %s %s should return 401 without auth, got %d", route.method, route.path, recorder.Code)
+			}
+		})
+	}
+}
+
+func TestRouteParameters(t *testing.T) {
+	router := createTestRouter(createDefaultRouterConfig())
+
+	testCases := []struct {
+		name        string
+		method      string
+		pathPattern string
+		testIDs     []string
+		isProtected bool
+	}{
+		{
+			name:        "Get post by ID",
+			method:      http.MethodGet,
+			pathPattern: "/api/posts/{id}",
+			testIDs:     []string{"1", "42", "999", "12345"},
+			isProtected: false,
+		},
+		{
+			name:        "Update post by ID",
+			method:      http.MethodPut,
+			pathPattern: "/api/posts/{id}",
+			testIDs:     []string{"1", "42", "999"},
+			isProtected: true,
+		},
+		{
+			name:        "Delete post by ID",
+			method:      http.MethodDelete,
+			pathPattern: "/api/posts/{id}",
+			testIDs:     []string{"1", "42", "999"},
+			isProtected: true,
+		},
+		{
+			name:        "Get user by ID",
+			method:      http.MethodGet,
+			pathPattern: "/api/users/{id}",
+			testIDs:     []string{"1", "42", "999", "12345"},
+			isProtected: true,
+		},
+		{
+			name:        "Get user posts by user ID",
+			method:      http.MethodGet,
+			pathPattern: "/api/users/{id}/posts",
+			testIDs:     []string{"1", "42", "999", "12345"},
+			isProtected: true,
+		},
+		{
+			name:        "Cast vote for post ID",
+			method:      http.MethodPost,
+			pathPattern: "/api/posts/{id}/vote",
+			testIDs:     []string{"1", "42", "999"},
+			isProtected: true,
+		},
+		{
+			name:        "Remove vote for post ID",
+			method:      http.MethodDelete,
+			pathPattern: "/api/posts/{id}/vote",
+			testIDs:     []string{"1", "42", "999"},
+			isProtected: true,
+		},
+		{
+			name:        "Get user vote for post ID",
+			method:      http.MethodGet,
+			pathPattern: "/api/posts/{id}/vote",
+			testIDs:     []string{"1", "42", "999", "12345"},
+			isProtected: true,
+		},
+		{
+			name:        "Get post votes by post ID",
+			method:      http.MethodGet,
+			pathPattern: "/api/posts/{id}/votes",
+			testIDs:     []string{"1", "42", "999", "12345"},
+			isProtected: true,
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			for _, id := range tc.testIDs {
+				path := replaceID(tc.pathPattern, id)
+				t.Run("ID_"+id, func(t *testing.T) {
+					request := httptest.NewRequest(http.MethodPatch, path, nil)
+					recorder := httptest.NewRecorder()
+					router.ServeHTTP(recorder, request)
+
+					routeExists := recorder.Code == http.StatusMethodNotAllowed
+
+					request = httptest.NewRequest(tc.method, path, nil)
+					recorder = httptest.NewRecorder()
+					router.ServeHTTP(recorder, request)
+
+					if !routeExists {
+						if recorder.Code == http.StatusNotFound {
+							t.Errorf("Route %s %s should exist with ID %s, got 404", tc.method, path, id)
+							return
+						}
+					}
+
+					if tc.isProtected {
+						if recorder.Code != http.StatusUnauthorized {
+							t.Errorf("Protected route %s %s should return 401 without auth, got %d", tc.method, path, recorder.Code)
+						}
+					}
+				})
+			}
+		})
+	}
+}
+
+func replaceID(pattern, id string) string {
+	return strings.Replace(pattern, "{id}", id, 1)
+}
+
+func TestInvalidRouteParameters(t *testing.T) {
+	router := createTestRouter(createDefaultRouterConfig())
+
+	testCases := []struct {
+		name        string
+		method      string
+		path        string
+		expectedMin int
+		expectedMax int
+		isProtected bool
+		allow401    bool
+	}{
+		{
+			name:        "Non-numeric post ID",
+			method:      http.MethodGet,
+			path:        "/api/posts/abc",
+			expectedMin: http.StatusBadRequest,
