Move API middleware and routes to api package

11 files changed, 183 insertions, 101 deletions

diff --git a/api/api.go b/api/api.go
new file mode 100644
index 0000000..167693f
--- /dev/null
+++ b/api/api.go
@@ -0,0 +1,47 @@
+// Copyright 2018 Frédéric Guillot. All rights reserved.
+// Use of this source code is governed by the Apache 2.0
+// license that can be found in the LICENSE file.
+
+package api // import "miniflux.app/api"
+
+import (
+	"miniflux.app/reader/feed"
+	"miniflux.app/storage"
+
+	"github.com/gorilla/mux"
+)
+
+// Serve declares API routes for the application.
+func Serve(router *mux.Router, store *storage.Storage, feedHandler *feed.Handler) {
+	handler := &handler{store, feedHandler}
+
+	sr := router.PathPrefix("/v1").Subrouter()
+	sr.Use(newMiddleware(store).serve)
+	sr.HandleFunc("/users", handler.createUser).Methods("POST")
+	sr.HandleFunc("/users", handler.users).Methods("GET")
+	sr.HandleFunc("/users/{userID:[0-9]+}", handler.userByID).Methods("GET")
+	sr.HandleFunc("/users/{userID:[0-9]+}", handler.updateUser).Methods("PUT")
+	sr.HandleFunc("/users/{userID:[0-9]+}", handler.removeUser).Methods("DELETE")
+	sr.HandleFunc("/users/{username}", handler.userByUsername).Methods("GET")
+	sr.HandleFunc("/me", handler.currentUser).Methods("GET")
+	sr.HandleFunc("/categories", handler.createCategory).Methods("POST")
+	sr.HandleFunc("/categories", handler.getCategories).Methods("GET")
+	sr.HandleFunc("/categories/{categoryID}", handler.updateCategory).Methods("PUT")
+	sr.HandleFunc("/categories/{categoryID}", handler.removeCategory).Methods("DELETE")
+	sr.HandleFunc("/discover", handler.getSubscriptions).Methods("POST")
+	sr.HandleFunc("/feeds", handler.createFeed).Methods("POST")
+	sr.HandleFunc("/feeds", handler.getFeeds).Methods("GET")
+	sr.HandleFunc("/feeds/{feedID}/refresh", handler.refreshFeed).Methods("PUT")
+	sr.HandleFunc("/feeds/{feedID}", handler.getFeed).Methods("GET")
+	sr.HandleFunc("/feeds/{feedID}", handler.updateFeed).Methods("PUT")
+	sr.HandleFunc("/feeds/{feedID}", handler.removeFeed).Methods("DELETE")
+	sr.HandleFunc("/feeds/{feedID}/icon", handler.feedIcon).Methods("GET")
+	sr.HandleFunc("/export", handler.exportFeeds).Methods("GET")
+	sr.HandleFunc("/import", handler.importFeeds).Methods("POST")
+	sr.HandleFunc("/feeds/{feedID}/entries", handler.getFeedEntries).Methods("GET")
+	sr.HandleFunc("/feeds/{feedID}/entries/{entryID}", handler.getFeedEntry).Methods("GET")
+	sr.HandleFunc("/entries", handler.getEntries).Methods("GET")
+	sr.HandleFunc("/entries", handler.setEntryStatus).Methods("PUT")
+	sr.HandleFunc("/entries/{entryID}", handler.getEntry).Methods("GET")
+	sr.HandleFunc("/entries/{entryID}/bookmark", handler.toggleBookmark).Methods("PUT")
+}
diff --git a/api/category.go b/api/category.go
index 6343517..2222369 100644
--- a/api/category.go
+++ b/api/category.go
@@ -12,8 +12,7 @@ import (
 	"miniflux.app/http/response/json"
 )
 
