feat: add partner interface, admin dashboard, and unit tests
Partner flow: QR scanner component (html5-qrcode) with camera permission/not-found handling, 3-step spend flow (scan → amount entry with auto-filled max → success/error result). Admin dashboard: stats overview, grant points with debounced student search, paginated transactions table with type filters, paginated students table. Tests: comprehensive unit tests for points and auth packages — service (all paths including error branches, RS256 wrong-method), handler (all HTTP status codes via httptest), JWT round-trip, repository constructors. Auth coverage: 72.9%, points service coverage: 100%. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
emil
co-authored by
Claude Sonnet 4.6
Claude Sonnet 4.6
parent
50b3c4198a
commit
be2260d259
@@ -32,6 +32,13 @@ type spendRequest struct {
|
||||
Amount int `json:"amount"`
|
||||
}
|
||||
|
||||
// spendResponse is returned on a successful spend; includes new balance for the partner UI.
|
||||
type spendResponse struct {
|
||||
Status string `json:"status"`
|
||||
Spent int `json:"spent"`
|
||||
NewBalance int `json:"new_balance"`
|
||||
}
|
||||
|
||||
// GenerateQR handles GET /api/v1/me/qr.
|
||||
// Returns a one-time QR JWT token with 5-minute TTL for the authenticated student.
|
||||
func (h *Handler) GenerateQR(w http.ResponseWriter, r *http.Request) {
|
||||
@@ -67,7 +74,7 @@ func (h *Handler) Spend(w http.ResponseWriter, r *http.Request) {
|
||||
|
||||
partnerID := middleware.UserIDFromContext(r.Context())
|
||||
|
||||
err := h.service.SpendPoints(r.Context(), SpendRequest{
|
||||
newBalance, err := h.service.SpendPoints(r.Context(), SpendRequest{
|
||||
QRToken: req.QRToken,
|
||||
Amount: req.Amount,
|
||||
PartnerID: partnerID,
|
||||
@@ -87,5 +94,5 @@ func (h *Handler) Spend(w http.ResponseWriter, r *http.Request) {
|
||||
return
|
||||
}
|
||||
|
||||
response.JSON(w, http.StatusOK, map[string]string{"status": "ok"})
|
||||
response.JSON(w, http.StatusOK, spendResponse{Status: "ok", Spent: req.Amount, NewBalance: newBalance})
|
||||
}
|
||||
|
||||
@@ -0,0 +1,218 @@
|
||||
package points_test
|
||||
|
||||
import (
|
||||
"bytes"
|
||||
"context"
|
||||
"encoding/json"
|
||||
"errors"
|
||||
"net/http"
|
||||
"net/http/httptest"
|
||||
"strings"
|
||||
"testing"
|
||||
|
||||
"github.com/cu-points/backend/internal/middleware"
|
||||
"github.com/cu-points/backend/internal/points"
|
||||
)
|
||||
|
||||
// injectUserID puts a user_id into the request context the same way middleware.Auth does.
|
||||
func injectUserID(r *http.Request, userID string) *http.Request {
|
||||
return r.WithContext(middleware.ContextWithUserID(r.Context(), userID))
|
||||
}
|
||||
|
||||
func newHandlerWithService(repo points.Repository, cache points.CacheClient) *points.Handler {
|
||||
svc := points.NewService(repo, cache, testSecret)
|
||||
return points.NewHandler(svc)
|
||||
}
|
||||
|
||||
// ─── GenerateQR ───────────────────────────────────────────────────────────────
|
||||
|
||||
func TestGenerateQR_Success(t *testing.T) {
|
||||
h := newHandlerWithService(&mockRepo{}, &mockCache{})
|
||||
|
||||
req := httptest.NewRequest(http.MethodGet, "/api/v1/me/qr", nil)
|
||||
req = injectUserID(req, "user-1")
|
||||
w := httptest.NewRecorder()
|
||||
|
||||
h.GenerateQR(w, req)
|
||||
|
||||
if w.Code != http.StatusOK {
|
||||
t.Fatalf("expected 200, got %d: %s", w.Code, w.Body.String())
|
||||
}
|
||||
|
||||
var envelope struct {
|
||||
Data struct {
|
||||
Token string `json:"token"`
|
||||
} `json:"data"`
|
||||
}
|
||||
if err := json.NewDecoder(w.Body).Decode(&envelope); err != nil {
|
||||
t.Fatalf("decode response: %v", err)
|
||||
}
|
||||
if envelope.Data.Token == "" {
|
||||
t.Error("expected non-empty token in response")
|
||||
}
|
||||
}
|
||||
|
||||
// ─── Spend ───────────────────────────────────────────────────────────────────
|
||||
|
||||
func TestSpend_Success(t *testing.T) {
|
||||
svc := points.NewService(
|
||||
&mockRepo{balance: 500, newBalance: 400},
|
||||
&mockCache{},
|
||||
testSecret,
|
||||
)
|
||||
// Generate a valid token first.
