Įkėlimas nuo pradžios iki galo, su gyva progreso juosta

Aštuoni failai, pateikimas ant ką tik pastatyto sluoksnio: rodinio modelis, jo atvaizdavimas, sąrašo fragmentas, įkėlimo valdiklis ir keturi maži sujungimo pakeitimai, kurie viską pagyvina. Tvarka: documents_web.go → documents_view.go → documents.templ → documents.go → dashboard.templ → auth.go → router.go → layout.templ.

1. internal/web/documents_web.go (naujas) — DocumentView, šablonui skirta forma: paprastos eilutės ir loginė reikšmė, jokio pgtype. Šablonai niekada tiesiogiai neliečia db.Document.

2. internal/handlers/documents_view.go (naujas) — viewDocument atvaizduoja db.Document į DocumentView (suformatuoja laiko žymą, sužmogina baitų skaičių), viewDocuments atvaizduoja pjūvį, o humanizeBytes pateikia 1.4 MB.

3. internal/web/documents.templ (naujas) — DocumentList(docs), fragmentas su id="doc-list", ir documentRow. Būtent šį gabalą HTMX pakeičia: įkėlimo forma taikosi į #doc-list ir pakeičia jį šviežiu sąrašu. (Peržiūros ir trynimo veiksmai atkeliaus kitą pamoką kartu su juos palaikančiais maršrutais.)

4. internal/handlers/documents.go (naujas) — Dashboard (perkeltas čia iš auth.go, dabar rodantis savininko dokumentus) ir UploadDocument:

r.Body = http.MaxBytesReader(w, r.Body, h.Cfg.MaxUploadBytes+1024)
file, header, err := r.FormFile("file")
// ...
key, size, hash, err := h.Store.Save(r.Context(), file) // srautas + maiša, vienas perėjimas
doc, err := h.Queries.CreateDocument(r.Context(), db.CreateDocumentParams{ /* ... */ })
if err != nil {
	_ = h.Store.Delete(r.Context(), key) // nepalik našlaičio failo
	// ...
}

Jei eilutės įterpimas nepavyksta jau įrašius failą, Store.Delete pašalina našlaitį — saugykla ir duomenų bazė laikomos sinchronizuotos. respondWithDocList grąžina atnaujintą fragmentą HTMX skambintojams ir peradresuoja paprastą formos siuntimą. sanitizeFilename nušluosto kelio skirtukus ir valdymo simbolius iš kliento pateikto vardo.

5. internal/web/dashboard.templ (keitimas) — vietos rezervavimo skydelis išauga į tikrą: herojų, įkėlimo kortelę (hx-post="/documents", hx-encoding="multipart/form-data", hx-target="#doc-list", <progress> juostą) ir @DocumentList(docs). Mažas skriptas sujungia htmx xhr:progress įvykius su progreso elementu. Dashboard dabar priima docs []DocumentView.

6. internal/handlers/auth.go (keitimas) — senas vietos rezervavimo Dashboard čia pašalintas; jis persikėlė į documents.go, kur gali išvardyti dokumentus. Daugiau auth.go niekas nesikeičia.

7. internal/handlers/router.go (keitimas) — vienas maršrutas autentifikuotoje grupėje: pr.Post("/documents", h.UploadDocument).

8. internal/web/layout.templ (keitimas) — du papildymai, leidžiantys HTMX siuntimams praeiti CSRF: <meta name="csrf-token"> ir mažas htmx:configRequest klausytojas, kopijuojantis žetoną į X-CSRF-Token antraštę. Įkėlimo forma neneša paslėpto lauko, tad antraštė yra tai, kaip gorilla/csrf mato žetoną — ir jis nuskaito antraštę prieš apdorodamas kūną, tad multipart srautas nesuvartojamas du kartus.

Įkėlimo forma neturi paslėpto CSRF lauko

Kiekviena kita forma įterpia gorilla.csrf.Token kaip paslėptą įvestį. Multipart įkėlimas negali — žetonas atvyktų po failo sraute, o gorilla/csrf jį reikia pirma. X-CSRF-Token antraštė tai išsprendžia: htmx prideda ją prie kiekvienos užklausos iš meta žymos, ir ji nuskaitoma prieš kūną. Be šio sujungimo įkėlimo POST grąžina 403 Forbidden.

