Close performs a graceful shutdown, flushing any in-flight processing.

NewClaimsParser creates a ClaimsParser. Both issuer and secret are required.

RateLimit is a sliding-window rate limiter middleware. A zero limit or interval disables rate limiting.

UserFromCtx extracts the authenticated user from context. Returns an empty User{} if not present — callers should check user.ID != "".

NewLogger creates a ZerologLogger with the given minimum level and static service metadata attached to every log line.

SetUserCtx injects the authenticated user into the request context.

TimeoutMiddleware wraps an endpoint with a context deadline. A zero or negative timeout is treated as disabled.

Start begins consuming messages. It must block until ctx is done or an unrecoverable error occurs.

MustGenerateToken creates a signed JWT token and fails the test on error.

ParseJWTToken validates the token string and extracts the user. Returns an error if the token is expired, has an invalid signature, or is malformed.

DoRequest performs an HTTP request against the test server and returns the response body and status code.

WithOutput returns a new logger writing to w instead of stderr.

Setup initialises the global OTel trace provider and log provider, then returns the provider and a shutdown function that flushes all pending spans/lo

GenerateJWTToken creates and signs a JWT for the given user.

Load reads configuration from an optional YAML file and a .env file, merging them. If configPath is empty, YAML loading is skipped and only .env + OS

NewConn creates a PostgreSQL connection pool. By default, no tracing is applied. Use WithTracerProvider to enable OTel-traced queries. The connection

RunHTTPService boots the real HTTP server with the test suite's database and config. Returns the base URL. The server is shut down when the test ends.

SetupTestSuite creates an isolated test environment. It provisions a unique database via testdb.CreateTestDB, runs migrations, and initialises all rep

WithFields returns a new logger with extra static fields attached.

WithMeter enables OTel metrics on the HTTP client.

WithMeter enables OTel metrics on the gRPC client.

WithTracerProvider enables OTel tracing on the HTTP client.

WithTracerProvider enables OTel tracing on the gRPC client.

WithTracerProvider enables OTel tracing on all SQL operations.

AuthMock bypasses JWT validation and injects a fixed user from config. Only active when cfg.Enabled is true — never enable in production.

AuthRequired validates the JWT on every request. Returns 401 if the header is missing, malformed, expired, or has an invalid signature. Flow: 1. Extr

ContextWithFields injects fields into ctx so they appear on every log line that passes this context. Fields are merged — later calls add to existing o

DSN returns a PostgreSQL connection string.

GRPCAuthMock injects a fixed user from config — for local development only. Never enable in production.

GRPCAuthRequired validates the JWT on every inbound RPC call. Returns codes.Unauthenticated when the metadata header is missing, malformed, expired, o

WithAddr sets the listen address. Call before Run.

dropDB terminates active connections and drops the database.

loggingMiddleware is the shared implementation — logs duration, masked request, masked response.

---- Encode helpers ----

withShutdown wraps a Process so that shutdown is called after Run returns, ensuring trace/log exporters are flushed even on error.

AuthOptional validates the JWT only when the Authorization header is present. Requests without the header continue unauthenticated — user.ID will be e

ConsumerAuthMock injects a fixed user from config — for local development only. Never enable in production.

ConsumerAuthOptional is like ConsumerAuthRequired but allows messages without a token. If the token is empty the context is returned unchanged — user.

CreateExample creates a new example.

DeleteExample deletes an example by ID.

GetExample returns a single example by ID.

ListExamples returns all examples.

LoggingHTTPMiddleware logs HTTP endpoint processing with masking.

New creates a resilient HTTP client with circuit breaker and retry support. By default, tracing and metrics are disabled. Use WithMeter and WithTracer

New creates a resilient gRPC client with circuit breaker and retry support. By default, tracing and metrics are disabled. Use WithMeter and WithTracer

NewClient creates an OTel-traced MongoDB client and verifies connectivity by sending a ping to the server. The returned *mongo.Client must be disconn