chore(api): type AuthServiceInterface user and group writes with the auth.API* request and response types

internal/api/group_explicit_zero_cap_test.go

@@ -30,11 +30,11 @@ type realGroupAuth struct {
 	svc *auth.Service
 }
 
-func (a *realGroupAuth) CreateGroupAPI(ctx context.Context, actor string, req any) (any, error) {
+func (a *realGroupAuth) CreateGroupAPI(ctx context.Context, actor string, req auth.APICreateGroupRequest) (*auth.APIGroup, error) {
 	return a.svc.CreateGroupAPI(ctx, actor, req)
 }
 
-func (a *realGroupAuth) UpdateGroupAPI(ctx context.Context, actor, id string, req any) (any, error) {
+func (a *realGroupAuth) UpdateGroupAPI(ctx context.Context, actor, id string, req auth.APIUpdateGroupRequest) (*auth.APIGroup, error) {
 	return a.svc.UpdateGroupAPI(ctx, actor, id, req)
 }
 

internal/api/handler_coverage_test.go

@@ -482,7 +482,9 @@ func TestRouter_Handlers_Coverage(t *testing.T) {
 		mockAuth.On("ValidateSession", ctx, "admin-token").Return(&Session{UserID: "admin"}, nil)
 		mockAuth.grantAdmin()
 		const groupID = "00000000-0000-5000-8000-000000000005"
-		created := func() map[string]string { return map[string]string{"id": "new-user"} }
+		created := func() *auth.APICreateUserResponse {
+			return &auth.APICreateUserResponse{APIUser: &auth.APIUser{ID: "new-user"}}
+		}
 		// The actor is the session user (grant ceiling, #226) and the password
 		// arrives decoded.
 		mockAuth.On("CreateUserAPI", ctx, "admin", auth.APICreateUserRequest{
@@ -528,7 +530,7 @@ func TestRouter_Handlers_Coverage(t *testing.T) {
 		mockAuth := strictAuthMock(t)
 		mockAuth.On("ValidateSession", ctx, "admin-token").Return(&Session{UserID: "admin"}, nil)
 		mockAuth.grantAdmin()
-		updated := func() map[string]string { return map[string]string{"id": testID, "email": "updated@example.com"} }
+		updated := func() *auth.APIUser { return &auth.APIUser{ID: testID, Email: "updated@example.com"} }
 		mockAuth.On("UpdateUserAPI", ctx, "admin", testID, auth.APIUpdateUserRequest{Email: "updated@example.com"}).Return(updated(), nil)
 
 		h := &Handler{auth: mockAuth}
@@ -568,7 +570,7 @@ func TestRouter_Handlers_Coverage(t *testing.T) {
 		mockAuth := strictAuthMock(t)
 		mockAuth.On("ValidateSession", ctx, "admin-token").Return(&Session{UserID: "admin"}, nil)
 		mockAuth.grantAdmin()
-		created := func() map[string]string { return map[string]string{"id": "new-group"} }
+		created := func() *auth.APIGroup { return &auth.APIGroup{ID: "new-group"} }
 		mockAuth.On("CreateGroupAPI", ctx, "admin", auth.APICreateGroupRequest{Name: "New Group"}).Return(created(), nil)
 
 		h := &Handler{auth: mockAuth}
@@ -608,7 +610,7 @@ func TestRouter_Handlers_Coverage(t *testing.T) {
 		mockAuth := strictAuthMock(t)
 		mockAuth.On("ValidateSession", ctx, "admin-token").Return(&Session{UserID: "admin"}, nil)
 		mockAuth.grantAdmin()
-		updated := func() map[string]string { return map[string]string{"id": testID, "name": "Updated Group"} }
+		updated := func() *auth.APIGroup { return &auth.APIGroup{ID: testID, Name: "Updated Group"} }
 		mockAuth.On("UpdateGroupAPI", ctx, "admin", testID, auth.APIUpdateGroupRequest{Name: "Updated Group"}).Return(updated(), nil)
 
 		h := &Handler{auth: mockAuth}

internal/api/handler_groups_ceiling_test.go

@@ -124,7 +124,7 @@ func TestUpdateGroup_AdminAPIKeyActorIsSentinel(t *testing.T) {
 	mockAuth := new(MockAuthService)
 	t.Cleanup(func() { mockAuth.AssertExpectations(t) })
 
-	updated := map[string]any{"id": ceilingGroupID}
+	updated := &auth.APIGroup{ID: ceilingGroupID}
 	mockAuth.On("UpdateGroupAPI", ctx, apiKeyAdminUserID, ceilingGroupID, mock.Anything).
 		Return(updated, nil).Once()
 

internal/api/handler_groups_test.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"testing"
 
+	"github.com/LeanerCloud/cloud-commitments-platform/internal/auth"
 	"github.com/aws/aws-lambda-go/events"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/mock"
@@ -52,9 +53,9 @@ func TestHandler_createGroup_Success(t *testing.T) {
 		Email:  "admin@example.com",
 	}
 