Patikra — perseeduok, go run ./cmd/signflow, prisijunk ir atverk /dashboard:

Pasirink failą ir spausk Upload. Progreso juosta prisipildo, o dokumentų sąrašas pasikeičia vietoje su tavo failu — be viso puslapio perkrovimo.
Eilutė rodo sužmogintą dydį ir draft ženkliuką.
Patikrink terminalą:

level=INFO msg="document uploaded" id=… owner=you@example.com size=1048576 sha256=4a7d1ed414474e4033ac29ccb8653d9b...

Įsitikink, kad baitai ir maiša nusėdo:

$ ls uploads/
7f3a9c1e0b2d4f6a8c5e1b3d7f9a2c4e
$ psql "$DATABASE_URL" -c "select filename, size, status, storage_key from documents;"
   filename   |  size   | status |           storage_key
--------------+---------+--------+----------------------------------
 contract.pdf | 1048576 | draft  | 7f3a9c1e0b2d4f6a8c5e1b3d7f9a2c4e

storage_key įvardija failą diske; jis nėra eilutės ID. file_hash buvo apskaičiuotas tuo pačiu perėjimu, kuris tuos baitus įrašė.

Pabandyk failą virš 25 MiB: įkėlimas atmetamas su 413, o į uploads/ ar lentelę nieko neįrašoma.

documents_web.go SUKURTI

Sukurk šį failą kataloge internal/web/

package web

// DocumentView is the template-facing shape of a document: plain strings, no
// pgtype. Handlers map db.Document into this.
type DocumentView struct {
	ID          string
	Filename    string
	ContentType string
	SizeHuman   string
	FileHash    string
	Status      string
	CreatedAt   string
	IsDraft     bool
}

documents_view.go SUKURTI

Sukurk šį failą kataloge internal/handlers/

package handlers

import (
	"fmt"

	"github.com/programuoki/signflow/internal/db"
	"github.com/programuoki/signflow/internal/web"
)

func viewDocument(d db.Document) web.DocumentView {
	return web.DocumentView{
		ID:          d.ID.String(),
		Filename:    d.Filename,
		ContentType: d.ContentType,
		SizeHuman:   humanizeBytes(d.Size),
		FileHash:    d.FileHash,
		Status:      d.Status,
		CreatedAt:   d.CreatedAt.Time.Format("2006-01-02 15:04"),
		IsDraft:     d.Status == "draft",
	}
}

func viewDocuments(docs []db.Document) []web.DocumentView {
	out := make([]web.DocumentView, 0, len(docs))
	for _, d := range docs {
		out = append(out, viewDocument(d))
	}
	return out
}

// humanizeBytes renders a byte count as e.g. "1.4 MB".
func humanizeBytes(n int64) string {
	const unit = 1024
	if n < unit {
		return fmt.Sprintf("%d B", n)
	}
	div, exp := int64(unit), 0
	for x := n / unit; x >= unit; x /= unit {
		div *= unit
		exp++
	}
	return fmt.Sprintf("%.1f %cB", float64(n)/float64(div), "KMGTPE"[exp])
}

documents.templ SUKURTI

Sukurk šį failą kataloge internal/web/

package web

// DocumentList is the swappable partial that HTMX refreshes after an upload.
// Its id="doc-list" is the hx-target the upload form swaps.
templ DocumentList(docs []DocumentView) {
	<section id="doc-list" class="card">
		<h2>Documents</h2>
		if len(docs) == 0 {
			<p class="muted">No documents yet. Upload one above to get started.</p>
		} else {
			<table class="table">
				<thead>
					<tr>
						<th>Name</th>
						<th>Status</th>
						<th>Size</th>
						<th>Uploaded</th>
					</tr>
				</thead>
				<tbody>
					for _, d := range docs {
						@documentRow(d)
					}
				</tbody>
			</table>
		}
	</section>
}

templ documentRow(d DocumentView) {
	<tr>
		<td>{ d.Filename }</td>
		<td><span class={ "pill", "pill-" + d.Status }>{ d.Status }</span></td>
		<td>{ d.SizeHuman }</td>
		<td>{ d.CreatedAt }</td>
	</tr>
}

documents.go SUKURTI

Sukurk šį failą kataloge internal/handlers/

package handlers

import (
	"net/http"
	"strings"