+			expectedMax: http.StatusBadRequest,
+			isProtected: false,
+		},
+		{
+			name:        "Negative post ID",
+			method:      http.MethodGet,
+			path:        "/api/posts/-1",
+			expectedMin: http.StatusBadRequest,
+			expectedMax: http.StatusBadRequest,
+			isProtected: false,
+		},
+		{
+			name:        "Zero post ID",
+			method:      http.MethodGet,
+			path:        "/api/posts/0",
+			expectedMin: http.StatusBadRequest,
+			expectedMax: http.StatusNotFound,
+			isProtected: false,
+		},
+		{
+			name:        "Post ID with special characters",
+			method:      http.MethodGet,
+			path:        "/api/posts/123@456",
+			expectedMin: http.StatusBadRequest,
+			expectedMax: http.StatusBadRequest,
+			isProtected: false,
+		},
+		{
+			name:        "Post ID with encoded spaces",
+			method:      http.MethodGet,
+			path:        "/api/posts/12%2034",
+			expectedMin: http.StatusBadRequest,
+			expectedMax: http.StatusBadRequest,
+			isProtected: false,
+		},
+		{
+			name:        "Non-numeric user ID",
+			method:      http.MethodGet,
+			path:        "/api/users/xyz",
+			expectedMin: http.StatusBadRequest,
+			expectedMax: http.StatusUnauthorized,
+			isProtected: true,
+			allow401:    true,
+		},
+		{
+			name:        "Negative user ID",
+			method:      http.MethodGet,
+			path:        "/api/users/-5",
+			expectedMin: http.StatusBadRequest,
+			expectedMax: http.StatusUnauthorized,
+			isProtected: true,
+			allow401:    true,
+		},
+		{
+			name:        "Non-numeric post ID in vote route",
+			method:      http.MethodGet,
+			path:        "/api/posts/invalid/vote",
+			expectedMin: http.StatusBadRequest,
+			expectedMax: http.StatusUnauthorized,
+			isProtected: true,
+			allow401:    true,
+		},
+		{
+			name:        "Very large post ID",
+			method:      http.MethodGet,
+			path:        "/api/posts/999999999999",
+			expectedMin: http.StatusBadRequest,
+			expectedMax: http.StatusNotFound,
+			isProtected: false,
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			request := httptest.NewRequest(tc.method, tc.path, nil)
+			recorder := httptest.NewRecorder()
+
+			router.ServeHTTP(recorder, request)
+
+			if tc.isProtected && tc.allow401 {
+				if recorder.Code != http.StatusUnauthorized && (recorder.Code < tc.expectedMin || recorder.Code > tc.expectedMax) {
+					t.Errorf("Protected route %s %s with invalid parameter should return 401 or status between %d and %d, got %d", tc.method, tc.path, tc.expectedMin, tc.expectedMax, recorder.Code)
+				}
+			} else {
+				if recorder.Code < tc.expectedMin || recorder.Code > tc.expectedMax {
+					t.Errorf("Route %s %s should return status between %d and %d, got %d", tc.method, tc.path, tc.expectedMin, tc.expectedMax, recorder.Code)
+				}
+
+				if recorder.Code != http.StatusNotFound && recorder.Code < 400 {
+					t.Errorf("Route %s %s with invalid parameter should return error status (4xx), got %d", tc.method, tc.path, recorder.Code)
+				}
+			}
+		})
+	}
+}
+
+func TestQueryParameters(t *testing.T) {
+	router := createTestRouter(createDefaultRouterConfig())
+
+	testCases := []struct {
+		name        string
+		method      string
+		path        string
+		queryParams string
+		expectRoute bool
+	}{
+		{
+			name:        "Get posts with limit and offset",
+			method:      http.MethodGet,
+			path:        "/api/posts",
+			queryParams: "limit=10&offset=5",
+			expectRoute: true,
+		},
+		{
+			name:        "Get posts with only limit",
+			method:      http.MethodGet,
+			path:        "/api/posts",
+			queryParams: "limit=20",
+			expectRoute: true,
+		},
+		{
+			name:        "Get posts with only offset",
