Context Deeper — Deadlines, Real Auth & Design

package main

import (
  "context"
  "fmt"
  "time"
)

// doWork simulates a slow operation (e.g. a database query).
// It watches ctx.Done() — if the context is cancelled, it bails out.
func doWork(ctx context.Context) (string, error) {
  select {
  case <-time.After(3 * time.Second):
      return "work completed", nil
  case <-ctx.Done():
      return "", fmt.Errorf("cancelled: %w", ctx.Err())
  }
}

func main() {
  // WithTimeout: auto-cancels after 1 second
  ctx, cancel := context.WithTimeout(context.Background(), 1*time.Second)
  defer cancel() // always call cancel to free resources

  fmt.Println("Starting work with 1 second deadline...")
  result, err := doWork(ctx)
  if err != nil {
      fmt.Println("Error:", err)
  } else {
      fmt.Println("Result:", result)
  }

  // Bonus: simulate a client disconnect
  fmt.Println("\n--- WithCancel demo ---")
  ctx2, cancel2 := context.WithCancel(context.Background())
  go func() {
      time.Sleep(500 * time.Millisecond)
      cancel2() // cancel after half a second
  }()
  result2, err2 := doWork(ctx2)
  if err2 != nil {
      fmt.Println("Error:", err2)
  } else {
      fmt.Println("Result:", result2)
  }
}

go run timeout.go

package main

import (
  "context"
  "log"
  "net/http"
  "strings"
)

// --- Context key and user type ---

type ctxKey string
const ctxKeyUser ctxKey = "user"

type AuthUser struct {
  ID    int
  Email string
}

// --- Real auth middleware ---

func jwtAuthMiddleware(next http.Handler) http.Handler {
  return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
      // 1) Read the Authorization header
      authHeader := r.Header.Get("Authorization")

      // 2) Check it's a Bearer token
      if !strings.HasPrefix(authHeader, "Bearer ") {
          http.Error(w, "missing or invalid token", http.StatusUnauthorized)
          return // ← important: never call next.ServeHTTP
      }

      // 3) Strip prefix and validate
      token := strings.TrimPrefix(authHeader, "Bearer ")
      user, err := validateToken(token)
      if err != nil {
          http.Error(w, "invalid token", http.StatusUnauthorized)
          return
      }

      // 4) Store the user in context → pass to next handler
      ctx := context.WithValue(r.Context(), ctxKeyUser, user)
      next.ServeHTTP(w, r.WithContext(ctx))
  })
}

// validateToken is a stub — real code would parse JWT, verify signature, check expiry.
func validateToken(token string) (*AuthUser, error) {
  if token == "secret-token" {
      return &AuthUser{ID: 42, Email: "alice@example.com"}, nil
  }
  return nil, http.ErrNoCookie // placeholder error
}

// --- Handler that reads the user ---

func whoami(w http.ResponseWriter, r *http.Request) {
  user, ok := r.Context().Value(ctxKeyUser).(*AuthUser)
  if !ok {
      http.Error(w, "unauthorized", http.StatusUnauthorized)
      return
  }
  w.Write([]byte("Hello, " + user.Email + "!\n"))
}

// --- Main ---

func main() {
  mux := http.NewServeMux()
  mux.HandleFunc("GET /whoami", whoami)
  mux.HandleFunc("GET /public", func(w http.ResponseWriter, r *http.Request) {
      w.Write([]byte("Anyone can access this.\n"))
  })

  // Only /whoami goes through auth middleware
  handler := jwtAuthMiddleware(mux)

  log.Println("Server starting on http://localhost:8080")
  log.Fatal(http.ListenAndServe(":8080", handler))
}

go run main.go

# Without token — blocked by middleware, returns 401
curl -i http://localhost:8080/whoami

# With a valid token — handler runs, returns user info
curl -H "Authorization: Bearer secret-token" http://localhost:8080/whoami

# With an invalid token — blocked with 401
curl -H "Authorization: Bearer wrong" http://localhost:8080/whoami

# Public endpoint — no auth needed (but auth middleware still runs,
# it just doesn't find a header, so everyone hits 401 for now!)

// ✅ GOOD: user identity via context (request-scoped, crosses boundaries)
func getUserOrders(w http.ResponseWriter, r *http.Request) {
  user := r.Context().Value(ctxKeyUser).(*AuthUser)
  orders := fetchOrders(user.ID)    // explicit argument for business data
  json.NewEncoder(w).Encode(orders)
}

// ✅ GOOD: request ID in context (cross-cutting, every handler might log it)
ctx = context.WithValue(ctx, ctxKeyRequestID, uuid.New().String())

// ✅ GOOD: database connection in a struct field, not context
type Server struct {
  db *sql.DB
}

// ❌ BAD: passing context values as regular arguments defeats the purpose
func getUserOrders(user AuthUser) { ... } // where does user come from?

// ❌ BAD: stuffing dependencies into context
ctx = context.WithValue(ctx, "db", myDB)  // don't do this