Kvietimas nuo pradžios iki galo, vienoje transakcijoje

Šeši failai kortelėse, iš apačios į viršų: rodinio modelis, jo atvaizdavimai, kvietimo valdiklis, tada savininko detalės puslapis, rodantis formą ir sąrašą. signing.go → signing_view.go → web/signing.go → documents.go → documents.templ → router.go.

1. internal/handlers/signing.go (naujas) — InviteSigners ir parseEmails. Valdiklis — transakcija gyvai:

tx, err := h.Pool.Begin(r.Context())
// ...
defer tx.Rollback(context.Background()) // nieko nedaro po sėkmingo Commit
q := h.Queries.WithTx(tx)               // tie patys užklausų metodai, susieti su tx

for _, addr := range emails {
	raw, hash, err := auth.GenerateToken()          // raw → nuoroda, hash → eilutė
	q.CreateSigner(r.Context(), db.CreateSignerParams{ /* ...TokenHash: hash... */ })
	invites = append(invites, invite{email: addr, link: h.Cfg.BaseURL + "/sign/" + raw})
}
q.MarkDocumentSent(r.Context(), /* ... */)
tx.Commit(r.Context())

defer tx.Rollback — apsaugos tinklas: jei bet kuris žingsnis grįžta anksti, atšaukimas suveikia ir niekas neįrašoma; po sėkmingo Commit atšaukimas nieko nedaro. El. laiškai apdorojami ir siunčiami po commit, tad konsolės siuntėjas spausdina nuorodas tik tikrai išsiųstam dokumentui. parseEmails suskaido teksto lauką (nauja eilutė/kablelis/tarpas), normalizuoja, patikrina ir pašalina dublikatus; tuščias ar visai neteisingas sąrašas iš naujo atvaizduoja detalės puslapį su klaida, o ne siunčia.

2. internal/handlers/signing_view.go (naujas) — viewSigner atvaizduoja db.Signer į web.SignerView, o viewSigners sudaro SignerRoster (viso + pasirašiusiųjų skaičius). Pasirašymo būsenos laukai sujungti dabar; jie lieka tušti, kol kas nors pasirašys kitą pamoką.

3. internal/web/signing.go (naujas) — SignerView ir SignerRoster rodinio struktūros. Paprastos eilutės, jokio pgtype.

4. internal/handlers/documents.go (keitimas) — ViewDocument dabar deleguoja naujam renderDocumentDetail, kuris įkelia pasirašytojų sąrašą ir atvaizduoja detalės puslapį. Ir peržiūros maršrutas, ir nepavykęs kvietimas atvaizduoja per šį vieną kelią.

5. internal/web/documents.templ (keitimas) — DocumentDetail įgyja du parametrus (roster, errMsg) ir du skyrius: kvietimo formą, kol dokumentas juodraštis, ir pasirašytojų sąrašą, kai jis išsiųstas.

6. internal/handlers/router.go (keitimas) — vienas maršrutas autentifikuotoje grupėje: pr.Post("/documents/{id}/invite", h.InviteSigners).

Patikra — perseeduok, paleisk, prisijunk, atverk juodraščio detalės puslapį:

Invite signers forma jau ten. Įvesk du adresus (po vieną eilutėje) ir Send for signature.
Puslapis persikrauna rodydamas dokumentą kaip sent, su Signers (0 of 2 signed) sąrašu — abu pending.
Dev pašto siuntėjas atspausdino kiekvieną pasirašymo nuorodą į terminalą:

────────────────────────────────────────────────────────
To:      alice@example.com
Subject: Please sign "contract.pdf"

You've been invited to sign "contract.pdf" on SignFlow.