+			method:      http.MethodGet,
+			path:        "/api/posts",
+			queryParams: "offset=10",
+			expectRoute: true,
+		},
+		{
+			name:        "Search posts with query parameter",
+			method:      http.MethodGet,
+			path:        "/api/posts/search",
+			queryParams: "q=test",
+			expectRoute: true,
+		},
+		{
+			name:        "Search posts with query, limit, and offset",
+			method:      http.MethodGet,
+			path:        "/api/posts/search",
+			queryParams: "q=test&limit=15&offset=3",
+			expectRoute: true,
+		},
+		{
+			name:        "Fetch title with URL parameter",
+			method:      http.MethodGet,
+			path:        "/api/posts/title",
+			queryParams: "url=https://example.com",
+			expectRoute: true,
+		},
+		{
+			name:        "Confirm email with token parameter",
+			method:      http.MethodGet,
+			path:        "/api/auth/confirm",
+			queryParams: "token=abc123",
+			expectRoute: true,
+		},
+		{
+			name:        "Get posts with invalid limit",
+			method:      http.MethodGet,
+			path:        "/api/posts",
+			queryParams: "limit=abc",
+			expectRoute: true,
+		},
+		{
+			name:        "Get posts with negative limit",
+			method:      http.MethodGet,
+			path:        "/api/posts",
+			queryParams: "limit=-5",
+			expectRoute: true,
+		},
+		{
+			name:        "Get posts with negative offset",
+			method:      http.MethodGet,
+			path:        "/api/posts",
+			queryParams: "offset=-10",
+			expectRoute: true,
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			fullPath := tc.path
+			if tc.queryParams != "" {
+				fullPath += "?" + tc.queryParams
+			}
+
+			request := httptest.NewRequest(tc.method, fullPath, nil)
+			recorder := httptest.NewRecorder()
+
+			router.ServeHTTP(recorder, request)
+
+			if tc.expectRoute {
+				if recorder.Code == http.StatusNotFound {
+					t.Errorf("Route %s %s should exist with query parameters, got 404", tc.method, fullPath)
+				}
+			}
+		})
+	}
+}
+
+func TestRouteConflicts(t *testing.T) {
+	router := createTestRouter(createDefaultRouterConfig())
+
+	testCases := []struct {
+		name        string
+		method      string
+		path        string
+		description string
+	}{
+		{
+			name:        "posts/search should not match posts/{id}",
+			method:      http.MethodGet,
+			path:        "/api/posts/search",
+			description: "search route should be matched, not treated as ID",
+		},
+		{
+			name:        "posts/title should not match posts/{id}",
+			method:      http.MethodGet,
+			path:        "/api/posts/title",
+			description: "title route should be matched, not treated as ID",
+		},
+		{
+			name:        "posts/{id} should work with numeric ID",
+			method:      http.MethodGet,
+			path:        "/api/posts/123",
+			description: "numeric ID should match {id} route",
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			request := httptest.NewRequest(tc.method, tc.path, nil)
+			recorder := httptest.NewRecorder()
+
+			router.ServeHTTP(recorder, request)
+
+			switch tc.path {
+			case "/api/posts/search":
+				if recorder.Code == http.StatusNotFound {
+					t.Errorf("%s: Route %s %s should exist (not 404), got %d", tc.description, tc.method, tc.path, recorder.Code)
+				}
+			case "/api/posts/title":
+				if recorder.Code == http.StatusNotFound {
+					t.Errorf("%s: Route %s %s should exist (not 404), got %d", tc.description, tc.method, tc.path, recorder.Code)
+				}
+			case "/api/posts/123":
+				if recorder.Code == http.StatusNotFound {
+					return
+				}
+				if recorder.Code < 400 {
+					t.Errorf("%s: Route %s %s should return 4xx or 5xx, got %d", tc.description, tc.method, tc.path, recorder.Code)
+				}
+			}
+		})
 	}
 }