-	createdGroup := map[string]interface{}{
-		"id":   "33333333-3333-3333-3333-333333333333",
-		"name": "New Group",
+	createdGroup := &auth.APIGroup{
+		ID:   "33333333-3333-3333-3333-333333333333",
+		Name: "New Group",
 	}
 
 	mockAuth.On("ValidateSession", ctx, "admin-token").Return(adminSession, nil)
@@ -115,9 +116,9 @@ func TestHandler_updateGroup_Success(t *testing.T) {
 		Email:  "admin@example.com",
 	}
 
-	updatedGroup := map[string]interface{}{
-		"id":   "11111111-1111-1111-1111-111111111111",
-		"name": "Updated Group",
+	updatedGroup := &auth.APIGroup{
+		ID:   "11111111-1111-1111-1111-111111111111",
+		Name: "Updated Group",
 	}
 
 	mockAuth.On("ValidateSession", ctx, "admin-token").Return(adminSession, nil)

internal/api/handler_ri_exchange_test.go

@@ -1615,19 +1615,19 @@ func (m *mockAuthForExchange) GetUser(_ context.Context, _ string) (*User, error
 func (m *mockAuthForExchange) UpdateUserProfile(_ context.Context, _, _, _, _ string) error {
 	return nil
 }
-func (m *mockAuthForExchange) CreateUserAPI(_ context.Context, _ string, _ any) (any, error) {
+func (m *mockAuthForExchange) CreateUserAPI(_ context.Context, _ string, _ auth.APICreateUserRequest) (*auth.APICreateUserResponse, error) {
 	return nil, nil
 }
-func (m *mockAuthForExchange) UpdateUserAPI(_ context.Context, _, _ string, _ any) (any, error) {
+func (m *mockAuthForExchange) UpdateUserAPI(_ context.Context, _, _ string, _ auth.APIUpdateUserRequest) (*auth.APIUser, error) {
 	return nil, nil
 }
 func (m *mockAuthForExchange) DeleteUser(_ context.Context, _ string) error              { return nil }
 func (m *mockAuthForExchange) ListUsersAPI(_ context.Context) (any, error)               { return nil, nil }
 func (m *mockAuthForExchange) ChangePasswordAPI(_ context.Context, _, _, _ string) error { return nil }
-func (m *mockAuthForExchange) CreateGroupAPI(_ context.Context, _ string, _ any) (any, error) {
+func (m *mockAuthForExchange) CreateGroupAPI(_ context.Context, _ string, _ auth.APICreateGroupRequest) (*auth.APIGroup, error) {
 	return nil, nil
 }
-func (m *mockAuthForExchange) UpdateGroupAPI(_ context.Context, _, _ string, _ any) (any, error) {
+func (m *mockAuthForExchange) UpdateGroupAPI(_ context.Context, _, _ string, _ auth.APIUpdateGroupRequest) (*auth.APIGroup, error) {
 	return nil, nil
 }
 func (m *mockAuthForExchange) DeleteGroup(_ context.Context, _ string) error        { return nil }

internal/api/handler_users_test.go

@@ -80,11 +80,11 @@ func TestHandler_createUser_Success(t *testing.T) {
 		Email:  "admin@example.com",
 	}
 
-	createdUser := &auth.APIUser{
+	createdUser := &auth.APICreateUserResponse{APIUser: &auth.APIUser{
 		ID:     "33333333-3333-3333-3333-333333333333",
 		Email:  "newuser@example.com",
 		Groups: []string{"00000000-0000-5000-8000-000000000005"},
-	}
+	}}
 
 	mockAuth.On("ValidateSession", ctx, "admin-token").Return(adminSession, nil)
 	mockAuth.grantAdmin()
@@ -148,10 +148,10 @@ func TestHandler_updateUser_Success(t *testing.T) {
 		Email:  "admin@example.com",
 	}
 
-	updatedUser := map[string]interface{}{
-		"id":     "11111111-1111-1111-1111-111111111111",
-		"email":  "user@example.com",
-		"groups": []string{"00000000-0000-5000-8000-000000000001"},
+	updatedUser := &auth.APIUser{
+		ID:     "11111111-1111-1111-1111-111111111111",
+		Email:  "user@example.com",
+		Groups: []string{"00000000-0000-5000-8000-000000000001"},
 	}
 
 	mockAuth.On("ValidateSession", ctx, "admin-token").Return(adminSession, nil)
@@ -189,10 +189,10 @@ func TestHandler_updateUser_Deactivate(t *testing.T) {
 		Email:  "admin@example.com",
 	}
 
-	updatedUser := map[string]interface{}{
-		"id":     "11111111-1111-1111-1111-111111111111",
-		"email":  "user@example.com",
-		"active": false,
+	updatedUser := &auth.APIUser{
+		ID:     "11111111-1111-1111-1111-111111111111",
+		Email:  "user@example.com",
+		Active: false,
 	}
 
 	mockAuth.On("ValidateSession", ctx, "admin-token").Return(adminSession, nil)

internal/api/handler_users_update_race_integration_test.go

@@ -24,7 +24,7 @@ type adminUserUpdateAuth struct {
 	marketplaceAuthFixture
 }
 
-func (a *adminUserUpdateAuth) UpdateUserAPI(ctx context.Context, actorUserID, userID string, req any) (any, error) {
+func (a *adminUserUpdateAuth) UpdateUserAPI(ctx context.Context, actorUserID, userID string, req auth.APIUpdateUserRequest) (*auth.APIUser, error) {
 	return a.service.UpdateUserAPI(ctx, actorUserID, userID, req)
 }
 

internal/api/mocks_test.go

@@ -250,14 +250,20 @@ func (m *MockAuthService) UpdateUserProfile(ctx context.Context, userID string,
 }
 