Open your signing link (valid 30 days):
http://localhost:8080/sign/9f3b2c...e1
────────────────────────────────────────────────────────

Patvirtink, kad DB saugo tik maišas ir kad kvietimas buvo atominis (dokumentas sent ir abi pasirašytojų eilutės yra):

$ psql "$DATABASE_URL" -c "select email, status, left(token_hash,16) as token_hash from signers;"
      email        | status  |    token_hash
-------------------+---------+------------------
 alice@example.com | pending | 3a7f9c2b1e0d4f6a
 bob@example.com   | pending | c1d2e3f4a5b6c7d8

Neapdorotas žetonas gyvena tik išsiųstoje nuorodoje; eilutė laiko jo SHA-256. Tos nuorodos atvėrimas — kita pamoka.

signing.go SUKURTI

Sukurk šį failą kataloge internal/handlers/

package handlers

import (
	"context"
	"errors"
	"fmt"
	"net/http"
	"strings"
	"time"

	"github.com/jackc/pgx/v5"
	"github.com/jackc/pgx/v5/pgtype"

	"github.com/programuoki/signflow/internal/auth"
	"github.com/programuoki/signflow/internal/db"
	"github.com/programuoki/signflow/internal/email"
)

// signerLinkTTL bounds how long a signing link is valid. Signers take days, not
// minutes, so this is generous — but it's still bounded, so a leaked link isn't
// useful forever.
const signerLinkTTL = 30 * 24 * time.Hour

// InviteSigners creates signer rows for a draft, flips it draft -> sent, and
// emails each signer their tokened link. All DB writes happen in one transaction.
func (h *Handlers) InviteSigners(w http.ResponseWriter, r *http.Request) {
	user := mustUser(r)
	id, ok := parseUUID(chiURLParam(r, "id"))
	if !ok {
		http.NotFound(w, r)
		return
	}
	doc, err := h.Queries.GetDocumentForOwner(r.Context(), db.GetDocumentForOwnerParams{ID: id, OwnerID: user.ID})
	if errors.Is(err, pgx.ErrNoRows) {
		http.NotFound(w, r)
		return
	}
	if err != nil {
		h.serverError(w, r, "get document", err)
		return
	}
	if doc.Status != "draft" {
		http.Error(w, "signers can only be invited while the document is a draft", http.StatusUnprocessableEntity)
		return
	}

	emails := parseEmails(r.FormValue("emails"))
	if len(emails) == 0 {
		h.renderDocumentDetail(w, r, doc, "Enter at least one valid email address.")
		return
	}

	// One transaction: create every signer + flip the document to sent. If any
	// insert fails, nothing is committed and the document stays a draft.
	type invite struct{ email, link string }
	var invites []invite

	tx, err := h.Pool.Begin(r.Context())
	if err != nil {
		h.serverError(w, r, "begin tx", err)
		return
	}
	defer tx.Rollback(context.Background())
	q := h.Queries.WithTx(tx)

	for _, addr := range emails {
		raw, hash, err := auth.GenerateToken()
		if err != nil {
			h.serverError(w, r, "generate token", err)
			return
		}
		if _, err := q.CreateSigner(r.Context(), db.CreateSignerParams{
			DocumentID: doc.ID,
			Email:      addr,
			TokenHash:  hash,
			ExpiresAt:  pgtype.Timestamptz{Time: time.Now().Add(signerLinkTTL), Valid: true},
		}); err != nil {
			h.serverError(w, r, "create signer", err)
			return
		}
		invites = append(invites, invite{email: addr, link: h.Cfg.BaseURL + "/sign/" + raw})
	}

	if _, err := q.MarkDocumentSent(r.Context(), db.MarkDocumentSentParams{ID: doc.ID, OwnerID: user.ID}); err != nil {
		h.serverError(w, r, "mark sent", err)
		return
	}
	if err := tx.Commit(r.Context()); err != nil {
		h.serverError(w, r, "commit", err)
		return
	}