-// CreateCategory is the API handler to create a new category.
-func (c *Controller) CreateCategory(w http.ResponseWriter, r *http.Request) {
+func (h *handler) createCategory(w http.ResponseWriter, r *http.Request) {
 	category, err := decodeCategoryPayload(r.Body)
 	if err != nil {
 		json.BadRequest(w, r, err)
@@ -27,12 +26,12 @@ func (c *Controller) CreateCategory(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	if c, err := c.store.CategoryByTitle(userID, category.Title); err != nil || c != nil {
+	if c, err := h.store.CategoryByTitle(userID, category.Title); err != nil || c != nil {
 		json.BadRequest(w, r, errors.New("This category already exists"))
 		return
 	}
 
-	if err := c.store.CreateCategory(category); err != nil {
+	if err := h.store.CreateCategory(category); err != nil {
 		json.ServerError(w, r, err)
 		return
 	}
@@ -40,8 +39,7 @@ func (c *Controller) CreateCategory(w http.ResponseWriter, r *http.Request) {
 	json.Created(w, r, category)
 }
 
-// UpdateCategory is the API handler to update a category.
-func (c *Controller) UpdateCategory(w http.ResponseWriter, r *http.Request) {
+func (h *handler) updateCategory(w http.ResponseWriter, r *http.Request) {
 	categoryID := request.RouteInt64Param(r, "categoryID")
 
 	category, err := decodeCategoryPayload(r.Body)
@@ -57,7 +55,7 @@ func (c *Controller) UpdateCategory(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	err = c.store.UpdateCategory(category)
+	err = h.store.UpdateCategory(category)
 	if err != nil {
 		json.ServerError(w, r, err)
 		return
@@ -66,9 +64,8 @@ func (c *Controller) UpdateCategory(w http.ResponseWriter, r *http.Request) {
 	json.Created(w, r, category)
 }
 
-// GetCategories is the API handler to get a list of categories for a given user.
-func (c *Controller) GetCategories(w http.ResponseWriter, r *http.Request) {
-	categories, err := c.store.Categories(request.UserID(r))
+func (h *handler) getCategories(w http.ResponseWriter, r *http.Request) {
+	categories, err := h.store.Categories(request.UserID(r))
 	if err != nil {
 		json.ServerError(w, r, err)
 		return
@@ -77,17 +74,16 @@ func (c *Controller) GetCategories(w http.ResponseWriter, r *http.Request) {
 	json.OK(w, r, categories)
 }
 
-// RemoveCategory is the API handler to remove a category.
-func (c *Controller) RemoveCategory(w http.ResponseWriter, r *http.Request) {
+func (h *handler) removeCategory(w http.ResponseWriter, r *http.Request) {
 	userID := request.UserID(r)
 	categoryID := request.RouteInt64Param(r, "categoryID")
 
-	if !c.store.CategoryExists(userID, categoryID) {
+	if !h.store.CategoryExists(userID, categoryID) {
 		json.NotFound(w, r)
 		return
 	}
 
-	if err := c.store.RemoveCategory(userID, categoryID); err != nil {
+	if err := h.store.RemoveCategory(userID, categoryID); err != nil {
 		json.ServerError(w, r, err)
 		return
 	}
diff --git a/api/doc.go b/api/doc.go
index 2b3cb33..4b017fc 100644
--- a/api/doc.go
+++ b/api/doc.go
@@ -4,7 +4,7 @@
 
 /*
 
-Package api implements API endpoints for Miniflux application.
+Package api implements API endpoints for the application.
 
