Basic example cleanup

Rename sales-api to web-api and remove sales-admin

example-project/cmd/web-api/tests/project_test.go

@@ -0,0 +1,447 @@
+package tests
+
+import (
+	"bytes"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	"geeks-accelerator/oss/saas-starter-kit/example-project/internal/platform/tests"
+	"geeks-accelerator/oss/saas-starter-kit/example-project/internal/platform/web"
+	"geeks-accelerator/oss/saas-starter-kit/example-project/internal/project"
+	"github.com/google/go-cmp/cmp"
+	"github.com/google/go-cmp/cmp/cmpopts"
+	"gopkg.in/mgo.v2/bson"
+)
+
+// TestProjects is the entry point for the projects
+func TestProjects(t *testing.T) {
+	defer tests.Recover(t)
+
+	t.Run("getProjects200Empty", getProjects200Empty)
+	t.Run("postProject400", postProject400)
+	t.Run("postProject401", postProject401)
+	t.Run("getProject404", getProject404)
+	t.Run("getProject400", getProject400)
+	t.Run("deleteProject404", deleteProject404)
+	t.Run("putProject404", putProject404)
+	t.Run("crudProjects", crudProject)
+}
+
+// getProjects200Empty validates an empty projects list can be retrieved with the endpoint.
+func getProjects200Empty(t *testing.T) {
+	r := httptest.NewRequest("GET", "/v1/projects", nil)
+	w := httptest.NewRecorder()
+
+	r.Header.Set("Authorization", userAuthorization)
+
+	a.ServeHTTP(w, r)
+
+	t.Log("Given the need to fetch an empty list of projects with the projects endpoint.")
+	{
+		t.Log("\tTest 0:\tWhen fetching an empty project list.")
+		{
+			if w.Code != http.StatusOK {
+				t.Fatalf("\t%s\tShould receive a status code of 200 for the response : %v", tests.Failed, w.Code)
+			}
+			t.Logf("\t%s\tShould receive a status code of 200 for the response.", tests.Success)
+
+			recv := w.Body.String()
+			resp := `[]`
+			if resp != recv {
+				t.Log("Got :", recv)
+				t.Log("Want:", resp)
+				t.Fatalf("\t%s\tShould get the expected result.", tests.Failed)
+			}
+			t.Logf("\t%s\tShould get the expected result.", tests.Success)
+		}
+	}
+}
+
+// postProject400 validates a project can't be created with the endpoint
+// unless a valid project document is submitted.
+func postProject400(t *testing.T) {
+	r := httptest.NewRequest("POST", "/v1/projects", strings.NewReader(`{}`))
+	w := httptest.NewRecorder()
+
+	r.Header.Set("Authorization", userAuthorization)
+
+	a.ServeHTTP(w, r)
+
+	t.Log("Given the need to validate a new project can't be created with an invalid document.")
+	{
+		t.Log("\tTest 0:\tWhen using an incomplete project value.")
+		{
+			if w.Code != http.StatusBadRequest {
+				t.Fatalf("\t%s\tShould receive a status code of 400 for the response : %v", tests.Failed, w.Code)
+			}
+			t.Logf("\t%s\tShould receive a status code of 400 for the response.", tests.Success)
+
+			// Inspect the response.
+			var got web.ErrorResponse
+			if err := json.NewDecoder(w.Body).Decode(&got); err != nil {
+				t.Fatalf("\t%s\tShould be able to unmarshal the response to an error type : %v", tests.Failed, err)
+			}
+			t.Logf("\t%s\tShould be able to unmarshal the response to an error type.", tests.Success)
+
+			// Define what we want to see.
+			want := web.ErrorResponse{
+				Error: "field validation error",
+				Fields: []web.FieldError{
+					{Field: "name", Error: "name is a required field"},
+					{Field: "cost", Error: "cost is a required field"},
+					{Field: "quantity", Error: "quantity is a required field"},
+				},
+			}
+
+			// We can't rely on the order of the field errors so they have to be
+			// sorted. Tell the cmp package how to sort them.
+			sorter := cmpopts.SortSlices(func(a, b web.FieldError) bool {
+				return a.Field < b.Field
+			})
+
+			if diff := cmp.Diff(want, got, sorter); diff != "" {
+				t.Fatalf("\t%s\tShould get the expected result. Diff:\n%s", tests.Failed, diff)
+			}
+			t.Logf("\t%s\tShould get the expected result.", tests.Success)
+		}
+	}
+}
+
+// postProject401 validates a project can't be created with the endpoint
+// unless the user is authenticated
+func postProject401(t *testing.T) {
+	np := project.NewProject{
+		Name:     "Comic Books",
+		Cost:     25,
+		Quantity: 60,
+	}
+
+	body, err := json.Marshal(&np)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	r := httptest.NewRequest("POST", "/v1/projects", bytes.NewBuffer(body))
+	w := httptest.NewRecorder()
+
+	// Not setting an authorization header
+
+	a.ServeHTTP(w, r)
+
+	t.Log("Given the need to validate a new project can't be created with an invalid document.")
+	{
+		t.Log("\tTest 0:\tWhen using an incomplete project value.")