internal/services/auth_service.go

@@ -1,12 +1,93 @@
 package services
 
 import (
+	"crypto/rand"
+	"crypto/sha256"
+	"encoding/hex"
+	"errors"
 	"fmt"
+	"net/mail"
+	"strings"
 
 	"goyco/internal/config"
 	"goyco/internal/database"
 )
 
+const (
+	defaultTokenExpirationHours  = 24
+	verificationTokenBytes       = 32
+	deletionTokenExpirationHours = 24
+)
+
+var (
+	ErrInvalidCredentials       = errors.New("invalid credentials")
+	ErrInvalidToken             = errors.New("invalid or expired token")
+	ErrUsernameTaken            = errors.New("username already exists")
+	ErrEmailTaken               = errors.New("email already exists")
+	ErrInvalidEmail             = errors.New("invalid email address")
+	ErrPasswordTooShort         = errors.New("password too short")
+	ErrEmailNotVerified         = errors.New("email not verified")
+	ErrAccountLocked            = errors.New("account is locked")
+	ErrInvalidVerificationToken = errors.New("invalid verification token")
+	ErrEmailSenderUnavailable   = errors.New("email sender not configured")
+	ErrDeletionEmailFailed      = errors.New("account deletion email failed")
+	ErrInvalidDeletionToken     = errors.New("invalid account deletion token")
+	ErrUserNotFound             = errors.New("user not found")
+	ErrDeletionRequestNotFound  = errors.New("deletion request not found")
+)
+
+type AuthResult struct {
+	AccessToken  string         `json:"access_token" example:"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."`
+	RefreshToken string         `json:"refresh_token" example:"a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6q7r8s9t0"`
+	User         *database.User `json:"user"`
+}
+
+type RegistrationResult struct {
+	User             *database.User `json:"user"`
+	VerificationSent bool           `json:"verification_sent"`
+}
+
+func normalizeEmail(email string) (string, error) {
+	trimmed := strings.TrimSpace(email)
+	if trimmed == "" {
+		return "", fmt.Errorf("email is required")
+	}
+
+	parsed, err := mail.ParseAddress(trimmed)
+	if err != nil {
+		return "", ErrInvalidEmail
+	}
+
+	return strings.ToLower(parsed.Address), nil
+}
+
+func generateVerificationToken() (string, string, error) {
+	buf := make([]byte, verificationTokenBytes)
+	if _, err := rand.Read(buf); err != nil {
+		return "", "", fmt.Errorf("generate verification token: %w", err)
+	}
+
+	token := hex.EncodeToString(buf)
+	hashed := HashVerificationToken(token)
+	return token, hashed, nil
+}
+
+func HashVerificationToken(token string) string {
+	sum := sha256.Sum256([]byte(token))
+	return hex.EncodeToString(sum[:])
+}
+
+func sanitizeUser(user *database.User) *database.User {
+	if user == nil {
+		return nil
+	}
+
+	copy := *user
+	copy.Password = ""
+	copy.EmailVerificationToken = ""
+	return &copy
+}
+
 type AuthFacade struct {
 	registrationService   *RegistrationService
 	passwordResetService  *PasswordResetService

internal/services/auth_types.go

@@ -1,35 +0,0 @@
-package services
-
-import (
-	"errors"
-
-	"goyco/internal/database"
-)
-
-var (
-	ErrInvalidCredentials       = errors.New("invalid credentials")
-	ErrInvalidToken             = errors.New("invalid or expired token")
-	ErrUsernameTaken            = errors.New("username already exists")
-	ErrEmailTaken               = errors.New("email already exists")
-	ErrInvalidEmail             = errors.New("invalid email address")
-	ErrPasswordTooShort         = errors.New("password too short")
-	ErrEmailNotVerified         = errors.New("email not verified")
-	ErrAccountLocked            = errors.New("account is locked")
-	ErrInvalidVerificationToken = errors.New("invalid verification token")
-	ErrEmailSenderUnavailable   = errors.New("email sender not configured")
-	ErrDeletionEmailFailed      = errors.New("account deletion email failed")
-	ErrInvalidDeletionToken     = errors.New("invalid account deletion token")
-	ErrUserNotFound             = errors.New("user not found")
-	ErrDeletionRequestNotFound  = errors.New("deletion request not found")
-)
-
-type AuthResult struct {
-	AccessToken  string         `json:"access_token" example:"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."`
-	RefreshToken string         `json:"refresh_token" example:"a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6q7r8s9t0"`
-	User         *database.User `json:"user"`
-}
-
-type RegistrationResult struct {
-	User             *database.User `json:"user"`
-	VerificationSent bool           `json:"verification_sent"`
-}

internal/services/auth_utils.go

@@ -1,59 +0,0 @@
-package services
-
-import (
-	"crypto/rand"
-	"crypto/sha256"
-	"encoding/hex"
-	"fmt"
-	"net/mail"
-	"strings"
-
-	"goyco/internal/database"
-)
-
-const (
-	defaultTokenExpirationHours  = 24
-	verificationTokenBytes       = 32
-	deletionTokenExpirationHours = 24
-)
-
-func normalizeEmail(email string) (string, error) {
-	trimmed := strings.TrimSpace(email)
-	if trimmed == "" {
-		return "", fmt.Errorf("email is required")
-	}
-
-	parsed, err := mail.ParseAddress(trimmed)
-	if err != nil {
-		return "", ErrInvalidEmail
-	}
-
-	return strings.ToLower(parsed.Address), nil
-}
-
-func generateVerificationToken() (string, string, error) {
-	buf := make([]byte, verificationTokenBytes)
-	if _, err := rand.Read(buf); err != nil {
-		return "", "", fmt.Errorf("generate verification token: %w", err)
-	}
-
-	token := hex.EncodeToString(buf)
-	hashed := HashVerificationToken(token)
-	return token, hashed, nil
-}
-
-func HashVerificationToken(token string) string {
-	sum := sha256.Sum256([]byte(token))
-	return hex.EncodeToString(sum[:])
-}
-
-func sanitizeUser(user *database.User) *database.User {
-	if user == nil {
-		return nil
-	}
-
-	copy := *user
-	copy.Password = ""
-	copy.EmailVerificationToken = ""
-	return &copy
-}

