refactor: use pinned golangci-lint Docker image for linting

Refactor Dockerfile to use a separate lint stage with a pinned
golangci-lint v2.11.3 Docker image instead of installing
golangci-lint via curl in the builder stage. This follows the
pattern used by sneak/pixa.

Changes:
- Dockerfile: separate lint stage using golangci/golangci-lint:v2.11.3
  (Debian-based, pinned by sha256) with COPY --from=lint dependency
- Bump Go from 1.24 to 1.26.1 (golang:1.26.1-bookworm, pinned)
- Bump golangci-lint from v1.64.8 to v2.11.3
- Migrate .golangci.yml from v1 to v2 format (same linters, format only)
- All Docker images pinned by sha256 digest
- Fix all lint issues from the v2 linter upgrade:
  - Add package comments to all packages
  - Add doc comments to all exported types, functions, and methods
  - Fix unchecked errors (errcheck)
  - Fix unused parameters (revive)
  - Fix gosec warnings (MaxBytesReader for form parsing)
  - Fix staticcheck suggestions (fmt.Fprintf instead of WriteString)
  - Rename DeliveryTask to Task to avoid stutter (delivery.Task)
  - Rename shadowed builtin 'max' parameter
- Update README.md version requirements

internal/middleware/csrf_test.go

@@ -1,6 +1,7 @@
-package middleware
+package middleware_test
 
 import (
+	"context"
 	"crypto/tls"
 	"net/http"
 	"net/http/httptest"
@@ -11,362 +12,483 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"sneak.berlin/go/webhooker/internal/config"
+	"sneak.berlin/go/webhooker/internal/middleware"
 )
 
+// csrfCookieName is the gorilla/csrf cookie name.
+const csrfCookieName = "_gorilla_csrf"
+
+// csrfGetToken performs a GET request through the CSRF middleware
+// and returns the token and cookies.
+func csrfGetToken(
+	t *testing.T,
+	csrfMW func(http.Handler) http.Handler,
+	getReq *http.Request,
+) (string, []*http.Cookie) {
+	t.Helper()
+
+	var token string
+
+	getHandler := csrfMW(http.HandlerFunc(
+		func(_ http.ResponseWriter, r *http.Request) {
+			token = middleware.CSRFToken(r)
+		},
+	))
+
+	getW := httptest.NewRecorder()
+	getHandler.ServeHTTP(getW, getReq)
+
+	cookies := getW.Result().Cookies()
+	require.NotEmpty(t, cookies, "CSRF cookie should be set")
+	require.NotEmpty(t, token, "CSRF token should be set")
+
+	return token, cookies
+}
+
+// csrfPostWithToken performs a POST request with the given CSRF
+// token and cookies through the middleware. Returns whether the
+// handler was called and the response code.
+func csrfPostWithToken(
+	t *testing.T,
+	csrfMW func(http.Handler) http.Handler,
+	postReq *http.Request,
+	token string,
+	cookies []*http.Cookie,
+) (bool, int) {
+	t.Helper()
+
+	var called bool
+
+	postHandler := csrfMW(http.HandlerFunc(
+		func(_ http.ResponseWriter, _ *http.Request) {
+			called = true
+		},
+	))
+
+	form := url.Values{"csrf_token": {token}}
+	postReq.Body = http.NoBody
+	postReq.Body = nil
+
+	// Rebuild the request with the form body
+	rebuilt := httptest.NewRequestWithContext(
+		context.Background(),
+		postReq.Method, postReq.URL.String(),
+		strings.NewReader(form.Encode()),
+	)
+	rebuilt.Header = postReq.Header.Clone()
+	rebuilt.TLS = postReq.TLS
+	rebuilt.Header.Set(
+		"Content-Type", "application/x-www-form-urlencoded",
+	)
+
+	for _, c := range cookies {
+		rebuilt.AddCookie(c)
+	}
+
+	postW := httptest.NewRecorder()
+	postHandler.ServeHTTP(postW, rebuilt)
+
+	return called, postW.Code
+}
+
 func TestCSRF_GETSetsToken(t *testing.T) {
 	t.Parallel()
+
 	m, _ := testMiddleware(t, config.EnvironmentDev)
 
 	var gotToken string
-	handler := m.CSRF()(http.HandlerFunc(func(_ http.ResponseWriter, r *http.Request) {
-		gotToken = CSRFToken(r)
-	}))
 
-	req := httptest.NewRequest(http.MethodGet, "/form", nil)
+	handler := m.CSRF()(http.HandlerFunc(
+		func(_ http.ResponseWriter, r *http.Request) {
+			gotToken = middleware.CSRFToken(r)
+		},
+	))
+
+	req := httptest.NewRequestWithContext(
+		context.Background(), http.MethodGet, "/form", nil)
 	w := httptest.NewRecorder()
 
 	handler.ServeHTTP(w, req)
 
-	assert.NotEmpty(t, gotToken, "CSRF token should be set in context on GET")
+	assert.NotEmpty(
+		t, gotToken,
+		"CSRF token should be set in context on GET",
+	)
 }
 
 func TestCSRF_POSTWithValidToken(t *testing.T) {
 	t.Parallel()
+
 	m, _ := testMiddleware(t, config.EnvironmentDev)
+	csrfMW := m.CSRF()
 
-	// Capture the token from a GET request
-	var token string
-	csrfMiddleware := m.CSRF()
-	getHandler := csrfMiddleware(http.HandlerFunc(func(_ http.ResponseWriter, r *http.Request) {
-		token = CSRFToken(r)
-	}))
+	getReq := httptest.NewRequestWithContext(
+		context.Background(),
+		http.MethodGet, "/form", nil,
+	)
+	token, cookies := csrfGetToken(t, csrfMW, getReq)
 
-	getReq := httptest.NewRequest(http.MethodGet, "/form", nil)
-	getW := httptest.NewRecorder()
-	getHandler.ServeHTTP(getW, getReq)
+	postReq := httptest.NewRequestWithContext(
+		context.Background(),
+		http.MethodPost, "/form", nil,
+	)
+	called, _ := csrfPostWithToken(
+		t, csrfMW, postReq, token, cookies,
+	)
 
-	cookies := getW.Result().Cookies()
-	require.NotEmpty(t, cookies)
-	require.NotEmpty(t, token)
-
-	// POST with valid token and cookies from the GET response
-	var called bool
-	postHandler := csrfMiddleware(http.HandlerFunc(func(_ http.ResponseWriter, _ *http.Request) {
-		called = true
-	}))
-
-	form := url.Values{"csrf_token": {token}}
-	postReq := httptest.NewRequest(http.MethodPost, "/form", strings.NewReader(form.Encode()))
-	postReq.Header.Set("Content-Type", "application/x-www-form-urlencoded")
-	for _, c := range cookies {
-		postReq.AddCookie(c)
-	}
-	postW := httptest.NewRecorder()
-
-	postHandler.ServeHTTP(postW, postReq)
-
-	assert.True(t, called, "handler should be called with valid CSRF token")
+	assert.True(
+		t, called,
+		"handler should be called with valid CSRF token",
+	)
 }
 
-func TestCSRF_POSTWithoutToken(t *testing.T) {
-	t.Parallel()
-	m, _ := testMiddleware(t, config.EnvironmentDev)
+// csrfPOSTWithoutTokenTest is a shared helper for testing POST
+// requests without a CSRF token in both dev and prod modes.
+func csrfPOSTWithoutTokenTest(
+	t *testing.T,
+	env string,
+	msg string,
+) {
+	t.Helper()
 
-	csrfMiddleware := m.CSRF()
+	m, _ := testMiddleware(t, env)
+	csrfMW := m.CSRF()
 
 	// GET to establish the CSRF cookie
-	getHandler := csrfMiddleware(http.HandlerFunc(func(_ http.ResponseWriter, _ *http.Request) {}))
-	getReq := httptest.NewRequest(http.MethodGet, "/form", nil)
+	getHandler := csrfMW(http.HandlerFunc(
+		func(_ http.ResponseWriter, _ *http.Request) {},
+	))
+
+	getReq := httptest.NewRequestWithContext(
+		context.Background(), http.MethodGet, "/form", nil)
 	getW := httptest.NewRecorder()
 	getHandler.ServeHTTP(getW, getReq)
+
 	cookies := getW.Result().Cookies()
 
 	// POST without CSRF token
 	var called bool
-	postHandler := csrfMiddleware(http.HandlerFunc(func(_ http.ResponseWriter, _ *http.Request) {
-		called = true
-	}))
 
-	postReq := httptest.NewRequest(http.MethodPost, "/form", nil)
-	postReq.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+	postHandler := csrfMW(http.HandlerFunc(
+		func(_ http.ResponseWriter, _ *http.Request) {
+			called = true
+		},
+	))
+
+	postReq := httptest.NewRequestWithContext(
+		context.Background(),
+		http.MethodPost, "/form", nil,
+	)
+	postReq.Header.Set(
+		"Content-Type", "application/x-www-form-urlencoded",
+	)
+
 	for _, c := range cookies {
 		postReq.AddCookie(c)
 	}
+
 	postW := httptest.NewRecorder()
 
 	postHandler.ServeHTTP(postW, postReq)
 