 */
 package api // import "miniflux.app/api"
diff --git a/api/entry.go b/api/entry.go
index c727785..3b948f6 100644
--- a/api/entry.go
+++ b/api/entry.go
@@ -15,12 +15,11 @@ import (
 	"miniflux.app/storage"
 )
 
-// GetFeedEntry is the API handler to get a single feed entry.
-func (c *Controller) GetFeedEntry(w http.ResponseWriter, r *http.Request) {
+func (h *handler) getFeedEntry(w http.ResponseWriter, r *http.Request) {
 	feedID := request.RouteInt64Param(r, "feedID")
 	entryID := request.RouteInt64Param(r, "entryID")
 
-	builder := c.store.NewEntryQueryBuilder(request.UserID(r))
+	builder := h.store.NewEntryQueryBuilder(request.UserID(r))
 	builder.WithFeedID(feedID)
 	builder.WithEntryID(entryID)
 
@@ -38,10 +37,9 @@ func (c *Controller) GetFeedEntry(w http.ResponseWriter, r *http.Request) {
 	json.OK(w, r, entry)
 }
 
-// GetEntry is the API handler to get a single entry.
-func (c *Controller) GetEntry(w http.ResponseWriter, r *http.Request) {
+func (h *handler) getEntry(w http.ResponseWriter, r *http.Request) {
 	entryID := request.RouteInt64Param(r, "entryID")
-	builder := c.store.NewEntryQueryBuilder(request.UserID(r))
+	builder := h.store.NewEntryQueryBuilder(request.UserID(r))
 	builder.WithEntryID(entryID)
 
 	entry, err := builder.GetEntry()
@@ -58,8 +56,7 @@ func (c *Controller) GetEntry(w http.ResponseWriter, r *http.Request) {
 	json.OK(w, r, entry)
 }
 
-// GetFeedEntries is the API handler to get all feed entries.
-func (c *Controller) GetFeedEntries(w http.ResponseWriter, r *http.Request) {
+func (h *handler) getFeedEntries(w http.ResponseWriter, r *http.Request) {
 	feedID := request.RouteInt64Param(r, "feedID")
 
 	status := request.QueryStringParam(r, "status", "")
@@ -89,7 +86,7 @@ func (c *Controller) GetFeedEntries(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	builder := c.store.NewEntryQueryBuilder(request.UserID(r))
+	builder := h.store.NewEntryQueryBuilder(request.UserID(r))
 	builder.WithFeedID(feedID)
 	builder.WithStatus(status)
 	builder.WithOrder(order)
@@ -113,8 +110,7 @@ func (c *Controller) GetFeedEntries(w http.ResponseWriter, r *http.Request) {
 	json.OK(w, r, &entriesResponse{Total: count, Entries: entries})
 }
 
-// GetEntries is the API handler to fetch entries.
-func (c *Controller) GetEntries(w http.ResponseWriter, r *http.Request) {
+func (h *handler) getEntries(w http.ResponseWriter, r *http.Request) {
 	status := request.QueryStringParam(r, "status", "")
 	if status != "" {
 		if err := model.ValidateEntryStatus(status); err != nil {
@@ -142,7 +138,7 @@ func (c *Controller) GetEntries(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	builder := c.store.NewEntryQueryBuilder(request.UserID(r))
+	builder := h.store.NewEntryQueryBuilder(request.UserID(r))
 	builder.WithStatus(status)
 	builder.WithOrder(order)
 	builder.WithDirection(direction)
@@ -165,8 +161,7 @@ func (c *Controller) GetEntries(w http.ResponseWriter, r *http.Request) {
 	json.OK(w, r, &entriesResponse{Total: count, Entries: entries})
 }
 
-// SetEntryStatus is the API handler to change the status of entries.
-func (c *Controller) SetEntryStatus(w http.ResponseWriter, r *http.Request) {
+func (h *handler) setEntryStatus(w http.ResponseWriter, r *http.Request) {
 	entryIDs, status, err := decodeEntryStatusPayload(r.Body)
 	if err != nil {
 		json.BadRequest(w , r, errors.New("Invalid JSON payload"))
@@ -178,7 +173,7 @@ func (c *Controller) SetEntryStatus(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	if err := c.store.SetEntriesStatus(request.UserID(r), entryIDs, status); err != nil {
+	if err := h.store.SetEntriesStatus(request.UserID(r), entryIDs, status); err != nil {
 		json.ServerError(w, r, err)
 		return
 	}
@@ -186,10 +181,9 @@ func (c *Controller) SetEntryStatus(w http.ResponseWriter, r *http.Request) {
 	json.NoContent(w, r)
 }
 
