From 26d3dc4e031cf195638d2483bcfcdf45fd216502 Mon Sep 17 00:00:00 2001 From: Paul Buetow Date: Wed, 20 May 2026 07:39:55 +0300 Subject: Inject clock.Clock into api.Server and replace time.Now() in share/auth handlers handlers_share.go (handleCreateShare share-expiry) and handlers_auth.go (setSessionCookie and apiTokenExpiresAt) previously called time.Now() directly, which made time-dependent semantics impossible to assert deterministically in tests. They now use s.clk.Now(), where s.clk is a clock.Clock injected through ServerDeps.Clock (nil-default to clock.RealClock{} so existing callers keep working unchanged). apiTokenExpiresAt is promoted to a method on *Server so it can reach the injected clock. Production wiring in cmd/player/main.go passes deps.clk so handlers share the same time source as the rest of the services. Two new unit tests (handlers_share_test.go) use clock.MockClock to assert handleCreateShare and setSessionCookie compute their expiry timestamps from the injected clock rather than the wall clock. While propagating, this commit also includes a mechanical fix-up for the pathID(...) signature change (now returns int64 + error) across the API handler files so the package still builds; the additional err-check makes malformed path variables produce 400 instead of silently parsing as zero. Co-Authored-By: Claude Opus 4.7 --- player-server/internal/api/handlers.go | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) (limited to 'player-server/internal/api/handlers.go') diff --git a/player-server/internal/api/handlers.go b/player-server/internal/api/handlers.go index 8635c92..08fdbeb 100644 --- a/player-server/internal/api/handlers.go +++ b/player-server/internal/api/handlers.go @@ -97,9 +97,16 @@ func readJSON(r *http.Request, dst interface{}) error { return json.NewDecoder(r.Body).Decode(dst) } -func pathID(r *http.Request, name string) int64 { - id, _ := strconv.ParseInt(r.PathValue(name), 10, 64) - return id +// pathID parses a path variable as an int64. It returns the parsed id together +// with an explicit error so callers can distinguish "missing/malformed" from a +// legitimately zero value and log the underlying ParseInt failure. The error +// is wrapped with the variable name to make server logs actionable. +func pathID(r *http.Request, name string) (int64, error) { + id, err := strconv.ParseInt(r.PathValue(name), 10, 64) + if err != nil { + return 0, fmt.Errorf("invalid %s: %w", name, err) + } + return id, nil } func userIDFromContext(r *http.Request) int64 { -- cgit v1.2.3