Refactor password hashing to follow DIP and improve CI/CD

- Create PasswordHasher interface in domain layer
- Implement BcryptHasher in infrastructure layer
- Update RegisterUserHandler and LoginUserHandler to use interface
- Remove bcrypt dependency from application layer
- Update main.go and integration tests with dependency injection
- Enhance CI/CD workflow with test and lint jobs
- Add code coverage check (minimum 50%)
- Add go vet and gofmt validation
- Configure build job to depend on test and lint passing
- Update GitHub Actions to latest versions (v4→v5)

This achieves 100% SOLID compliance (DIP) and ensures Clean Architecture
by removing external library dependencies from application/domain layers.

internal/application/commands/register_user.go

@@ -5,9 +5,8 @@ import (
 
 	"apocapoc-api/internal/domain/entities"
 	"apocapoc-api/internal/domain/repositories"
+	"apocapoc-api/internal/domain/services"
 	"apocapoc-api/internal/shared/errors"
-
-	"golang.org/x/crypto/bcrypt"
 )
 
 type RegisterUserCommand struct {
@@ -17,11 +16,15 @@ type RegisterUserCommand struct {
 }
 
 type RegisterUserHandler struct {
-	userRepo repositories.UserRepository
+	userRepo       repositories.UserRepository
+	passwordHasher services.PasswordHasher
 }
 
-func NewRegisterUserHandler(userRepo repositories.UserRepository) *RegisterUserHandler {
-	return &RegisterUserHandler{userRepo: userRepo}
+func NewRegisterUserHandler(userRepo repositories.UserRepository, passwordHasher services.PasswordHasher) *RegisterUserHandler {
+	return &RegisterUserHandler{
+		userRepo:       userRepo,
+		passwordHasher: passwordHasher,
+	}
 }
 
 func (h *RegisterUserHandler) Handle(ctx context.Context, cmd RegisterUserCommand) (string, error) {
@@ -38,7 +41,7 @@ func (h *RegisterUserHandler) Handle(ctx context.Context, cmd RegisterUserComman
 		return "", errors.ErrAlreadyExists
 	}
 
-	hashedPassword, err := bcrypt.GenerateFromPassword([]byte(cmd.Password), bcrypt.DefaultCost)
+	hashedPassword, err := h.passwordHasher.Hash(cmd.Password)
 	if err != nil {
 		return "", err
 	}
@@ -48,7 +51,7 @@ func (h *RegisterUserHandler) Handle(ctx context.Context, cmd RegisterUserComman
 		timezone = "UTC"
 	}
 
-	user := entities.NewUser(cmd.Email, string(hashedPassword), timezone)
+	user := entities.NewUser(cmd.Email, hashedPassword, timezone)
 
 	if err := h.userRepo.Create(ctx, user); err != nil {
 		return "", err

internal/application/queries/login_user.go

@@ -4,9 +4,8 @@ import (
 	"context"
 
 	"apocapoc-api/internal/domain/repositories"
+	"apocapoc-api/internal/domain/services"
 	"apocapoc-api/internal/shared/errors"
-
-	"golang.org/x/crypto/bcrypt"
 )
 
 type LoginUserQuery struct {
@@ -21,11 +20,15 @@ type LoginUserResult struct {
 }
 
 type LoginUserHandler struct {
-	userRepo repositories.UserRepository
+	userRepo       repositories.UserRepository
+	passwordHasher services.PasswordHasher
 }
 
-func NewLoginUserHandler(userRepo repositories.UserRepository) *LoginUserHandler {
-	return &LoginUserHandler{userRepo: userRepo}
+func NewLoginUserHandler(userRepo repositories.UserRepository, passwordHasher services.PasswordHasher) *LoginUserHandler {
+	return &LoginUserHandler{
+		userRepo:       userRepo,
+		passwordHasher: passwordHasher,
+	}
 }
 
 func (h *LoginUserHandler) Handle(ctx context.Context, query LoginUserQuery) (*LoginUserResult, error) {
@@ -38,7 +41,7 @@ func (h *LoginUserHandler) Handle(ctx context.Context, query LoginUserQuery) (*L
 		return nil, errors.ErrNotFound
 	}
 
-	if err := bcrypt.CompareHashAndPassword([]byte(user.PasswordHash), []byte(query.Password)); err != nil {
+	if err := h.passwordHasher.Compare(user.PasswordHash, query.Password); err != nil {
 		return nil, errors.ErrNotFound
 	}
 

internal/domain/services/password_hasher.go

@@ -0,0 +1,6 @@
+package services
+
+type PasswordHasher interface {
+	Hash(password string) (string, error)
+	Compare(hashedPassword, password string) error
+}

internal/infrastructure/crypto/bcrypt_hasher.go

@@ -0,0 +1,25 @@
+package crypto
+
+import (
+	"apocapoc-api/internal/domain/services"
+
+	"golang.org/x/crypto/bcrypt"
+)
+
+type BcryptHasher struct{}
+
+func NewBcryptHasher() services.PasswordHasher {
+	return &BcryptHasher{}
+}
+
+func (b *BcryptHasher) Hash(password string) (string, error) {
+	hashedBytes, err := bcrypt.GenerateFromPassword([]byte(password), bcrypt.DefaultCost)
+	if err != nil {
+		return "", err
+	}
+	return string(hashedBytes), nil
+}
+
+func (b *BcryptHasher) Compare(hashedPassword, password string) error {
+	return bcrypt.CompareHashAndPassword([]byte(hashedPassword), []byte(password))
+}

internal/infrastructure/http/integration_test.go

@@ -11,6 +11,7 @@ import (
 	"apocapoc-api/internal/application/commands"
 	"apocapoc-api/internal/application/queries"
 	"apocapoc-api/internal/infrastructure/auth"
+	"apocapoc-api/internal/infrastructure/crypto"
 	"apocapoc-api/internal/infrastructure/persistence/sqlite"
 
 	_ "github.com/mattn/go-sqlite3"
@@ -32,13 +33,14 @@ func setupTestServer(t *testing.T) *TestServer {
 	}
 
 	jwtService := auth.NewJWTService("test-secret", 24)
+	passwordHasher := crypto.NewBcryptHasher()
 
 	userRepo := sqlite.NewUserRepository(db)
 	habitRepo := sqlite.NewHabitRepository(db)
 	entryRepo := sqlite.NewHabitEntryRepository(db)
 
-	registerHandler := commands.NewRegisterUserHandler(userRepo)
-	loginHandler := queries.NewLoginUserHandler(userRepo)
+	registerHandler := commands.NewRegisterUserHandler(userRepo, passwordHasher)
+	loginHandler := queries.NewLoginUserHandler(userRepo, passwordHasher)
 	createHandler := commands.NewCreateHabitHandler(habitRepo)
 	getTodaysHandler := queries.NewGetTodaysHabitsHandler(habitRepo, entryRepo)
 	getUserHabitsHandler := queries.NewGetUserHabitsHandler(habitRepo)