+		{
+			if w.Code != http.StatusUnauthorized {
+				t.Fatalf("\t%s\tShould receive a status code of 401 for the response : %v", tests.Failed, w.Code)
+			}
+			t.Logf("\t%s\tShould receive a status code of 401 for the response.", tests.Success)
+		}
+	}
+}
+
+// getProject400 validates a project request for a malformed id.
+func getProject400(t *testing.T) {
+	id := "12345"
+
+	r := httptest.NewRequest("GET", "/v1/projects/"+id, nil)
+	w := httptest.NewRecorder()
+
+	r.Header.Set("Authorization", userAuthorization)
+
+	a.ServeHTTP(w, r)
+
+	t.Log("Given the need to validate getting a project with a malformed id.")
+	{
+		t.Logf("\tTest 0:\tWhen using the new project %s.", id)
+		{
+			if w.Code != http.StatusBadRequest {
+				t.Fatalf("\t%s\tShould receive a status code of 400 for the response : %v", tests.Failed, w.Code)
+			}
+			t.Logf("\t%s\tShould receive a status code of 400 for the response.", tests.Success)
+
+			recv := w.Body.String()
+			resp := `{"error":"ID is not in its proper form"}`
+			if resp != recv {
+				t.Log("Got :", recv)
+				t.Log("Want:", resp)
+				t.Fatalf("\t%s\tShould get the expected result.", tests.Failed)
+			}
+			t.Logf("\t%s\tShould get the expected result.", tests.Success)
+		}
+	}
+}
+
+// getProject404 validates a project request for a project that does not exist with the endpoint.
+func getProject404(t *testing.T) {
+	id := bson.NewObjectId().Hex()
+
+	r := httptest.NewRequest("GET", "/v1/projects/"+id, nil)
+	w := httptest.NewRecorder()
+
+	r.Header.Set("Authorization", userAuthorization)
+
+	a.ServeHTTP(w, r)
+
+	t.Log("Given the need to validate getting a project with an unknown id.")
+	{
+		t.Logf("\tTest 0:\tWhen using the new project %s.", id)
+		{
+			if w.Code != http.StatusNotFound {
+				t.Fatalf("\t%s\tShould receive a status code of 404 for the response : %v", tests.Failed, w.Code)
+			}
+			t.Logf("\t%s\tShould receive a status code of 404 for the response.", tests.Success)
+
+			recv := w.Body.String()
+			resp := "Entity not found"
+			if !strings.Contains(recv, resp) {
+				t.Log("Got :", recv)
+				t.Log("Want:", resp)
+				t.Fatalf("\t%s\tShould get the expected result.", tests.Failed)
+			}
+			t.Logf("\t%s\tShould get the expected result.", tests.Success)
+		}
+	}
+}
+
+// deleteProject404 validates deleting a project that does not exist.
+func deleteProject404(t *testing.T) {
+	id := bson.NewObjectId().Hex()
+
+	r := httptest.NewRequest("DELETE", "/v1/projects/"+id, nil)
+	w := httptest.NewRecorder()
+
+	r.Header.Set("Authorization", userAuthorization)
+
+	a.ServeHTTP(w, r)
+
+	t.Log("Given the need to validate deleting a project that does not exist.")
+	{
+		t.Logf("\tTest 0:\tWhen using the new project %s.", id)
+		{
+			if w.Code != http.StatusNotFound {
+				t.Fatalf("\t%s\tShould receive a status code of 404 for the response : %v", tests.Failed, w.Code)
+			}
+			t.Logf("\t%s\tShould receive a status code of 404 for the response.", tests.Success)
+
+			recv := w.Body.String()
+			resp := "Entity not found"
+			if !strings.Contains(recv, resp) {
+				t.Log("Got :", recv)
+				t.Log("Want:", resp)
+				t.Fatalf("\t%s\tShould get the expected result.", tests.Failed)
+			}
+			t.Logf("\t%s\tShould get the expected result.", tests.Success)
+		}
+	}
+}
+
+// putProject404 validates updating a project that does not exist.
+func putProject404(t *testing.T) {
+	up := project.UpdateProject{
+		Name: tests.StringPointer("Nonexistent"),
+	}
+
+	id := bson.NewObjectId().Hex()
+
+	body, err := json.Marshal(&up)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	r := httptest.NewRequest("PUT", "/v1/projects/"+id, bytes.NewBuffer(body))
+	w := httptest.NewRecorder()
+
+	r.Header.Set("Authorization", userAuthorization)
+
+	a.ServeHTTP(w, r)
+
+	t.Log("Given the need to validate updating a project that does not exist.")
+	{
+		t.Logf("\tTest 0:\tWhen using the new project %s.", id)
+		{
+			if w.Code != http.StatusNotFound {
+				t.Fatalf("\t%s\tShould receive a status code of 404 for the response : %v", tests.Failed, w.Code)
+			}
+			t.Logf("\t%s\tShould receive a status code of 404 for the response.", tests.Success)
+
+			recv := w.Body.String()
+			resp := "Entity not found"
+			if !strings.Contains(recv, resp) {
+				t.Log("Got :", recv)
+				t.Log("Want:", resp)
+				t.Fatalf("\t%s\tShould get the expected result.", tests.Failed)
+			}
+			t.Logf("\t%s\tShould get the expected result.", tests.Success)
+		}
+	}
+}
+
+// crudProject performs a complete test of CRUD against the api.