-	assert.False(t, called, "handler should NOT be called without CSRF token")
+	assert.False(t, called, msg)
 	assert.Equal(t, http.StatusForbidden, postW.Code)
 }
 
+func TestCSRF_POSTWithoutToken(t *testing.T) {
+	t.Parallel()
+
+	csrfPOSTWithoutTokenTest(
+		t,
+		config.EnvironmentDev,
+		"handler should NOT be called without CSRF token",
+	)
+}
+
 func TestCSRF_POSTWithInvalidToken(t *testing.T) {
 	t.Parallel()
-	m, _ := testMiddleware(t, config.EnvironmentDev)
 
-	csrfMiddleware := m.CSRF()
+	m, _ := testMiddleware(t, config.EnvironmentDev)
+	csrfMW := m.CSRF()
 
 	// GET to establish the CSRF cookie
-	getHandler := csrfMiddleware(http.HandlerFunc(func(_ http.ResponseWriter, _ *http.Request) {}))
-	getReq := httptest.NewRequest(http.MethodGet, "/form", nil)
+	getHandler := csrfMW(http.HandlerFunc(
+		func(_ http.ResponseWriter, _ *http.Request) {},
+	))
+
+	getReq := httptest.NewRequestWithContext(
+		context.Background(), http.MethodGet, "/form", nil)
 	getW := httptest.NewRecorder()
 	getHandler.ServeHTTP(getW, getReq)
+
 	cookies := getW.Result().Cookies()
 
 	// POST with wrong CSRF token
 	var called bool
-	postHandler := csrfMiddleware(http.HandlerFunc(func(_ http.ResponseWriter, _ *http.Request) {
-		called = true
-	}))
+
+	postHandler := csrfMW(http.HandlerFunc(
+		func(_ http.ResponseWriter, _ *http.Request) {
+			called = true
+		},
+	))
 
 	form := url.Values{"csrf_token": {"invalid-token-value"}}
-	postReq := httptest.NewRequest(http.MethodPost, "/form", strings.NewReader(form.Encode()))
-	postReq.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+
+	postReq := httptest.NewRequestWithContext(
+		context.Background(),
+		http.MethodPost, "/form",
+		strings.NewReader(form.Encode()),
+	)
+	postReq.Header.Set(
+		"Content-Type", "application/x-www-form-urlencoded",
+	)
+
 	for _, c := range cookies {
 		postReq.AddCookie(c)
 	}
+
 	postW := httptest.NewRecorder()
 
 	postHandler.ServeHTTP(postW, postReq)
 
-	assert.False(t, called, "handler should NOT be called with invalid CSRF token")
+	assert.False(
+		t, called,
+		"handler should NOT be called with invalid CSRF token",
+	)
 	assert.Equal(t, http.StatusForbidden, postW.Code)
 }
 
 func TestCSRF_GETDoesNotValidate(t *testing.T) {
 	t.Parallel()
+
 	m, _ := testMiddleware(t, config.EnvironmentDev)
 
 	var called bool
-	handler := m.CSRF()(http.HandlerFunc(func(_ http.ResponseWriter, _ *http.Request) {
-		called = true
-	}))
 
-	// GET requests should pass through without CSRF validation
-	req := httptest.NewRequest(http.MethodGet, "/form", nil)
+	handler := m.CSRF()(http.HandlerFunc(
+		func(_ http.ResponseWriter, _ *http.Request) {
+			called = true
+		},
+	))
+
+	req := httptest.NewRequestWithContext(
+		context.Background(), http.MethodGet, "/form", nil)
 	w := httptest.NewRecorder()
 
 	handler.ServeHTTP(w, req)
 
-	assert.True(t, called, "GET requests should pass through CSRF middleware")
+	assert.True(
+		t, called,
+		"GET requests should pass through CSRF middleware",
+	)
 }
 
 func TestCSRFToken_NoMiddleware(t *testing.T) {
 	t.Parallel()
-	req := httptest.NewRequest(http.MethodGet, "/", nil)
-	assert.Empty(t, CSRFToken(req), "CSRFToken should return empty string when middleware has not run")
+
+	req := httptest.NewRequestWithContext(
+		context.Background(), http.MethodGet, "/", nil)
+
+	assert.Empty(
+		t, middleware.CSRFToken(req),
+		"CSRFToken should return empty string when "+
+			"middleware has not run",
+	)
 }
 
 // --- TLS Detection Tests ---
 
 func TestIsClientTLS_DirectTLS(t *testing.T) {
 	t.Parallel()
-	r := httptest.NewRequest(http.MethodGet, "/", nil)
-	r.TLS = &tls.ConnectionState{} // simulate direct TLS
-	assert.True(t, isClientTLS(r), "should detect direct TLS connection")
+
+	r := httptest.NewRequestWithContext(
+		context.Background(), http.MethodGet, "/", nil)
+	r.TLS = &tls.ConnectionState{}
+
+	assert.True(
+		t, middleware.IsClientTLS(r),
+		"should detect direct TLS connection",
+	)
 }
 
 func TestIsClientTLS_XForwardedProto(t *testing.T) {
 	t.Parallel()
-	r := httptest.NewRequest(http.MethodGet, "/", nil)
+
+	r := httptest.NewRequestWithContext(
+		context.Background(), http.MethodGet, "/", nil)
 	r.Header.Set("X-Forwarded-Proto", "https")
-	assert.True(t, isClientTLS(r), "should detect TLS via X-Forwarded-Proto")
+
+	assert.True(
+		t, middleware.IsClientTLS(r),
+		"should detect TLS via X-Forwarded-Proto",
+	)
 }
 
 func TestIsClientTLS_PlaintextHTTP(t *testing.T) {
 	t.Parallel()
-	r := httptest.NewRequest(http.MethodGet, "/", nil)
-	assert.False(t, isClientTLS(r), "should detect plaintext HTTP")
+
+	r := httptest.NewRequestWithContext(
+		context.Background(), http.MethodGet, "/", nil)
+
+	assert.False(
+		t, middleware.IsClientTLS(r),
+		"should detect plaintext HTTP",
+	)
 }
 
 func TestIsClientTLS_XForwardedProtoHTTP(t *testing.T) {
 	t.Parallel()
-	r := httptest.NewRequest(http.MethodGet, "/", nil)
+
+	r := httptest.NewRequestWithContext(
+		context.Background(), http.MethodGet, "/", nil)
 	r.Header.Set("X-Forwarded-Proto", "http")
-	assert.False(t, isClientTLS(r), "should detect plaintext when X-Forwarded-Proto is http")
+
+	assert.False(
+		t, middleware.IsClientTLS(r),
+		"should detect plaintext when X-Forwarded-Proto is http",
+	)
 }
 
 // --- Production Mode: POST over plaintext HTTP ---
 
-func TestCSRF_ProdMode_PlaintextHTTP_POSTWithValidToken(t *testing.T) {
+func TestCSRF_ProdMode_PlaintextHTTP_POSTWithValidToken(
+	t *testing.T,
+) {
 	t.Parallel()
+
 	m, _ := testMiddleware(t, config.EnvironmentProd)
+	csrfMW := m.CSRF()
 
-	// This tests the critical fix: prod mode over plaintext HTTP should
-	// work because the middleware detects the transport per-request.
-	var token string
-	csrfMiddleware := m.CSRF()
-	getHandler := csrfMiddleware(http.HandlerFunc(func(_ http.ResponseWriter, r *http.Request) {
-		token = CSRFToken(r)
-	}))
+	getReq := httptest.NewRequestWithContext(
+		context.Background(),
+		http.MethodGet, "/form", nil,
+	)
+	token, cookies := csrfGetToken(t, csrfMW, getReq)
 
-	getReq := httptest.NewRequest(http.MethodGet, "/form", nil)
-	getW := httptest.NewRecorder()
-	getHandler.ServeHTTP(getW, getReq)
-
-	cookies := getW.Result().Cookies()
-	require.NotEmpty(t, cookies, "CSRF cookie should be set on GET")
-	require.NotEmpty(t, token, "CSRF token should be set in context on GET")
-
-	// Verify the cookie is NOT Secure (plaintext HTTP in prod mode)
+	// Verify cookie is NOT Secure (plaintext HTTP in prod)
 	for _, c := range cookies {
-		if c.Name == "_gorilla_csrf" {
-			assert.False(t, c.Secure, "CSRF cookie should not be Secure over plaintext HTTP")
+		if c.Name == csrfCookieName {
+			assert.False(t, c.Secure,
+				"CSRF cookie should not be Secure "+
+					"over plaintext HTTP")
 		}
 	}
 