	"github.com/programuoki/signflow/internal/db"
	"github.com/programuoki/signflow/internal/web"
)

// Dashboard lists the signed-in user's documents.
func (h *Handlers) Dashboard(w http.ResponseWriter, r *http.Request) {
	user := mustUser(r)
	docs, err := h.Queries.ListDocumentsByOwner(r.Context(), user.ID)
	if err != nil {
		h.serverError(w, r, "list documents", err)
		return
	}
	render(w, r, http.StatusOK, web.Dashboard(h.nav(r), viewDocuments(docs)))
}

// UploadDocument accepts a multipart file, hashes and stores it, and records it
// as a draft owned by the current user.
func (h *Handlers) UploadDocument(w http.ResponseWriter, r *http.Request) {
	user := mustUser(r)

	// Cap the request body. +1KiB slack covers multipart field overhead so a
	// file exactly at the limit still succeeds.
	r.Body = http.MaxBytesReader(w, r.Body, h.Cfg.MaxUploadBytes+1024)

	file, header, err := r.FormFile("file")
	if err != nil {
		// Covers both "no file" and "too large" (MaxBytesReader error).
		h.Log.Warn("upload rejected", "err", err, "user", user.Email)
		http.Error(w, "upload failed: file missing or too large", http.StatusRequestEntityTooLarge)
		return
	}
	defer file.Close()

	if header.Size == 0 {
		http.Error(w, "upload failed: empty file", http.StatusBadRequest)
		return
	}

	contentType := header.Header.Get("Content-Type")
	if contentType == "" {
		contentType = "application/octet-stream"
	}

	// The store hashes while it writes — the file is never fully in memory.
	key, size, hash, err := h.Store.Save(r.Context(), file)
	if err != nil {
		h.serverError(w, r, "store file", err)
		return
	}

	doc, err := h.Queries.CreateDocument(r.Context(), db.CreateDocumentParams{
		OwnerID:     user.ID,
		Filename:    sanitizeFilename(header.Filename),
		ContentType: contentType,
		Size:        size,
		FileHash:    hash,
		StorageKey:  key,
	})
	if err != nil {
		_ = h.Store.Delete(r.Context(), key) // don't orphan the blob
		h.serverError(w, r, "create document", err)
		return
	}
	h.Log.Info("document uploaded", "id", doc.ID.String(), "owner", user.Email, "size", size, "sha256", hash)

	h.respondWithDocList(w, r, user)
}

// respondWithDocList returns the refreshed list partial to HTMX callers, or
// redirects to the dashboard for a plain form post.
func (h *Handlers) respondWithDocList(w http.ResponseWriter, r *http.Request, user db.User) {
	if r.Header.Get("HX-Request") == "" {
		http.Redirect(w, r, "/dashboard", http.StatusSeeOther)
		return
	}
	docs, err := h.Queries.ListDocumentsByOwner(r.Context(), user.ID)
	if err != nil {
		h.serverError(w, r, "list documents", err)
		return
	}
	render(w, r, http.StatusOK, web.DocumentList(viewDocuments(docs)))
}

func mustUser(r *http.Request) db.User {
	u, _ := UserFrom(r.Context()) // routes are behind RequireAuth
	return u
}