+func crudProject(t *testing.T) {
+	p := postProject201(t)
+	defer deleteProject204(t, p.ID.Hex())
+
+	getProject200(t, p.ID.Hex())
+	putProject204(t, p.ID.Hex())
+}
+
+// postProject201 validates a project can be created with the endpoint.
+func postProject201(t *testing.T) project.Project {
+	np := project.NewProject{
+		Name:     "Comic Books",
+		Cost:     25,
+		Quantity: 60,
+	}
+
+	body, err := json.Marshal(&np)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	r := httptest.NewRequest("POST", "/v1/projects", bytes.NewBuffer(body))
+	w := httptest.NewRecorder()
+
+	r.Header.Set("Authorization", userAuthorization)
+
+	a.ServeHTTP(w, r)
+
+	// p is the value we will return.
+	var p project.Project
+
+	t.Log("Given the need to create a new project with the projects endpoint.")
+	{
+		t.Log("\tTest 0:\tWhen using the declared project value.")
+		{
+			if w.Code != http.StatusCreated {
+				t.Fatalf("\t%s\tShould receive a status code of 201 for the response : %v", tests.Failed, w.Code)
+			}
+			t.Logf("\t%s\tShould receive a status code of 201 for the response.", tests.Success)
+
+			if err := json.NewDecoder(w.Body).Decode(&p); err != nil {
+				t.Fatalf("\t%s\tShould be able to unmarshal the response : %v", tests.Failed, err)
+			}
+
+			// Define what we wanted to receive. We will just trust the generated
+			// fields like ID and Dates so we copy p.
+			want := p
+			want.Name = "Comic Books"
+			want.Cost = 25
+			want.Quantity = 60
+
+			if diff := cmp.Diff(want, p); diff != "" {
+				t.Fatalf("\t%s\tShould get the expected result. Diff:\n%s", tests.Failed, diff)
+			}
+			t.Logf("\t%s\tShould get the expected result.", tests.Success)
+		}
+	}
+
+	return p
+}
+
+// deleteProject200 validates deleting a project that does exist.
+func deleteProject204(t *testing.T, id string) {
+	r := httptest.NewRequest("DELETE", "/v1/projects/"+id, nil)
+	w := httptest.NewRecorder()
+
+	r.Header.Set("Authorization", userAuthorization)
+
+	a.ServeHTTP(w, r)
+
+	t.Log("Given the need to validate deleting a project that does exist.")
+	{
+		t.Logf("\tTest 0:\tWhen using the new project %s.", id)
+		{
+			if w.Code != http.StatusNoContent {
+				t.Fatalf("\t%s\tShould receive a status code of 204 for the response : %v", tests.Failed, w.Code)
+			}
+			t.Logf("\t%s\tShould receive a status code of 204 for the response.", tests.Success)
+		}
+	}
+}
+
+// getProject200 validates a project request for an existing id.
+func getProject200(t *testing.T, id string) {
+	r := httptest.NewRequest("GET", "/v1/projects/"+id, nil)
+	w := httptest.NewRecorder()
+
+	r.Header.Set("Authorization", userAuthorization)
+
+	a.ServeHTTP(w, r)
+
+	t.Log("Given the need to validate getting a project that exists.")
+	{
+		t.Logf("\tTest 0:\tWhen using the new project %s.", id)
+		{
+			if w.Code != http.StatusOK {
+				t.Fatalf("\t%s\tShould receive a status code of 200 for the response : %v", tests.Failed, w.Code)
+			}
+			t.Logf("\t%s\tShould receive a status code of 200 for the response.", tests.Success)
+
+			var p project.Project
+			if err := json.NewDecoder(w.Body).Decode(&p); err != nil {
+				t.Fatalf("\t%s\tShould be able to unmarshal the response : %v", tests.Failed, err)
+			}
+
+			// Define what we wanted to receive. We will just trust the generated
+			// fields like Dates so we copy p.
+			want := p
+			want.ID = bson.ObjectIdHex(id)
+			want.Name = "Comic Books"
+			want.Cost = 25
+			want.Quantity = 60
+
+			if diff := cmp.Diff(want, p); diff != "" {
+				t.Fatalf("\t%s\tShould get the expected result. Diff:\n%s", tests.Failed, diff)
+			}
+			t.Logf("\t%s\tShould get the expected result.", tests.Success)
+		}
+	}
+}
+
+// putProject204 validates updating a project that does exist.
+func putProject204(t *testing.T, id string) {
+	body := `{"name": "Graphic Novels", "cost": 100}`
+	r := httptest.NewRequest("PUT", "/v1/projects/"+id, strings.NewReader(body))
+	w := httptest.NewRecorder()
+
+	r.Header.Set("Authorization", userAuthorization)
+
+	a.ServeHTTP(w, r)
+
+	t.Log("Given the need to update a project with the projects endpoint.")
+	{
+		t.Log("\tTest 0:\tWhen using the modified project value.")