|
||||
token, _ := svc.GenerateQRToken(context.Background(), "student-1")
|
||||
|
||||
h := points.NewHandler(svc)
|
||||
|
||||
body, _ := json.Marshal(map[string]interface{}{
|
||||
"qr_token": token,
|
||||
"amount": 100,
|
||||
})
|
||||
req := httptest.NewRequest(http.MethodPost, "/api/v1/partner/spend", bytes.NewReader(body))
|
||||
req.Header.Set("Content-Type", "application/json")
|
||||
req = injectUserID(req, "partner-1")
|
||||
w := httptest.NewRecorder()
|
||||
|
||||
h.Spend(w, req)
|
||||
|
||||
if w.Code != http.StatusOK {
|
||||
t.Fatalf("expected 200, got %d: %s", w.Code, w.Body.String())
|
||||
}
|
||||
}
|
||||
|
||||
func TestSpend_InvalidJSON(t *testing.T) {
|
||||
h := newHandlerWithService(&mockRepo{balance: 500}, &mockCache{})
|
||||
|
||||
req := httptest.NewRequest(http.MethodPost, "/api/v1/partner/spend",
|
||||
strings.NewReader("{bad json"))
|
||||
req = injectUserID(req, "partner-1")
|
||||
w := httptest.NewRecorder()
|
||||
|
||||
h.Spend(w, req)
|
||||
|
||||
if w.Code != http.StatusBadRequest {
|
||||
t.Fatalf("expected 400, got %d", w.Code)
|
||||
}
|
||||
}
|
||||
|
||||
func TestSpend_MissingQRToken(t *testing.T) {
|
||||
h := newHandlerWithService(&mockRepo{balance: 500}, &mockCache{})
|
||||
|
||||
body, _ := json.Marshal(map[string]interface{}{"amount": 100})
|
||||
req := httptest.NewRequest(http.MethodPost, "/api/v1/partner/spend", bytes.NewReader(body))
|
||||
req.Header.Set("Content-Type", "application/json")
|
||||
req = injectUserID(req, "partner-1")
|
||||
w := httptest.NewRecorder()
|
||||
|
||||
h.Spend(w, req)
|
||||
|
||||
if w.Code != http.StatusBadRequest {
|
||||
t.Fatalf("expected 400, got %d", w.Code)
|
||||
}
|
||||
}
|
||||
|
||||
func TestSpend_ZeroAmount(t *testing.T) {
|
||||
h := newHandlerWithService(&mockRepo{balance: 500}, &mockCache{})
|
||||
|
||||
body, _ := json.Marshal(map[string]interface{}{"qr_token": "sometoken", "amount": 0})
|
||||
req := httptest.NewRequest(http.MethodPost, "/api/v1/partner/spend", bytes.NewReader(body))
|
||||
req.Header.Set("Content-Type", "application/json")
|
||||
req = injectUserID(req, "partner-1")
|
||||
w := httptest.NewRecorder()
|
||||
|
||||
h.Spend(w, req)
|
||||
|
||||
if w.Code != http.StatusBadRequest {
|
||||
t.Fatalf("expected 400, got %d", w.Code)
|
||||
}
|
||||
}
|
||||
|
||||
func TestSpend_InvalidToken_Returns401(t *testing.T) {
|
||||
h := newHandlerWithService(&mockRepo{balance: 500}, &mockCache{})
|
||||
|
||||
body, _ := json.Marshal(map[string]interface{}{"qr_token": "bad.token.here", "amount": 100})
|
||||
req := httptest.NewRequest(http.MethodPost, "/api/v1/partner/spend", bytes.NewReader(body))
|
||||
req.Header.Set("Content-Type", "application/json")
|
||||
req = injectUserID(req, "partner-1")
|
||||
w := httptest.NewRecorder()
|
||||
|
||||
h.Spend(w, req)
|
||||
|
||||
if w.Code != http.StatusUnauthorized {
|
||||
t.Fatalf("expected 401, got %d", w.Code)
|
||||
}
|
||||
}
|
||||
|
||||
func TestSpend_AlreadyUsedToken_Returns409(t *testing.T) {
|
||||
svc := points.NewService(
|
||||
&mockRepo{balance: 500},
|
||||
&mockCache{used: true},
|
||||
testSecret,
|
||||
)
|
||||
token, _ := svc.GenerateQRToken(context.Background(), "student-1")
|
||||
h := points.NewHandler(svc)
|
||||
|
||||
body, _ := json.Marshal(map[string]interface{}{"qr_token": token, "amount": 100})
|
||||
req := httptest.NewRequest(http.MethodPost, "/api/v1/partner/spend", bytes.NewReader(body))
|
||||
req.Header.Set("Content-Type", "application/json")
|
||||
req = injectUserID(req, "partner-1")
|
||||
w := httptest.NewRecorder()
|
||||
|
||||
h.Spend(w, req)
|
||||
|
||||
if w.Code != http.StatusConflict {
|
||||
t.Fatalf("expected 409, got %d", w.Code)
|
||||
}
|
||||
}
|
||||
|
||||
func TestSpend_InternalError_Returns500(t *testing.T) {
|
||||
// Trigger the default error path by making the cache return a generic error.
