No way to fetch a single category by id — feature ticket · 10xDebuggable

Expense Tracker — SQL-Enforced Multi-User Isolation

enhancementintermediateP2internal/categories/repo.go, internal/categories/handlers.go, cmd/server/main.go (route)Level 2 · Implement a feature15 XP45–90 minutes

No way to fetch a single category by id

Nobody has started this yet — be first.

Business impact

Every other resource in this API (expenses, budgets) supports fetching a single record by id -- categories is the only one where a client has to fetch the entire list just to check whether one category id is still valid, or get its current name (e.g. before rendering a single expense's category, or confirming a delete). Any frontend built against this API has to work around the missing endpoint with extra round trips.

Problem

internal/categories/handlers.go has List, Create, Update, Delete -- no Get. No route for GET /categories/{id} is registered in cmd/server/main.go's NewRouter, so today that URL simply 404s from Go's ServeMux default ("no matching route"), not from any application logic.

Current behavior

GET /categories/{id} returns a bare 405/404 from the router itself -- there is no handler at all, and the obvious repo method to reach for (GetOwned) would silently exclude every global category if wired in naively.

Expected behavior

GET /categories/{id} (auth required) returns the category if it is visible to the caller -- global (user_id IS NULL) or owned by the caller -- exactly the same visibility rule List already uses, not merely "owned by the caller." A non-owner's or nonexistent id's request gets 404, same as every other resource.

Steps to reproduce

GET /categories/1 (a global "Food" category), with any valid token.

Expected: 200 with the category.

Actual: no route exists yet, so this 404s/405s at the router level.

Why this matters

internal/categories/repo.go already has a GetOwned(ctx, id, userID) method -- it looks like the obvious thing to reach for, but it is not sufficient here: its WHERE clause is id = $1 AND user_id = $2, which only matches a user's private categories, and would incorrectly 404 on every global category (id 1 "Food", etc.) even though List includes globals for every user. Wiring this endpoint straight to GetOwned ships a subtly-broken feature that passes a shallow "can I get my own category" smoke test while being wrong for the common case.

Suggested approach

Add a repo method whose visibility rule matches List's / CategoryVisible's user_id IS NULL OR user_id = $N pattern instead of GetOwned's owner-only rule, returning the full row (unlike CategoryVisible/IsVisible, which only check existence). Wire it into the router at GET /categories/{id} (no conflicting pattern exists yet).

Acceptance criteria

Fetching a global category by id succeeds for any authenticated user.
Fetching your own private category by id succeeds.
Fetching another user's private category by id returns 404 (not the category, not a 403).
Fetching a nonexistent id returns 404.
Response shape matches the existing Category JSON (id, user_id omitted when global, name, global).

Verification

go test ./practicetickets/... -run TestTicket06 -v

Hints (0/2)

Try it without hints first — the reading is the exercise.

Working on this ticket

Work on a branch named for the ticket — that's what you'll submit.

Branch off your fork

$git checkout -b feat/category-get-by-id

Fix it and commit

Meet every acceptance criterion, and add a test that would have caught this.

Push the branch

$git push -u origin feat/category-get-by-id

Submit it below

Paste your fork URL and the branch name, with a short write-up of the root cause.

Submit your fix

Questions

Stuck on something?

Ask about anything unclear in the ticket — the maintainer and anyone who has solved it can answer. Please don't post full solutions.

No questions yet. If something in this ticket reads ambiguously, you are probably not the only one — ask.

The project

Expense Tracker — SQL-Enforced Multi-User Isolation

A production-style multi-user expense tracker in Go where the authorization boundary between one user's financial data and everyone else's is a literal SQL `WHERE id = $1 AND user_id = $2` clause -- not an application-layer check -- so a single flipped operator or dropped predicate is a real, silent cross-account data breach, not a cosmetic bug.

Fork on GitHub

Download

Setup

Expense Tracker — SQL-Enforced Multi-User Isolation

git clone <your-fork>
cd expense_tracker
docker compose up --build   # postgres (host port 5434) + app (host port 8082)

auto-applies on first boot via Postgres's mechanism, seeding the seven global default categories (ids 1-7). The compose project is named , so it won't collide with sibling projects on the same machine. Health-check on gates 's startup so the API never starts before the schema exists.

docker-compose.yml

migrations/0001_init.sql

docker-entrypoint-initdb.d

expense_tracker

db

app

curl http://localhost:8082/healthz

go test ./practicetickets/... -run TestTicket01 -v   # a single ticket
./practice_tickets_run.sh                             # all 10, clean pass/fail summary