Skip to content

v3: Modernize boilerplate with sqlx, middleware, reusable validation, and invoice PDF

Latest

Choose a tag to compare

@Massad Massad released this 17 Mar 21:36

What's new in v3

  • sqlx migration: Replaced go-gorp with sqlx for a thinner database layer. All raw SQL queries unchanged.
  • Middleware extraction: Moved CORS, RequestID, and JWT auth middleware from main.go into middleware/ package. Auth middleware calls models directly to avoid import cycles.
  • Reusable form validation: Replaced duplicated per-field error methods with a single forms.Translate(err, messages) function and declarative message maps.
  • Invoice example: Added invoice/ package with HTML preview and PDF download using maroto (pure Go, no external binaries).
  • Dependency upgrades: gin 1.11, crypto 0.49, validator 10.28, gzip 1.2.5, swag 1.16.6. Removed go-gorp.
  • README refreshed for v3 with API endpoint table, project structure, and new sections for invoice demo, trusted proxies, and CORS.

Security fixes

  • Authorization bypass fixed: Article Update/Delete now enforce user_id in SQL queries (previously any authenticated user could modify any article by ID).
  • DB SSL: PostgreSQL connection respects SSL env var (sslmode=require when SSL=TRUE).
  • Logout route: Now uses TokenAuth middleware for consistent 401 responses.
  • Login error handling: CreateAuth failure now returns error instead of silently issuing unusable tokens.
  • Token validation: ExtractTokenMetadata returns explicit errors instead of nil, nil on invalid claims.
  • Test credential leak: Removed fmt.Println(DB_PASS) from test output.
  • Trusted proxies: Added SetTrustedProxies(nil) to prevent proxy header trust warning.

Other improvements

  • Added DB_HOST and DB_PORT env vars for flexible DB connection
  • Removed dead TokenValid method from models and controllers
  • Replaced deprecated ioutil.ReadAll with io.ReadAll in tests
  • Fixed UserLoginResponse.Token Swagger type (was string, now Token struct)
  • Added invoice integration tests
  • Regenerated Swagger docs