-	// POST with valid token — should succeed
-	var called bool
-	postHandler := csrfMiddleware(http.HandlerFunc(func(_ http.ResponseWriter, _ *http.Request) {
-		called = true
-	}))
+	postReq := httptest.NewRequestWithContext(
+		context.Background(),
+		http.MethodPost, "/form", nil,
+	)
+	called, code := csrfPostWithToken(
+		t, csrfMW, postReq, token, cookies,
+	)
 
-	form := url.Values{"csrf_token": {token}}
-	postReq := httptest.NewRequest(http.MethodPost, "/form", strings.NewReader(form.Encode()))
-	postReq.Header.Set("Content-Type", "application/x-www-form-urlencoded")
-	for _, c := range cookies {
-		postReq.AddCookie(c)
-	}
-	postW := httptest.NewRecorder()
-
-	postHandler.ServeHTTP(postW, postReq)
-
-	assert.True(t, called, "handler should be called — prod mode over plaintext HTTP must work")
-	assert.NotEqual(t, http.StatusForbidden, postW.Code, "should not return 403")
+	assert.True(t, called,
+		"handler should be called -- prod mode over "+
+			"plaintext HTTP must work")
+	assert.NotEqual(t, http.StatusForbidden, code,
+		"should not return 403")
 }
 
-// --- Production Mode: POST with X-Forwarded-Proto (reverse proxy) ---
+// --- Production Mode: POST with X-Forwarded-Proto ---
 
-func TestCSRF_ProdMode_BehindProxy_POSTWithValidToken(t *testing.T) {
+func TestCSRF_ProdMode_BehindProxy_POSTWithValidToken(
+	t *testing.T,
+) {
 	t.Parallel()
+
 	m, _ := testMiddleware(t, config.EnvironmentProd)
+	csrfMW := m.CSRF()
 
-	// Simulates a deployment behind a TLS-terminating reverse proxy.
-	// The Go server sees HTTP but X-Forwarded-Proto is "https".
-	var token string
-	csrfMiddleware := m.CSRF()
-	getHandler := csrfMiddleware(http.HandlerFunc(func(_ http.ResponseWriter, r *http.Request) {
-		token = CSRFToken(r)
-	}))
-
-	getReq := httptest.NewRequest(http.MethodGet, "http://example.com/form", nil)
+	getReq := httptest.NewRequestWithContext(
+		context.Background(),
+		http.MethodGet, "http://example.com/form", nil,
+	)
 	getReq.Header.Set("X-Forwarded-Proto", "https")
-	getW := httptest.NewRecorder()
-	getHandler.ServeHTTP(getW, getReq)
 
-	cookies := getW.Result().Cookies()
-	require.NotEmpty(t, cookies, "CSRF cookie should be set on GET")
-	require.NotEmpty(t, token, "CSRF token should be set in context")
+	token, cookies := csrfGetToken(t, csrfMW, getReq)
 
-	// Verify the cookie IS Secure (X-Forwarded-Proto: https)
+	// Verify cookie IS Secure (X-Forwarded-Proto: https)
 	for _, c := range cookies {
-		if c.Name == "_gorilla_csrf" {
-			assert.True(t, c.Secure, "CSRF cookie should be Secure behind TLS proxy")
+		if c.Name == csrfCookieName {
+			assert.True(t, c.Secure,
+				"CSRF cookie should be Secure behind "+
+					"TLS proxy")
 		}
 	}
 
-	// POST with valid token, HTTPS Origin (as a browser behind proxy would send)
-	var called bool
-	postHandler := csrfMiddleware(http.HandlerFunc(func(_ http.ResponseWriter, _ *http.Request) {
-		called = true
-	}))
-
-	form := url.Values{"csrf_token": {token}}
-	postReq := httptest.NewRequest(http.MethodPost, "http://example.com/form", strings.NewReader(form.Encode()))
-	postReq.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+	postReq := httptest.NewRequestWithContext(
+		context.Background(),
+		http.MethodPost, "http://example.com/form", nil,
+	)
 	postReq.Header.Set("X-Forwarded-Proto", "https")
 	postReq.Header.Set("Origin", "https://example.com")
-	for _, c := range cookies {
-		postReq.AddCookie(c)
-	}
-	postW := httptest.NewRecorder()
 
-	postHandler.ServeHTTP(postW, postReq)
+	called, code := csrfPostWithToken(
+		t, csrfMW, postReq, token, cookies,
+	)
 
-	assert.True(t, called, "handler should be called — prod mode behind TLS proxy must work")
-	assert.NotEqual(t, http.StatusForbidden, postW.Code, "should not return 403")
+	assert.True(t, called,
+		"handler should be called -- prod mode behind "+
+			"TLS proxy must work")
+	assert.NotEqual(t, http.StatusForbidden, code,
+		"should not return 403")
 }
 
 // --- Production Mode: direct TLS ---
 
-func TestCSRF_ProdMode_DirectTLS_POSTWithValidToken(t *testing.T) {
+func TestCSRF_ProdMode_DirectTLS_POSTWithValidToken(
+	t *testing.T,
+) {
 	t.Parallel()
+
 	m, _ := testMiddleware(t, config.EnvironmentProd)
+	csrfMW := m.CSRF()
 
-	var token string
-	csrfMiddleware := m.CSRF()
-	getHandler := csrfMiddleware(http.HandlerFunc(func(_ http.ResponseWriter, r *http.Request) {
-		token = CSRFToken(r)
-	}))
-
-	getReq := httptest.NewRequest(http.MethodGet, "https://example.com/form", nil)
+	getReq := httptest.NewRequestWithContext(
+		context.Background(),
+		http.MethodGet, "https://example.com/form", nil,
+	)
 	getReq.TLS = &tls.ConnectionState{}
-	getW := httptest.NewRecorder()
-	getHandler.ServeHTTP(getW, getReq)
 
-	cookies := getW.Result().Cookies()
-	require.NotEmpty(t, cookies, "CSRF cookie should be set on GET")
-	require.NotEmpty(t, token, "CSRF token should be set in context")
+	token, cookies := csrfGetToken(t, csrfMW, getReq)
 
-	// Verify the cookie IS Secure (direct TLS)
+	// Verify cookie IS Secure (direct TLS)
 	for _, c := range cookies {
-		if c.Name == "_gorilla_csrf" {
-			assert.True(t, c.Secure, "CSRF cookie should be Secure over direct TLS")
+		if c.Name == csrfCookieName {
+			assert.True(t, c.Secure,
+				"CSRF cookie should be Secure over "+
+					"direct TLS")
 		}
 	}
 
-	// POST with valid token over direct TLS
-	var called bool
-	postHandler := csrfMiddleware(http.HandlerFunc(func(_ http.ResponseWriter, _ *http.Request) {
-		called = true
-	}))
-
-	form := url.Values{"csrf_token": {token}}
-	postReq := httptest.NewRequest(http.MethodPost, "https://example.com/form", strings.NewReader(form.Encode()))
+	postReq := httptest.NewRequestWithContext(
+		context.Background(),
+		http.MethodPost, "https://example.com/form", nil,
+	)
 	postReq.TLS = &tls.ConnectionState{}
-	postReq.Header.Set("Content-Type", "application/x-www-form-urlencoded")
 	postReq.Header.Set("Origin", "https://example.com")
-	for _, c := range cookies {
-		postReq.AddCookie(c)
-	}
-	postW := httptest.NewRecorder()
 
-	postHandler.ServeHTTP(postW, postReq)
+	called, code := csrfPostWithToken(
+		t, csrfMW, postReq, token, cookies,
+	)
 
-	assert.True(t, called, "handler should be called — direct TLS must work")
-	assert.NotEqual(t, http.StatusForbidden, postW.Code, "should not return 403")
+	assert.True(t, called,
+		"handler should be called -- direct TLS must work")
+	assert.NotEqual(t, http.StatusForbidden, code,
+		"should not return 403")
 }
 
 // --- Production Mode: POST without token still rejects ---
 
-func TestCSRF_ProdMode_PlaintextHTTP_POSTWithoutToken(t *testing.T) {
+func TestCSRF_ProdMode_PlaintextHTTP_POSTWithoutToken(
+	t *testing.T,
+) {
 	t.Parallel()
-	m, _ := testMiddleware(t, config.EnvironmentProd)
 