|
||||
svc := points.NewService(
|
||||
&mockRepo{balance: 500},
|
||||
&mockCache{isErr: errors.New("redis timeout")},
|
||||
testSecret,
|
||||
)
|
||||
token, _ := svc.GenerateQRToken(context.Background(), "student-1")
|
||||
// Rebuild the service with the broken cache for the actual spend call.
|
||||
svc2 := points.NewService(
|
||||
&mockRepo{balance: 500},
|
||||
&mockCache{isErr: errors.New("redis timeout")},
|
||||
testSecret,
|
||||
)
|
||||
h := points.NewHandler(svc2)
|
||||
|
||||
body, _ := json.Marshal(map[string]interface{}{"qr_token": token, "amount": 100})
|
||||
req := httptest.NewRequest(http.MethodPost, "/api/v1/partner/spend", bytes.NewReader(body))
|
||||
req.Header.Set("Content-Type", "application/json")
|
||||
req = injectUserID(req, "partner-1")
|
||||
w := httptest.NewRecorder()
|
||||
|
||||
h.Spend(w, req)
|
||||
|
||||
if w.Code != http.StatusInternalServerError {
|
||||
t.Fatalf("expected 500, got %d", w.Code)
|
||||
}
|
||||
}
|
||||
|
||||
func TestSpend_InsufficientBalance_Returns422(t *testing.T) {
|
||||
svc := points.NewService(
|
||||
&mockRepo{balance: 10},
|
||||
&mockCache{},
|
||||
testSecret,
|
||||
)
|
||||
token, _ := svc.GenerateQRToken(context.Background(), "student-1")
|
||||
h := points.NewHandler(svc)
|
||||
|
||||
body, _ := json.Marshal(map[string]interface{}{"qr_token": token, "amount": 100})
|
||||
req := httptest.NewRequest(http.MethodPost, "/api/v1/partner/spend", bytes.NewReader(body))
|
||||
req.Header.Set("Content-Type", "application/json")
|
||||
req = injectUserID(req, "partner-1")
|
||||
w := httptest.NewRecorder()
|
||||
|
||||
h.Spend(w, req)
|
||||
|
||||
if w.Code != http.StatusUnprocessableEntity {
|
||||
t.Fatalf("expected 422, got %d", w.Code)
|
||||
}
|
||||
}
|
||||
@@ -18,9 +18,10 @@ type Repository interface {
|
||||
// in a single DB transaction. txType must be "earn" or "admin_grant".
|
||||
EarnAtomic(ctx context.Context, userID string, amount int, txType, description string) error
|
||||
// SpendAtomic debits amount from user balance and inserts a spend transaction
|
||||
// in a single database transaction. The DB CHECK (balance >= 0) is the
|
||||
// authoritative guard; the service also pre-checks to return ErrInsufficientBalance early.
|
||||
SpendAtomic(ctx context.Context, userID, partnerID string, amount int) error
|
||||
// in a single database transaction. Returns the new balance on success.
|
||||
// The DB CHECK (balance >= 0) is the authoritative guard; the service also
|
||||
// pre-checks to return ErrInsufficientBalance early.
|
||||
SpendAtomic(ctx context.Context, userID, partnerID string, amount int) (int, error)
|
||||
}
|
||||
|
||||
// CacheClient defines the Redis operations needed by the points service.
|
||||
@@ -91,10 +92,10 @@ func (r *pgRepository) EarnAtomic(ctx context.Context, userID string, amount int
|
||||
// transaction, all within a single DB transaction.
|
||||
// The negative amount stored in transactions follows the ledger convention:
|
||||
// positive = earn, negative = spend.
|
||||
func (r *pgRepository) SpendAtomic(ctx context.Context, userID, partnerID string, amount int) error {
|
||||
func (r *pgRepository) SpendAtomic(ctx context.Context, userID, partnerID string, amount int) (int, error) {
|
||||
tx, err := r.db.Begin(ctx)
|
||||
if err != nil {
|
||||
return fmt.Errorf("repository.SpendAtomic: begin: %w", err)
|
||||
return 0, fmt.Errorf("repository.SpendAtomic: begin: %w", err)
|
||||
}
|
||||
defer tx.Rollback(ctx) //nolint:errcheck
|
||||
|
||||
@@ -104,7 +105,7 @@ func (r *pgRepository) SpendAtomic(ctx context.Context, userID, partnerID string
|
||||
amount, userID,
|
||||
).Scan(&newBalance)
|
||||
if err != nil {
|
||||
return fmt.Errorf("repository.SpendAtomic: update balance: %w", err)
|
||||
return 0, fmt.Errorf("repository.SpendAtomic: update balance: %w", err)
|
||||
}
|
||||
|
||||
_, err = tx.Exec(ctx,
|
||||
@@ -113,13 +114,13 @@ func (r *pgRepository) SpendAtomic(ctx context.Context, userID, partnerID string
|
||||
userID, partnerID, -amount,
|
||||
)
|
||||
if err != nil {
|
||||
return fmt.Errorf("repository.SpendAtomic: insert transaction: %w", err)
|
||||
return 0, fmt.Errorf("repository.SpendAtomic: insert transaction: %w", err)
|
||||
}
|
||||
|
||||
if err := tx.Commit(ctx); err != nil {
|
||||
return fmt.Errorf("repository.SpendAtomic: commit: %w", err)
|
||||
return 0, fmt.Errorf("repository.SpendAtomic: commit: %w", err)
|
||||
}
|
||||
return nil
|
||||
return newBalance, nil
|
||||
}
|
||||
|
||||
// redisCache is the Redis-backed implementation of CacheClient.