 // User management mock methods.
-func (m *MockAuthService) CreateUserAPI(ctx context.Context, actorUserID string, req interface{}) (interface{}, error) {
+func (m *MockAuthService) CreateUserAPI(ctx context.Context, actorUserID string, req auth.APICreateUserRequest) (*auth.APICreateUserResponse, error) {
 	args := m.Called(ctx, actorUserID, req)
-	return args.Get(0), args.Error(1)
+	if args.Get(0) == nil {
+		return nil, args.Error(1)
+	}
+	return args.Get(0).(*auth.APICreateUserResponse), args.Error(1)
 }
 
-func (m *MockAuthService) UpdateUserAPI(ctx context.Context, actorUserID, userID string, req interface{}) (interface{}, error) {
+func (m *MockAuthService) UpdateUserAPI(ctx context.Context, actorUserID, userID string, req auth.APIUpdateUserRequest) (*auth.APIUser, error) {
 	args := m.Called(ctx, actorUserID, userID, req)
-	return args.Get(0), args.Error(1)
+	if args.Get(0) == nil {
+		return nil, args.Error(1)
+	}
+	return args.Get(0).(*auth.APIUser), args.Error(1)
 }
 
 func (m *MockAuthService) DeleteUser(ctx context.Context, userID string) error {
@@ -303,14 +309,20 @@ func (m *MockAuthService) MFARegenerateRecoveryCodesAPI(ctx context.Context, use
 }
 
 // Group management mock methods.
-func (m *MockAuthService) CreateGroupAPI(ctx context.Context, actorUserID string, req interface{}) (interface{}, error) {
+func (m *MockAuthService) CreateGroupAPI(ctx context.Context, actorUserID string, req auth.APICreateGroupRequest) (*auth.APIGroup, error) {
 	args := m.Called(ctx, actorUserID, req)
-	return args.Get(0), args.Error(1)
+	if args.Get(0) == nil {
+		return nil, args.Error(1)
+	}
+	return args.Get(0).(*auth.APIGroup), args.Error(1)
 }
 
-func (m *MockAuthService) UpdateGroupAPI(ctx context.Context, actorUserID, groupID string, req interface{}) (interface{}, error) {
+func (m *MockAuthService) UpdateGroupAPI(ctx context.Context, actorUserID, groupID string, req auth.APIUpdateGroupRequest) (*auth.APIGroup, error) {
 	args := m.Called(ctx, actorUserID, groupID, req)
-	return args.Get(0), args.Error(1)
+	if args.Get(0) == nil {
+		return nil, args.Error(1)
+	}
+	return args.Get(0).(*auth.APIGroup), args.Error(1)
 }
 
 func (m *MockAuthService) DeleteGroup(ctx context.Context, groupID string) error {

internal/api/types.go

@@ -199,8 +199,8 @@ type AuthServiceInterface interface {
 	GetUser(ctx context.Context, userID string) (*User, error)
 	UpdateUserProfile(ctx context.Context, userID string, email string, currentPassword string, newPassword string) error
 	// User management - uses auth.API* types
-	CreateUserAPI(ctx context.Context, actorUserID string, req any) (any, error)
-	UpdateUserAPI(ctx context.Context, actorUserID, userID string, req any) (any, error)
+	CreateUserAPI(ctx context.Context, actorUserID string, req auth.APICreateUserRequest) (*auth.APICreateUserResponse, error)
+	UpdateUserAPI(ctx context.Context, actorUserID, userID string, req auth.APIUpdateUserRequest) (*auth.APIUser, error)
 	DeleteUser(ctx context.Context, userID string) error
 	ListUsersAPI(ctx context.Context) (any, error)
 	ChangePasswordAPI(ctx context.Context, userID, currentPassword, newPassword string) error
@@ -217,8 +217,8 @@ type AuthServiceInterface interface {
 	// permission onto a group that their own effective permissions do not
 	// hold, and the money verbs carved out of admin:* are not grantable at
 	// all (issues #1550, #1629).
-	CreateGroupAPI(ctx context.Context, actorUserID string, req any) (any, error)
-	UpdateGroupAPI(ctx context.Context, actorUserID, groupID string, req any) (any, error)
+	CreateGroupAPI(ctx context.Context, actorUserID string, req auth.APICreateGroupRequest) (*auth.APIGroup, error)
+	UpdateGroupAPI(ctx context.Context, actorUserID, groupID string, req auth.APIUpdateGroupRequest) (*auth.APIGroup, error)
 	DeleteGroup(ctx context.Context, groupID string) error
 	GetGroupAPI(ctx context.Context, groupID string) (any, error)
 	ListGroupsAPI(ctx context.Context) (any, error)