+		{
+			if w.Code != http.StatusNoContent {
+				t.Fatalf("\t%s\tShould receive a status code of 204 for the response : %v", tests.Failed, w.Code)
+			}
+			t.Logf("\t%s\tShould receive a status code of 204 for the response.", tests.Success)
+
+			r = httptest.NewRequest("GET", "/v1/projects/"+id, nil)
+			w = httptest.NewRecorder()
+
+			r.Header.Set("Authorization", userAuthorization)
+
+			a.ServeHTTP(w, r)
+
+			if w.Code != http.StatusOK {
+				t.Fatalf("\t%s\tShould receive a status code of 200 for the retrieve : %v", tests.Failed, w.Code)
+			}
+			t.Logf("\t%s\tShould receive a status code of 200 for the retrieve.", tests.Success)
+
+			var ru project.Project
+			if err := json.NewDecoder(w.Body).Decode(&ru); err != nil {
+				t.Fatalf("\t%s\tShould be able to unmarshal the response : %v", tests.Failed, err)
+			}
+
+			if ru.Name != "Graphic Novels" {
+				t.Fatalf("\t%s\tShould see an updated Name : got %q want %q", tests.Failed, ru.Name, "Graphic Novels")
+			}
+			t.Logf("\t%s\tShould see an updated Name.", tests.Success)
+		}
+	}
+}

example-project/cmd/web-api/tests/tests_test.go

@@ -0,0 +1,97 @@
+package tests
+
+import (
+	"crypto/rand"
+	"crypto/rsa"
+	"net/http"
+	"os"
+	"testing"
+	"time"
+
+	"geeks-accelerator/oss/saas-starter-kit/example-project/cmd/web-api/handlers"
+	"geeks-accelerator/oss/saas-starter-kit/example-project/internal/platform/auth"
+	"geeks-accelerator/oss/saas-starter-kit/example-project/internal/platform/tests"
+	"geeks-accelerator/oss/saas-starter-kit/example-project/internal/user"
+)
+
+var a http.Handler
+var test *tests.Test
+
+// Information about the users we have created for testing.
+var adminAuthorization string
+var adminID string
+var userAuthorization string
+var userID string
+
+// TestMain is the entry point for testing.
+func TestMain(m *testing.M) {
+	os.Exit(testMain(m))
+}
+
+func testMain(m *testing.M) int {
+	test = tests.New()
+	defer test.TearDown()
+
+	// Create RSA keys to enable authentication in our service.
+	key, err := rsa.GenerateKey(rand.Reader, 2048)
+	if err != nil {
+		panic(err)
+	}
+
+	kid := "4754d86b-7a6d-4df5-9c65-224741361492"
+	kf := auth.NewSingleKeyFunc(kid, key.Public().(*rsa.PublicKey))
+	authenticator, err := auth.NewAuthenticator(key, kid, "RS256", kf)
+	if err != nil {
+		panic(err)
+	}
+
+	shutdown := make(chan os.Signal, 1)
+	a = handlers.API(shutdown, test.Log, test.MasterDB, authenticator)
+
+	// Create an admin user directly with our business logic. This creates an
+	// initial user that we will use for admin validated endpoints.
+	nu := user.NewUser{
+		Email:           "admin@ardanlabs.com",
+		Name:            "Admin User",
+		Roles:           []string{auth.RoleAdmin, auth.RoleUser},
+		Password:        "gophers",
+		PasswordConfirm: "gophers",
+	}
+
+	admin, err := user.Create(tests.Context(), test.MasterDB, &nu, time.Now())
+	if err != nil {
+		panic(err)
+	}
+	adminID = admin.ID.Hex()
+
+	tkn, err := user.Authenticate(tests.Context(), test.MasterDB, authenticator, time.Now(), nu.Email, nu.Password)
+	if err != nil {
+		panic(err)
+	}
+
+	adminAuthorization = "Bearer " + tkn.Token
+
+	// Create a regular user to use when calling regular validated endpoints.
+	nu = user.NewUser{
+		Email:           "user@ardanlabs.com",
+		Name:            "Regular User",
+		Roles:           []string{auth.RoleUser},
+		Password:        "concurrency",
+		PasswordConfirm: "concurrency",
+	}
+
+	usr, err := user.Create(tests.Context(), test.MasterDB, &nu, time.Now())
+	if err != nil {
+		panic(err)
+	}
+	userID = usr.ID.Hex()
+
+	tkn, err = user.Authenticate(tests.Context(), test.MasterDB, authenticator, time.Now(), nu.Email, nu.Password)
+	if err != nil {
+		panic(err)
+	}
+
+	userAuthorization = "Bearer " + tkn.Token
+
+	return m.Run()
+}

example-project/cmd/web-api/tests/user_test.go

@@ -0,0 +1,576 @@
+package tests
+
+import (
+	"bytes"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	"geeks-accelerator/oss/saas-starter-kit/example-project/internal/platform/auth"
+	"geeks-accelerator/oss/saas-starter-kit/example-project/internal/platform/tests"
+	"geeks-accelerator/oss/saas-starter-kit/example-project/internal/platform/web"
+	"geeks-accelerator/oss/saas-starter-kit/example-project/internal/user"
+	"github.com/google/go-cmp/cmp"
+	"github.com/google/go-cmp/cmp/cmpopts"
+	"gopkg.in/mgo.v2/bson"
+)
+
+// TestUsers is the entry point for testing user management functions.
