this repo has no description
feat(api): add DELETE /api/v1/links/{id} endpoint
Implements authorized deletion of links via the API v1 endpoint.
Requires X-API-Key header for remote requests; localhost is always
allowed. Returns 204 No Content on success, 403 Forbidden for
unauthorized requests, and 404 Not Found for non-existent links.
+272
-2
+27
-2
internal/handler/api_v1_links.go
+27
-2
internal/handler/api_v1_links.go
···
233
233
}
234
234
235
235
// apiV1DeleteLink handles DELETE /api/v1/links/{id}
236
-
// Stub for now - to be implemented in Task 2.4
236
+
// Requires X-API-Key header for authorization (localhost always allowed).
237
237
func (h *Handler) apiV1DeleteLink(w http.ResponseWriter, r *http.Request, id int) {
238
-
writeAPIError(w, http.StatusNotImplemented, "not_implemented", "Not yet implemented")
238
+
// Check authorization - requires X-API-Key header
239
+
if !isAuthorizedAPIKey(r, h.Config.AdminSecret) {
240
+
writeAPIError(w, http.StatusForbidden, "forbidden", "Invalid or missing API key")
241
+
return
242
+
}
243
+
244
+
ctx := r.Context()
245
+
246
+
// Check if link exists
247
+
link, err := h.Store.GetIRCLinkByID(ctx, id)
248
+
if err != nil {
249
+
writeAPIError(w, http.StatusInternalServerError, "internal_error", "Failed to fetch link")
250
+
return
251
+
}
252
+
if link == nil {
253
+
writeAPIError(w, http.StatusNotFound, "not_found", "Link not found")
254
+
return
255
+
}
256
+
257
+
// Delete the link
258
+
if err := h.Store.DeleteIRCLink(ctx, id); err != nil {
259
+
writeAPIError(w, http.StatusInternalServerError, "internal_error", "Failed to delete link")
260
+
return
261
+
}
262
+
263
+
w.WriteHeader(http.StatusNoContent) // 204
239
264
}
+245
internal/handler/api_v1_links_test.go
+245
internal/handler/api_v1_links_test.go
···
25
25
linksByURLFn func(url string) ([]data.IRCLink, error)
26
26
insertedLinkID int
27
27
insertLinkFn func(user, title, url, contentType string) (int, error)
28
+
deleteLinkFn func(id int) error
28
29
err error
29
30
}
30
31
···
63
64
return 0, m.err
64
65
}
65
66
return m.insertedLinkID, nil
67
+
}
68
+
69
+
func (m *mockAPIStore) DeleteIRCLink(ctx context.Context, id int) error {
70
+
if m.deleteLinkFn != nil {
71
+
return m.deleteLinkFn(id)
72
+
}
73
+
if m.err != nil {
74
+
return m.err
75
+
}
76
+
return nil
66
77
}
67
78
68
79
func TestAPIv1_ListLinks(t *testing.T) {
···
836
847
t.Errorf("expected code internal_error, got %s", resp.Error.Code)
837
848
}
838
849
}
850
+
851
+
func TestAPIv1_DeleteLink(t *testing.T) {
852
+
now := time.Now()
853
+
854
+
tests := []struct {
855
+
name string
856
+
path string
857
+
linkByID *data.IRCLink
858
+
linkByIDFn func(id int) (*data.IRCLink, error)
859
+
deleteLinkFn func(id int) error
860
+
remoteAddr string
861
+
apiKey string
862
+
adminSecret string
863
+
expectedStatus int
864
+
checkBody func(t *testing.T, body []byte)
865
+
}{
866
+
{
867
+
name: "authorized delete returns 204",
868
+
path: "/api/v1/links/1",
869
+
linkByID: &data.IRCLink{
870
+
ID: 1,
871
+
Timestamp: now,
872
+
User: "testuser",
873
+
Title: "Test Link",
874
+