// sanitizeFilename strips path separators and control characters so a filename
// can't traverse directories or inject headers.
func sanitizeFilename(name string) string {
	name = strings.ReplaceAll(name, "\\", "/")
	if i := strings.LastIndex(name, "/"); i >= 0 {
		name = name[i+1:]
	}
	name = strings.Map(func(rn rune) rune {
		if rn < 0x20 || rn == 0x7f || rn == '"' {
			return -1
		}
		return rn
	}, name)
	name = strings.TrimSpace(name)
	if name == "" {
		return "document"
	}
	return name
}

dashboard.templ MODIFIKUOTI 37 eilutės pakeistos

Redaguok šį failą kataloge internal/web/

package web

// Dashboard is the signed-in home: an upload card plus the owner's document list.
templ Dashboard(nav Nav, docs []DocumentView) {
	@Layout("Dashboard", nav) {
		<section class="hero">
			<h1>Your documents</h1>
			<p class="lead">Upload a file, then invite signers. Any file type works —
				SignFlow hashes it on upload so you can prove it hasn't changed.</p>
		</section>
		<section class="card upload-card">
			<h2>Upload a document</h2>
			<form
				id="upload-form"
				hx-post="/documents"
				hx-encoding="multipart/form-data"
				hx-target="#doc-list"
				hx-swap="outerHTML"
				hx-on::after-request="if(event.detail.successful){this.reset();}"
			>
				<div class="upload-row">
					<input type="file" name="file" required/>
					<button class="btn btn-primary" type="submit">Upload</button>
				</div>
				<progress id="upload-progress" value="0" max="100"></progress>
			</form>
			<p id="upload-error" class="flash flash-error" hidden></p>
		</section>
		@DocumentList(docs)
		<script>
			(function () {
				var form = document.getElementById('upload-form');
				var prog = document.getElementById('upload-progress');
				var err = document.getElementById('upload-error');
				if (!form) return;
				form.addEventListener('htmx:xhr:loadstart', function () { prog.classList.add('active'); prog.value = 0; err.hidden = true; });
				form.addEventListener('htmx:xhr:progress', function (e) { if (e.detail.lengthComputable) prog.value = (e.detail.loaded / e.detail.total) * 100; });
				form.addEventListener('htmx:afterRequest', function (e) {
					prog.classList.remove('active');
					if (!e.detail.successful) { err.textContent = 'Upload failed (file too large, or an error occurred).'; err.hidden = false; }
				});
			})();
		</script>
	}
}

auth.go MODIFIKUOTI

Redaguok šį failą kataloge internal/handlers/

package handlers

import (
	"errors"
	"fmt"
	"net/http"
	"net/mail"
	"strings"
	"time"

	"github.com/gorilla/csrf"
	"github.com/jackc/pgx/v5"
	"github.com/jackc/pgx/v5/pgtype"

	"github.com/programuoki/signflow/internal/auth"
	"github.com/programuoki/signflow/internal/db"
	"github.com/programuoki/signflow/internal/email"
	"github.com/programuoki/signflow/internal/web"
)

// passwordResetTTL is how long a reset link stays valid.
const passwordResetTTL = time.Hour

// nav builds the per-request nav model (current user + CSRF token) for templates.
func (h *Handlers) nav(r *http.Request) web.Nav {
	n := web.Nav{CSRFToken: csrf.Token(r)}
	if u, ok := UserFrom(r.Context()); ok {
		n.LoggedIn = true
		n.Email = u.Email
	}
	return n
}

// --- Register ---

func (h *Handlers) RegisterForm(w http.ResponseWriter, r *http.Request) {
	render(w, r, http.StatusOK, web.Register(h.nav(r), "", ""))
}

func (h *Handlers) Register(w http.ResponseWriter, r *http.Request) {
	emailAddr := normalizeEmail(r.FormValue("email"))
	password := r.FormValue("password")
	confirm := r.FormValue("confirm")

	fail := func(msg string) {
		render(w, r, http.StatusUnprocessableEntity, web.Register(h.nav(r), emailAddr, msg))
	}

	if !validEmail(emailAddr) {
		fail("Please enter a valid email address.")
		return
	}
	if password != confirm {
		fail("Passwords do not match.")
		return
	}
	hash, err := auth.HashPassword(password)
	if errors.Is(err, auth.ErrPasswordLength) {
		fail("Password must be between 8 and 64 characters.")
		return
	}
	if err != nil {
		h.serverError(w, r, "hash password", err)
		return
	}