+func TestUsers(t *testing.T) {
+	defer tests.Recover(t)
+
+	t.Run("getToken401", getToken401)
+	t.Run("getToken200", getToken200)
+	t.Run("postUser400", postUser400)
+	t.Run("postUser401", postUser401)
+	t.Run("postUser403", postUser403)
+	t.Run("getUser400", getUser400)
+	t.Run("getUser403", getUser403)
+	t.Run("getUser404", getUser404)
+	t.Run("deleteUser404", deleteUser404)
+	t.Run("putUser404", putUser404)
+	t.Run("crudUsers", crudUser)
+}
+
+// getToken401 ensures an unknown user can't generate a token.
+func getToken401(t *testing.T) {
+	r := httptest.NewRequest("GET", "/v1/users/token", nil)
+	w := httptest.NewRecorder()
+
+	r.SetBasicAuth("unknown@example.com", "some-password")
+
+	a.ServeHTTP(w, r)
+
+	t.Log("Given the need to deny tokens to unknown users.")
+	{
+		t.Log("\tTest 0:\tWhen fetching a token with an unrecognized email.")
+		{
+			if w.Code != http.StatusUnauthorized {
+				t.Fatalf("\t%s\tShould receive a status code of 401 for the response : %v", tests.Failed, w.Code)
+			}
+			t.Logf("\t%s\tShould receive a status code of 401 for the response.", tests.Success)
+		}
+	}
+}
+
+// getToken200
+func getToken200(t *testing.T) {
+
+	r := httptest.NewRequest("GET", "/v1/users/token", nil)
+	w := httptest.NewRecorder()
+
+	r.SetBasicAuth("admin@ardanlabs.com", "gophers")
+
+	a.ServeHTTP(w, r)
+
+	t.Log("Given the need to issues tokens to known users.")
+	{
+		t.Log("\tTest 0:\tWhen fetching a token with valid credentials.")
+		{
+			if w.Code != http.StatusOK {
+				t.Fatalf("\t%s\tShould receive a status code of 200 for the response : %v", tests.Failed, w.Code)
+			}
+			t.Logf("\t%s\tShould receive a status code of 200 for the response.", tests.Success)
+
+			var got user.Token
+			if err := json.NewDecoder(w.Body).Decode(&got); err != nil {
+				t.Fatalf("\t%s\tShould be able to unmarshal the response : %v", tests.Failed, err)
+			}
+			t.Logf("\t%s\tShould be able to unmarshal the response.", tests.Success)
+
+			// TODO(jlw) Should we ensure the token is valid?
+		}
+	}
+}
+
+// postUser400 validates a user can't be created with the endpoint
+// unless a valid user document is submitted.
+func postUser400(t *testing.T) {
+	body, err := json.Marshal(&user.NewUser{})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	r := httptest.NewRequest("POST", "/v1/users", bytes.NewBuffer(body))
+	w := httptest.NewRecorder()
+
+	r.Header.Set("Authorization", adminAuthorization)
+
+	a.ServeHTTP(w, r)
+
+	t.Log("Given the need to validate a new user can't be created with an invalid document.")
+	{
+		t.Log("\tTest 0:\tWhen using an incomplete user value.")
+		{
+			if w.Code != http.StatusBadRequest {
+				t.Fatalf("\t%s\tShould receive a status code of 400 for the response : %v", tests.Failed, w.Code)
+			}
+			t.Logf("\t%s\tShould receive a status code of 400 for the response.", tests.Success)
+
+			// Inspect the response.
+			var got web.ErrorResponse
+			if err := json.NewDecoder(w.Body).Decode(&got); err != nil {
+				t.Fatalf("\t%s\tShould be able to unmarshal the response to an error type : %v", tests.Failed, err)
+			}
+			t.Logf("\t%s\tShould be able to unmarshal the response to an error type.", tests.Success)
+
+			// Define what we want to see.
+			want := web.ErrorResponse{
+				Error: "field validation error",
+				Fields: []web.FieldError{
+					{Field: "name", Error: "name is a required field"},
+					{Field: "email", Error: "email is a required field"},
+					{Field: "roles", Error: "roles is a required field"},
+					{Field: "password", Error: "password is a required field"},
+				},
+			}
+
+			// We can't rely on the order of the field errors so they have to be
+			// sorted. Tell the cmp package how to sort them.
+			sorter := cmpopts.SortSlices(func(a, b web.FieldError) bool {
+				return a.Field < b.Field
+			})
+
+			if diff := cmp.Diff(want, got, sorter); diff != "" {
+				t.Fatalf("\t%s\tShould get the expected result. Diff:\n%s", tests.Failed, diff)
+			}
+			t.Logf("\t%s\tShould get the expected result.", tests.Success)
+		}
+	}
+}
+
+// postUser401 validates a user can't be created unless the calling user is
+// authenticated.
+func postUser401(t *testing.T) {
+	body, err := json.Marshal(&user.User{})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	r := httptest.NewRequest("POST", "/v1/users", bytes.NewBuffer(body))
+	w := httptest.NewRecorder()
+
+	r.Header.Set("Authorization", userAuthorization)
+
+	a.ServeHTTP(w, r)
+
+	t.Log("Given the need to validate a new user can't be created with an invalid document.")
+	{
+		t.Log("\tTest 0:\tWhen using an incomplete user value.")