-// ToggleBookmark is the API handler to toggle bookmark status.
-func (c *Controller) ToggleBookmark(w http.ResponseWriter, r *http.Request) {
+func (h *handler) toggleBookmark(w http.ResponseWriter, r *http.Request) {
 	entryID := request.RouteInt64Param(r, "entryID")
-	if err := c.store.ToggleBookmark(request.UserID(r), entryID); err != nil {
+	if err := h.store.ToggleBookmark(request.UserID(r), entryID); err != nil {
 		json.ServerError(w, r, err)
 		return
 	}
diff --git a/api/feed.go b/api/feed.go
index 914ba0d..fdc1560 100644
--- a/api/feed.go
+++ b/api/feed.go
@@ -12,8 +12,7 @@ import (
 	"miniflux.app/http/response/json"
 )
 
-// CreateFeed is the API handler to create a new feed.
-func (c *Controller) CreateFeed(w http.ResponseWriter, r *http.Request) {
+func (h *handler) createFeed(w http.ResponseWriter, r *http.Request) {
 	feedInfo, err := decodeFeedCreationPayload(r.Body)
 	if err != nil {
 		json.BadRequest(w, r, err)
@@ -32,17 +31,17 @@ func (c *Controller) CreateFeed(w http.ResponseWriter, r *http.Request) {
 
 	userID := request.UserID(r)
 
-	if c.store.FeedURLExists(userID, feedInfo.FeedURL) {
+	if h.store.FeedURLExists(userID, feedInfo.FeedURL) {
 		json.BadRequest(w, r, errors.New("This feed_url already exists"))
 		return
 	}
 
-	if !c.store.CategoryExists(userID, feedInfo.CategoryID) {
+	if !h.store.CategoryExists(userID, feedInfo.CategoryID) {
 		json.BadRequest(w, r, errors.New("This category_id doesn't exists or doesn't belongs to this user"))
 		return
 	}
 
-	feed, err := c.feedHandler.CreateFeed(
+	feed, err := h.feedHandler.CreateFeed(
 		userID,
 		feedInfo.CategoryID,
 		feedInfo.FeedURL,
@@ -63,17 +62,16 @@ func (c *Controller) CreateFeed(w http.ResponseWriter, r *http.Request) {
 	json.Created(w, r, &result{FeedID: feed.ID})
 }
 
-// RefreshFeed is the API handler to refresh a feed.
-func (c *Controller) RefreshFeed(w http.ResponseWriter, r *http.Request) {
+func (h *handler) refreshFeed(w http.ResponseWriter, r *http.Request) {
 	feedID := request.RouteInt64Param(r, "feedID")
 	userID := request.UserID(r)
 
-	if !c.store.FeedExists(userID, feedID) {
+	if !h.store.FeedExists(userID, feedID) {
 		json.NotFound(w, r)
 		return
 	}
 
-	err := c.feedHandler.RefreshFeed(userID, feedID)
+	err := h.feedHandler.RefreshFeed(userID, feedID)
 	if err != nil {
 		json.ServerError(w, r, err)
 		return
@@ -82,8 +80,7 @@ func (c *Controller) RefreshFeed(w http.ResponseWriter, r *http.Request) {
 	json.NoContent(w, r)
 }
 
-// UpdateFeed is the API handler that is used to update a feed.
-func (c *Controller) UpdateFeed(w http.ResponseWriter, r *http.Request) {
+func (h *handler) updateFeed(w http.ResponseWriter, r *http.Request) {
 	feedID := request.RouteInt64Param(r, "feedID")
 	feedChanges, err := decodeFeedModificationPayload(r.Body)
 	if err != nil {
@@ -93,7 +90,7 @@ func (c *Controller) UpdateFeed(w http.ResponseWriter, r *http.Request) {
 
 	userID := request.UserID(r)
 