	if _, err := h.Queries.GetUserByEmail(r.Context(), emailAddr); err == nil {
		fail("That email is already registered. Try logging in.")
		return
	} else if !errors.Is(err, pgx.ErrNoRows) {
		h.serverError(w, r, "lookup user", err)
		return
	}

	user, err := h.Queries.CreateUser(r.Context(), db.CreateUserParams{
		Email:        emailAddr,
		PasswordHash: hash,
	})
	if err != nil {
		if isUniqueViolation(err) {
			fail("That email is already registered. Try logging in.")
			return
		}
		h.serverError(w, r, "create user", err)
		return
	}

	if err := h.Sessions.Create(r.Context(), w, user.ID); err != nil {
		h.serverError(w, r, "create session", err)
		return
	}
	h.Log.Info("user registered", "email", user.Email)
	http.Redirect(w, r, "/dashboard", http.StatusSeeOther)
}

// --- Login / Logout ---

func (h *Handlers) LoginForm(w http.ResponseWriter, r *http.Request) {
	render(w, r, http.StatusOK, web.Login(h.nav(r), "", ""))
}

func (h *Handlers) Login(w http.ResponseWriter, r *http.Request) {
	emailAddr := normalizeEmail(r.FormValue("email"))
	password := r.FormValue("password")

	invalid := func() {
		render(w, r, http.StatusUnprocessableEntity, web.Login(h.nav(r), emailAddr, "Invalid email or password."))
	}

	user, err := h.Queries.GetUserByEmail(r.Context(), emailAddr)
	if errors.Is(err, pgx.ErrNoRows) {
		invalid()
		return
	}
	if err != nil {
		h.serverError(w, r, "lookup user", err)
		return
	}
	if !auth.CheckPassword(user.PasswordHash, password) {
		invalid()
		return
	}

	if err := h.Sessions.Create(r.Context(), w, user.ID); err != nil {
		h.serverError(w, r, "create session", err)
		return
	}
	h.Log.Info("user logged in", "email", user.Email)
	http.Redirect(w, r, "/dashboard", http.StatusSeeOther)
}

func (h *Handlers) Logout(w http.ResponseWriter, r *http.Request) {
	if err := h.Sessions.Destroy(r.Context(), w, r); err != nil {
		h.serverError(w, r, "destroy session", err)
		return
	}
	http.Redirect(w, r, "/", http.StatusSeeOther)
}

// --- Password reset ---

func (h *Handlers) ForgotForm(w http.ResponseWriter, r *http.Request) {
	render(w, r, http.StatusOK, web.Forgot(h.nav(r), false, ""))
}

func (h *Handlers) Forgot(w http.ResponseWriter, r *http.Request) {
	emailAddr := normalizeEmail(r.FormValue("email"))

	// Always show the same confirmation regardless of whether the account
	// exists — no account enumeration. Do the real work only if it does.
	if validEmail(emailAddr) {
		if err := h.sendResetLink(r, emailAddr); err != nil {
			h.Log.Error("send reset link", "err", err, "email", emailAddr)
			// Still show the generic confirmation; don't reveal internal errors.
		}
	}
	render(w, r, http.StatusOK, web.Forgot(h.nav(r), true, emailAddr))
}

// sendResetLink creates a reset token for an existing user and emails the link.
// A no-op (nil) if the email isn't registered.
func (h *Handlers) sendResetLink(r *http.Request, emailAddr string) error {
	user, err := h.Queries.GetUserByEmail(r.Context(), emailAddr)
	if errors.Is(err, pgx.ErrNoRows) {
		return nil
	}
	if err != nil {
		return err
	}

	raw, hash, err := auth.GenerateToken()
	if err != nil {
		return err
	}
	if _, err := h.Queries.CreatePasswordReset(r.Context(), db.CreatePasswordResetParams{
		TokenHash: hash,
		UserID:    user.ID,
		ExpiresAt: pgtype.Timestamptz{Time: time.Now().Add(passwordResetTTL), Valid: true},
	}); err != nil {
		return err
	}