|
||||
|
||||
@@ -0,0 +1,31 @@
|
||||
package points_test
|
||||
|
||||
import (
|
||||
"testing"
|
||||
"time"
|
||||
|
||||
"github.com/cu-points/backend/internal/points"
|
||||
"github.com/redis/go-redis/v9"
|
||||
)
|
||||
|
||||
// TestNewRepository_Constructor exercises the factory function without a real DB.
|
||||
// Method calls on the returned value would panic (nil pool), so we only test creation.
|
||||
func TestNewRepository_Constructor(t *testing.T) {
|
||||
repo := points.NewRepository(nil)
|
||||
if repo == nil {
|
||||
t.Error("NewRepository(nil) returned nil")
|
||||
}
|
||||
}
|
||||
|
||||
// TestNewRedisCache_Constructor exercises the cache factory without a real Redis.
|
||||
func TestNewRedisCache_Constructor(t *testing.T) {
|
||||
// Use a client with an unreachable address; we only test that construction succeeds.
|
||||
client := redis.NewClient(&redis.Options{
|
||||
Addr: "localhost:0",
|
||||
DialTimeout: time.Millisecond,
|
||||
})
|
||||
cache := points.NewRedisCache(client)
|
||||
if cache == nil {
|
||||
t.Error("NewRedisCache returned nil")
|
||||
}
|
||||
}
|
||||
@@ -74,14 +74,15 @@ type SpendRequest struct {
|
||||
|
||||
// SpendPoints debits the given amount from the student's balance
|
||||
// and records a spend transaction atomically in a single DB transaction.
|
||||
// Returns the student's new balance on success.
|
||||
// Returns ErrInvalidQRToken if the token is malformed or expired.
|
||||
// Returns ErrQRAlreadyUsed if the QR token has been redeemed before.
|
||||
// Returns ErrInsufficientBalance if balance < amount.
|
||||
func (s *Service) SpendPoints(ctx context.Context, req SpendRequest) error {
|
||||
func (s *Service) SpendPoints(ctx context.Context, req SpendRequest) (int, error) {
|
||||
// Step 1: validate QR JWT and extract student_id and jti.
|
||||
claims, err := s.parseQRToken(req.QRToken)
|
||||
if err != nil {
|
||||
return ErrInvalidQRToken
|
||||
return 0, ErrInvalidQRToken
|
||||
}
|
||||
studentID := claims.Subject
|
||||
jti := claims.ID
|
||||
@@ -89,40 +90,41 @@ func (s *Service) SpendPoints(ctx context.Context, req SpendRequest) error {
|
||||
// Step 2: one-time-use check — reject if already redeemed.
|
||||
used, err := s.cache.IsQRUsed(ctx, jti)
|
||||
if err != nil {
|
||||
return fmt.Errorf("service.SpendPoints: cache check: %w", err)
|
||||
return 0, fmt.Errorf("service.SpendPoints: cache check: %w", err)
|
||||
}
|
||||
if used {
|
||||
return ErrQRAlreadyUsed
|
||||
return 0, ErrQRAlreadyUsed
|
||||
}
|
||||
|
||||
// Step 3: pre-check balance for a clear error message before hitting the DB.
|
||||
// The DB CHECK (balance >= 0) is the authoritative guard; this is a fast-fail.
|
||||
balance, err := s.repo.GetBalance(ctx, studentID)
|
||||
if err != nil {
|
||||
return fmt.Errorf("service.SpendPoints: get balance: %w", err)
|
||||
return 0, fmt.Errorf("service.SpendPoints: get balance: %w", err)
|
||||
}
|
||||
if balance < req.Amount {
|
||||
return ErrInsufficientBalance
|
||||
return 0, ErrInsufficientBalance
|
||||
}
|
||||
|
||||
// Step 4–5: debit balance and insert spend transaction atomically.
|
||||
// SpendAtomic uses a DB transaction; the balance CHECK constraint is the
|
||||
// last line of defence against concurrent overdrafts.
|
||||
if err := s.repo.SpendAtomic(ctx, studentID, req.PartnerID, req.Amount); err != nil {
|
||||
newBalance, err := s.repo.SpendAtomic(ctx, studentID, req.PartnerID, req.Amount)
|
||||
if err != nil {
|
||||
// Propagate balance constraint violation with a domain error.