+		{
+			if w.Code != http.StatusForbidden {
+				t.Fatalf("\t%s\tShould receive a status code of 403 for the response : %v", tests.Failed, w.Code)
+			}
+			t.Logf("\t%s\tShould receive a status code of 403 for the response.", tests.Success)
+		}
+	}
+}
+
+// postUser403 validates a user can't be created unless the calling user is
+// an admin user. Regular users can't do this.
+func postUser403(t *testing.T) {
+	body, err := json.Marshal(&user.User{})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	r := httptest.NewRequest("POST", "/v1/users", bytes.NewBuffer(body))
+	w := httptest.NewRecorder()
+
+	// Not setting the Authorization header
+
+	a.ServeHTTP(w, r)
+
+	t.Log("Given the need to validate a new user can't be created with an invalid document.")
+	{
+		t.Log("\tTest 0:\tWhen using an incomplete user value.")
+		{
+			if w.Code != http.StatusUnauthorized {
+				t.Fatalf("\t%s\tShould receive a status code of 401 for the response : %v", tests.Failed, w.Code)
+			}
+			t.Logf("\t%s\tShould receive a status code of 401 for the response.", tests.Success)
+		}
+	}
+}
+
+// getUser400 validates a user request for a malformed userid.
+func getUser400(t *testing.T) {
+	id := "12345"
+
+	r := httptest.NewRequest("GET", "/v1/users/"+id, nil)
+	w := httptest.NewRecorder()
+
+	r.Header.Set("Authorization", adminAuthorization)
+
+	a.ServeHTTP(w, r)
+
+	t.Log("Given the need to validate getting a user with a malformed userid.")
+	{
+		t.Logf("\tTest 0:\tWhen using the new user %s.", id)
+		{
+			if w.Code != http.StatusBadRequest {
+				t.Fatalf("\t%s\tShould receive a status code of 400 for the response : %v", tests.Failed, w.Code)
+			}
+			t.Logf("\t%s\tShould receive a status code of 400 for the response.", tests.Success)
+
+			recv := w.Body.String()
+			resp := `{"error":"ID is not in its proper form"}`
+			if resp != recv {
+				t.Log("Got :", recv)
+				t.Log("Want:", resp)
+				t.Fatalf("\t%s\tShould get the expected result.", tests.Failed)
+			}
+			t.Logf("\t%s\tShould get the expected result.", tests.Success)
+		}
+	}
+}
+
+// getUser403 validates a regular user can't fetch anyone but themselves
+func getUser403(t *testing.T) {
+	t.Log("Given the need to validate regular users can't fetch other users.")
+	{
+		t.Logf("\tTest 0:\tWhen fetching the admin user as a regular user.")
+		{
+			r := httptest.NewRequest("GET", "/v1/users/"+adminID, nil)
+			w := httptest.NewRecorder()
+
+			r.Header.Set("Authorization", userAuthorization)
+
+			a.ServeHTTP(w, r)
+
+			if w.Code != http.StatusForbidden {
+				t.Fatalf("\t%s\tShould receive a status code of 403 for the response : %v", tests.Failed, w.Code)
+			}
+			t.Logf("\t%s\tShould receive a status code of 403 for the response.", tests.Success)
+
+			recv := w.Body.String()
+			resp := `{"error":"Attempted action is not allowed"}`
+			if resp != recv {
+				t.Log("Got :", recv)
+				t.Log("Want:", resp)
+				t.Fatalf("\t%s\tShould get the expected result.", tests.Failed)
+			}
+			t.Logf("\t%s\tShould get the expected result.", tests.Success)
+		}
+
+		t.Logf("\tTest 1:\tWhen fetching the user as a themselves.")
+		{
+
+			r := httptest.NewRequest("GET", "/v1/users/"+userID, nil)
+			w := httptest.NewRecorder()
+
+			r.Header.Set("Authorization", userAuthorization)
+
+			a.ServeHTTP(w, r)
+			if w.Code != http.StatusOK {
+				t.Fatalf("\t%s\tShould receive a status code of 200 for the response : %v", tests.Failed, w.Code)
+			}
+			t.Logf("\t%s\tShould receive a status code of 200 for the response.", tests.Success)
+		}
+	}
+}
+
+// getUser404 validates a user request for a user that does not exist with the endpoint.
+func getUser404(t *testing.T) {
+	id := bson.NewObjectId().Hex()
+
+	r := httptest.NewRequest("GET", "/v1/users/"+id, nil)
+	w := httptest.NewRecorder()
+
+	r.Header.Set("Authorization", adminAuthorization)
+
+	a.ServeHTTP(w, r)
+
+	t.Log("Given the need to validate getting a user with an unknown id.")
+	{
+		t.Logf("\tTest 0:\tWhen using the new user %s.", id)
+		{
+			if w.Code != http.StatusNotFound {
+				t.Fatalf("\t%s\tShould receive a status code of 404 for the response : %v", tests.Failed, w.Code)
+			}
+			t.Logf("\t%s\tShould receive a status code of 404 for the response.", tests.Success)
+
+			recv := w.Body.String()
+			resp := "Entity not found"
+			if !strings.Contains(recv, resp) {
+				t.Log("Got :", recv)
+				t.Log("Want:", resp)
+				t.Fatalf("\t%s\tShould get the expected result.", tests.Failed)
+			}
+			t.Logf("\t%s\tShould get the expected result.", tests.Success)
+		}
+	}
+}
+
+// deleteUser404 validates deleting a user that does not exist.
