fix some security issues

handler_user.go

@@ -44,7 +44,7 @@ func (cfg *apiConfig) handlerUsersCreate(w http.ResponseWriter, r *http.Request)
 		return
 	}
 
-	user, err := cfg.DB.GetUserByAPIKey(r.Context(), apiKey)
+	user, err := cfg.DB.GetUser(r.Context(), apiKey)
 	if err != nil {
 		log.Println(err)
 		respondWithError(w, http.StatusInternalServerError, "Couldn't get user")

internal/database/users.sql.go

@@ -40,13 +40,13 @@ func (q *Queries) CreateUser(ctx context.Context, arg CreateUserParams) error {
 	return err
 }
 
-const getUserByAPIKey = `-- name: GetUserByAPIKey :one
+const getUser = `-- name: GetUser :one
 
 SELECT id, created_at, updated_at, name, api_key FROM users WHERE api_key = ?
 `
 
-func (q *Queries) GetUserByAPIKey(ctx context.Context, apiKey string) (User, error) {
+func (q *Queries) GetUser(ctx context.Context, apiKey string) (User, error) {
-	row := q.db.QueryRowContext(ctx, getUserByAPIKey, apiKey)
+	row := q.db.QueryRowContext(ctx, getUser, apiKey)
 	var i User
 	err := row.Scan(
 		&i.ID,

main.go

@@ -27,7 +27,10 @@ type apiConfig struct {
 var staticFiles embed.FS
 
 func main() {
-	godotenv.Load(".env")
+	err := godotenv.Load(".env")
+	if err != nil {
+		log.Fatalf("Error loading .env file: %v", err)
+	}
 
 	port := os.Getenv("PORT")
 	if port == "" {

middleware_auth.go

@@ -17,7 +17,7 @@ func (cfg *apiConfig) middlewareAuth(handler authedHandler) http.HandlerFunc {
 			return
 		}
 
-		user, err := cfg.DB.GetUserByAPIKey(r.Context(), apiKey)
+		user, err := cfg.DB.GetUser(r.Context(), apiKey)
 		if err != nil {
 			respondWithError(w, http.StatusNotFound, "Couldn't get user")
 			return

sql/queries/users.sql

@@ -9,6 +9,6 @@ VALUES (
 );
 --
 
--- name: GetUserByAPIKey :one
+-- name: GetUser :one
 SELECT * FROM users WHERE api_key = ?;
 --