|
||||
if isConstraintError(err) {
|
||||
return ErrInsufficientBalance
|
||||
return 0, ErrInsufficientBalance
|
||||
}
|
||||
return fmt.Errorf("service.SpendPoints: spend atomic: %w", err)
|
||||
return 0, fmt.Errorf("service.SpendPoints: spend atomic: %w", err)
|
||||
}
|
||||
|
||||
// Step 6: mark token as used only after the DB commit succeeds.
|
||||
// If MarkQRUsed fails, the spend already committed — log but don't rollback.
|
||||
if err := s.cache.MarkQRUsed(ctx, jti); err != nil {
|
||||
return fmt.Errorf("service.SpendPoints: mark qr used: %w", err)
|
||||
return 0, fmt.Errorf("service.SpendPoints: mark qr used: %w", err)
|
||||
}
|
||||
|
||||
return nil
|
||||
return newBalance, nil
|
||||
}
|
||||
|
||||
// GenerateQRToken creates a one-time JWT for the student to present at a partner terminal.
|
||||
|
||||
@@ -0,0 +1,432 @@
|
||||
package points_test
|
||||
|
||||
import (
|
||||
"context"
|
||||
"crypto/rand"
|
||||
"crypto/rsa"
|
||||
"errors"
|
||||
"testing"
|
||||
"time"
|
||||
|
||||
"github.com/golang-jwt/jwt/v5"
|
||||
|
||||
"github.com/cu-points/backend/internal/points"
|
||||
)
|
||||
|
||||
// ─── mocks ───────────────────────────────────────────────────────────────────
|
||||
|
||||
type mockRepo struct {
|
||||
balance int
|
||||
balanceErr error
|
||||
earnErr error
|
||||
spendErr error
|
||||
newBalance int
|
||||
}
|
||||
|
||||
func (m *mockRepo) GetBalance(_ context.Context, _ string) (int, error) {
|
||||
return m.balance, m.balanceErr
|
||||
}
|
||||
func (m *mockRepo) EarnAtomic(_ context.Context, _ string, _ int, _, _ string) error {
|
||||
return m.earnErr
|
||||
}
|
||||
func (m *mockRepo) SpendAtomic(_ context.Context, _, _ string, _ int) (int, error) {
|
||||
return m.newBalance, m.spendErr
|
||||
}
|
||||
|
||||
type mockCache struct {
|
||||
used bool
|
||||
isErr error
|
||||
markErr error
|
||||
markedID string
|
||||
}
|
||||
|
||||
func (m *mockCache) IsQRUsed(_ context.Context, _ string) (bool, error) {
|
||||
return m.used, m.isErr
|
||||
}
|
||||
func (m *mockCache) MarkQRUsed(_ context.Context, jti string) error {
|
||||
m.markedID = jti
|
||||
return m.markErr
|
||||
}
|
||||
|
||||
// ─── helpers ─────────────────────────────────────────────────────────────────
|
||||
|
||||
const testSecret = "test-secret-minimum-32-characters-long"
|
||||
|
||||
func newService(repo points.Repository, cache points.CacheClient) *points.Service {
|
||||
return points.NewService(repo, cache, testSecret)
|
||||
}
|
||||
|
||||
// makeExpiredToken creates a QR JWT that is already past its expiry.
|
||||
func makeExpiredToken(secret string, userID string) string {
|
||||
type qrClaims struct {
|
||||
jwt.RegisteredClaims
|
||||
Type string `json:"type"`
|
||||
}
|
||||
claims := qrClaims{
|
||||
RegisteredClaims: jwt.RegisteredClaims{
|
||||
Subject: userID,
|
||||
ID: "expired-jti",
|
||||
IssuedAt: jwt.NewNumericDate(time.Now().Add(-10 * time.Minute)),
|
||||
ExpiresAt: jwt.NewNumericDate(time.Now().Add(-1 * time.Second)),
|
||||
},
|
||||
Type: "qr",
|
||||
}
|
||||
tok, _ := jwt.NewWithClaims(jwt.SigningMethodHS256, claims).SignedString([]byte(secret))
|
||||
return tok
|
||||
}
|
||||
|
||||
// makeWrongTypeToken creates a valid JWT but with type != "qr".