-	originalFeed, err := c.store.FeedByID(userID, feedID)
+	originalFeed, err := h.store.FeedByID(userID, feedID)
 	if err != nil {
 		json.NotFound(w, r)
 		return
@@ -106,17 +103,17 @@ func (c *Controller) UpdateFeed(w http.ResponseWriter, r *http.Request) {
 
 	feedChanges.Update(originalFeed)
 
-	if !c.store.CategoryExists(userID, originalFeed.Category.ID) {
+	if !h.store.CategoryExists(userID, originalFeed.Category.ID) {
 		json.BadRequest(w, r, errors.New("This category_id doesn't exists or doesn't belongs to this user"))
 		return
 	}
 
-	if err := c.store.UpdateFeed(originalFeed); err != nil {
+	if err := h.store.UpdateFeed(originalFeed); err != nil {
 		json.ServerError(w, r, err)
 		return
 	}
 
-	originalFeed, err = c.store.FeedByID(userID, feedID)
+	originalFeed, err = h.store.FeedByID(userID, feedID)
 	if err != nil {
 		json.ServerError(w, r, err)
 		return
@@ -125,9 +122,8 @@ func (c *Controller) UpdateFeed(w http.ResponseWriter, r *http.Request) {
 	json.Created(w, r, originalFeed)
 }
 
-// GetFeeds is the API handler that get all feeds that belongs to the given user.
-func (c *Controller) GetFeeds(w http.ResponseWriter, r *http.Request) {
-	feeds, err := c.store.Feeds(request.UserID(r))
+func (h *handler) getFeeds(w http.ResponseWriter, r *http.Request) {
+	feeds, err := h.store.Feeds(request.UserID(r))
 	if err != nil {
 		json.ServerError(w, r, err)
 		return
@@ -136,10 +132,9 @@ func (c *Controller) GetFeeds(w http.ResponseWriter, r *http.Request) {
 	json.OK(w, r, feeds)
 }
 
-// GetFeed is the API handler to get a feed.
-func (c *Controller) GetFeed(w http.ResponseWriter, r *http.Request) {
+func (h *handler) getFeed(w http.ResponseWriter, r *http.Request) {
 	feedID := request.RouteInt64Param(r, "feedID")
-	feed, err := c.store.FeedByID(request.UserID(r), feedID)
+	feed, err := h.store.FeedByID(request.UserID(r), feedID)
 	if err != nil {
 		json.ServerError(w, r, err)
 		return
@@ -153,17 +148,16 @@ func (c *Controller) GetFeed(w http.ResponseWriter, r *http.Request) {
 	json.OK(w, r, feed)
 }
 
-// RemoveFeed is the API handler to remove a feed.
-func (c *Controller) RemoveFeed(w http.ResponseWriter, r *http.Request) {
+func (h *handler) removeFeed(w http.ResponseWriter, r *http.Request) {
 	feedID := request.RouteInt64Param(r, "feedID")
 	userID := request.UserID(r)
 
-	if !c.store.FeedExists(userID, feedID) {
+	if !h.store.FeedExists(userID, feedID) {
 		json.NotFound(w, r)
 		return
 	}
 
-	if err := c.store.RemoveFeed(userID, feedID); err != nil {
+	if err := h.store.RemoveFeed(userID, feedID); err != nil {
 		json.ServerError(w, r, err)
 		return
 	}
diff --git a/api/controller.go b/api/handler.go
index 5cdc056..8585dcd 100644
--- a/api/controller.go
+++ b/api/handler.go
@@ -9,13 +9,7 @@ import (
 	"miniflux.app/storage"
 )
 
