refactor(api): introduce v1 response contract

backend/internal/httpx/router_test.go

@@ -23,9 +23,9 @@ func TestHealthz(t *testing.T) {
 	require.JSONEq(t, `{"status":"ok"}`, rec.Body.String())
 }
 
-func TestNewRouterRegistersFeatureRoutesUnderAPI(t *testing.T) {
+func TestNewRouterRegistersFeatureRoutesUnderAPIV1(t *testing.T) {
 	router := NewRouter(config.Config{Env: "test"}, testRegistrar{})
-	req := httptest.NewRequest(http.MethodGet, "/api/ping", nil)
+	req := httptest.NewRequest(http.MethodGet, "/api/v1/ping", nil)
 	rec := httptest.NewRecorder()
 
 	router.ServeHTTP(rec, req)
@@ -34,7 +34,27 @@ func TestNewRouterRegistersFeatureRoutesUnderAPI(t *testing.T) {
 	require.JSONEq(t, `{"pong":true}`, rec.Body.String())
 }
 
-func TestAPIStatusReturnsChangingTimestampMillisecondsWithoutAuth(t *testing.T) {
+func TestStatusLivesUnderAPIV1(t *testing.T) {
+	router := NewRouter(config.Config{Env: "test"})
+	req := httptest.NewRequest(http.MethodGet, "/api/v1/status", nil)
+	recorder := httptest.NewRecorder()
+
+	router.ServeHTTP(recorder, req)
+
+	require.Equal(t, http.StatusOK, recorder.Code)
+}
+
+func TestLegacyAPIRouteIsNotExposed(t *testing.T) {
+	router := NewRouter(config.Config{Env: "test"}, testRegistrar{})
+	req := httptest.NewRequest(http.MethodGet, "/api/ping", nil)
+	recorder := httptest.NewRecorder()
+
+	router.ServeHTTP(recorder, req)
+
+	require.Equal(t, http.StatusNotFound, recorder.Code)
+}
+
+func TestAPIStatusReturnsChangingRFC3339UTCTimestampWithoutAuth(t *testing.T) {
 	router := NewProtectedRouter(config.Config{Env: "test"}, func(token string) (uint, error) {
 		return 0, http.ErrNoCookie
 	})
@@ -43,13 +63,14 @@ func TestAPIStatusReturnsChangingTimestampMillisecondsWithoutAuth(t *testing.T)
 	time.Sleep(2 * time.Millisecond)
 	second := getStatusTimestamp(t, router)
 
-	require.Greater(t, first, int64(0))
-	require.Greater(t, second, first)
+	require.Equal(t, time.UTC, first.Location())
+	require.Equal(t, time.UTC, second.Location())
+	require.True(t, second.After(first))
 }
 
 func TestRouterAddsCORSHeadersForLocalWebClient(t *testing.T) {
 	router := NewRouter(config.Config{Env: "test"}, testRegistrar{})
-	req := httptest.NewRequest(http.MethodGet, "/api/ping", nil)
+	req := httptest.NewRequest(http.MethodGet, "/api/v1/ping", nil)
 	req.Header.Set("Origin", "http://localhost:5173")
 	rec := httptest.NewRecorder()
 
@@ -60,11 +81,45 @@ func TestRouterAddsCORSHeadersForLocalWebClient(t *testing.T) {
 	require.Contains(t, rec.Header().Get("Access-Control-Allow-Headers"), "Authorization")
 }
 
+func TestAPIV1LoginRemainsPublic(t *testing.T) {
+	router := NewProtectedRouter(config.Config{Env: "test"}, func(token string) (uint, error) {
+		return 0, http.ErrNoCookie
+	}, loginRegistrar{})
+	req := httptest.NewRequest(http.MethodPost, "/api/v1/auth/login", nil)
+	rec := httptest.NewRecorder()
+
+	router.ServeHTTP(rec, req)
+
+	require.Equal(t, http.StatusOK, rec.Code)
+}
+
+func TestRouterUsesConfiguredCORSOrigins(t *testing.T) {
+	router := NewRouter(config.Config{Env: "test", AllowedOrigins: []string{"https://workbench.example.com"}}, testRegistrar{})
+	req := httptest.NewRequest(http.MethodGet, "/api/v1/ping", nil)
+	req.Header.Set("Origin", "https://workbench.example.com")
+	rec := httptest.NewRecorder()
+
+	router.ServeHTTP(rec, req)
+
+	require.Equal(t, "https://workbench.example.com", rec.Header().Get("Access-Control-Allow-Origin"))
+}
+
+func TestRouterRejectsUnconfiguredCORSOrigin(t *testing.T) {
+	router := NewRouter(config.Config{Env: "production", AllowedOrigins: []string{"https://workbench.example.com"}}, testRegistrar{})
+	req := httptest.NewRequest(http.MethodGet, "/api/v1/ping", nil)
+	req.Header.Set("Origin", "https://attacker.example.com")
+	rec := httptest.NewRecorder()
+
+	router.ServeHTTP(rec, req)
+
+	require.Empty(t, rec.Header().Get("Access-Control-Allow-Origin"))
+}
+
 func TestRouterHandlesCORSPreflightBeforeAuth(t *testing.T) {
 	router := NewProtectedRouter(config.Config{Env: "test"}, func(token string) (uint, error) {
 		return 0, http.ErrNoCookie
 	}, testRegistrar{})
-	req := httptest.NewRequest(http.MethodOptions, "/api/ping", nil)
+	req := httptest.NewRequest(http.MethodOptions, "/api/v1/ping", nil)
 	req.Header.Set("Origin", "http://localhost:5173")
 	req.Header.Set("Access-Control-Request-Method", "GET")
 	req.Header.Set("Access-Control-Request-Headers", "Authorization")
@@ -85,17 +140,27 @@ func (testRegistrar) Register(router gin.IRouter) {
 	})
 }
 
-func getStatusTimestamp(t *testing.T, router http.Handler) int64 {
+type loginRegistrar struct{}
+
+func (loginRegistrar) Register(router gin.IRouter) {
+	router.POST("/auth/login", func(c *gin.Context) {
+		c.Status(http.StatusOK)
+	})
+}
+
+func getStatusTimestamp(t *testing.T, router http.Handler) time.Time {
 	t.Helper()
-	req := httptest.NewRequest(http.MethodGet, "/api/status", nil)
+	req := httptest.NewRequest(http.MethodGet, "/api/v1/status", nil)
 	rec := httptest.NewRecorder()
 
 	router.ServeHTTP(rec, req)
 
 	require.Equal(t, http.StatusOK, rec.Code)
 	var payload struct {
-		TimestampMS int64 `json:"timestamp_ms"`
+		Timestamp string `json:"timestamp"`
 	}
 	require.NoError(t, json.Unmarshal(rec.Body.Bytes(), &payload))
-	return payload.TimestampMS
+	timestamp, err := time.Parse(time.RFC3339Nano, payload.Timestamp)
+	require.NoError(t, err)
+	return timestamp
 }