URL: "https://example.com",
875
+
},
876
+
remoteAddr: "127.0.0.1:12345",
877
+
expectedStatus: http.StatusNoContent,
878
+
checkBody: func(t *testing.T, body []byte) {
879
+
if len(body) != 0 {
880
+
t.Errorf("expected empty body, got %q", string(body))
881
+
}
882
+
},
883
+
},
884
+
{
885
+
name: "unauthorized (no header) returns 403",
886
+
path: "/api/v1/links/1",
887
+
linkByID: &data.IRCLink{ID: 1},
888
+
remoteAddr: "192.168.1.100:12345",
889
+
adminSecret: "secret123",
890
+
expectedStatus: http.StatusForbidden,
891
+
checkBody: func(t *testing.T, body []byte) {
892
+
var resp APIErrorResponse
893
+
if err := json.Unmarshal(body, &resp); err != nil {
894
+
t.Fatalf("failed to unmarshal response: %v", err)
895
+
}
896
+
if resp.Error.Code != "forbidden" {
897
+
t.Errorf("expected code forbidden, got %s", resp.Error.Code)
898
+
}
899
+
},
900
+
},
901
+
{
902
+
name: "unauthorized (wrong key) returns 403",
903
+
path: "/api/v1/links/1",
904
+
linkByID: &data.IRCLink{ID: 1},
905
+
remoteAddr: "192.168.1.100:12345",
906
+
apiKey: "wrongkey",
907
+
adminSecret: "secret123",
908
+
expectedStatus: http.StatusForbidden,
909
+
checkBody: func(t *testing.T, body []byte) {
910
+
var resp APIErrorResponse
911
+
if err := json.Unmarshal(body, &resp); err != nil {
912
+
t.Fatalf("failed to unmarshal response: %v", err)
913
+
}
914
+
if resp.Error.Code != "forbidden" {
915
+
t.Errorf("expected code forbidden, got %s", resp.Error.Code)
916
+
}
917
+
},
918
+
},
919
+
{
920
+
name: "delete non-existent link returns 404",
921
+
path: "/api/v1/links/999",
922
+
linkByID: nil,
923
+
remoteAddr: "127.0.0.1:12345",
924
+
expectedStatus: http.StatusNotFound,
925
+
checkBody: func(t *testing.T, body []byte) {
926
+
var resp APIErrorResponse
927
+
if err := json.Unmarshal(body, &resp); err != nil {
928
+
t.Fatalf("failed to unmarshal response: %v", err)
929
+
}
930
+
if resp.Error.Code != "not_found" {
931
+
t.Errorf("expected code not_found, got %s", resp.Error.Code)
932
+
}
933
+
},
934
+
},
935
+
{
936
+
name: "localhost always authorized (no key needed)",
937
+
path: "/api/v1/links/1",
938
+
linkByID: &data.IRCLink{
939
+
ID: 1,
940
+
Timestamp: now,
941
+
User: "testuser",
942
+
Title: "Test Link",
943
+
URL: "https://example.com",
944
+
},
945
+
remoteAddr: "127.0.0.1:12345",
946
+
adminSecret: "secret123",
947
+
expectedStatus: http.StatusNoContent,
948
+
},
949
+
{
950
+
name: "valid API key authorizes delete",
951
+
path: "/api/v1/links/1",
952
+
linkByID: &data.IRCLink{
953
+
ID: 1,
954
+
Timestamp: now,
955
+
User: "testuser",
956
+
Title: "Test Link",
957
+
URL: "https://example.com",
958
+
},
959
+
remoteAddr: "192.168.1.100:12345",
960
+
apiKey: "secret123",
961
+
adminSecret: "secret123",
962
+
expectedStatus: http.StatusNoContent,
963
+
},
964
+
{
965
+
name: "invalid ID returns 400",
966
+
path: "/api/v1/links/abc",
967
+
remoteAddr: "127.0.0.1:12345",
968
+
expectedStatus: http.StatusBadRequest,
969
+
checkBody: func(t *testing.T, body []byte) {
970
+
var resp APIErrorResponse
971
+
if err := json.Unmarshal(body, &resp); err != nil {
972
+