-// Controller holds all handlers for the API.
-type Controller struct {
+type handler struct {
 	store       *storage.Storage
 	feedHandler *feed.Handler
 }
-
-// NewController creates a new controller.
-func NewController(store *storage.Storage, feedHandler *feed.Handler) *Controller {
-	return &Controller{store: store, feedHandler: feedHandler}
-}
diff --git a/api/icon.go b/api/icon.go
index 1954769..406e6a6 100644
--- a/api/icon.go
+++ b/api/icon.go
@@ -11,16 +11,15 @@ import (
 	"miniflux.app/http/response/json"
 )
 
-// FeedIcon returns a feed icon.
-func (c *Controller) FeedIcon(w http.ResponseWriter, r *http.Request) {
+func (h *handler) feedIcon(w http.ResponseWriter, r *http.Request) {
 	feedID := request.RouteInt64Param(r, "feedID")
 
-	if !c.store.HasIcon(feedID) {
+	if !h.store.HasIcon(feedID) {
 		json.NotFound(w, r)
 		return
 	}
 
-	icon, err := c.store.IconByFeedID(request.UserID(r), feedID)
+	icon, err := h.store.IconByFeedID(request.UserID(r), feedID)
 	if err != nil {
 		json.ServerError(w, r, err)
 		return
diff --git a/api/middleware.go b/api/middleware.go
new file mode 100644
index 0000000..09a6f8c
--- /dev/null
+++ b/api/middleware.go
@@ -0,0 +1,68 @@
+// Copyright 2018 Frédéric Guillot. All rights reserved.
+// Use of this source code is governed by the Apache 2.0
+// license that can be found in the LICENSE file.
+
+package api // import "miniflux.app/api"
+
+import (
+	"context"
+	"net/http"
+
+	"miniflux.app/http/request"
+	"miniflux.app/http/response/json"
+	"miniflux.app/logger"
+	"miniflux.app/storage"
+)
+
+type middleware struct {
+	store *storage.Storage
+}
+
+func newMiddleware(s *storage.Storage) *middleware {
+	return &middleware{s}
+}
+
+// BasicAuth handles HTTP basic authentication.
+func (m *middleware) serve(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("WWW-Authenticate", `Basic realm="Restricted"`)
+
+		clientIP := request.ClientIP(r)
+		username, password, authOK := r.BasicAuth()
+		if !authOK {
+			logger.Debug("[API] No authentication headers sent")
+			json.Unauthorized(w, r)
+			return
+		}
+
+		if err := m.store.CheckPassword(username, password); err != nil {
+			logger.Error("[API] [ClientIP=%s] Invalid username or password: %s", clientIP, username)
+			json.Unauthorized(w, r)
+			return
+		}
+
+		user, err := m.store.UserByUsername(username)
+		if err != nil {
+			logger.Error("[API] %v", err)
+			json.ServerError(w, r, err)
+			return
+		}
+
+		if user == nil {
+			logger.Error("[API] [ClientIP=%s] User not found: %s", clientIP, username)
+			json.Unauthorized(w, r)
+			return
+		}
+
+		logger.Info("[API] User authenticated: %s", username)
+		m.store.SetLastLogin(user.ID)
+
+		ctx := r.Context()
+		ctx = context.WithValue(ctx, request.UserIDContextKey, user.ID)
+		ctx = context.WithValue(ctx, request.UserTimezoneContextKey, user.Timezone)
+		ctx = context.WithValue(ctx, request.IsAdminUserContextKey, user.IsAdmin)
+		ctx = context.WithValue(ctx, request.IsAuthenticatedContextKey, true)
+
+		next.ServeHTTP(w, r.WithContext(ctx))
+	})
+}
diff --git a/api/opml.go b/api/opml.go
index 199c0e7..e5af7c9 100644
--- a/api/opml.go
+++ b/api/opml.go
@@ -13,9 +13,8 @@ import (
 	"miniflux.app/reader/opml"
 )
 