	// Send the links after the DB is committed (console sender prints them).
	for _, inv := range invites {
		text := fmt.Sprintf(
			"You've been invited to sign \"%s\" on SignFlow.\n\n"+
				"Open your signing link (valid 30 days):\n%s\n",
			doc.Filename, inv.link)
		if err := h.Mailer.Send(r.Context(), email.Message{
			To:      inv.email,
			Subject: fmt.Sprintf("Please sign \"%s\"", doc.Filename),
			Text:    text,
			HTML:    fmt.Sprintf(`<p>You've been invited to sign <strong>%s</strong>.</p><p><a href="%s">Open your signing link</a> (valid 30 days).</p>`, doc.Filename, inv.link),
		}); err != nil {
			h.Log.Error("send signer invite", "err", err, "to", inv.email)
		}
	}
	h.Log.Info("document sent for signature", "id", doc.ID.String(), "signers", len(invites))

	http.Redirect(w, r, "/documents/"+doc.ID.String(), http.StatusSeeOther)
}

// parseEmails splits a textarea of emails (newline/comma separated), normalizes,
// validates, and de-duplicates while preserving order.
func parseEmails(raw string) []string {
	fields := strings.FieldsFunc(raw, func(r rune) bool {
		return r == '\n' || r == '\r' || r == ',' || r == ';' || r == ' ' || r == '\t'
	})
	seen := map[string]bool{}
	var out []string
	for _, f := range fields {
		addr := normalizeEmail(f)
		if addr == "" || seen[addr] || !validEmail(addr) {
			continue
		}
		seen[addr] = true
		out = append(out, addr)
	}
	return out
}

signing_view.go SUKURTI

Sukurk šį failą kataloge internal/handlers/

package handlers

import (
	"github.com/programuoki/signflow/internal/db"
	"github.com/programuoki/signflow/internal/web"
)

func viewSigner(s db.Signer) web.SignerView {
	v := web.SignerView{
		Email:    s.Email,
		Status:   s.Status,
		IsSigned: s.Status == "signed",
	}
	if s.SignedName != nil {
		v.SignedName = *s.SignedName
	}
	if s.SignedAt.Valid {
		v.SignedAt = s.SignedAt.Time.Format("2006-01-02 15:04 MST")
	}
	if s.SignedDocHash != nil {
		v.SignedDocHash = *s.SignedDocHash
	}
	return v
}

func viewSigners(signers []db.Signer, doc db.Document) web.SignerRoster {
	roster := web.SignerRoster{Total: len(signers)}
	for _, s := range signers {
		sv := viewSigner(s)
		// Flag any signature made against a different hash than the file now
		// holds — extra tamper visibility on the roster.
		if sv.IsSigned {
			roster.Signed++
			sv.HashMatchesNow = sv.SignedDocHash == doc.FileHash
		}
		roster.Signers = append(roster.Signers, sv)
	}
	return roster
}

signing.go SUKURTI

Sukurk šį failą kataloge internal/web/

package web

// SignerView is one row in the signer roster / a signer's own signed state.
type SignerView struct {
	Email         string
	Status        string
	IsSigned      bool
	SignedName    string
	SignedAt      string
	SignedDocHash string
	// HashMatchesNow is true when this signature's hash still equals the file's
	// current stored hash (i.e. the file wasn't changed after they signed).
	HashMatchesNow bool
}

// SignerRoster is the owner-facing summary of who has and hasn't signed.
type SignerRoster struct {
	Signers []SignerView
	Total   int
	Signed  int
}

documents.go MODIFIKUOTI 14 eilučių pakeista

Redaguok šį failą kataloge internal/handlers/

package handlers

import (
	"errors"
	"fmt"
	"io"
	"net/http"
	"net/url"
	"strings"

	"github.com/jackc/pgx/v5"
	"github.com/jackc/pgx/v5/pgtype"

	"github.com/programuoki/signflow/internal/db"
	"github.com/programuoki/signflow/internal/web"
)

// Dashboard lists the signed-in user's documents.
func (h *Handlers) Dashboard(w http.ResponseWriter, r *http.Request) {
	user := mustUser(r)
	docs, err := h.Queries.ListDocumentsByOwner(r.Context(), user.ID)
	if err != nil {
		h.serverError(w, r, "list documents", err)
		return
	}
	render(w, r, http.StatusOK, web.Dashboard(h.nav(r), viewDocuments(docs)))
}