	link := h.Cfg.BaseURL + "/reset/" + raw
	text := fmt.Sprintf(
		"Someone requested a password reset for your SignFlow account.\n\n"+
			"Reset your password (link valid for 1 hour):\n%s\n\n"+
			"If this wasn't you, you can safely ignore this email.",
		link,
	)
	return h.Mailer.Send(r.Context(), email.Message{
		To:      user.Email,
		Subject: "Reset your SignFlow password",
		Text:    text,
		HTML:    fmt.Sprintf(`<p>Reset your SignFlow password (valid 1 hour):</p><p><a href="%s">%s</a></p>`, link, link),
	})
}

func (h *Handlers) ResetForm(w http.ResponseWriter, r *http.Request) {
	token := chiURLParam(r, "token")
	if _, err := h.Queries.GetValidPasswordReset(r.Context(), auth.HashToken(token)); err != nil {
		render(w, r, http.StatusOK, web.ResetInvalid(h.nav(r)))
		return
	}
	render(w, r, http.StatusOK, web.ResetPassword(h.nav(r), token, ""))
}

func (h *Handlers) Reset(w http.ResponseWriter, r *http.Request) {
	token := chiURLParam(r, "token")
	password := r.FormValue("password")
	confirm := r.FormValue("confirm")

	prt, err := h.Queries.GetValidPasswordReset(r.Context(), auth.HashToken(token))
	if err != nil {
		render(w, r, http.StatusOK, web.ResetInvalid(h.nav(r)))
		return
	}

	fail := func(msg string) {
		render(w, r, http.StatusUnprocessableEntity, web.ResetPassword(h.nav(r), token, msg))
	}
	if password != confirm {
		fail("Passwords do not match.")
		return
	}
	hash, err := auth.HashPassword(password)
	if errors.Is(err, auth.ErrPasswordLength) {
		fail("Password must be between 8 and 64 characters.")
		return
	}
	if err != nil {
		h.serverError(w, r, "hash password", err)
		return
	}

	if err := h.Queries.UpdateUserPassword(r.Context(), db.UpdateUserPasswordParams{
		ID:           prt.UserID,
		PasswordHash: hash,
	}); err != nil {
		h.serverError(w, r, "update password", err)
		return
	}
	// Burn this token and any other outstanding ones, and log the user out of
	// all existing sessions — a password change should invalidate them.
	_ = h.Queries.MarkPasswordResetUsed(r.Context(), prt.ID)
	_ = h.Queries.InvalidateUserPasswordResets(r.Context(), prt.UserID)
	_ = h.Queries.DeleteSessionsForUser(r.Context(), prt.UserID)

	h.Log.Info("password reset completed", "user_id", prt.UserID.String())
	http.Redirect(w, r, "/login", http.StatusSeeOther)
}

// --- helpers ---

func normalizeEmail(s string) string { return strings.ToLower(strings.TrimSpace(s)) }

func validEmail(s string) bool {
	if s == "" || len(s) > 254 {
		return false
	}
	_, err := mail.ParseAddress(s)
	return err == nil
}

router.go MODIFIKUOTI 1 eilutė pakeista

Redaguok šį failą kataloge internal/handlers/

package handlers

import (
	"io/fs"
	"net/http"

	"github.com/go-chi/chi/v5"
	"github.com/go-chi/chi/v5/middleware"
	"github.com/gorilla/csrf"
)

// Router builds the Chi router with the middleware stack and all routes.
//
// csrfKey must be 32 bytes; it authenticates the CSRF token cookie.
func (h *Handlers) Router(staticFS fs.FS, csrfKey []byte) http.Handler {
	r := chi.NewRouter()

	// Base middleware, outermost first.
	r.Use(middleware.RequestID)
	r.Use(middleware.RealIP)
	r.Use(middleware.Logger)    // request logging
	r.Use(middleware.Recoverer) // turn panics into 500s instead of crashing