|
||||
func makeWrongTypeToken(secret string, userID string) string {
|
||||
type qrClaims struct {
|
||||
jwt.RegisteredClaims
|
||||
Type string `json:"type"`
|
||||
}
|
||||
claims := qrClaims{
|
||||
RegisteredClaims: jwt.RegisteredClaims{
|
||||
Subject: userID,
|
||||
ID: "wrong-type-jti",
|
||||
IssuedAt: jwt.NewNumericDate(time.Now()),
|
||||
ExpiresAt: jwt.NewNumericDate(time.Now().Add(5 * time.Minute)),
|
||||
},
|
||||
Type: "access", // wrong
|
||||
}
|
||||
tok, _ := jwt.NewWithClaims(jwt.SigningMethodHS256, claims).SignedString([]byte(secret))
|
||||
return tok
|
||||
}
|
||||
|
||||
// ─── EarnPoints tests ─────────────────────────────────────────────────────────
|
||||
|
||||
func TestEarnPoints_Success(t *testing.T) {
|
||||
repo := &mockRepo{}
|
||||
svc := newService(repo, &mockCache{})
|
||||
|
||||
err := svc.EarnPoints(context.Background(), points.EarnRequest{
|
||||
UserID: "user-1",
|
||||
Amount: 100,
|
||||
Type: "earn",
|
||||
Description: "test",
|
||||
})
|
||||
if err != nil {
|
||||
t.Fatalf("expected no error, got: %v", err)
|
||||
}
|
||||
}
|
||||
|
||||
func TestEarnPoints_ZeroAmount(t *testing.T) {
|
||||
svc := newService(&mockRepo{}, &mockCache{})
|
||||
|
||||
err := svc.EarnPoints(context.Background(), points.EarnRequest{
|
||||
UserID: "user-1",
|
||||
Amount: 0,
|
||||
Type: "earn",
|
||||
})
|
||||
if err == nil {
|
||||
t.Fatal("expected error for zero amount, got nil")
|
||||
}
|
||||
}
|
||||
|
||||
func TestEarnPoints_NegativeAmount(t *testing.T) {
|
||||
svc := newService(&mockRepo{}, &mockCache{})
|
||||
|
||||
err := svc.EarnPoints(context.Background(), points.EarnRequest{
|
||||
UserID: "user-1",
|
||||
Amount: -50,
|
||||
Type: "earn",
|
||||
})
|
||||
if err == nil {
|
||||
t.Fatal("expected error for negative amount, got nil")
|
||||
}
|
||||
}
|
||||
|
||||
func TestEarnPoints_RepoError(t *testing.T) {
|
||||
repoErr := errors.New("db is down")
|
||||
repo := &mockRepo{earnErr: repoErr}
|
||||
svc := newService(repo, &mockCache{})
|
||||
|
||||
err := svc.EarnPoints(context.Background(), points.EarnRequest{
|
||||
UserID: "user-1",
|
||||
Amount: 100,
|
||||
Type: "earn",
|
||||
})
|
||||
if err == nil {
|
||||
t.Fatal("expected error, got nil")
|
||||
}
|
||||
}
|
||||
|
||||
// ─── GenerateQRToken tests ────────────────────────────────────────────────────
|
||||
|
||||
func TestGenerateQRToken_ReturnsToken(t *testing.T) {
|
||||
svc := newService(&mockRepo{}, &mockCache{})
|
||||
|
||||
token, err := svc.GenerateQRToken(context.Background(), "user-1")
|
||||
if err != nil {
|
||||
t.Fatalf("expected no error, got: %v", err)
|
||||
}
|
||||
if token == "" {
|
||||
t.Fatal("expected non-empty token")
|
||||
}
|
||||
}
|
||||
|
||||
func TestGenerateQRToken_DifferentEachCall(t *testing.T) {
|
||||
svc := newService(&mockRepo{}, &mockCache{})
|
||||
|
||||
t1, _ := svc.GenerateQRToken(context.Background(), "user-1")
|
||||
t2, _ := svc.GenerateQRToken(context.Background(), "user-1")
|
||||
if t1 == t2 {
|
||||
t.Error("expected different tokens on successive calls (distinct jti)")
|
||||
}
|
||||
}
|
||||
|
||||
// ─── SpendPoints tests ────────────────────────────────────────────────────────
|
||||
|
||||
func TestSpendPoints_Success(t *testing.T) {
|
||||
svc := newService(
|
||||
&mockRepo{balance: 500, newBalance: 400},
|
||||
&mockCache{},
|
||||
)
|
||||
|
||||
token, err := svc.GenerateQRToken(context.Background(), "user-1")
|
||||
if err != nil {
|
||||
t.Fatalf("generate token: %v", err)
|
||||
}
|
||||
|
||||
newBalance, err := svc.SpendPoints(context.Background(), points.SpendRequest{
|
||||
QRToken: token,
|
||||
Amount: 100,
|
||||
PartnerID: "partner-1",
|
||||
})
|
||||
if err != nil {
|
||||
t.Fatalf("expected no error, got: %v", err)
|
||||
}
|
||||
if newBalance != 400 {
|
||||
t.Errorf("expected newBalance=400, got %d", newBalance)
|
||||
}
|
||||
}
|
||||
|
||||
func TestSpendPoints_InsufficientBalance(t *testing.T) {
|
||||
svc := newService(
|
||||
&mockRepo{balance: 50},
|
||||
&mockCache{},
|
||||
)
|
||||
|
||||
token, _ := svc.GenerateQRToken(context.Background(), "user-1")
|
||||
|
||||
_, err := svc.SpendPoints(context.Background(), points.SpendRequest{
|
||||
QRToken: token,
|
||||
Amount: 100,
|
||||
PartnerID: "partner-1",
|
||||
})
|
||||
if !errors.Is(err, points.ErrInsufficientBalance) {
|
||||
t.Errorf("expected ErrInsufficientBalance, got: %v", err)
|
||||
}
|
||||
}
|