// UploadDocument accepts a multipart file, hashes and stores it, and records it
// as a draft owned by the current user.
func (h *Handlers) UploadDocument(w http.ResponseWriter, r *http.Request) {
	user := mustUser(r)

	// Cap the request body. +1KiB slack covers multipart field overhead so a
	// file exactly at the limit still succeeds.
	r.Body = http.MaxBytesReader(w, r.Body, h.Cfg.MaxUploadBytes+1024)

	file, header, err := r.FormFile("file")
	if err != nil {
		// Covers both "no file" and "too large" (MaxBytesReader error).
		h.Log.Warn("upload rejected", "err", err, "user", user.Email)
		http.Error(w, "upload failed: file missing or too large", http.StatusRequestEntityTooLarge)
		return
	}
	defer file.Close()

	if header.Size == 0 {
		http.Error(w, "upload failed: empty file", http.StatusBadRequest)
		return
	}

	contentType := header.Header.Get("Content-Type")
	if contentType == "" {
		contentType = "application/octet-stream"
	}

	// The store hashes while it writes — the file is never fully in memory.
	key, size, hash, err := h.Store.Save(r.Context(), file)
	if err != nil {
		h.serverError(w, r, "store file", err)
		return
	}

	doc, err := h.Queries.CreateDocument(r.Context(), db.CreateDocumentParams{
		OwnerID:     user.ID,
		Filename:    sanitizeFilename(header.Filename),
		ContentType: contentType,
		Size:        size,
		FileHash:    hash,
		StorageKey:  key,
	})
	if err != nil {
		_ = h.Store.Delete(r.Context(), key) // don't orphan the blob
		h.serverError(w, r, "create document", err)
		return
	}
	h.Log.Info("document uploaded", "id", doc.ID.String(), "owner", user.Email, "size", size, "sha256", hash)

	h.respondWithDocList(w, r, user)
}

// ViewDocument renders a single document's detail page. Owner only: ownedDocument
// enforces that in the query, returning 404 for anything the user doesn't own.
func (h *Handlers) ViewDocument(w http.ResponseWriter, r *http.Request) {
	doc, ok := h.ownedDocument(w, r)
	if !ok {
		return
	}
	h.renderDocumentDetail(w, r, doc, "")
}

// renderDocumentDetail loads the signer roster and renders the owner detail page,
// optionally with an inline error (e.g. bad invite input).
func (h *Handlers) renderDocumentDetail(w http.ResponseWriter, r *http.Request, doc db.Document, errMsg string) {
	signers, err := h.Queries.ListSignersByDocument(r.Context(), doc.ID)
	if err != nil {
		h.serverError(w, r, "list signers", err)
		return
	}
	render(w, r, http.StatusOK, web.DocumentDetail(
		h.nav(r), viewDocument(doc), viewSigners(signers, doc), errMsg,
	))
}

// DownloadDocument streams the stored file back with its original name (owner only).
func (h *Handlers) DownloadDocument(w http.ResponseWriter, r *http.Request) {
	doc, ok := h.ownedDocument(w, r)
	if !ok {
		return
	}
	rc, err := h.Store.Open(r.Context(), doc.StorageKey)
	if err != nil {
		h.serverError(w, r, "open file", err)
		return
	}
	defer rc.Close()

	safe := sanitizeFilename(doc.Filename)
	w.Header().Set("Content-Type", doc.ContentType)
	w.Header().Set("Content-Length", fmt.Sprintf("%d", doc.Size))
	// Provide both a plain ASCII filename and a UTF-8 one per RFC 6266.
	w.Header().Set("Content-Disposition",
		fmt.Sprintf("attachment; filename=%q; filename*=UTF-8''%s", safe, url.PathEscape(doc.Filename)))
	if _, err := io.Copy(w, rc); err != nil {
		h.Log.Warn("stream download", "err", err, "id", doc.ID.String())
	}
}