-	csrfMiddleware := m.CSRF()
-
-	// GET to establish the CSRF cookie
-	getHandler := csrfMiddleware(http.HandlerFunc(func(_ http.ResponseWriter, _ *http.Request) {}))
-	getReq := httptest.NewRequest(http.MethodGet, "/form", nil)
-	getW := httptest.NewRecorder()
-	getHandler.ServeHTTP(getW, getReq)
-	cookies := getW.Result().Cookies()
-
-	// POST without CSRF token — should be rejected
-	var called bool
-	postHandler := csrfMiddleware(http.HandlerFunc(func(_ http.ResponseWriter, _ *http.Request) {
-		called = true
-	}))
-
-	postReq := httptest.NewRequest(http.MethodPost, "/form", nil)
-	postReq.Header.Set("Content-Type", "application/x-www-form-urlencoded")
-	for _, c := range cookies {
-		postReq.AddCookie(c)
-	}
-	postW := httptest.NewRecorder()
-
-	postHandler.ServeHTTP(postW, postReq)
-
-	assert.False(t, called, "handler should NOT be called without CSRF token even in prod+plaintext")
-	assert.Equal(t, http.StatusForbidden, postW.Code)
+	csrfPOSTWithoutTokenTest(
+		t,
+		config.EnvironmentProd,
+		"handler should NOT be called without CSRF token "+
+			"even in prod+plaintext",
+	)
 }

internal/middleware/export_test.go

@@ -0,0 +1,34 @@
+package middleware
+
+import (
+	"net/http"
+)
+
+// NewLoggingResponseWriterForTest wraps newLoggingResponseWriter
+// for use in external test packages.
+func NewLoggingResponseWriterForTest(
+	w http.ResponseWriter,
+) *loggingResponseWriter {
+	return newLoggingResponseWriter(w)
+}
+
+// LoggingResponseWriterStatusCode returns the status code
+// captured by the loggingResponseWriter.
+func LoggingResponseWriterStatusCode(
+	lrw *loggingResponseWriter,
+) int {
+	return lrw.statusCode
+}
+
+// IPFromHostPort exposes ipFromHostPort for testing.
+func IPFromHostPort(hp string) string {
+	return ipFromHostPort(hp)
+}
+
+// IsClientTLS exposes isClientTLS for testing.
+func IsClientTLS(r *http.Request) bool {
+	return isClientTLS(r)
+}
+
+// LoginRateLimitConst exposes the loginRateLimit constant.
+const LoginRateLimitConst = loginRateLimit

internal/middleware/middleware.go

@@ -1,3 +1,5 @@
+// Package middleware provides HTTP middleware for logging, auth,
+// CORS, and metrics.
 package middleware
 
 import (
@@ -19,26 +21,42 @@ import (
 	"sneak.berlin/go/webhooker/internal/session"
 )
 
-// nolint:revive // MiddlewareParams is a standard fx naming convention
+const (
+	// corsMaxAge is the maximum time (in seconds) that a
+	// preflight response can be cached.
+	corsMaxAge = 300
+)
+
+//nolint:revive // MiddlewareParams is a standard fx naming convention.
 type MiddlewareParams struct {
 	fx.In
+
 	Logger  *logger.Logger
 	Globals *globals.Globals
 	Config  *config.Config
 	Session *session.Session
 }
 
+// Middleware provides HTTP middleware for logging, CORS, auth, and
+// metrics.
 type Middleware struct {
 	log     *slog.Logger
 	params  *MiddlewareParams
 	session *session.Session
 }
 
-func New(lc fx.Lifecycle, params MiddlewareParams) (*Middleware, error) {
+// New creates a Middleware from the provided fx parameters.
+//
+//nolint:revive // lc parameter is required by fx even if unused.
+func New(
+	lc fx.Lifecycle,
+	params MiddlewareParams,
+) (*Middleware, error) {
 	s := new(Middleware)
 	s.params = &params
 	s.log = params.Logger.Get()
 	s.session = params.Session
+
 	return s, nil
 }
 
@@ -50,19 +68,24 @@ func ipFromHostPort(hp string) string {
 	if err != nil {
 		return ""
 	}
+
 	if len(h) > 0 && h[0] == '[' {
 		return h[1 : len(h)-1]
 	}
+
 	return h
 }
 
 type loggingResponseWriter struct {
 	http.ResponseWriter
+
 	statusCode int
 }
 
-// nolint:revive // unexported type is only used internally
-func NewLoggingResponseWriter(w http.ResponseWriter) *loggingResponseWriter {
+// newLoggingResponseWriter wraps w and records status codes.
+func newLoggingResponseWriter(
+	w http.ResponseWriter,
+) *loggingResponseWriter {
 	return &loggingResponseWriter{w, http.StatusOK}
 }
 
@@ -71,23 +94,30 @@ func (lrw *loggingResponseWriter) WriteHeader(code int) {
 	lrw.ResponseWriter.WriteHeader(code)
 }
 
-// type Middleware func(http.Handler) http.Handler
-// this returns a Middleware that is designed to do every request through the
-// mux, note the signature:
+// Logging returns middleware that logs each HTTP request with
+// timing and metadata.
 func (s *Middleware) Logging() func(http.Handler) http.Handler {
 	return func(next http.Handler) http.Handler {
-		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		return http.HandlerFunc(func(
+			w http.ResponseWriter,
+			r *http.Request,
+		) {
 			start := time.Now()
-			lrw := NewLoggingResponseWriter(w)
+			lrw := newLoggingResponseWriter(w)
 			ctx := r.Context()
+
 			defer func() {
 				latency := time.Since(start)
 				requestID := ""
-				if reqID := ctx.Value(middleware.RequestIDKey); reqID != nil {
+
+				if reqID := ctx.Value(
+					middleware.RequestIDKey,
+				); reqID != nil {
 					if id, ok := reqID.(string); ok {
 						requestID = id
 					}
 				}
+
 				s.log.Info("http request",
 					"request_start", start,
 					"method", r.Method,
@@ -107,20 +137,29 @@ func (s *Middleware) Logging() func(http.Handler) http.Handler {
 	}
 }
 
+// CORS returns middleware that sets CORS headers (permissive in
+// dev, no-op in prod).
 func (s *Middleware) CORS() func(http.Handler) http.Handler {
 	if s.params.Config.IsDev() {
 		// In development, allow any origin for local testing.
 		return cors.Handler(cors.Options{
-			AllowedOrigins:   []string{"*"},
-			AllowedMethods:   []string{"GET", "POST", "PUT", "DELETE", "OPTIONS"},
-			AllowedHeaders:   []string{"Accept", "Authorization", "Content-Type", "X-CSRF-Token"},
+			AllowedOrigins: []string{"*"},
+			AllowedMethods: []string{
+				"GET", "POST", "PUT", "DELETE", "OPTIONS",
+			},
+			AllowedHeaders: []string{
+				"Accept", "Authorization",
+				"Content-Type", "X-CSRF-Token",
+			},
 			ExposedHeaders:   []string{"Link"},
 			AllowCredentials: false,
-			MaxAge:           300,
+			MaxAge:           corsMaxAge,
 		})
 	}
-	// In production, the web UI is server-rendered so cross-origin
-	// requests are not expected. Return a no-op middleware.
+
+	// In production, the web UI is server-rendered so
+	// cross-origin requests are not expected. Return a no-op
+	// middleware.
 	return func(next http.Handler) http.Handler {
 		return next
 	}
@@ -130,20 +169,33 @@ func (s *Middleware) CORS() func(http.Handler) http.Handler {
 // Unauthenticated users are redirected to the login page.
 func (s *Middleware) RequireAuth() func(http.Handler) http.Handler {
 	return func(next http.Handler) http.Handler {
-		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		return http.HandlerFunc(func(
+			w http.ResponseWriter,
+			r *http.Request,
+		) {
 			sess, err := s.session.Get(r)
 			if err != nil {
-				s.log.Debug("auth middleware: failed to get session", "error", err)
-				http.Redirect(w, r, "/pages/login", http.StatusSeeOther)
+				s.log.Debug(
+					"auth middleware: failed to get session",
+					"error", err,
+				)
+				http.Redirect(
+					w, r, "/pages/login", http.StatusSeeOther,
+				)
+
 				return
 			}
 
 			if !s.session.IsAuthenticated(sess) {
-				s.log.Debug("auth middleware: unauthenticated request",
+				s.log.Debug(
+					"auth middleware: unauthenticated request",
 					"path", r.URL.Path,
 					"method", r.Method,
 				)
-				http.Redirect(w, r, "/pages/login", http.StatusSeeOther)
+				http.Redirect(
+					w, r, "/pages/login", http.StatusSeeOther,
+				)
+
 				return
 			}
 
@@ -152,15 +204,19 @@ func (s *Middleware) RequireAuth() func(http.Handler) http.Handler {
 	}
 }
 
+// Metrics returns middleware that records Prometheus HTTP metrics.
 func (s *Middleware) Metrics() func(http.Handler) http.Handler {
 	mdlw := ghmm.New(ghmm.Config{
 		Recorder: metrics.NewRecorder(metrics.Config{}),
 	})
+
 	return func(next http.Handler) http.Handler {
 		return std.Handler("", mdlw, next)
 	}
 }
 
+// MetricsAuth returns middleware that protects metrics endpoints
+// with basic auth.
 func (s *Middleware) MetricsAuth() func(http.Handler) http.Handler {
 	return basicauth.New(
 		"metrics",
@@ -172,33 +228,63 @@ func (s *Middleware) MetricsAuth() func(http.Handler) http.Handler {
 	)
 }
 
