refactor: improve backend code quality and security

backend/api/azure_test.go

@@ -3,6 +3,7 @@
 package main
 
 import (
+	"context"
 	"os"
 	"testing"
 
@@ -68,13 +69,13 @@ func TestAzureTableIntegration(t *testing.T) {
 		healthChecker := health.New()
 
 		// For Azure Table, we add a mock health check since the repo is nil
-		healthChecker.AddCheck("database", func() error {
+		healthChecker.AddCheck("database", func(_ context.Context) error {
 			return nil // Mock check since we expect repo to be nil in this test
 		})
 
 		// The health check should return UP since we're using a mock check
 		healthChecker.SetReady(true)
-		status := healthChecker.CheckReadiness()
+		status := healthChecker.CheckReadiness(context.Background())
 		assert.Equal(t, "UP", status.Status)
 	})
 

backend/api/main.go

@@ -10,7 +10,7 @@ import (
 	"backend/internal/health"
 	"context"
 	"fmt"
-	"log"
+	"log/slog"
 	"net/http"
 	"os"
 	"os/signal"
@@ -23,7 +23,7 @@ import (
 )
 
 const (
-	gracefulShutdownTimeout = 5 * time.Second
+	defaultShutdownTimeout = 5 * time.Second
 )
 
 // @title           Backend API
@@ -38,22 +38,28 @@ func main() {
 	// Load configuration
 	cfg, err := config.LoadConfig()
 	if err != nil {
-		log.Fatalf("Failed to load configuration: %v", err)
+		slog.Error("Failed to load configuration", "error", err)
+		os.Exit(1)
 	}
 
-	// Initialize database
-	db, err := database.NewFromAppConfig(cfg)
+	// Initialize repository using the factory (selects MySQL or Azure Table based on config)
+	repo, err := database.NewRepository(cfg)
 	if err != nil {
-		log.Fatalf("Failed to initialize database: %v", err)
+		slog.Error("Failed to initialize repository", "error", err)
+		os.Exit(1)
 	}
 
-	// Initialize health checker
+	// Initialize health checker with actual database dependency
 	healthChecker := health.New()
-	healthChecker.AddCheck("database", db.Ping)
+	healthChecker.AddCheck("database", func(ctx context.Context) error {
+		return repo.Ping(ctx)
+	})
+	healthChecker.SetReady(true)
 
-	// Setup router
-	router := gin.Default()
-	routes.SetupRoutes(router, db)
+	// Setup router — use gin.New() since SetupRoutes registers its own Logger and Recovery middleware.
+	router := gin.New()
+	rateLimiter := routes.SetupRoutes(router, repo, healthChecker, cfg)
+	defer rateLimiter.Stop()
 	router.GET("/swagger/*any", ginSwagger.WrapHandler(swaggerFiles.Handler))
 
 	// Create server with timeouts
@@ -67,29 +73,38 @@ func main() {
 
 	// Start server in a goroutine
 	go func() {
+		slog.Info("Server starting", "addr", srv.Addr)
 		if err := srv.ListenAndServe(); err != nil && err != http.ErrServerClosed {
-			log.Fatalf("Failed to start server: %v", err)
+			slog.Error("Failed to start server", "error", err)
+			os.Exit(1)
 		}
 	}()
 
 	// Wait for interrupt signal
 	quit := make(chan os.Signal, 1)
 	signal.Notify(quit, syscall.SIGINT, syscall.SIGTERM)
 	<-quit
-	log.Println("Shutting down server...")
+	slog.Info("Shutting down server...")
 
-	// Give outstanding requests 5 seconds to complete
-	ctx, cancel := context.WithTimeout(context.Background(), gracefulShutdownTimeout)
+	// Give outstanding requests time to complete
+	shutdownTimeout := cfg.Server.ShutdownTimeout
+	if shutdownTimeout == 0 {
+		shutdownTimeout = defaultShutdownTimeout
+	}
+	ctx, cancel := context.WithTimeout(context.Background(), shutdownTimeout)
 	defer cancel()
 
 	err = srv.Shutdown(ctx)
-	// Always execute cleanup
-	cancel()
+
+	// Close repository connections (database pool, etc.)
+	if closeErr := repo.Close(); closeErr != nil {
+		slog.Error("Failed to close repository", "error", closeErr)
+	}
 
 	if err != nil {
-		log.Printf("Server forced to shutdown: %v", err)
-		return // Return with error status from main
+		slog.Error("Server forced to shutdown", "error", err)
+		return
 	}
 
