api: scope activities, sync, review-queue, and reclassify handlers to userID

Completes the internal/api scoping pass -- the whole package now compiles
against the per-user store/sync/garmin signatures from Tasks 4-13. Also
fixes the test helpers (newTestServer now returns the provisioned userID)
and a latent bug in TestResolveUser_LeavesContextEmptyWhenNotProvisioned,
which relied on doJSON's hardcoded "test-user" session sub being
unprovisioned -- never caught before since internal/api couldn't compile
since Task 12.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
2026-07-25 18:28:02 +02:00
parent eaca8e602b
commit e37173ea08
7 changed files with 137 additions and 94 deletions

View File

@@ -25,6 +25,7 @@ type activityListItem struct {
}
func (s *Server) handleListActivities(w http.ResponseWriter, r *http.Request) {
userID := userIDFromContext(r.Context())
q := r.URL.Query()
filter := store.ActivityFilter{
FromDate: q.Get("from"),
@@ -37,13 +38,13 @@ func (s *Server) handleListActivities(w http.ResponseWriter, r *http.Request) {
filter.Offset = offset
}
activities, err := s.DB.ListActivities(r.Context(), filter)
activities, err := s.DB.ListActivities(r.Context(), userID, filter)
if err != nil {
writeError(w, http.StatusInternalServerError, err.Error())
return
}
kinds, err := s.DB.ListWorkoutKinds(r.Context(), false)
kinds, err := s.DB.ListWorkoutKinds(r.Context(), userID, false)
if err != nil {
writeError(w, http.StatusInternalServerError, err.Error())
return
@@ -56,7 +57,7 @@ func (s *Server) handleListActivities(w http.ResponseWriter, r *http.Request) {
resp := make([]activityListItem, 0, len(activities))
for _, a := range activities {
item := activityListItem{activityResponse: toActivityResponse(a)}
assignment, ok, err := s.DB.CurrentAssignment(r.Context(), a.ID)
assignment, ok, err := s.DB.CurrentAssignment(r.Context(), userID, a.ID)
if err != nil {
writeError(w, http.StatusInternalServerError, err.Error())
return
@@ -79,13 +80,14 @@ func (s *Server) handleListActivities(w http.ResponseWriter, r *http.Request) {
}
func (s *Server) handleGetActivity(w http.ResponseWriter, r *http.Request) {
userID := userIDFromContext(r.Context())
id, err := strconv.ParseInt(chi.URLParam(r, "id"), 10, 64)
if err != nil {
writeError(w, http.StatusBadRequest, "invalid activity id")
return
}
activity, ok, err := s.DB.GetActivity(r.Context(), id)
activity, ok, err := s.DB.GetActivity(r.Context(), userID, id)
if err != nil {
writeError(w, http.StatusInternalServerError, err.Error())
return
@@ -95,13 +97,13 @@ func (s *Server) handleGetActivity(w http.ResponseWriter, r *http.Request) {
return
}
laps, err := s.DB.LapsForActivity(r.Context(), id)
laps, err := s.DB.LapsForActivity(r.Context(), userID, id)
if err != nil {
writeError(w, http.StatusInternalServerError, err.Error())
return
}
assignment, hasAssignment, err := s.DB.CurrentAssignment(r.Context(), id)
assignment, hasAssignment, err := s.DB.CurrentAssignment(r.Context(), userID, id)
if err != nil {
writeError(w, http.StatusInternalServerError, err.Error())
return