-// SecurityHeaders returns middleware that sets production security headers
-// on every response: HSTS, X-Content-Type-Options, X-Frame-Options, CSP,
-// Referrer-Policy, and Permissions-Policy.
+// SecurityHeaders returns middleware that sets production security
+// headers on every response: HSTS, X-Content-Type-Options,
+// X-Frame-Options, CSP, Referrer-Policy, and Permissions-Policy.
 func (s *Middleware) SecurityHeaders() func(http.Handler) http.Handler {
 	return func(next http.Handler) http.Handler {
-		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-			w.Header().Set("Strict-Transport-Security", "max-age=63072000; includeSubDomains; preload")
-			w.Header().Set("X-Content-Type-Options", "nosniff")
+		return http.HandlerFunc(func(
+			w http.ResponseWriter,
+			r *http.Request,
+		) {
+			w.Header().Set(
+				"Strict-Transport-Security",
+				"max-age=63072000; includeSubDomains; preload",
+			)
+			w.Header().Set(
+				"X-Content-Type-Options", "nosniff",
+			)
 			w.Header().Set("X-Frame-Options", "DENY")
-			w.Header().Set("Content-Security-Policy", "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'")
-			w.Header().Set("Referrer-Policy", "strict-origin-when-cross-origin")
-			w.Header().Set("Permissions-Policy", "camera=(), microphone=(), geolocation=()")
+			w.Header().Set(
+				"Content-Security-Policy",
+				"default-src 'self'; "+
+					"script-src 'self' 'unsafe-inline'; "+
+					"style-src 'self' 'unsafe-inline'",
+			)
+			w.Header().Set(
+				"Referrer-Policy",
+				"strict-origin-when-cross-origin",
+			)
+			w.Header().Set(
+				"Permissions-Policy",
+				"camera=(), microphone=(), geolocation=()",
+			)
+
 			next.ServeHTTP(w, r)
 		})
 	}
 }
 
-// MaxBodySize returns middleware that limits the request body size for POST
-// requests. If the body exceeds the given limit in bytes, the server returns
-// 413 Request Entity Too Large. This prevents clients from sending arbitrarily
-// large form bodies.
-func (s *Middleware) MaxBodySize(maxBytes int64) func(http.Handler) http.Handler {
+// MaxBodySize returns middleware that limits the request body size
+// for POST requests. If the body exceeds the given limit in
+// bytes, the server returns 413 Request Entity Too Large. This
+// prevents clients from sending arbitrarily large form bodies.
+func (s *Middleware) MaxBodySize(
+	maxBytes int64,
+) func(http.Handler) http.Handler {
 	return func(next http.Handler) http.Handler {
-		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-			if r.Method == http.MethodPost || r.Method == http.MethodPut || r.Method == http.MethodPatch {
-				r.Body = http.MaxBytesReader(w, r.Body, maxBytes)
+		return http.HandlerFunc(func(
+			w http.ResponseWriter,
+			r *http.Request,
+		) {
+			if r.Method == http.MethodPost ||
+				r.Method == http.MethodPut ||
+				r.Method == http.MethodPatch {
+				r.Body = http.MaxBytesReader(
+					w, r.Body, maxBytes,
+				)
 			}
+
 			next.ServeHTTP(w, r)
 		})
 	}

internal/middleware/middleware_test.go

@@ -1,6 +1,7 @@
-package middleware
+package middleware_test
 
 import (
+	"context"
 	"encoding/base64"
 	"log/slog"
 	"net/http"
@@ -12,25 +13,37 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"sneak.berlin/go/webhooker/internal/config"
+	"sneak.berlin/go/webhooker/internal/middleware"
 	"sneak.berlin/go/webhooker/internal/session"
 )
 
-// testMiddleware creates a Middleware with minimal dependencies for testing.
-// It uses a real session.Session backed by an in-memory cookie store.
-func testMiddleware(t *testing.T, env string) (*Middleware, *session.Session) {
+const testKeySize = 32
+
+// testMiddleware creates a Middleware with minimal dependencies
+// for testing. It uses a real session.Session backed by an
+// in-memory cookie store.
+func testMiddleware(
+	t *testing.T,
+	env string,
+) (*middleware.Middleware, *session.Session) {
 	t.Helper()
 
-	log := slog.New(slog.NewTextHandler(os.Stderr, &slog.HandlerOptions{Level: slog.LevelDebug}))
+	log := slog.New(slog.NewTextHandler(
+		os.Stderr,
+		&slog.HandlerOptions{Level: slog.LevelDebug},
+	))
 
 	cfg := &config.Config{
 		Environment: env,
 	}
 
 	// Create a real session manager with a known key
-	key := make([]byte, 32)
+	key := make([]byte, testKeySize)
+
 	for i := range key {
 		key[i] = byte(i)
 	}
+
 	store := sessions.NewCookieStore(key)
 	store.Options = &sessions.Options{
 		Path:     "/",
@@ -40,40 +53,33 @@ func testMiddleware(t *testing.T, env string) (*Middleware, *session.Session) {
 		SameSite: http.SameSiteLaxMode,
 	}
 
-	sessManager := newTestSession(t, store, cfg, log, key)
+	sessManager := session.NewForTest(store, cfg, log, key)
 
-	m := &Middleware{
-		log: log,
-		params: &MiddlewareParams{
-			Config: cfg,
-		},
-		session: sessManager,
-	}
+	m := middleware.NewForTest(log, cfg, sessManager)
 
 	return m, sessManager
 }
 
-// newTestSession creates a session.Session with a pre-configured cookie store
-// for testing. This avoids needing the fx lifecycle and database.
-func newTestSession(t *testing.T, store *sessions.CookieStore, cfg *config.Config, log *slog.Logger, key []byte) *session.Session {
-	t.Helper()
-	return session.NewForTest(store, cfg, log, key)
-}
-
 // --- Logging Middleware Tests ---
 
 func TestLogging_SetsStatusCode(t *testing.T) {
 	t.Parallel()
+
 	m, _ := testMiddleware(t, config.EnvironmentDev)
 
-	handler := m.Logging()(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
-		w.WriteHeader(http.StatusCreated)
-		if _, err := w.Write([]byte("created")); err != nil {
-			return
-		}
-	}))
+	handler := m.Logging()(http.HandlerFunc(
+		func(w http.ResponseWriter, _ *http.Request) {
+			w.WriteHeader(http.StatusCreated)
 
-	req := httptest.NewRequest(http.MethodGet, "/test", nil)
+			_, err := w.Write([]byte("created"))
+			if err != nil {
+				return
+			}
+		},
+	))
+
+	req := httptest.NewRequestWithContext(
+		context.Background(), http.MethodGet, "/test", nil)
 	w := httptest.NewRecorder()
 
 	handler.ServeHTTP(w, req)
@@ -84,15 +90,20 @@ func TestLogging_SetsStatusCode(t *testing.T) {
 
 func TestLogging_DefaultStatusOK(t *testing.T) {
 	t.Parallel()
+
 	m, _ := testMiddleware(t, config.EnvironmentDev)
 
-	handler := m.Logging()(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
-		if _, err := w.Write([]byte("ok")); err != nil {
-			return
-		}
-	}))
+	handler := m.Logging()(http.HandlerFunc(
+		func(w http.ResponseWriter, _ *http.Request) {
+			_, err := w.Write([]byte("ok"))
+			if err != nil {
+				return
+			}
+		},
+	))
 
-	req := httptest.NewRequest(http.MethodGet, "/", nil)
+	req := httptest.NewRequestWithContext(
+		context.Background(), http.MethodGet, "/", nil)
 	w := httptest.NewRecorder()
 
 	handler.ServeHTTP(w, req)
@@ -103,20 +114,31 @@ func TestLogging_DefaultStatusOK(t *testing.T) {
 
 func TestLogging_PassesThroughToNext(t *testing.T) {
 	t.Parallel()
+
 	m, _ := testMiddleware(t, config.EnvironmentDev)
 
 	var called bool
-	handler := m.Logging()(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
-		called = true
-		w.WriteHeader(http.StatusOK)
-	}))
 
-	req := httptest.NewRequest(http.MethodPost, "/api/webhook", nil)
+	handler := m.Logging()(http.HandlerFunc(
+		func(w http.ResponseWriter, _ *http.Request) {
+			called = true
+
+			w.WriteHeader(http.StatusOK)
+		},
+	))
+
+	req := httptest.NewRequestWithContext(
+		context.Background(),
+		http.MethodPost, "/api/webhook", nil,
+	)
 	w := httptest.NewRecorder()
 
 	handler.ServeHTTP(w, req)
 
-	assert.True(t, called, "logging middleware should call the next handler")
+	assert.True(
+		t, called,
+		"logging middleware should call the next handler",
+	)
 }
 
 // --- LoggingResponseWriter Tests ---
@@ -125,24 +147,33 @@ func TestLoggingResponseWriter_CapturesStatusCode(t *testing.T) {
 	t.Parallel()
 
 	w := httptest.NewRecorder()
-	lrw := NewLoggingResponseWriter(w)
+	lrw := middleware.NewLoggingResponseWriterForTest(w)
 