+func deleteUser404(t *testing.T) {
+	id := bson.NewObjectId().Hex()
+
+	r := httptest.NewRequest("DELETE", "/v1/users/"+id, nil)
+	w := httptest.NewRecorder()
+
+	r.Header.Set("Authorization", adminAuthorization)
+
+	a.ServeHTTP(w, r)
+
+	t.Log("Given the need to validate deleting a user that does not exist.")
+	{
+		t.Logf("\tTest 0:\tWhen using the new user %s.", id)
+		{
+			if w.Code != http.StatusNotFound {
+				t.Fatalf("\t%s\tShould receive a status code of 404 for the response : %v", tests.Failed, w.Code)
+			}
+			t.Logf("\t%s\tShould receive a status code of 404 for the response.", tests.Success)
+
+			recv := w.Body.String()
+			resp := "Entity not found"
+			if !strings.Contains(recv, resp) {
+				t.Log("Got :", recv)
+				t.Log("Want:", resp)
+				t.Fatalf("\t%s\tShould get the expected result.", tests.Failed)
+			}
+			t.Logf("\t%s\tShould get the expected result.", tests.Success)
+		}
+	}
+}
+
+// putUser404 validates updating a user that does not exist.
+func putUser404(t *testing.T) {
+	u := user.UpdateUser{
+		Name: tests.StringPointer("Doesn't Exist"),
+	}
+
+	id := bson.NewObjectId().Hex()
+
+	body, err := json.Marshal(&u)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	r := httptest.NewRequest("PUT", "/v1/users/"+id, bytes.NewBuffer(body))
+	w := httptest.NewRecorder()
+
+	r.Header.Set("Authorization", adminAuthorization)
+
+	a.ServeHTTP(w, r)
+
+	t.Log("Given the need to validate updating a user that does not exist.")
+	{
+		t.Logf("\tTest 0:\tWhen using the new user %s.", id)
+		{
+			if w.Code != http.StatusNotFound {
+				t.Fatalf("\t%s\tShould receive a status code of 404 for the response : %v", tests.Failed, w.Code)
+			}
+			t.Logf("\t%s\tShould receive a status code of 404 for the response.", tests.Success)
+
+			recv := w.Body.String()
+			resp := "Entity not found"
+			if !strings.Contains(recv, resp) {
+				t.Log("Got :", recv)
+				t.Log("Want:", resp)
+				t.Fatalf("\t%s\tShould get the expected result.", tests.Failed)
+			}
+			t.Logf("\t%s\tShould get the expected result.", tests.Success)
+		}
+	}
+}
+
+// crudUser performs a complete test of CRUD against the api.
+func crudUser(t *testing.T) {
+	nu := postUser201(t)
+	defer deleteUser204(t, nu.ID.Hex())
+
+	getUser200(t, nu.ID.Hex())
+	putUser204(t, nu.ID.Hex())
+	putUser403(t, nu.ID.Hex())
+}
+
+// postUser201 validates a user can be created with the endpoint.
+func postUser201(t *testing.T) user.User {
+	nu := user.NewUser{
+		Name:            "Bill Kennedy",
+		Email:           "bill@ardanlabs.com",
+		Roles:           []string{auth.RoleAdmin},
+		Password:        "gophers",
+		PasswordConfirm: "gophers",
+	}
+
+	body, err := json.Marshal(&nu)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	r := httptest.NewRequest("POST", "/v1/users", bytes.NewBuffer(body))
+	w := httptest.NewRecorder()
+
+	r.Header.Set("Authorization", adminAuthorization)
+
+	a.ServeHTTP(w, r)
+
+	// u is the value we will return.
+	var u user.User
+
+	t.Log("Given the need to create a new user with the users endpoint.")
+	{
+		t.Log("\tTest 0:\tWhen using the declared user value.")
+		{
+			if w.Code != http.StatusCreated {
+				t.Fatalf("\t%s\tShould receive a status code of 201 for the response : %v", tests.Failed, w.Code)
+			}
+			t.Logf("\t%s\tShould receive a status code of 201 for the response.", tests.Success)
+
+			if err := json.NewDecoder(w.Body).Decode(&u); err != nil {
+				t.Fatalf("\t%s\tShould be able to unmarshal the response : %v", tests.Failed, err)
+			}
+
+			// Define what we wanted to receive. We will just trust the generated
+			// fields like ID and Dates so we copy u.
+			want := u
+			want.Name = "Bill Kennedy"
+			want.Email = "bill@ardanlabs.com"
+			want.Roles = []string{auth.RoleAdmin}
+
+			if diff := cmp.Diff(want, u); diff != "" {
+				t.Fatalf("\t%s\tShould get the expected result. Diff:\n%s", tests.Failed, diff)
+			}
+			t.Logf("\t%s\tShould get the expected result.", tests.Success)
+		}
+	}
+
+	return u
+}
+
+// deleteUser200 validates deleting a user that does exist.
+func deleteUser204(t *testing.T, id string) {
+	r := httptest.NewRequest("DELETE", "/v1/users/"+id, nil)
+	w := httptest.NewRecorder()
+
+	r.Header.Set("Authorization", adminAuthorization)
+
+	a.ServeHTTP(w, r)
+
+	t.Log("Given the need to validate deleting a user that does exist.")