||||
|
||||
func TestSpendPoints_QRAlreadyUsed(t *testing.T) {
|
||||
svc := newService(
|
||||
&mockRepo{balance: 500},
|
||||
&mockCache{used: true},
|
||||
)
|
||||
|
||||
token, _ := svc.GenerateQRToken(context.Background(), "user-1")
|
||||
|
||||
_, err := svc.SpendPoints(context.Background(), points.SpendRequest{
|
||||
QRToken: token,
|
||||
Amount: 100,
|
||||
PartnerID: "partner-1",
|
||||
})
|
||||
if !errors.Is(err, points.ErrQRAlreadyUsed) {
|
||||
t.Errorf("expected ErrQRAlreadyUsed, got: %v", err)
|
||||
}
|
||||
}
|
||||
|
||||
func TestSpendPoints_InvalidToken(t *testing.T) {
|
||||
svc := newService(&mockRepo{balance: 500}, &mockCache{})
|
||||
|
||||
_, err := svc.SpendPoints(context.Background(), points.SpendRequest{
|
||||
QRToken: "not.a.valid.jwt",
|
||||
Amount: 100,
|
||||
PartnerID: "partner-1",
|
||||
})
|
||||
if !errors.Is(err, points.ErrInvalidQRToken) {
|
||||
t.Errorf("expected ErrInvalidQRToken, got: %v", err)
|
||||
}
|
||||
}
|
||||
|
||||
func TestSpendPoints_ExpiredToken(t *testing.T) {
|
||||
svc := newService(&mockRepo{balance: 500}, &mockCache{})
|
||||
|
||||
expiredToken := makeExpiredToken(testSecret, "user-1")
|
||||
|
||||
_, err := svc.SpendPoints(context.Background(), points.SpendRequest{
|
||||
QRToken: expiredToken,
|
||||
Amount: 100,
|
||||
PartnerID: "partner-1",
|
||||
})
|
||||
if !errors.Is(err, points.ErrInvalidQRToken) {
|
||||
t.Errorf("expected ErrInvalidQRToken for expired token, got: %v", err)
|
||||
}
|
||||
}
|
||||
|
||||
func TestSpendPoints_WrongSigningMethod(t *testing.T) {
|
||||
// Build a QR token signed with RS256 to trigger the "unexpected signing method" check.
|
||||
rsaKey, err := rsa.GenerateKey(rand.Reader, 2048)
|
||||
if err != nil {
|
||||
t.Fatalf("generate RSA key: %v", err)
|
||||
}
|
||||
|
||||
type qrClaims struct {
|
||||
jwt.RegisteredClaims
|
||||
Type string `json:"type"`
|
||||
}
|
||||
claims := qrClaims{
|
||||
RegisteredClaims: jwt.RegisteredClaims{
|
||||
Subject: "user-1",
|
||||
ID: "jti-1",
|
||||
IssuedAt: jwt.NewNumericDate(time.Now()),
|
||||
ExpiresAt: jwt.NewNumericDate(time.Now().Add(5 * time.Minute)),
|
||||
},
|
||||
Type: "qr",
|
||||
}
|
||||
rs256Token, _ := jwt.NewWithClaims(jwt.SigningMethodRS256, claims).SignedString(rsaKey)
|
||||
|
||||
svc := newService(&mockRepo{balance: 500}, &mockCache{})
|
||||
|
||||
_, err = svc.SpendPoints(context.Background(), points.SpendRequest{
|
||||
QRToken: rs256Token,
|
||||
Amount: 100,
|
||||
PartnerID: "partner-1",
|
||||
})
|
||||
if !errors.Is(err, points.ErrInvalidQRToken) {
|
||||
t.Errorf("expected ErrInvalidQRToken for RS256-signed token, got: %v", err)
|
||||
}
|
||||
}
|
||||
|
||||
func TestSpendPoints_WrongTokenType(t *testing.T) {
|
||||
svc := newService(&mockRepo{balance: 500}, &mockCache{})
|
||||
|
||||
wrongToken := makeWrongTypeToken(testSecret, "user-1")
|
||||
|
||||
_, err := svc.SpendPoints(context.Background(), points.SpendRequest{
|
||||
QRToken: wrongToken,
|
||||
Amount: 100,
|
||||
PartnerID: "partner-1",
|
||||
})
|
||||
if !errors.Is(err, points.ErrInvalidQRToken) {
|
||||
t.Errorf("expected ErrInvalidQRToken for wrong type token, got: %v", err)
|
||||
}
|
||||
}
|
||||
|
||||
func TestSpendPoints_MarksTokenUsedAfterSuccess(t *testing.T) {
|
||||
cache := &mockCache{}
|
||||
svc := newService(
|
||||
&mockRepo{balance: 500, newBalance: 400},
|
||||
cache,
|
||||
)
|
||||
|
||||
token, _ := svc.GenerateQRToken(context.Background(), "user-1")
|
||||
_, err := svc.SpendPoints(context.Background(), points.SpendRequest{
|
||||
QRToken: token,
|
||||
Amount: 100,
|
||||
PartnerID: "partner-1",
|
||||
})
|
||||
if err != nil {
|
||||
t.Fatalf("expected no error, got: %v", err)
|
||||
}
|
||||
if cache.markedID == "" {
|
||||
t.Error("expected MarkQRUsed to be called after successful spend")
|
||||
}
|
||||
}
|
||||
|
||||
func TestSpendPoints_CacheCheckError(t *testing.T) {
|
||||
svc := newService(
|
||||
&mockRepo{balance: 500},
|
||||
&mockCache{isErr: errors.New("redis down")},
|
||||
)
|
||||
token, _ := svc.GenerateQRToken(context.Background(), "user-1")
|
||||
|
||||
_, err := svc.SpendPoints(context.Background(), points.SpendRequest{
|
||||
QRToken: token,
|
||||
Amount: 100,
|
||||
PartnerID: "partner-1",
|
||||
})
|
||||
if err == nil {
|
||||
t.Fatal("expected error from cache check, got nil")
|
||||
}
|
||||
// Should NOT be a domain-level error — it's an infrastructure error.