// DeleteDocument deletes a draft the user owns. Non-drafts are refused — the
// first real business rule: once a document is sent, its record is immutable.
func (h *Handlers) DeleteDocument(w http.ResponseWriter, r *http.Request) {
	user := mustUser(r)
	id, ok := parseUUID(chiURLParam(r, "id"))
	if !ok {
		http.NotFound(w, r)
		return
	}

	doc, err := h.Queries.GetDocumentForOwner(r.Context(), db.GetDocumentForOwnerParams{ID: id, OwnerID: user.ID})
	if errors.Is(err, pgx.ErrNoRows) {
		http.NotFound(w, r) // not owned / not found — don't leak which
		return
	}
	if err != nil {
		h.serverError(w, r, "get document", err)
		return
	}
	if doc.Status != "draft" {
		http.Error(w, "only draft documents can be deleted", http.StatusUnprocessableEntity)
		return
	}

	// The query is the real guard: it filters owner_id AND status='draft', so even
	// without the check above a sent or foreign document deletes zero rows.
	n, err := h.Queries.DeleteDraftDocument(r.Context(), db.DeleteDraftDocumentParams{ID: id, OwnerID: user.ID})
	if err != nil {
		h.serverError(w, r, "delete document", err)
		return
	}
	if n == 1 {
		// Best-effort blob cleanup; a leftover file is harmless.
		_ = h.Store.Delete(r.Context(), doc.StorageKey)
		h.Log.Info("document deleted", "id", doc.ID.String(), "owner", user.Email)
	}

	h.respondWithDocList(w, r, user)
}

// --- helpers ---

// ownedDocument loads the {id} document if the current user owns it, else writes
// a 404 and returns ok=false.
func (h *Handlers) ownedDocument(w http.ResponseWriter, r *http.Request) (db.Document, bool) {
	user := mustUser(r)
	id, ok := parseUUID(chiURLParam(r, "id"))
	if !ok {
		http.NotFound(w, r)
		return db.Document{}, false
	}
	doc, err := h.Queries.GetDocumentForOwner(r.Context(), db.GetDocumentForOwnerParams{ID: id, OwnerID: user.ID})
	if errors.Is(err, pgx.ErrNoRows) {
		http.NotFound(w, r)
		return db.Document{}, false
	}
	if err != nil {
		h.serverError(w, r, "get document", err)
		return db.Document{}, false
	}
	return doc, true
}

// respondWithDocList returns the refreshed list partial to HTMX callers, or
// redirects to the dashboard for a plain form post.
func (h *Handlers) respondWithDocList(w http.ResponseWriter, r *http.Request, user db.User) {
	if r.Header.Get("HX-Request") == "" {
		http.Redirect(w, r, "/dashboard", http.StatusSeeOther)
		return
	}
	docs, err := h.Queries.ListDocumentsByOwner(r.Context(), user.ID)
	if err != nil {
		h.serverError(w, r, "list documents", err)
		return
	}
	render(w, r, http.StatusOK, web.DocumentList(viewDocuments(docs)))
}

func mustUser(r *http.Request) db.User {
	u, _ := UserFrom(r.Context()) // routes are behind RequireAuth
	return u
}

func parseUUID(s string) (pgtype.UUID, bool) {
	var u pgtype.UUID
	if err := u.Scan(s); err != nil {
		return u, false
	}
	return u, u.Valid
}

// sanitizeFilename strips path separators and control characters so a filename
// can't traverse directories or inject headers.
func sanitizeFilename(name string) string {
	name = strings.ReplaceAll(name, "\\", "/")
	if i := strings.LastIndex(name, "/"); i >= 0 {
		name = name[i+1:]
	}
	name = strings.Map(func(rn rune) rune {
		if rn < 0x20 || rn == 0x7f || rn == '"' {
			return -1
		}
		return rn
	}, name)
	name = strings.TrimSpace(name)
	if name == "" {
		return "document"
	}
	return name
}

documents.templ MODIFIKUOTI 42 eilutės pakeistos

Redaguok šį failą kataloge internal/web/

package web

import "fmt"