+	{
+		t.Logf("\tTest 0:\tWhen using the new user %s.", id)
+		{
+			if w.Code != http.StatusNoContent {
+				t.Fatalf("\t%s\tShould receive a status code of 204 for the response : %v", tests.Failed, w.Code)
+			}
+			t.Logf("\t%s\tShould receive a status code of 204 for the response.", tests.Success)
+		}
+	}
+}
+
+// getUser200 validates a user request for an existing userid.
+func getUser200(t *testing.T, id string) {
+	r := httptest.NewRequest("GET", "/v1/users/"+id, nil)
+	w := httptest.NewRecorder()
+
+	r.Header.Set("Authorization", adminAuthorization)
+
+	a.ServeHTTP(w, r)
+
+	t.Log("Given the need to validate getting a user that exsits.")
+	{
+		t.Logf("\tTest 0:\tWhen using the new user %s.", id)
+		{
+			if w.Code != http.StatusOK {
+				t.Fatalf("\t%s\tShould receive a status code of 200 for the response : %v", tests.Failed, w.Code)
+			}
+			t.Logf("\t%s\tShould receive a status code of 200 for the response.", tests.Success)
+
+			var u user.User
+			if err := json.NewDecoder(w.Body).Decode(&u); err != nil {
+				t.Fatalf("\t%s\tShould be able to unmarshal the response : %v", tests.Failed, err)
+			}
+
+			// Define what we wanted to receive. We will just trust the generated
+			// fields like Dates so we copy p.
+			want := u
+			want.ID = bson.ObjectIdHex(id)
+			want.Name = "Bill Kennedy"
+			want.Email = "bill@ardanlabs.com"
+			want.Roles = []string{auth.RoleAdmin}
+
+			if diff := cmp.Diff(want, u); diff != "" {
+				t.Fatalf("\t%s\tShould get the expected result. Diff:\n%s", tests.Failed, diff)
+			}
+			t.Logf("\t%s\tShould get the expected result.", tests.Success)
+		}
+	}
+}
+
+// putUser204 validates updating a user that does exist.
+func putUser204(t *testing.T, id string) {
+	body := `{"name": "Jacob Walker"}`
+
+	r := httptest.NewRequest("PUT", "/v1/users/"+id, strings.NewReader(body))
+	w := httptest.NewRecorder()
+
+	r.Header.Set("Authorization", adminAuthorization)
+
+	a.ServeHTTP(w, r)
+
+	t.Log("Given the need to update a user with the users endpoint.")
+	{
+		t.Log("\tTest 0:\tWhen using the modified user value.")
+		{
+			if w.Code != http.StatusNoContent {
+				t.Fatalf("\t%s\tShould receive a status code of 204 for the response : %v", tests.Failed, w.Code)
+			}
+			t.Logf("\t%s\tShould receive a status code of 204 for the response.", tests.Success)
+
+			r = httptest.NewRequest("GET", "/v1/users/"+id, nil)
+			w = httptest.NewRecorder()
+
+			r.Header.Set("Authorization", adminAuthorization)
+
+			a.ServeHTTP(w, r)
+
+			if w.Code != http.StatusOK {
+				t.Fatalf("\t%s\tShould receive a status code of 200 for the retrieve : %v", tests.Failed, w.Code)
+			}
+			t.Logf("\t%s\tShould receive a status code of 200 for the retrieve.", tests.Success)
+
+			var ru user.User
+			if err := json.NewDecoder(w.Body).Decode(&ru); err != nil {
+				t.Fatalf("\t%s\tShould be able to unmarshal the response : %v", tests.Failed, err)
+			}
+
+			if ru.Name != "Jacob Walker" {
+				t.Fatalf("\t%s\tShould see an updated Name : got %q want %q", tests.Failed, ru.Name, "Jacob Walker")
+			}
+			t.Logf("\t%s\tShould see an updated Name.", tests.Success)
+
+			if ru.Email != "bill@ardanlabs.com" {
+				t.Fatalf("\t%s\tShould not affect other fields like Email : got %q want %q", tests.Failed, ru.Email, "bill@ardanlabs.com")
+			}
+			t.Logf("\t%s\tShould not affect other fields like Email.", tests.Success)
+		}
+	}
+}
+
+// putUser403 validates that a user can't modify users unless they are an admin.
+func putUser403(t *testing.T, id string) {
+	body := `{"name": "Anna Walker"}`
+
+	r := httptest.NewRequest("PUT", "/v1/users/"+id, strings.NewReader(body))
+	w := httptest.NewRecorder()
+
+	r.Header.Set("Authorization", userAuthorization)
+
+	a.ServeHTTP(w, r)
+
+	t.Log("Given the need to update a user with the users endpoint.")
+	{
+		t.Log("\tTest 0:\tWhen a non-admin user makes a request")
+		{
+			if w.Code != http.StatusForbidden {
+				t.Fatalf("\t%s\tShould receive a status code of 403 for the response : %v", tests.Failed, w.Code)
+			}
+			t.Logf("\t%s\tShould receive a status code of 403 for the response.", tests.Success)
+		}
+	}
+}