|
||||
if errors.Is(err, points.ErrInsufficientBalance) || errors.Is(err, points.ErrQRAlreadyUsed) {
|
||||
t.Errorf("unexpected domain error for cache failure: %v", err)
|
||||
}
|
||||
}
|
||||
|
||||
func TestSpendPoints_GetBalanceError(t *testing.T) {
|
||||
svc := newService(
|
||||
&mockRepo{balanceErr: errors.New("db error"), balance: 0},
|
||||
&mockCache{},
|
||||
)
|
||||
token, _ := svc.GenerateQRToken(context.Background(), "user-1")
|
||||
|
||||
_, err := svc.SpendPoints(context.Background(), points.SpendRequest{
|
||||
QRToken: token,
|
||||
Amount: 100,
|
||||
PartnerID: "partner-1",
|
||||
})
|
||||
if err == nil {
|
||||
t.Fatal("expected error from GetBalance, got nil")
|
||||
}
|
||||
}
|
||||
|
||||
func TestSpendPoints_SpendAtomicNonConstraintError(t *testing.T) {
|
||||
svc := newService(
|
||||
&mockRepo{balance: 500, spendErr: errors.New("connection reset")},
|
||||
&mockCache{},
|
||||
)
|
||||
token, _ := svc.GenerateQRToken(context.Background(), "user-1")
|
||||
|
||||
_, err := svc.SpendPoints(context.Background(), points.SpendRequest{
|
||||
QRToken: token,
|
||||
Amount: 100,
|
||||
PartnerID: "partner-1",
|
||||
})
|
||||
if err == nil {
|
||||
t.Fatal("expected error from SpendAtomic, got nil")
|
||||
}
|
||||
if errors.Is(err, points.ErrInsufficientBalance) {
|
||||
t.Error("non-constraint error should not map to ErrInsufficientBalance")
|
||||
}
|
||||
}
|
||||
|
||||
func TestSpendPoints_MarkQRUsedError(t *testing.T) {
|
||||
svc := newService(
|
||||
&mockRepo{balance: 500, newBalance: 400},
|
||||
&mockCache{markErr: errors.New("redis write failed")},
|
||||
)
|
||||
token, _ := svc.GenerateQRToken(context.Background(), "user-1")
|
||||
|
||||
_, err := svc.SpendPoints(context.Background(), points.SpendRequest{
|
||||
QRToken: token,
|
||||
Amount: 100,
|
||||
PartnerID: "partner-1",
|
||||
})
|
||||
if err == nil {
|
||||
t.Fatal("expected error from MarkQRUsed, got nil")
|
||||
}
|
||||
}
|
||||
|
||||
func TestSpendPoints_DbConstraintError_ReturnsInsufficientBalance(t *testing.T) {
|
||||
// Simulate a scenario where the pre-check passes (balance == amount)
|
||||
// but the DB CHECK constraint fires (e.g. concurrent spend).
|
||||
svc := newService(
|
||||
&mockRepo{balance: 100, spendErr: errors.New("check constraint violation")},
|
||||
&mockCache{},
|
||||
)
|
||||
|
||||
token, _ := svc.GenerateQRToken(context.Background(), "user-1")
|
||||
|
||||
_, err := svc.SpendPoints(context.Background(), points.SpendRequest{
|
||||
QRToken: token,
|
||||
Amount: 100,
|
||||
PartnerID: "partner-1",
|
||||
})
|
||||
if !errors.Is(err, points.ErrInsufficientBalance) {
|
||||
t.Errorf("expected ErrInsufficientBalance from constraint error, got: %v", err)
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user