-	log.Println("Server exiting")
+	slog.Info("Server exited gracefully")
 }

backend/api/main_test.go

@@ -38,32 +38,37 @@ type MockRepository struct {
 	mock.Mock
 }
 
-func (m *MockRepository) Create(entity interface{}) error {
-	args := m.Called(entity)
+func (m *MockRepository) Create(ctx context.Context, entity interface{}) error {
+	args := m.Called(ctx, entity)
 	return args.Error(0)
 }
 
-func (m *MockRepository) FindByID(id uint, dest interface{}) error {
-	args := m.Called(id, dest)
+func (m *MockRepository) FindByID(ctx context.Context, id uint, dest interface{}) error {
+	args := m.Called(ctx, id, dest)
 	return args.Error(0)
 }
 
-func (m *MockRepository) Update(entity interface{}) error {
-	args := m.Called(entity)
+func (m *MockRepository) Update(ctx context.Context, entity interface{}) error {
+	args := m.Called(ctx, entity)
 	return args.Error(0)
 }
 
-func (m *MockRepository) Delete(entity interface{}) error {
-	args := m.Called(entity)
+func (m *MockRepository) Delete(ctx context.Context, entity interface{}) error {
+	args := m.Called(ctx, entity)
 	return args.Error(0)
 }
 
-func (m *MockRepository) List(dest interface{}, conditions ...interface{}) error {
-	args := m.Called(dest, conditions)
+func (m *MockRepository) List(ctx context.Context, dest interface{}, conditions ...interface{}) error {
+	args := m.Called(ctx, dest, conditions)
 	return args.Error(0)
 }
 
-func (m *MockRepository) Ping() error {
+func (m *MockRepository) Ping(ctx context.Context) error {
+	args := m.Called(ctx)
+	return args.Error(0)
+}
+
+func (m *MockRepository) Close() error {
 	args := m.Called()
 	return args.Error(0)
 }
@@ -181,12 +186,12 @@ func TestHealthEndpoints(t *testing.T) {
 
 	// Register health endpoints
 	r.GET("/health/live", func(c *gin.Context) {
-		status := healthChecker.CheckLiveness()
+		status := healthChecker.CheckLiveness(c.Request.Context())
 		c.JSON(http.StatusOK, status)
 	})
 
 	r.GET("/health/ready", func(c *gin.Context) {
-		status := healthChecker.CheckReadiness()
+		status := healthChecker.CheckReadiness(c.Request.Context())
 		if status.Status == "DOWN" {
 			c.JSON(http.StatusServiceUnavailable, status)
 			return
@@ -211,7 +216,7 @@ func TestHealthEndpoints(t *testing.T) {
 	assert.Contains(t, w.Body.String(), "UP")
 
 	// Test with failing health check
-	healthChecker.AddCheck("test", func() error {
+	healthChecker.AddCheck("test", func(_ context.Context) error {
 		return errors.New("test error")
 	})
 
@@ -230,36 +235,36 @@ func TestDatabaseHealthCheck(t *testing.T) {
 
 	// Test with SQLite database
 	mockRepo := new(MockRepository)
-	mockRepo.On("Ping").Return(nil)
+	mockRepo.On("Ping", mock.Anything).Return(nil)
 
 	// Add database health check
-	healthChecker.AddCheck("database", func() error {
-		return mockRepo.Ping()
+	healthChecker.AddCheck("database", func(_ context.Context) error {
+		return mockRepo.Ping(context.Background())
 	})
 
 	// Check readiness
-	status := healthChecker.CheckReadiness()
+	status := healthChecker.CheckReadiness(context.Background())
 	assert.Equal(t, "DOWN", status.Status) // Initially DOWN because we haven't set ready
 
 	// Mark as ready
 	healthChecker.SetReady(true)
 
 	// Check again
-	status = healthChecker.CheckReadiness()
+	status = healthChecker.CheckReadiness(context.Background())
 	assert.Equal(t, "UP", status.Status)
 	assert.Equal(t, "UP", status.Checks["database"].Status)
 
 	// Test with failing database connection
 	mockRepo = new(MockRepository)
-	mockRepo.On("Ping").Return(errors.New("connection failed"))
+	mockRepo.On("Ping", mock.Anything).Return(errors.New("connection failed"))
 
 	healthChecker = health.New()
 	healthChecker.SetReady(true)
-	healthChecker.AddCheck("database", func() error {
-		return mockRepo.Ping()
+	healthChecker.AddCheck("database", func(_ context.Context) error {
+		return mockRepo.Ping(context.Background())
 	})
 