t.Fatalf("failed to unmarshal response: %v", err)
973
+
}
974
+
if resp.Error.Code != "invalid_id" {
975
+
t.Errorf("expected code invalid_id, got %s", resp.Error.Code)
976
+
}
977
+
},
978
+
},
979
+
}
980
+
981
+
for _, tt := range tests {
982
+
t.Run(tt.name, func(t *testing.T) {
983
+
store := &mockAPIStore{
984
+
linkByID: tt.linkByID,
985
+
linkByIDFn: tt.linkByIDFn,
986
+
deleteLinkFn: tt.deleteLinkFn,
987
+
}
988
+
handler := &Handler{
989
+
Store: store,
990
+
Config: &config.Config{
991
+
AdminSecret: tt.adminSecret,
992
+
},
993
+
}
994
+
995
+
req := httptest.NewRequest(http.MethodDelete, tt.path, nil)
996
+
req.RemoteAddr = tt.remoteAddr
997
+
if tt.apiKey != "" {
998
+
req.Header.Set("X-API-Key", tt.apiKey)
999
+
}
1000
+
w := httptest.NewRecorder()
1001
+
1002
+
handler.APIv1LinksHandler(w, req)
1003
+
1004
+
if w.Code != tt.expectedStatus {
1005
+
t.Errorf("expected status %d, got %d. Body: %s", tt.expectedStatus, w.Code, w.Body.String())
1006
+
}
1007
+
1008
+
if tt.checkBody != nil {
1009
+
tt.checkBody(t, w.Body.Bytes())
1010
+
}
1011
+
})
1012
+
}
1013
+
}
1014
+
1015
+
func TestAPIv1_DeleteLink_StoreError(t *testing.T) {
1016
+
now := time.Now()
1017
+
1018
+
tests := []struct {
1019
+
name string
1020
+
linkByIDFn func(id int) (*data.IRCLink, error)
1021
+
deleteLinkFn func(id int) error
1022
+
expectedStatus int
1023
+
expectedCode string
1024
+
}{
1025
+
{
1026
+
name: "GetIRCLinkByID error returns 500",
1027
+
linkByIDFn: func(id int) (*data.IRCLink, error) {
1028
+
return nil, context.DeadlineExceeded
1029
+
},
1030
+
expectedStatus: http.StatusInternalServerError,
1031
+
expectedCode: "internal_error",
1032
+
},
1033
+
{
1034
+
name: "DeleteIRCLink error returns 500",
1035
+
linkByIDFn: func(id int) (*data.IRCLink, error) {
1036
+
return &data.IRCLink{
1037
+
ID: 1,
1038
+
Timestamp: now,
1039
+
User: "testuser",
1040
+
Title: "Test Link",
1041
+
URL: "https://example.com",
1042
+
}, nil
1043
+
},
1044
+
deleteLinkFn: func(id int) error {
1045
+
return context.DeadlineExceeded
1046
+
},
1047
+
expectedStatus: http.StatusInternalServerError,
1048
+
expectedCode: "internal_error",
1049
+
},
1050
+
}
1051
+
1052
+
for _, tt := range tests {
1053
+
t.Run(tt.name, func(t *testing.T) {
1054
+
store := &mockAPIStore{
1055
+
linkByIDFn: tt.linkByIDFn,
1056
+
deleteLinkFn: tt.deleteLinkFn,
1057
+
}
1058
+
handler := &Handler{
1059
+
Store: store,
1060
+
Config: &config.Config{},
1061
+
}
1062
+
1063
+
req := httptest.NewRequest(http.MethodDelete, "/api/v1/links/1", nil)
1064
+
req.RemoteAddr = "127.0.0.1:12345"
1065
+
w := httptest.NewRecorder()
1066
+
1067
+
handler.APIv1LinksHandler(w, req)
1068
+
1069
+
if w.Code != tt.expectedStatus {
1070
+
t.Errorf("expected status %d, got %d", tt.expectedStatus, w.Code)
1071
+
}
1072
+
1073
+
var resp APIErrorResponse
1074
+
if err := json.Unmarshal(w.Body.Bytes(), &resp); err != nil {
1075
+
t.Fatalf("failed to unmarshal response: %v", err)
1076
+
}
1077
+
1078
+
if resp.Error.Code != tt.expectedCode {
1079
+
t.Errorf("expected code %s, got %s", tt.expectedCode, resp.Error.Code)
1080
+
}
1081
+
})
1082
+
}
1083
+
}