// DocumentList is the swappable partial that HTMX refreshes after upload/delete.
// Its id="doc-list" is the hx-target the upload form swaps.
templ DocumentList(docs []DocumentView) {
	<section id="doc-list" class="card">
		<h2>Documents</h2>
		if len(docs) == 0 {
			<p class="muted">No documents yet. Upload one above to get started.</p>
		} else {
			<table class="table">
				<thead>
					<tr>
						<th>Name</th>
						<th>Status</th>
						<th>Size</th>
						<th>Uploaded</th>
						<th></th>
					</tr>
				</thead>
				<tbody>
					for _, d := range docs {
						@documentRow(d)
					}
				</tbody>
			</table>
		}
	</section>
}

templ documentRow(d DocumentView) {
	<tr>
		<td><a href={ templ.SafeURL("/documents/" + d.ID) }>{ d.Filename }</a></td>
		<td><span class={ "pill", "pill-" + d.Status }>{ d.Status }</span></td>
		<td>{ d.SizeHuman }</td>
		<td>{ d.CreatedAt }</td>
		<td class="row-actions">
			<a class="btn btn-ghost btn-sm" href={ templ.SafeURL("/documents/" + d.ID) }>View</a>
			if d.IsDraft {
				<button
					class="btn btn-danger btn-sm"
					hx-post={ "/documents/" + d.ID + "/delete" }
					hx-target="#doc-list"
					hx-swap="outerHTML"
					hx-confirm={ fmt.Sprintf("Delete draft %q? This can't be undone.", d.Filename) }
				>Delete</button>
			}
		</td>
	</tr>
}

// DocumentDetail shows a document's metadata and integrity hash, with download
// and (while it is a draft) delete. A draft can invite signers; once sent, the
// signer roster is shown instead.
templ DocumentDetail(nav Nav, d DocumentView, roster SignerRoster, errMsg string) {
	@Layout(d.Filename, nav) {
		<p><a href="/dashboard">← Back to documents</a></p>
		<section class="card">
			<div class="doc-head">
				<h1>{ d.Filename }</h1>
				<span class={ "pill", "pill-" + d.Status }>{ d.Status }</span>
			</div>
			<dl class="meta">
				<dt>Type</dt>
				<dd>{ d.ContentType }</dd>
				<dt>Size</dt>
				<dd>{ d.SizeHuman }</dd>
				<dt>Uploaded</dt>
				<dd>{ d.CreatedAt }</dd>
				<dt>SHA-256</dt>
				<dd><code class="hash">{ d.FileHash }</code></dd>
			</dl>
			<div class="cta-row">
				<a class="btn btn-primary" href={ templ.SafeURL("/documents/" + d.ID + "/download") }>Download</a>
				if d.IsDraft {
					<form method="post" action={ templ.SafeURL("/documents/" + d.ID + "/delete") } class="inline-form">
						@authCSRF(nav.CSRFToken)
						<button class="btn btn-danger" type="submit">Delete draft</button>
					</form>
				}
			</div>
		</section>
		if d.IsDraft {
			<section class="card">
				<h2>Invite signers</h2>
				<p class="muted">Enter one or more email addresses. Sending will move this
					document from <em>draft</em> to <em>sent</em> and email each signer a
					private signing link.</p>
				if errMsg != "" {
					<div class="flash flash-error">{ errMsg }</div>
				}
				<form method="post" action={ templ.SafeURL("/documents/" + d.ID + "/invite") } class="form">
					@authCSRF(nav.CSRFToken)
					<div class="field">
						<label for="emails">Signer emails (one per line, or comma-separated)</label>
						<textarea id="emails" name="emails" rows="3" placeholder="alice@example.com&#10;bob@example.com" required></textarea>
					</div>
					<button class="btn btn-primary" type="submit">Send for signature</button>
				</form>
			</section>
		} else {
			<section class="card">
				<h2>Signers <span class="muted">({ fmt.Sprintf("%d of %d signed", roster.Signed, roster.Total) })</span></h2>
				<table class="table">
					<thead>
						<tr>
							<th>Email</th>
							<th>Status</th>
						</tr>
					</thead>
					<tbody>
						for _, s := range roster.Signers {
							<tr>
								<td>{ s.Email }</td>
								<td><span class={ "pill", "pill-" + s.Status }>{ s.Status }</span></td>
							</tr>
						}
					</tbody>
				</table>
			</section>
		}
	}
}