-// Export is the API handler that export feeds to OPML.
-func (c *Controller) Export(w http.ResponseWriter, r *http.Request) {
-	opmlHandler := opml.NewHandler(c.store)
+func (h *handler) exportFeeds(w http.ResponseWriter, r *http.Request) {
+	opmlHandler := opml.NewHandler(h.store)
 	opml, err := opmlHandler.Export(request.UserID(r))
 	if err != nil {
 		json.ServerError(w, r, err)
@@ -25,9 +24,8 @@ func (c *Controller) Export(w http.ResponseWriter, r *http.Request) {
 	xml.OK(w, r, opml)
 }
 
-// Import is the API handler that import an OPML file.
-func (c *Controller) Import(w http.ResponseWriter, r *http.Request) {
-	opmlHandler := opml.NewHandler(c.store)
+func (h *handler) importFeeds(w http.ResponseWriter, r *http.Request) {
+	opmlHandler := opml.NewHandler(h.store)
 	err := opmlHandler.Import(request.UserID(r), r.Body)
 	defer r.Body.Close()
 	if err != nil {
diff --git a/api/subscription.go b/api/subscription.go
index 55d0dd8..983a3ca 100644
--- a/api/subscription.go
+++ b/api/subscription.go
@@ -11,8 +11,7 @@ import (
 	"miniflux.app/reader/subscription"
 )
 
-// GetSubscriptions is the API handler to find subscriptions.
-func (c *Controller) GetSubscriptions(w http.ResponseWriter, r *http.Request) {
+func (h *handler) getSubscriptions(w http.ResponseWriter, r *http.Request) {
 	subscriptionInfo, bodyErr := decodeURLPayload(r.Body)
 	if bodyErr != nil {
 		json.BadRequest(w, r, bodyErr)
diff --git a/api/user.go b/api/user.go
index db1e049..62b13bd 100644
--- a/api/user.go
+++ b/api/user.go
@@ -12,9 +12,8 @@ import (
 	"miniflux.app/http/response/json"
 )
 
-// CurrentUser is the API handler to retrieve the authenticated user.
-func (c *Controller) CurrentUser(w http.ResponseWriter, r *http.Request) {
-	user, err := c.store.UserByID(request.UserID(r))
+func (h *handler) currentUser(w http.ResponseWriter, r *http.Request) {
+	user, err := h.store.UserByID(request.UserID(r))
 	if err != nil {
 		json.ServerError(w, r, err)
 		return
@@ -23,8 +22,7 @@ func (c *Controller) CurrentUser(w http.ResponseWriter, r *http.Request) {
 	json.OK(w, r, user)
 }
 
-// CreateUser is the API handler to create a new user.
-func (c *Controller) CreateUser(w http.ResponseWriter, r *http.Request) {
+func (h *handler) createUser(w http.ResponseWriter, r *http.Request) {
 	if !request.IsAdminUser(r) {
 		json.Forbidden(w, r)
 		return
@@ -41,12 +39,12 @@ func (c *Controller) CreateUser(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	if c.store.UserExists(user.Username) {
+	if h.store.UserExists(user.Username) {
 		json.BadRequest(w, r, errors.New("This user already exists"))
 		return
 	}
 
-	err = c.store.CreateUser(user)
+	err = h.store.CreateUser(user)
 	if err != nil {
 		json.ServerError(w, r, err)
 		return
@@ -56,8 +54,7 @@ func (c *Controller) CreateUser(w http.ResponseWriter, r *http.Request) {
 	json.Created(w, r, user)
 }
 