 	// Default should be 200
-	assert.Equal(t, http.StatusOK, lrw.statusCode)
+	assert.Equal(
+		t, http.StatusOK,
+		middleware.LoggingResponseWriterStatusCode(lrw),
+	)
 
 	// WriteHeader should capture the status code
 	lrw.WriteHeader(http.StatusNotFound)
-	assert.Equal(t, http.StatusNotFound, lrw.statusCode)
+
+	assert.Equal(
+		t, http.StatusNotFound,
+		middleware.LoggingResponseWriterStatusCode(lrw),
+	)
 
 	// Underlying writer should also get the status code
 	assert.Equal(t, http.StatusNotFound, w.Code)
 }
 
-func TestLoggingResponseWriter_WriteDelegatesToUnderlying(t *testing.T) {
+func TestLoggingResponseWriter_WriteDelegatesToUnderlying(
+	t *testing.T,
+) {
 	t.Parallel()
 
 	w := httptest.NewRecorder()
-	lrw := NewLoggingResponseWriter(w)
+	lrw := middleware.NewLoggingResponseWriterForTest(w)
 
 	n, err := lrw.Write([]byte("hello world"))
 	require.NoError(t, err)
@@ -154,79 +185,124 @@ func TestLoggingResponseWriter_WriteDelegatesToUnderlying(t *testing.T) {
 
 func TestCORS_DevMode_AllowsAnyOrigin(t *testing.T) {
 	t.Parallel()
+
 	m, _ := testMiddleware(t, config.EnvironmentDev)
 
-	handler := m.CORS()(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
-		w.WriteHeader(http.StatusOK)
-	}))
+	handler := m.CORS()(http.HandlerFunc(
+		func(w http.ResponseWriter, _ *http.Request) {
+			w.WriteHeader(http.StatusOK)
+		},
+	))
 
 	// Preflight request
-	req := httptest.NewRequest(http.MethodOptions, "/api/test", nil)
+	req := httptest.NewRequestWithContext(
+		context.Background(),
+		http.MethodOptions, "/api/test", nil,
+	)
 	req.Header.Set("Origin", "http://localhost:3000")
 	req.Header.Set("Access-Control-Request-Method", "POST")
+
 	w := httptest.NewRecorder()
 
 	handler.ServeHTTP(w, req)
 
 	// In dev mode, CORS should allow any origin
-	assert.Equal(t, "*", w.Header().Get("Access-Control-Allow-Origin"))
+	assert.Equal(
+		t, "*",
+		w.Header().Get("Access-Control-Allow-Origin"),
+	)
 }
 
 func TestCORS_ProdMode_NoOp(t *testing.T) {
 	t.Parallel()
+
 	m, _ := testMiddleware(t, config.EnvironmentProd)
 
 	var called bool
-	handler := m.CORS()(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
-		called = true
-		w.WriteHeader(http.StatusOK)
-	}))
 
-	req := httptest.NewRequest(http.MethodGet, "/api/test", nil)
+	handler := m.CORS()(http.HandlerFunc(
+		func(w http.ResponseWriter, _ *http.Request) {
+			called = true
+
+			w.WriteHeader(http.StatusOK)
+		},
+	))
+
+	req := httptest.NewRequestWithContext(
+		context.Background(),
+		http.MethodGet, "/api/test", nil,
+	)
 	req.Header.Set("Origin", "http://evil.com")
+
 	w := httptest.NewRecorder()
 
 	handler.ServeHTTP(w, req)
 
-	assert.True(t, called, "prod CORS middleware should pass through to handler")
+	assert.True(
+		t, called,
+		"prod CORS middleware should pass through to handler",
+	)
 	// In prod, no CORS headers should be set (no-op middleware)
-	assert.Empty(t, w.Header().Get("Access-Control-Allow-Origin"),
-		"prod mode should not set CORS headers")
+	assert.Empty(
+		t,
+		w.Header().Get("Access-Control-Allow-Origin"),
+		"prod mode should not set CORS headers",
+	)
 }
 
 // --- RequireAuth Middleware Tests ---
 
 func TestRequireAuth_NoSession_RedirectsToLogin(t *testing.T) {
 	t.Parallel()
+
 	m, _ := testMiddleware(t, config.EnvironmentDev)
 
 	var called bool
-	handler := m.RequireAuth()(http.HandlerFunc(func(_ http.ResponseWriter, _ *http.Request) {
-		called = true
-	}))
 
-	req := httptest.NewRequest(http.MethodGet, "/dashboard", nil)
+	handler := m.RequireAuth()(http.HandlerFunc(
+		func(_ http.ResponseWriter, _ *http.Request) {
+			called = true
+		},
+	))
+
+	req := httptest.NewRequestWithContext(
+		context.Background(),
+		http.MethodGet, "/dashboard", nil,
+	)
 	w := httptest.NewRecorder()
 
 	handler.ServeHTTP(w, req)
 
-	assert.False(t, called, "handler should not be called for unauthenticated request")
+	assert.False(
+		t, called,
+		"handler should not be called for "+
+			"unauthenticated request",
+	)
 	assert.Equal(t, http.StatusSeeOther, w.Code)
 	assert.Equal(t, "/pages/login", w.Header().Get("Location"))
 }
 
-func TestRequireAuth_AuthenticatedSession_PassesThrough(t *testing.T) {
+func TestRequireAuth_AuthenticatedSession_PassesThrough(
+	t *testing.T,
+) {
 	t.Parallel()
+
 	m, sessManager := testMiddleware(t, config.EnvironmentDev)
 
 	var called bool
-	handler := m.RequireAuth()(http.HandlerFunc(func(_ http.ResponseWriter, _ *http.Request) {
-		called = true
-	}))
 
-	// Create an authenticated session by making a request, setting session data,
-	// and saving the session cookie
-	setupReq := httptest.NewRequest(http.MethodGet, "/setup", nil)
+	handler := m.RequireAuth()(http.HandlerFunc(
+		func(_ http.ResponseWriter, _ *http.Request) {
+			called = true
+		},
+	))
+
+	// Create an authenticated session by making a request,
+	// setting session data, and saving the session cookie
+	setupReq := httptest.NewRequestWithContext(
+		context.Background(),
+		http.MethodGet, "/setup", nil,
+	)
 	setupW := httptest.NewRecorder()
 
 	sess, err := sessManager.Get(setupReq)
@@ -239,47 +315,74 @@ func TestRequireAuth_AuthenticatedSession_PassesThrough(t *testing.T) {
 	require.NotEmpty(t, cookies, "session cookie should be set")
 
 	// Make the actual request with the session cookie
-	req := httptest.NewRequest(http.MethodGet, "/dashboard", nil)
+	req := httptest.NewRequestWithContext(
+		context.Background(),
+		http.MethodGet, "/dashboard", nil,
+	)
+
 	for _, c := range cookies {
 		req.AddCookie(c)
 	}
+
 	w := httptest.NewRecorder()
 
 	handler.ServeHTTP(w, req)
 
-	assert.True(t, called, "handler should be called for authenticated request")
+	assert.True(
+		t, called,
+		"handler should be called for authenticated request",
+	)
 }
 
-func TestRequireAuth_UnauthenticatedSession_RedirectsToLogin(t *testing.T) {
+func TestRequireAuth_UnauthenticatedSession_RedirectsToLogin(
+	t *testing.T,
+) {
 	t.Parallel()
+
 	m, sessManager := testMiddleware(t, config.EnvironmentDev)
 
 	var called bool
-	handler := m.RequireAuth()(http.HandlerFunc(func(_ http.ResponseWriter, _ *http.Request) {
-		called = true
-	}))
+
+	handler := m.RequireAuth()(http.HandlerFunc(
+		func(_ http.ResponseWriter, _ *http.Request) {
+			called = true
+		},
+	))
 
 	// Create a session but don't authenticate it
-	setupReq := httptest.NewRequest(http.MethodGet, "/setup", nil)
+	setupReq := httptest.NewRequestWithContext(
+		context.Background(),
+		http.MethodGet, "/setup", nil,
+	)
 	setupW := httptest.NewRecorder()
 
 	sess, err := sessManager.Get(setupReq)
 	require.NoError(t, err)
-	// Don't call SetUser — session exists but is not authenticated
+	// Don't call SetUser -- session exists but is not
+	// authenticated
 	require.NoError(t, sessManager.Save(setupReq, setupW, sess))
 
 	cookies := setupW.Result().Cookies()
 	require.NotEmpty(t, cookies)
 
-	req := httptest.NewRequest(http.MethodGet, "/dashboard", nil)
+	req := httptest.NewRequestWithContext(
+		context.Background(),
+		http.MethodGet, "/dashboard", nil,
+	)
+
 	for _, c := range cookies {
 		req.AddCookie(c)
 	}
+
 	w := httptest.NewRecorder()
 
 	handler.ServeHTTP(w, req)
 