internal/templates/template_test.go

@@ -2,43 +2,70 @@ package templates
 
 import (
 	"html/template"
-	"io/fs"
 	"path/filepath"
+	"strings"
 	"testing"
+	"time"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 
-func TestTemplateParsing(t *testing.T) {
-	templateDir := "./"
+func templateFuncMap() template.FuncMap {
+	return template.FuncMap{
+		"formatTime": func(t time.Time) string {
+			if t.IsZero() {
+				return ""
+			}
+			return t.Format("02 Jan 2006 15:04")
+		},
+		"truncate": func(s string, length int) string {
+			if len(s) <= length {
+				return s
+			}
+			if length <= 3 {
+				return s[:length]
+			}
+			return s[:length-3] + "..."
+		},
+		"substr": func(s string, start, length int) string {
+			if start >= len(s) {
+				return ""
+			}
+			end := min(start+length, len(s))
+			return s[start:end]
+		},
+		"upper": strings.ToUpper,
+	}
+}
 
-	var templateFiles []string
-	err := filepath.WalkDir(templateDir, func(path string, d fs.DirEntry, err error) error {
-		if err != nil {
-			return err
-		}
-		if !d.IsDir() && filepath.Ext(path) == ".gohtml" {
-			templateFiles = append(templateFiles, path)
-		}
-		return nil
-	})
+func TestTemplateParsing(t *testing.T) {
+	layoutPath := filepath.Join(".", "base.gohtml")
+	require.FileExists(t, layoutPath, "base layout is required for all templates")
+
+	partials, err := filepath.Glob(filepath.Join(".", "partials", "*.gohtml"))
 	require.NoError(t, err)
 
-	tmpl := template.New("test")
+	pages, err := filepath.Glob(filepath.Join(".", "*.gohtml"))
+	require.NoError(t, err)
+	require.NotEmpty(t, pages, "no page templates found")
 
-	tmpl = tmpl.Funcs(template.FuncMap{
-		"formatTime": func(any) string { return "2024-01-01" },
-		"eq":         func(a, b any) bool { return a == b },
-		"ne":         func(a, b any) bool { return a != b },
-		"len":        func(s any) int { return 0 },
-		"range":      func(s any) any { return s },
-	})
+	for _, page := range pages {
+		if filepath.Base(page) == "base.gohtml" {
+			continue
+		}
 
-	for _, file := range templateFiles {
-		t.Run(file, func(t *testing.T) {
-			_, err := tmpl.ParseFiles(file)
-			assert.NoError(t, err, "Template %s should parse without errors", file)
+		page := page
+		t.Run(filepath.Base(page), func(t *testing.T) {
+			t.Parallel()
+
+			files := append([]string{layoutPath}, partials...)
+			files = append(files, page)
+
+			tmpl, err := template.New(filepath.Base(page)).Funcs(templateFuncMap()).ParseFiles(files...)
+			require.NoError(t, err)
+			require.NotNil(t, tmpl.Lookup("layout"), "layout template should be available")
+			require.NotNil(t, tmpl.Lookup("content"), "content block should be defined by page templates")
 		})
 	}
 }

scripts/setup-postgres.sh

@@ -2,21 +2,21 @@
 # helper script to setup a postgres database on deb based systems
 
 if [ "$EUID" -ne 0 ]; then
-    echo "Please run as root"
-    exit 1
+  echo "Please run as root"
+  exit 1
 fi
 
 read -s "Do you want to install PostgreSQL 18? [y/N] " INSTALL_PG
 if [ "$INSTALL_PG" != "y" ]; then
-    echo "PostgreSQL 18 will not be installed"
-    exit 0
+  echo "PostgreSQL 18 will not be installed"
+  exit 0
 fi
 
 read -s -p "Enter password for PostgreSQL user 'goyco': " GOYCO_PWD
 echo
 
 apt-get update
-apt-get install -y postgresql-18 
+apt-get install -y postgresql-18
 
 systemctl enable --now postgresql
 
@@ -44,5 +44,3 @@ GRANT ALL PRIVILEGES ON DATABASE goyco TO goyco;
 EOF
 
 echo "PostgreSQL 18 installed, database 'goyco' and user 'goyco' set up."
-
-