From e930642fb8b1a936167a6348ed9b6bbc7e36f9e7 Mon Sep 17 00:00:00 2001
From: QuantCode Agent <agent@quantcode.dev>
Date: Mon, 17 Aug 2026 16:19:06 +0000
Subject: [PATCH] fix: correct user field name, auth method casing, and
 pagination stub

Renames the shared User.userName field to username to match the API
contract the tests assert, implements the paginate utility, uppercases
POST in the auth public-method allow-list, imports badRequest in the
users route, and references bun-types in tsconfig so process and
bun:test resolve.

All 22 tests pass and tsc --noEmit is clean.
---
 packages/api/src/middleware/auth.ts     |  9 ++-------
 packages/api/src/routes/users.ts        |  6 +-----
 packages/shared/src/types.ts            |  6 +-----
 packages/shared/src/utils/pagination.ts | 17 +++++++++++++----
 tsconfig.json                           |  1 +
 5 files changed, 18 insertions(+), 21 deletions(-)

diff --git a/packages/api/src/middleware/auth.ts b/packages/api/src/middleware/auth.ts
index dde32d9..152ae5a 100644
--- a/packages/api/src/middleware/auth.ts
+++ b/packages/api/src/middleware/auth.ts
@@ -7,15 +7,10 @@ import type { MiddlewareHandler } from "hono"
  *   GET, POST  → public (no token required)
  *   PUT, DELETE, PATCH → require Bearer token
  *
- * BUG: The allow-list check uses `'post'` (lowercase) instead of `'POST'`.
- * HTTP methods are always uppercase per RFC 7231, so POST is never matched
- * as a public method — POST requests incorrectly require a token.
- *
- * Fix: change `'post'` to `'POST'` in the public methods array.
+ * Methods are compared uppercase, per RFC 7231.
  */
 export const authMiddleware: MiddlewareHandler = async (c, next) => {
-  // BUG: 'post' should be 'POST' — POST is never treated as public
-  const publicMethods = ["GET", "post"]
+  const publicMethods = ["GET", "POST"]
 
   if (publicMethods.includes(c.req.method)) {
     return next()
diff --git a/packages/api/src/routes/users.ts b/packages/api/src/routes/users.ts
index 53e605a..8056ce3 100644
--- a/packages/api/src/routes/users.ts
+++ b/packages/api/src/routes/users.ts
@@ -1,9 +1,6 @@
 import { Hono } from "hono"
 import { db } from "../lib/db"
-import { notFound } from "../lib/errors"
-// BUG: missing import — `badRequest` is used below but not imported here.
-// This causes a ReferenceError at runtime when POST /users is called with invalid data.
-// Fix: add `badRequest` to the import from "../lib/errors"
+import { notFound, badRequest } from "../lib/errors"
 
 const router = new Hono()
 
@@ -20,7 +17,6 @@ router.get("/:id", (c) => {
 router.post("/", async (c) => {
   const body = await c.req.json().catch(() => null)
   if (!body || !body.username || !body.email) {
-    // BUG: badRequest is not imported — this will throw ReferenceError
     return badRequest(c, "username and email are required")
   }
   const user = db.users.create({ username: body.username, email: body.email })
diff --git a/packages/shared/src/types.ts b/packages/shared/src/types.ts
index a2a1377..b6f7974 100644
--- a/packages/shared/src/types.ts
+++ b/packages/shared/src/types.ts
@@ -1,14 +1,10 @@
 /**
  * Shared types used by both the API and any consumers.
- *
- * BUG: The field is named `userName` here but the API routes reference `username`
- * (lowercase n). This causes a type error in routes/users.ts and a runtime
- * mismatch when serialising responses.
  */
 
 export type User = {
   id: string
-  userName: string // BUG: should be `username` to match API usage
+  username: string
   email: string
   createdAt: string
 }
diff --git a/packages/shared/src/utils/pagination.ts b/packages/shared/src/utils/pagination.ts
index 12f8062..c9fc2a7 100644
--- a/packages/shared/src/utils/pagination.ts
+++ b/packages/shared/src/utils/pagination.ts
@@ -5,11 +5,20 @@ import type { PaginatedResponse } from "../types"
  *
  * @param items  Full array of items
  * @param page   1-indexed page number
- * @param size   Number of items per page
+ * @param size   Number of items per page, returned as `pageSize`
  *
- * TODO: implement this function — it is currently a stub.
- * The test in packages/shared/test/pagination.test.ts exercises the full contract.
+ * Pages beyond the end of the array yield an empty `data` array.
+ * An empty input yields a `totalPages` of 0.
  */
 export function paginate<T>(items: T[], page: number, size: number): PaginatedResponse<T> {
-  throw new Error("not implemented")
+  const total = items.length
+  const totalPages = Math.ceil(total / size)
+  const start = (page - 1) * size
+  return {
+    data: items.slice(start, start + size),
+    page,
+    pageSize: size,
+    total,
+    totalPages,
+  }
 }
diff --git a/tsconfig.json b/tsconfig.json
index 53de6fd..b4bf326 100644
--- a/tsconfig.json
+++ b/tsconfig.json
@@ -5,6 +5,7 @@
     "moduleResolution": "bundler",
     "strict": true,
     "skipLibCheck": true,
+    "types": ["bun-types"],
     "paths": {
       "@e2e/shared": ["./packages/shared/src/index.ts"]
     }