Enhance tests and refactor controller for improved coverage

[edigar]

Description

Substantially improves the project's test coverage and restores a meaningful coverage gate. It builds on #77 (the x/crypto/Go 1.25 bump), which had to temporarily lower the CI gate to 15% because Go 1.25 changed how coverage is measured (packages without tests now count as 0% in the module total).

This PR adds tests to the packages that were at 0%, refactors the controller layer so it can be unit-tested, fixes a few latent handler bugs found along the way, and raises the coverage gate back to a meaningful 50%. Module-wide coverage goes from ~18.7% to 58.9%.

Checklist

• Tests has been changed.
• All tests pass.
• Documentation has been updated.
• Code follows style guidelines.
• All merge conflicts have been resolved.
• The pull request is targeted to the correct branch.

Related Issue

Builds on #77. No tracking issue.

Proposed Changes

Grouped by the 4 commits in this branch:

• test: auth middleware, JWT security gaps and HTTP response helpers
  • middleware: Authenticate lets valid tokens through and returns 401 (without calling next) for invalid/missing tokens; Logger passes through.
  • authentication: reject non-HMAC signing methods (algorithm-confusion defense), expired tokens and missing/malformed Authorization headers.
  • response: JSON sets content-type/status/body and omits the body when data is nil; Error renders {"error":...} with the given status.
• refactor(controller): inject usecases and connect the DB at startup
  • Handlers became methods on UserController/PostController depending on usecase interfaces, wired in the routing layer; the DB is now connected once in main() and injected via router.Generate/routes.Setup instead of per request inside every handler.
  • Bug fixes (missing return/masked errors): Login and UpdatePassword no longer continue with an empty payload after an invalid body; GetUserPosts and DeleteUser no longer fall through to a success response after an error.
  • Full controller test suite with mocked usecases (httptest): success paths, auth/authorization (401/403), not-found (404) and error→status mapping.
• ci: raise coverage threshold from 15% to 50%
  • The Validate coverage gate uses a numeric comparison (bc) and is set to 50%, now that honest coverage is ~58%.
• test: config loading, router wiring and validation error types
  • config: Load() env→settings mapping, with port fallback to 8000.
  • router: smoke-tests the route table and auth middleware via Generate(nil) and httptest (health 200, protected routes 401, unknown path 404, 405).
  • error_type: validation error constructors and the errors.As contract.

Tests Performed

Run on Go 1.25 (PowerShell):

go build ./... # ok
go vet ./... # ok
go test ./... # all packages PASS
go test ./... -coverprofile=coverage
go tool cover -func=coverage | grep total
total: (statements) 58.9%

Per-package coverage after this PR: middleware 100%, router 100%, error_type 100%, controller 94.1%, authentication 92.9%, config 77.8%, response 83.3% (plus the pre-existing entity 94.7%, usecase 92.3%, crypt 100%). Only database and repository remain untested (they need a real DB or sqlmock).

Additional Notes

• Behavior change: the database is now opened once at startup, so the app fails fast if the DB is unreachable (previously each request reconnected). Running locally now requires a reachable DB; docker-compose is unaffected.
• No application/production logic changed other than the controller DI wiring and the four handler bug fixes noted above. No new dependencies.