-// UpdateUser is the API handler to update the given user.
-func (c *Controller) UpdateUser(w http.ResponseWriter, r *http.Request) {
+func (h *handler) updateUser(w http.ResponseWriter, r *http.Request) {
 	if !request.IsAdminUser(r) {
 		json.Forbidden(w, r)
 		return
@@ -70,7 +67,7 @@ func (c *Controller) UpdateUser(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	originalUser, err := c.store.UserByID(userID)
+	originalUser, err := h.store.UserByID(userID)
 	if err != nil {
 		json.BadRequest(w, r, errors.New("Unable to fetch this user from the database"))
 		return
@@ -87,7 +84,7 @@ func (c *Controller) UpdateUser(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	if err = c.store.UpdateUser(originalUser); err != nil {
+	if err = h.store.UpdateUser(originalUser); err != nil {
 		json.ServerError(w, r, err)
 		return
 	}
@@ -95,14 +92,13 @@ func (c *Controller) UpdateUser(w http.ResponseWriter, r *http.Request) {
 	json.Created(w, r, originalUser)
 }
 
-// Users is the API handler to get the list of users.
-func (c *Controller) Users(w http.ResponseWriter, r *http.Request) {
+func (h *handler) users(w http.ResponseWriter, r *http.Request) {
 	if !request.IsAdminUser(r) {
 		json.Forbidden(w, r)
 		return
 	}
 
-	users, err := c.store.Users()
+	users, err := h.store.Users()
 	if err != nil {
 		json.ServerError(w, r, err)
 		return
@@ -112,15 +108,14 @@ func (c *Controller) Users(w http.ResponseWriter, r *http.Request) {
 	json.OK(w, r, users)
 }
 
-// UserByID is the API handler to fetch the given user by the ID.
-func (c *Controller) UserByID(w http.ResponseWriter, r *http.Request) {
+func (h *handler) userByID(w http.ResponseWriter, r *http.Request) {
 	if !request.IsAdminUser(r) {
 		json.Forbidden(w, r)
 		return
 	}
 
 	userID := request.RouteInt64Param(r, "userID")
-	user, err := c.store.UserByID(userID)
+	user, err := h.store.UserByID(userID)
 	if err != nil {
 		json.BadRequest(w, r, errors.New("Unable to fetch this user from the database"))
 		return
@@ -135,15 +130,14 @@ func (c *Controller) UserByID(w http.ResponseWriter, r *http.Request) {
 	json.OK(w, r, user)
 }
 
-// UserByUsername is the API handler to fetch the given user by the username.
-func (c *Controller) UserByUsername(w http.ResponseWriter, r *http.Request) {
+func (h *handler) userByUsername(w http.ResponseWriter, r *http.Request) {
 	if !request.IsAdminUser(r) {
 		json.Forbidden(w, r)
 		return
 	}
 
 	username := request.RouteStringParam(r, "username")
-	user, err := c.store.UserByUsername(username)
+	user, err := h.store.UserByUsername(username)
 	if err != nil {
 		json.BadRequest(w, r, errors.New("Unable to fetch this user from the database"))
 		return
@@ -157,15 +151,14 @@ func (c *Controller) UserByUsername(w http.ResponseWriter, r *http.Request) {
 	json.OK(w, r, user)
 }
 
-// RemoveUser is the API handler to remove an existing user.
-func (c *Controller) RemoveUser(w http.ResponseWriter, r *http.Request) {
+func (h *handler) removeUser(w http.ResponseWriter, r *http.Request) {
 	if !request.IsAdminUser(r) {
 		json.Forbidden(w, r)
 		return
 	}
 
 	userID := request.RouteInt64Param(r, "userID")
-	user, err := c.store.UserByID(userID)
+	user, err := h.store.UserByID(userID)
 	if err != nil {
 		json.ServerError(w, r, err)
 		return
@@ -176,7 +169,7 @@ func (c *Controller) RemoveUser(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	if err := c.store.RemoveUser(user.ID); err != nil {
+	if err := h.store.RemoveUser(user.ID); err != nil {
 		json.BadRequest(w, r, errors.New("Unable to remove this user from the database"))
 		return
 	}