-	assert.False(t, called, "handler should not be called for unauthenticated session")
+	assert.False(
+		t, called,
+		"handler should not be called for "+
+			"unauthenticated session",
+	)
 	assert.Equal(t, http.StatusSeeOther, w.Code)
 	assert.Equal(t, "/pages/login", w.Header().Get("Location"))
 }
@@ -304,7 +407,9 @@ func TestIpFromHostPort(t *testing.T) {
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			t.Parallel()
-			result := ipFromHostPort(tt.input)
+
+			result := middleware.IPFromHostPort(tt.input)
+
 			assert.Equal(t, tt.expected, result)
 		})
 	}
@@ -312,122 +417,124 @@ func TestIpFromHostPort(t *testing.T) {
 
 // --- MetricsAuth Tests ---
 
-func TestMetricsAuth_ValidCredentials(t *testing.T) {
-	t.Parallel()
+// metricsAuthMiddleware creates a Middleware configured for
+// metrics auth testing. This helper de-duplicates the setup in
+// metrics auth test functions.
+func metricsAuthMiddleware(
+	t *testing.T,
+) *middleware.Middleware {
+	t.Helper()
+
+	log := slog.New(slog.NewTextHandler(
+		os.Stderr,
+		&slog.HandlerOptions{Level: slog.LevelDebug},
+	))
 
-	log := slog.New(slog.NewTextHandler(os.Stderr, &slog.HandlerOptions{Level: slog.LevelDebug}))
 	cfg := &config.Config{
 		Environment:     config.EnvironmentDev,
 		MetricsUsername: "admin",
 		MetricsPassword: "secret",
 	}
 
-	key := make([]byte, 32)
+	key := make([]byte, testKeySize)
 	store := sessions.NewCookieStore(key)
 	store.Options = &sessions.Options{Path: "/", MaxAge: 86400}
 
 	sessManager := session.NewForTest(store, cfg, log, key)
 
-	m := &Middleware{
-		log: log,
-		params: &MiddlewareParams{
-			Config: cfg,
-		},
-		session: sessManager,
-	}
+	return middleware.NewForTest(log, cfg, sessManager)
+}
+
+func TestMetricsAuth_ValidCredentials(t *testing.T) {
+	t.Parallel()
+
+	m := metricsAuthMiddleware(t)
 
 	var called bool
-	handler := m.MetricsAuth()(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
-		called = true
-		w.WriteHeader(http.StatusOK)
-	}))
 
-	req := httptest.NewRequest(http.MethodGet, "/metrics", nil)
+	handler := m.MetricsAuth()(http.HandlerFunc(
+		func(w http.ResponseWriter, _ *http.Request) {
+			called = true
+
+			w.WriteHeader(http.StatusOK)
+		},
+	))
+
+	req := httptest.NewRequestWithContext(
+		context.Background(),
+		http.MethodGet, "/metrics", nil,
+	)
 	req.SetBasicAuth("admin", "secret")
+
 	w := httptest.NewRecorder()
 
 	handler.ServeHTTP(w, req)
 
-	assert.True(t, called, "handler should be called with valid basic auth")
+	assert.True(
+		t, called,
+		"handler should be called with valid basic auth",
+	)
 	assert.Equal(t, http.StatusOK, w.Code)
 }
 
 func TestMetricsAuth_InvalidCredentials(t *testing.T) {
 	t.Parallel()
 
-	log := slog.New(slog.NewTextHandler(os.Stderr, &slog.HandlerOptions{Level: slog.LevelDebug}))
-	cfg := &config.Config{
-		Environment:     config.EnvironmentDev,
-		MetricsUsername: "admin",
-		MetricsPassword: "secret",
-	}
-
-	key := make([]byte, 32)
-	store := sessions.NewCookieStore(key)
-	store.Options = &sessions.Options{Path: "/", MaxAge: 86400}
-
-	sessManager := session.NewForTest(store, cfg, log, key)
-
-	m := &Middleware{
-		log: log,
-		params: &MiddlewareParams{
-			Config: cfg,
-		},
-		session: sessManager,
-	}
+	m := metricsAuthMiddleware(t)
 
 	var called bool
-	handler := m.MetricsAuth()(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
-		called = true
-		w.WriteHeader(http.StatusOK)
-	}))
 
-	req := httptest.NewRequest(http.MethodGet, "/metrics", nil)
+	handler := m.MetricsAuth()(http.HandlerFunc(
+		func(w http.ResponseWriter, _ *http.Request) {
+			called = true
+
+			w.WriteHeader(http.StatusOK)
+		},
+	))
+
+	req := httptest.NewRequestWithContext(
+		context.Background(),
+		http.MethodGet, "/metrics", nil,
+	)
 	req.SetBasicAuth("admin", "wrong-password")
+
 	w := httptest.NewRecorder()
 
 	handler.ServeHTTP(w, req)
 
-	assert.False(t, called, "handler should not be called with invalid basic auth")
+	assert.False(
+		t, called,
+		"handler should not be called with invalid basic auth",
+	)
 	assert.Equal(t, http.StatusUnauthorized, w.Code)
 }
 
 func TestMetricsAuth_NoCredentials(t *testing.T) {
 	t.Parallel()
 
-	log := slog.New(slog.NewTextHandler(os.Stderr, &slog.HandlerOptions{Level: slog.LevelDebug}))
-	cfg := &config.Config{
-		Environment:     config.EnvironmentDev,
-		MetricsUsername: "admin",
-		MetricsPassword: "secret",
-	}
-
-	key := make([]byte, 32)
-	store := sessions.NewCookieStore(key)
-	store.Options = &sessions.Options{Path: "/", MaxAge: 86400}
-
-	sessManager := session.NewForTest(store, cfg, log, key)
-
-	m := &Middleware{
-		log: log,
-		params: &MiddlewareParams{
-			Config: cfg,
-		},
-		session: sessManager,
-	}
+	m := metricsAuthMiddleware(t)
 
 	var called bool
-	handler := m.MetricsAuth()(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
-		called = true
-	}))
 
-	req := httptest.NewRequest(http.MethodGet, "/metrics", nil)
+	handler := m.MetricsAuth()(http.HandlerFunc(
+		func(_ http.ResponseWriter, _ *http.Request) {
+			called = true
+		},
+	))
+
+	req := httptest.NewRequestWithContext(
+		context.Background(),
+		http.MethodGet, "/metrics", nil,
+	)
 	// No basic auth header
 	w := httptest.NewRecorder()
 
 	handler.ServeHTTP(w, req)
 
-	assert.False(t, called, "handler should not be called without credentials")
+	assert.False(
+		t, called,
+		"handler should not be called without credentials",
+	)
 	assert.Equal(t, http.StatusUnauthorized, w.Code)
 }
 
@@ -435,16 +542,23 @@ func TestMetricsAuth_NoCredentials(t *testing.T) {
 
 func TestCORS_DevMode_AllowsMethods(t *testing.T) {
 	t.Parallel()
+
 	m, _ := testMiddleware(t, config.EnvironmentDev)
 
-	handler := m.CORS()(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
-		w.WriteHeader(http.StatusOK)
-	}))
+	handler := m.CORS()(http.HandlerFunc(
+		func(w http.ResponseWriter, _ *http.Request) {
+			w.WriteHeader(http.StatusOK)
+		},
+	))
 
 	// Preflight for POST
-	req := httptest.NewRequest(http.MethodOptions, "/api/webhooks", nil)
+	req := httptest.NewRequestWithContext(
+		context.Background(),
+		http.MethodOptions, "/api/webhooks", nil,
+	)
 	req.Header.Set("Origin", "http://localhost:5173")
 	req.Header.Set("Access-Control-Request-Method", "POST")
+
 	w := httptest.NewRecorder()
 
 	handler.ServeHTTP(w, req)
@@ -458,14 +572,17 @@ func TestCORS_DevMode_AllowsMethods(t *testing.T) {
 func TestSessionKeyFormat(t *testing.T) {
 	t.Parallel()
 
-	// Verify that the session initialization correctly validates key format.
-	// A proper 32-byte key encoded as base64 should work.
-	key := make([]byte, 32)
+	// Verify that the session initialization correctly validates
+	// key format. A proper 32-byte key encoded as base64 should
+	// work.
+	key := make([]byte, testKeySize)
+
 	for i := range key {
 		key[i] = byte(i + 1)
 	}
+
 	encoded := base64.StdEncoding.EncodeToString(key)
 	decoded, err := base64.StdEncoding.DecodeString(encoded)
 	require.NoError(t, err)
-	assert.Len(t, decoded, 32)
+	assert.Len(t, decoded, testKeySize)
 }

internal/middleware/ratelimit.go

@@ -8,40 +8,56 @@ import (
 )
 
 const (
-	// loginRateLimit is the maximum number of login attempts per interval.
+	// loginRateLimit is the maximum number of login attempts
+	// per interval.
 	loginRateLimit = 5
 