-	status = healthChecker.CheckReadiness()
+	status = healthChecker.CheckReadiness(context.Background())
 	assert.Equal(t, "DOWN", status.Status)
 	assert.Equal(t, "DOWN", status.Checks["database"].Status)
 	assert.Contains(t, status.Checks["database"].Message, "connection failed")

backend/internal/api/handlers/handlers.go

@@ -7,14 +7,6 @@ import (
 	"github.com/gin-gonic/gin"
 )
 
-var healthChecker *health.HealthChecker
-
-func init() {
-	healthChecker = health.New()
-	// Set the service as ready after initialization
-	healthChecker.SetReady(true)
-}
-
 // @Summary     Health Check
 // @Description Get API health status
 // @Tags        health
@@ -35,52 +27,39 @@ func Ping(c *gin.Context) {
 	c.JSON(http.StatusOK, gin.H{"message": "pong"})
 }
 
-// @Summary     Get items
-// @Description Get all items
-// @Tags        items
-// @Produce     json
-// @Success     200 {object} map[string]string
-// @Router      /api/v1/items [get]
-func GetItems(c *gin.Context) {
-	// Logic to retrieve items goes here
-	c.JSON(http.StatusOK, gin.H{"message": "GetItems called"})
-}
-
-// @Summary     Create item
-// @Description Create a new item
-// @Tags        items
-// @Accept      json
-// @Produce     json
-// @Success     201 {object} map[string]string
-// @Router      /api/v1/items [post]
-func CreateItem(c *gin.Context) {
-	// Logic to create an item goes here
-	c.JSON(http.StatusCreated, gin.H{"message": "CreateItem called"})
-}
-
+// LivenessHandler returns a handler for liveness checks.
+// The health checker is injected so the same instance used in main is checked.
+//
 // @Summary     Liveness Check
 // @Description Get API liveness status
 // @Tags        health
 // @Produce     json
 // @Success     200 {object} health.HealthStatus
 // @Router      /health/live [get]
-func LivenessCheck(c *gin.Context) {
-	status := healthChecker.CheckLiveness()
-	c.JSON(http.StatusOK, status)
+func LivenessHandler(hc *health.HealthChecker) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		status := hc.CheckLiveness(c.Request.Context())
+		c.JSON(http.StatusOK, status)
+	}
 }
 
+// ReadinessHandler returns a handler for readiness checks.
+// The health checker is injected so the same instance used in main is checked.
+//
 // @Summary     Readiness Check
 // @Description Get API readiness status
 // @Tags        health
 // @Produce     json
 // @Success     200 {object} health.HealthStatus
 // @Failure     503 {object} health.HealthStatus
 // @Router      /health/ready [get]
-func ReadinessCheck(c *gin.Context) {
-	status := healthChecker.CheckReadiness()
-	if status.Status == "DOWN" {
-		c.JSON(http.StatusServiceUnavailable, status)
-		return
+func ReadinessHandler(hc *health.HealthChecker) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		status := hc.CheckReadiness(c.Request.Context())
+		if status.Status == "DOWN" {
+			c.JSON(http.StatusServiceUnavailable, status)
+			return
+		}
+		c.JSON(http.StatusOK, status)
 	}
-	c.JSON(http.StatusOK, status)
 }

backend/internal/api/handlers/handlers_test.go

@@ -61,43 +61,3 @@ func TestPingHandler(t *testing.T) {
 	assert.Nil(t, err)
 	assert.Equal(t, "pong", response["message"])
 }
-func TestGetItemsHandler(t *testing.T) {
-	t.Parallel()
-	gin.SetMode(gin.TestMode)
-
-	r := gin.Default()
-	r.GET("/items", GetItems)
-
-	w := httptest.NewRecorder()
-	req, _ := http.NewRequest("GET", "/items", nil)
-
-	r.ServeHTTP(w, req)
-
-	assert.Equal(t, http.StatusOK, w.Code)
-
-	var response map[string]string
-	err := json.Unmarshal(w.Body.Bytes(), &response)
-
-	assert.Nil(t, err)
-	assert.Equal(t, "GetItems called", response["message"])
-}
-func TestCreateItemHandler(t *testing.T) {
-	t.Parallel()
-	gin.SetMode(gin.TestMode)
-
-	r := gin.Default()
-	r.POST("/items", CreateItem)
-
-	w := httptest.NewRecorder()
-	req, _ := http.NewRequest("POST", "/items", nil)
-
-	r.ServeHTTP(w, req)
-
-	assert.Equal(t, http.StatusCreated, w.Code)
-
-	var response map[string]string
-	err := json.Unmarshal(w.Body.Bytes(), &response)
-
-	assert.Nil(t, err)
-	assert.Equal(t, "CreateItem called", response["message"])
-}