	// In dev we serve plaintext HTTP on localhost. gorilla/csrf otherwise assumes
	// TLS and enforces a strict Origin/Referer check that rejects http:// origins.
	// Marking dev requests plaintext relaxes that ONE check while keeping the
	// token check. Production (HTTPS at Railway's edge) is NOT marked, so it keeps
	// the full strict-origin protection.
	if !h.Cfg.IsProd() {
		r.Use(func(next http.Handler) http.Handler {
			return http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {
				next.ServeHTTP(w, csrf.PlaintextHTTPRequest(req))
			})
		})
	}

	// CSRF: enforced on all unsafe methods (POST/PUT/PATCH/DELETE). Safe methods
	// pass through but get the token cookie set so forms can embed it. The field
	// name matches the hidden input our templates render.
	csrfMW := csrf.Protect(
		csrfKey,
		csrf.Secure(h.Cfg.IsProd()),
		csrf.Path("/"),
		csrf.SameSite(csrf.SameSiteLaxMode),
		csrf.FieldName("gorilla.csrf.Token"),
	)
	r.Use(csrfMW)

	// Resolve the session cookie into the request context for every route.
	r.Use(h.LoadUser)

	// Static assets (CSS, vendored htmx), served from the embedded FS.
	r.Handle("/static/*", http.StripPrefix("/static/", http.FileServer(http.FS(staticFS))))

	// Public routes.
	r.Get("/", h.Home)
	r.Get("/healthz", h.Health)

	// Auth routes.
	r.Get("/register", h.RegisterForm)
	r.Post("/register", h.Register)
	r.Get("/login", h.LoginForm)
	r.Post("/login", h.Login)
	r.Post("/logout", h.Logout)
	r.Get("/forgot", h.ForgotForm)
	r.Post("/forgot", h.Forgot)
	r.Get("/reset/{token}", h.ResetForm)
	r.Post("/reset/{token}", h.Reset)

	// Authenticated routes.
	r.Group(func(pr chi.Router) {
		pr.Use(h.RequireAuth)
		pr.Get("/dashboard", h.Dashboard)
		pr.Post("/documents", h.UploadDocument)
	})

	return r
}

layout.templ MODIFIKUOTI 10 eilučių pakeista

Redaguok šį failą kataloge internal/web/

package web

// Layout is the shared HTML shell. Page templates call it and pass their body
// as children. htmx is vendored under /static/js so the app has no runtime CDN
// dependency.
templ Layout(title string, nav Nav) {
	<!DOCTYPE html>
	<html lang="en">
		<head>
			<meta charset="utf-8"/>
			<meta name="viewport" content="width=device-width, initial-scale=1"/>
			<meta name="csrf-token" content={ nav.CSRFToken }/>
			<title>{ title } · SignFlow</title>
			<link rel="stylesheet" href="/static/css/style.css"/>
			<script src="/static/js/htmx.min.js"></script>
			<script>
				// Attach the CSRF token to every htmx request as a header. gorilla/csrf
				// reads X-CSRF-Token before touching the body, so multipart uploads
				// aren't parsed twice.
				document.addEventListener('htmx:configRequest', function (e) {
					var m = document.querySelector('meta[name="csrf-token"]');
					if (m) e.detail.headers['X-CSRF-Token'] = m.getAttribute('content');
				});
			</script>
		</head>
		<body>
			<header class="topbar">
				<a href="/" class="brand">✍️ SignFlow</a>
				<nav class="topnav">
					if nav.LoggedIn {
						<a href="/dashboard">Dashboard</a>
						<span class="who">{ nav.Email }</span>
						<form method="post" action="/logout" class="inline-form">
							<input type="hidden" name="gorilla.csrf.Token" value={ nav.CSRFToken }/>
							<button type="submit" class="btn btn-ghost btn-sm">Log out</button>
						</form>
					} else {
						<a href="/login">Log in</a>
						<a href="/register" class="btn btn-primary btn-sm">Register</a>
					}
				</nav>
			</header>
			<main class="container">
				{ children... }
			</main>
			<footer class="footer">
				<p>SignFlow — reference app for the Programuoki server-side web track.</p>
			</footer>
		</body>
	</html>
}