7690f07a2b
Comprehensive security hardening from audit findings: - Add validation tags to all DTO request structs (max lengths, ranges, enums) - Replace unsafe type assertions with MustGetAuthUser helper across all handlers - Remove query-param token auth from admin middleware (prevents URL token leakage) - Add request validation calls in handlers that were missing c.Validate() - Remove goroutines in handlers (timezone update now synchronous) - Add sanitize middleware and path traversal protection (path_utils) - Stop resetting admin passwords on migration restart - Warn on well-known default SECRET_KEY - Add ~30 new test files covering security regressions, auth safety, repos, and services - Add deploy/ config, audit digests, and AUDIT_FINDINGS documentation Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
39 lines
1.1 KiB
Go
39 lines
1.1 KiB
Go
package repositories
|
|
|
|
import (
|
|
"fmt"
|
|
"testing"
|
|
|
|
"github.com/stretchr/testify/assert"
|
|
"github.com/stretchr/testify/require"
|
|
|
|
"github.com/treytartt/casera-api/internal/models"
|
|
"github.com/treytartt/casera-api/internal/testutil"
|
|
)
|
|
|
|
func TestDocumentRepository_FindByUser_HasDefaultLimit(t *testing.T) {
|
|
db := testutil.SetupTestDB(t)
|
|
repo := NewDocumentRepository(db)
|
|
|
|
user := testutil.CreateTestUser(t, db, "owner", "owner@test.com", "password")
|
|
residence := testutil.CreateTestResidence(t, db, user.ID, "Test House")
|
|
|
|
// Create 510 documents to exceed the default limit of 500
|
|
for i := 0; i < 510; i++ {
|
|
doc := &models.Document{
|
|
ResidenceID: residence.ID,
|
|
CreatedByID: user.ID,
|
|
Title: fmt.Sprintf("Doc %d", i+1),
|
|
DocumentType: models.DocumentTypeGeneral,
|
|
FileURL: "https://example.com/doc.pdf",
|
|
IsActive: true,
|
|
}
|
|
err := db.Create(doc).Error
|
|
require.NoError(t, err)
|
|
}
|
|
|
|
docs, err := repo.FindByUser([]uint{residence.ID})
|
|
require.NoError(t, err)
|
|
assert.Equal(t, 500, len(docs), "FindByUser should return at most 500 documents by default")
|
|
}
|