router.go MODIFIKUOTI 1 eilutė pakeista

Redaguok šį failą kataloge internal/handlers/

package handlers

import (
	"io/fs"
	"net/http"

	"github.com/go-chi/chi/v5"
	"github.com/go-chi/chi/v5/middleware"
	"github.com/gorilla/csrf"
)

// Router builds the Chi router with the middleware stack and all routes.
//
// csrfKey must be 32 bytes; it authenticates the CSRF token cookie.
func (h *Handlers) Router(staticFS fs.FS, csrfKey []byte) http.Handler {
	r := chi.NewRouter()

	// Base middleware, outermost first.
	r.Use(middleware.RequestID)
	r.Use(middleware.RealIP)
	r.Use(middleware.Logger)    // request logging
	r.Use(middleware.Recoverer) // turn panics into 500s instead of crashing

	// In dev we serve plaintext HTTP on localhost. gorilla/csrf otherwise assumes
	// TLS and enforces a strict Origin/Referer check that rejects http:// origins.
	// Marking dev requests plaintext relaxes that ONE check while keeping the
	// token check. Production (HTTPS at Railway's edge) is NOT marked, so it keeps
	// the full strict-origin protection.
	if !h.Cfg.IsProd() {
		r.Use(func(next http.Handler) http.Handler {
			return http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {
				next.ServeHTTP(w, csrf.PlaintextHTTPRequest(req))
			})
		})
	}

	// CSRF: enforced on all unsafe methods (POST/PUT/PATCH/DELETE). Safe methods
	// pass through but get the token cookie set so forms can embed it. The field
	// name matches the hidden input our templates render.
	csrfMW := csrf.Protect(
		csrfKey,
		csrf.Secure(h.Cfg.IsProd()),
		csrf.Path("/"),
		csrf.SameSite(csrf.SameSiteLaxMode),
		csrf.FieldName("gorilla.csrf.Token"),
	)
	r.Use(csrfMW)

	// Resolve the session cookie into the request context for every route.
	r.Use(h.LoadUser)

	// Static assets (CSS, vendored htmx), served from the embedded FS.
	r.Handle("/static/*", http.StripPrefix("/static/", http.FileServer(http.FS(staticFS))))

	// Public routes.
	r.Get("/", h.Home)
	r.Get("/healthz", h.Health)

	// Auth routes.
	r.Get("/register", h.RegisterForm)
	r.Post("/register", h.Register)
	r.Get("/login", h.LoginForm)
	r.Post("/login", h.Login)
	r.Post("/logout", h.Logout)
	r.Get("/forgot", h.ForgotForm)
	r.Post("/forgot", h.Forgot)
	r.Get("/reset/{token}", h.ResetForm)
	r.Post("/reset/{token}", h.Reset)

	// Authenticated routes.
	r.Group(func(pr chi.Router) {
		pr.Use(h.RequireAuth)
		pr.Get("/dashboard", h.Dashboard)
		pr.Post("/documents", h.UploadDocument)
		pr.Get("/documents/{id}", h.ViewDocument)
		pr.Get("/documents/{id}/download", h.DownloadDocument)
		pr.Post("/documents/{id}/delete", h.DeleteDocument)
		pr.Post("/documents/{id}/invite", h.InviteSigners)
	})

	return r
}