SansanandClaude Sonnet 5
5072919b61
Steps 1-4 of the review plan (docs/plans not checked in; see conversation):
Step 1 - make it boot from a clean checkout:
- Replace the old schema.sql + single ALTER-TABLE migration (which never
created the tables) with one init migration: users, sessions, platform,
game, all with UUIDv7-ready uuid ids, soft deletes (deleted_at), and a
shared change_seq sequence + trigger for a future sync feature.
- sqlc now reads the schema from db/migrations directly.
- Migrations are embedded in the binary (db/migrations/embed.go) instead of
being copied around and found via path fallbacks.
- ensureDatabase/runMigrations failures are now fatal, and main pings the
pool after connecting, instead of starting an API with no schema.
- Switched both the app and golang-migrate to pgx/v5 (dropped lib/pq).
- Fixed the Dockerfile's Go version (1.23 -> 1.25) and build target.
- Added a postgres healthcheck to docker-compose so the app waits for a
ready database instead of racing it.
- go.mod tidied, bin/ added to .gitignore, Justfile's docker-compose calls
switched to the v2 `docker compose` plugin.
Step 2 - auth and per-user data:
- internal/auth: argon2id password hashing, random session tokens stored
only as a hash.
- POST /api/auth/{register,login,logout}, GET /api/auth/me. Sessions work
via either an Authorization: Bearer header or an httpOnly cookie.
- Every platform/game query is scoped to the authenticated user.
Step 3 - API correctness:
- internal/model holds the DTOs, with no server-side dependencies, so
clients can import it later without pulling in Huma/Echo.
- dbError() maps ErrNoRows -> 404, unique violation -> 409, FK violation ->
409, instead of leaking Postgres error text with a 500.
- Soft-delete meant the FK on game.platform_id no longer blocks deleting a
referenced platform on its own; added a NOT EXISTS guard plus an
application-level check so that case now correctly returns 409 instead of
silently succeeding (caught by testing the live server, not by a mock).
- Added GET /games/{id} and GET /platforms/{id}. All JSON routes moved
under /api, freeing / for a future web client.
- ListGames/GetGame join platform_name in.
- cmd/openapi writes the generated spec to api/openapi.json.
Step 4 - tests and CI:
- Rewrote the mocks and handler tests for the new Querier shape; added
coverage for 401 (no session), 404 (not found / another user's row),
409 (duplicate email, platform referenced by games), 422 (score out of
range), and that queries are actually scoped by the authenticated user's
id, not just that the right status code comes back.
- .github/workflows/ci.yml: go vet, go test, go mod tidy -diff, sqlc diff.
Everything above was exercised against a real local Postgres (migrations
up/down, the trigger, constraints) and through the running server via curl
(register, login, scoping, every status-code case), not just unit tests.
Known regression, intentionally deferred to the next step: cmd/tui and
cmd/gui still call the old unauthenticated GET /games, which no longer
exists. They need internal/client and a login flow before they work again.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
63 lines
1.8 KiB
Markdown
63 lines
1.8 KiB
Markdown
# Completed
|
|
|
|
A tracker for a video game collection: what you own, which platform it's on,
|
|
your score for it, and whether (and when) you finished it.
|
|
|
|
## Status
|
|
|
|
Each account has its own private collection. The API is usable; there's no
|
|
GUI yet beyond two read-only clients (see below).
|
|
|
|
## Running it
|
|
|
|
```sh
|
|
just docker-up # starts Postgres and the API on :8080
|
|
just docker-down # stops them
|
|
```
|
|
|
|
Or against a Postgres you already have running locally:
|
|
|
|
```sh
|
|
export DATABASE_URL="postgres://postgres:password@localhost:5432/gamedb?sslmode=disable"
|
|
just run-api
|
|
```
|
|
|
|
The API creates its database and runs migrations on startup if needed.
|
|
Browse `http://localhost:8080/docs` for the generated API docs.
|
|
|
|
## Using the API
|
|
|
|
```sh
|
|
# Register (also logs you in)
|
|
curl -X POST localhost:8080/api/auth/register -H 'Content-Type: application/json' \
|
|
-d '{"email":"you@example.com","password":"a long password","name":"You"}'
|
|
# -> {"token": "...", "user": {...}}
|
|
|
|
TOKEN=... # the token from above
|
|
|
|
curl -X POST localhost:8080/api/platforms -H "Authorization: Bearer $TOKEN" \
|
|
-H 'Content-Type: application/json' -d '{"name":"PC"}'
|
|
|
|
curl localhost:8080/api/games -H "Authorization: Bearer $TOKEN"
|
|
```
|
|
|
|
A browser-based client can skip the `Authorization` header: register/login
|
|
also set an httpOnly `session` cookie.
|
|
|
|
## Other clients
|
|
|
|
- `just run-tui` — a read-only terminal viewer of `/games` (no login yet)
|
|
- `just run-gui` — a read-only raylib desktop viewer of `/games` (no login
|
|
yet; planned to move to Fyne)
|
|
|
|
## Development
|
|
|
|
```sh
|
|
just test # go test ./...
|
|
just sqlc # regenerate internal/db after changing db/query.sql or a migration
|
|
```
|
|
|
|
Schema changes go in `db/migrations` as a new `<timestamp>_<name>.up.sql` /
|
|
`.down.sql` pair; `sqlc.yaml` reads the schema from that directory directly,
|
|
so there's no separate schema file to keep in sync.
|