To send approval signal from your API handler:

Benchmarks live beside tests; the tool tunes b.N until timing is stable.

Policy: can `s` perform `action` on `r`, given the environment?

Double-submit: compare the CSRF cookie against the header.

bcrypt.CompareHashAndPassword is constant-time internally

DatabaseURL constructs the connection URL from the parts.

Consumer: runs as a separate process (or goroutine)

Producer: push job to queue (called from your API handler)

── PRODUCER ──────────────────────────────────────────

A SEPARATE method for the single-book case. No optional toggles.

GetProduct implements Cache-Aside (Lazy) caching. 1. Check Redis first 2. On miss, fetch from DB, store in cache, return

GetSession retrieves session data — works regardless of which server the request lands on, because Redis is shared across all instances.

GlobalErrorHandler wraps a handler that returns an error.

Handle is the method that satisfies the Handler INTERFACE Because GetUser has Handle(req Request) Response, Go says "GetUser IS-A Handler" — it can be

Go — Idempotent multi-step task with full transaction rollback

Usage in Asynq handler

HandleSendVerificationEmail — registered with the Asynq server

returns an encoded string: salt + params + hash

hash once at signup; store hash, never the password

GET /v1/organizations?status=active&sortBy=name&sortOrder=ascending&page=1&limit=10

Load reads env vars, applies defaults, then VALIDATES before returning. Called once at startup — fail loudly here, never silently in production.

In Go, middleware wraps the "next" handler. Calling next.ServeHTTP is the equivalent of next(): pass execution along the chain.

MustLoad panics if any required variable is missing. Call this once in main() before http.ListenAndServe.

NewSendVerificationEmailTask creates the Asynq task

Constructors

A service that needs no database at all is perfectly valid:

workflows/payment_approval.go — Wait for human signal

── CONSUMER ──────────────────────────────────────────

Rotate a refresh token; detect reuse of an already-spent one.

Regenerate the session ID right after a successful login.

RequireRole runs AFTER an auth middleware that set "user".

RequireSession reads the sid cookie and looks it up in Redis.

mint a self-contained token carrying the claims

StoreSession saves session data in Redis so ANY server can read it.

File naming convention: foo.go is tested by foo_test.go in the same package. Test functions are func TestXxx(t *testing.T) — the `go test` tool finds

2) Stub an external HTTP API with httptest.Server — no real network.

Build tag keeps slow integration tests out of the fast unit run: go:build integration → run with: go test -tags=integration ./...

TimingMiddleware logs the duration of every HTTP request.

Write-Through: update DB and cache simultaneously