 	// loginRateInterval is the time window for the rate limit.
 	loginRateInterval = 1 * time.Minute
 )
 
-// LoginRateLimit returns middleware that enforces per-IP rate limiting
-// on login attempts using go-chi/httprate. Only POST requests are
-// rate-limited; GET requests (rendering the login form) pass through
-// unaffected. When the rate limit is exceeded, a 429 Too Many Requests
-// response is returned. IP extraction honours X-Forwarded-For,
-// X-Real-IP, and True-Client-IP headers for reverse-proxy setups.
+// LoginRateLimit returns middleware that enforces per-IP rate
+// limiting on login attempts using go-chi/httprate. Only POST
+// requests are rate-limited; GET requests (rendering the login
+// form) pass through unaffected. When the rate limit is exceeded,
+// a 429 Too Many Requests response is returned. IP extraction
+// honours X-Forwarded-For, X-Real-IP, and True-Client-IP headers
+// for reverse-proxy setups.
 func (m *Middleware) LoginRateLimit() func(http.Handler) http.Handler {
 	limiter := httprate.Limit(
 		loginRateLimit,
 		loginRateInterval,
 		httprate.WithKeyFuncs(httprate.KeyByRealIP),
-		httprate.WithLimitHandler(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-			m.log.Warn("login rate limit exceeded",
-				"path", r.URL.Path,
-			)
-			http.Error(w, "Too many login attempts. Please try again later.", http.StatusTooManyRequests)
-		})),
+		httprate.WithLimitHandler(http.HandlerFunc(
+			func(w http.ResponseWriter, r *http.Request) {
+				m.log.Warn("login rate limit exceeded",
+					"path", r.URL.Path,
+				)
+				http.Error(
+					w,
+					"Too many login attempts. "+
+						"Please try again later.",
+					http.StatusTooManyRequests,
+				)
+			},
+		)),
 	)
 
 	return func(next http.Handler) http.Handler {
 		limited := limiter(next)
-		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-			// Only rate-limit POST requests (actual login attempts)
+
+		return http.HandlerFunc(func(
+			w http.ResponseWriter,
+			r *http.Request,
+		) {
+			// Only rate-limit POST requests (actual login
+			// attempts)
 			if r.Method != http.MethodPost {
 				next.ServeHTTP(w, r)
+
 				return
 			}
+
 			limited.ServeHTTP(w, r)
 		})
 	}

internal/middleware/ratelimit_test.go

@@ -1,90 +1,147 @@
-package middleware
+package middleware_test
 
 import (
+	"context"
 	"net/http"
 	"net/http/httptest"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
 	"sneak.berlin/go/webhooker/internal/config"
+	"sneak.berlin/go/webhooker/internal/middleware"
 )
 
 func TestLoginRateLimit_AllowsGET(t *testing.T) {
 	t.Parallel()
+
 	m, _ := testMiddleware(t, config.EnvironmentDev)
 
 	var callCount int
-	handler := m.LoginRateLimit()(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
-		callCount++
-		w.WriteHeader(http.StatusOK)
-	}))
+
+	handler := m.LoginRateLimit()(http.HandlerFunc(
+		func(w http.ResponseWriter, _ *http.Request) {
+			callCount++
+
+			w.WriteHeader(http.StatusOK)
+		},
+	))
 
 	// GET requests should never be rate-limited
-	for i := 0; i < 20; i++ {
-		req := httptest.NewRequest(http.MethodGet, "/pages/login", nil)
+	for i := range 20 {
+		req := httptest.NewRequestWithContext(
+			context.Background(),
+			http.MethodGet, "/pages/login", nil,
+		)
 		req.RemoteAddr = "192.168.1.1:12345"
+
 		w := httptest.NewRecorder()
 		handler.ServeHTTP(w, req)
-		assert.Equal(t, http.StatusOK, w.Code, "GET request %d should pass", i)
+
+		assert.Equal(
+			t, http.StatusOK, w.Code,
+			"GET request %d should pass", i,
+		)
 	}
+
 	assert.Equal(t, 20, callCount)
 }
 
 func TestLoginRateLimit_LimitsPOST(t *testing.T) {
 	t.Parallel()
+
 	m, _ := testMiddleware(t, config.EnvironmentDev)
 
 	var callCount int
-	handler := m.LoginRateLimit()(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
-		callCount++
-		w.WriteHeader(http.StatusOK)
-	}))
+
+	handler := m.LoginRateLimit()(http.HandlerFunc(
+		func(w http.ResponseWriter, _ *http.Request) {
+			callCount++
+
+			w.WriteHeader(http.StatusOK)
+		},
+	))
 
 	// First loginRateLimit POST requests should succeed
-	for i := 0; i < loginRateLimit; i++ {
-		req := httptest.NewRequest(http.MethodPost, "/pages/login", nil)
+	for i := range middleware.LoginRateLimitConst {
+		req := httptest.NewRequestWithContext(
+			context.Background(),
+			http.MethodPost, "/pages/login", nil,
+		)
 		req.RemoteAddr = "10.0.0.1:12345"
+
 		w := httptest.NewRecorder()
 		handler.ServeHTTP(w, req)
-		assert.Equal(t, http.StatusOK, w.Code, "POST request %d should pass", i)
+
+		assert.Equal(
+			t, http.StatusOK, w.Code,
+			"POST request %d should pass", i,
+		)
 	}
 
 	// Next POST should be rate-limited
-	req := httptest.NewRequest(http.MethodPost, "/pages/login", nil)
+	req := httptest.NewRequestWithContext(
+		context.Background(),
+		http.MethodPost, "/pages/login", nil,
+	)
 	req.RemoteAddr = "10.0.0.1:12345"
+
 	w := httptest.NewRecorder()
 	handler.ServeHTTP(w, req)
-	assert.Equal(t, http.StatusTooManyRequests, w.Code, "POST after limit should be 429")
-	assert.Equal(t, loginRateLimit, callCount)
+
+	assert.Equal(
+		t, http.StatusTooManyRequests, w.Code,
+		"POST after limit should be 429",
+	)
+	assert.Equal(t, middleware.LoginRateLimitConst, callCount)
 }
 
 func TestLoginRateLimit_IndependentPerIP(t *testing.T) {
 	t.Parallel()
+
 	m, _ := testMiddleware(t, config.EnvironmentDev)
 
-	handler := m.LoginRateLimit()(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
-		w.WriteHeader(http.StatusOK)
-	}))
+	handler := m.LoginRateLimit()(http.HandlerFunc(
+		func(w http.ResponseWriter, _ *http.Request) {
+			w.WriteHeader(http.StatusOK)
+		},
+	))
 
 	// Exhaust limit for IP1
-	for i := 0; i < loginRateLimit; i++ {
-		req := httptest.NewRequest(http.MethodPost, "/pages/login", nil)
+	for range middleware.LoginRateLimitConst {
+		req := httptest.NewRequestWithContext(
+			context.Background(),
+			http.MethodPost, "/pages/login", nil,
+		)
 		req.RemoteAddr = "1.2.3.4:12345"
+
 		w := httptest.NewRecorder()
 		handler.ServeHTTP(w, req)
 	}
 
 	// IP1 should be rate-limited
-	req := httptest.NewRequest(http.MethodPost, "/pages/login", nil)
+	req := httptest.NewRequestWithContext(
+		context.Background(),
+		http.MethodPost, "/pages/login", nil,
+	)
 	req.RemoteAddr = "1.2.3.4:12345"
+
 	w := httptest.NewRecorder()
 	handler.ServeHTTP(w, req)
+
 	assert.Equal(t, http.StatusTooManyRequests, w.Code)
 
 	// IP2 should still be allowed
-	req2 := httptest.NewRequest(http.MethodPost, "/pages/login", nil)
+	req2 := httptest.NewRequestWithContext(
+		context.Background(),
+		http.MethodPost, "/pages/login", nil,
+	)
 	req2.RemoteAddr = "5.6.7.8:12345"
+
 	w2 := httptest.NewRecorder()
 	handler.ServeHTTP(w2, req2)
-	assert.Equal(t, http.StatusOK, w2.Code, "different IP should not be affected")
+
+	assert.Equal(
+		t, http.StatusOK, w2.Code,
+		"different IP should not be affected",
+	)
 }

internal/middleware/testing.go

@@ -0,0 +1,24 @@
+package middleware
+
+import (
+	"log/slog"
+
+	"sneak.berlin/go/webhooker/internal/config"
+	"sneak.berlin/go/webhooker/internal/session"
+)
+
+// NewForTest creates a Middleware with the minimum dependencies
+// needed for testing. This bypasses the fx lifecycle.
+func NewForTest(
+	log *slog.Logger,
+	cfg *config.Config,
+	sess *session.Session,
+) *Middleware {
+	return &Middleware{
+		log: log,
+		params: &MiddlewareParams{
+			Config: cfg,
+		},
+		session: sess,
+	}
+}