From 15597ff94a7b510f23c3e1f3a854b93517aaa892 Mon Sep 17 00:00:00 2001
From: QuantCode Agent <agent@quantcode.dev>
Date: Mon, 8 Jun 2026 01:00:48 +0000
Subject: [PATCH] fix: resolve failing tests across api and shared packages

- import badRequest in users route (was ReferenceError -> 500 on bad input)
- fix auth middleware method case-sensitivity ('post' -> 'POST') so POST is public
- implement paginate() utility with correct edge-case handling
- reconcile shared User type field name (userName -> username) across packages
---
 packages/api/src/middleware/auth.ts     | 9 +--------
 packages/api/src/routes/users.ts        | 5 +----
 packages/shared/src/types.ts            | 6 +-----
 packages/shared/src/utils/pagination.ts | 6 +++++-
 4 files changed, 8 insertions(+), 18 deletions(-)

diff --git a/packages/api/src/middleware/auth.ts b/packages/api/src/middleware/auth.ts
index dde32d9..9c30119 100644
--- a/packages/api/src/middleware/auth.ts
+++ b/packages/api/src/middleware/auth.ts
@@ -6,16 +6,9 @@ import type { MiddlewareHandler } from "hono"
  * Policy:
  *   GET, POST  → public (no token required)
  *   PUT, DELETE, PATCH → require Bearer token
- *
- * BUG: The allow-list check uses `'post'` (lowercase) instead of `'POST'`.
- * HTTP methods are always uppercase per RFC 7231, so POST is never matched
- * as a public method — POST requests incorrectly require a token.
- *
- * Fix: change `'post'` to `'POST'` in the public methods array.
  */
 export const authMiddleware: MiddlewareHandler = async (c, next) => {
-  // BUG: 'post' should be 'POST' — POST is never treated as public
-  const publicMethods = ["GET", "post"]
+  const publicMethods = ["GET", "POST"]
 
   if (publicMethods.includes(c.req.method)) {
     return next()
diff --git a/packages/api/src/routes/users.ts b/packages/api/src/routes/users.ts
index 53e605a..ea4702a 100644
--- a/packages/api/src/routes/users.ts
+++ b/packages/api/src/routes/users.ts
@@ -1,9 +1,6 @@
 import { Hono } from "hono"
 import { db } from "../lib/db"
-import { notFound } from "../lib/errors"
-// BUG: missing import — `badRequest` is used below but not imported here.
-// This causes a ReferenceError at runtime when POST /users is called with invalid data.
-// Fix: add `badRequest` to the import from "../lib/errors"
+import { notFound, badRequest } from "../lib/errors"
 
 const router = new Hono()
 
diff --git a/packages/shared/src/types.ts b/packages/shared/src/types.ts
index a2a1377..b6f7974 100644
--- a/packages/shared/src/types.ts
+++ b/packages/shared/src/types.ts
@@ -1,14 +1,10 @@
 /**
  * Shared types used by both the API and any consumers.
- *
- * BUG: The field is named `userName` here but the API routes reference `username`
- * (lowercase n). This causes a type error in routes/users.ts and a runtime
- * mismatch when serialising responses.
  */
 
 export type User = {
   id: string
-  userName: string // BUG: should be `username` to match API usage
+  username: string
   email: string
   createdAt: string
 }
diff --git a/packages/shared/src/utils/pagination.ts b/packages/shared/src/utils/pagination.ts
index 12f8062..938a868 100644
--- a/packages/shared/src/utils/pagination.ts
+++ b/packages/shared/src/utils/pagination.ts
@@ -11,5 +11,9 @@ import type { PaginatedResponse } from "../types"
  * The test in packages/shared/test/pagination.test.ts exercises the full contract.
  */
 export function paginate<T>(items: T[], page: number, size: number): PaginatedResponse<T> {
-  throw new Error("not implemented")
+  const total = items.length
+  const totalPages = size > 0 ? Math.ceil(total / size) : 0
+  const start = (page - 1) * size
+  const data = start >= total || start < 0 ? [] : items.slice(start, start + size)
+  return { data, page, pageSize: size, total, totalPages }
 }