Prisijungimas, atsijungimas, apsaugotas skydelis

Dabar viską atgaivink. Penki failai kaip skirtukai, priklausomybių tvarka: dashboard.templ → auth.templ → auth.go → handlers.go → router.go (apsaugotas puslapis, prisijungimo forma, apdorotojai, tada sujungimas). Keturi — nauji arba pakeisti nuo 4 pamokos.

1. internal/web/dashboard.templ (naujas) — tik nariams skirtas puslapis. Kol kas jis tik pasveikina nav.Email; dokumentų fazė jį užpildo.

2. internal/web/auth.templ (modify) — Register gauna nav parametrą, ir prisijungia Login šablonas (el. paštas + slaptažodis, viena bendra klaidos vieta).

3. internal/handlers/auth.go (modify) — pamokos širdis:

func (h *Handlers) nav(r *http.Request) web.Nav { /* UserFrom → {LoggedIn, Email} */ }

func (h *Handlers) Login(w, r) {
	user, err := h.Queries.GetUserByEmail(...)         // nežinomas el. paštas → invalid()
	if !auth.CheckPassword(user.PasswordHash, pw) { invalid(); return }  // blogas slaptažodis → invalid()
	h.Sessions.Create(r.Context(), w, user.ID)          // tas pats kvietimas kaip registracijoje
	http.Redirect(w, r, "/dashboard", http.StatusSeeOther)
}

func (h *Handlers) Logout(w, r) {
	h.Sessions.Destroy(r.Context(), w, r)               // ← tas vienas DELETE
	http.Redirect(w, r, "/", http.StatusSeeOther)
}

nav() naujas; Register dabar perduoda h.nav(r) ir nukreipia į /dashboard; Dashboard atvaizduoja apsaugotą puslapį. invalid() — ta viena bendra klaida.

4. internal/handlers/handlers.go (modify) — Home gauna vieną šaką: prisijungęs lankytojas nukreipiamas į /dashboard, o ne mato viešą puslapį.

5. internal/handlers/router.go (modify) — trys pakeitimai: r.Use(h.LoadUser) (anotuoja kiekvieną užklausą), login/logout maršrutai ir autentifikuota grupė:

r.Group(func(pr chi.Router) {
	pr.Use(h.RequireAuth)
	pr.Get("/dashboard", h.Dashboard)
})

Patikrink. templ generate && go run ./cmd/signflow, tada:

Apsaugotas maršrutas, atsijungus. Aplankyk http://localhost:8080/dashboard → būsi nublokštas į /login. RequireAuth veikia.
Prisijunk. Naudok paskyrą iš 4 pamokos. Atsidursi skydelyje, o antraštė dabar rodo tavo el. paštą ir Log out mygtuką — LoadUser išsprendė slapuką, nav atvaizdavo būseną.

Atsijunk. Paspausk. Grįžti į viešą pradinį puslapį, antraštė rodo Log in / Register. Ir serveryje:

$ psql signflow -c "SELECT count(*) FROM sessions;"
 count
-------
     0          ← eilutės nebėra. Tai atšaukimas, kurio JWT negali.

Bendra klaida. /login bandyk blogą slaptažodį, tada neegzistuojantį el. paštą. Abu sako „Invalid email or password." — vienodai, tad nė vienas neatskleidžia, ar paskyra egzistuoja.

Spąstai (nukreipimas po POST). Pastebėk: prisijungimas/atsijungimas/registracija visi baigiasi http.StatusSeeOther (303) nukreipimais, niekada neatvaizduojant tiesiai per POST. Tai POST/redirect/GET šablonas: naršyklės perkrovimas iš naujo užklausia skydelio (GET), o ne pakartotinai pateikia prisijungimo formą. Be jo „perkrauti" pakartotų POST — klasikinė dvigubo pateikimo klaida.

dashboard.templ SUKURTI

Sukurk šį failą kataloge internal/web/

package web

// Dashboard is the signed-in landing page. This lesson shows just enough to
// prove auth works; the documents phase fills it with the owner's documents.
templ Dashboard(nav Nav) {
	@Layout("Dashboard", nav) {
		<section class="hero">
			<h1>Welcome back</h1>
			<p class="lead">You're signed in as <strong>{ nav.Email }</strong>.</p>
		</section>
		<section class="card">
			<h2>Your documents</h2>
			<p class="muted">Document upload arrives in the documents phase. For now,
				auth is live: your session is stored server-side and this page is
				protected by <code>RequireAuth</code>.</p>
		</section>
	}
}

auth.templ MODIFIKUOTI 23 eilutės pakeistos

Redaguok šį failą kataloge internal/web/

package web

templ Register(nav Nav, email, errMsg string) {
	@Layout("Register", nav) {
		<div class="card auth-card">
			<h1>Create your account</h1>
			if errMsg != "" {
				<div class="flash flash-error">{ errMsg }</div>
			}
			<form method="post" action="/register" class="form">
				<div class="field">
					<label for="email">Email</label>
					<input id="email" name="email" type="email" value={ email } required autofocus/>
				</div>
				<div class="field">
					<label for="password">Password</label>
					<input id="password" name="password" type="password" minlength="8" maxlength="64" required/>
				</div>
				<div class="field">
					<label for="confirm">Confirm password</label>
					<input id="confirm" name="confirm" type="password" minlength="8" maxlength="64" required/>
				</div>
				<button class="btn btn-primary" type="submit">Create account</button>
			</form>
			<p class="muted">Already have an account? <a href="/login">Log in</a>.</p>
		</div>
	}
}

templ Login(nav Nav, email, errMsg string) {
	@Layout("Log in", nav) {
		<div class="card auth-card">
			<h1>Log in</h1>
			if errMsg != "" {
				<div class="flash flash-error">{ errMsg }</div>
			}
			<form method="post" action="/login" class="form">
				<div class="field">
					<label for="email">Email</label>
					<input id="email" name="email" type="email" value={ email } required autofocus/>
				</div>
				<div class="field">
					<label for="password">Password</label>
					<input id="password" name="password" type="password" required/>
				</div>
				<button class="btn btn-primary" type="submit">Log in</button>
			</form>
			<p class="muted">No account? <a href="/register">Register</a>.</p>
		</div>
	}
}

auth.go MODIFIKUOTI 67 eilutės pakeistos

Redaguok šį failą kataloge internal/handlers/

package handlers

import (
	"errors"
	"net/http"
	"net/mail"
	"strings"

	"github.com/jackc/pgx/v5"

	"github.com/programuoki/signflow/internal/auth"
	"github.com/programuoki/signflow/internal/db"
	"github.com/programuoki/signflow/internal/web"
)

// nav builds the per-request nav model (current user) for templates. A CSRF
// token joins it in lesson 6.
func (h *Handlers) nav(r *http.Request) web.Nav {
	n := web.Nav{}
	if u, ok := UserFrom(r.Context()); ok {
		n.LoggedIn = true
		n.Email = u.Email
	}
	return n
}

// --- Register ---

func (h *Handlers) RegisterForm(w http.ResponseWriter, r *http.Request) {
	render(w, r, http.StatusOK, web.Register(h.nav(r), "", ""))
}

func (h *Handlers) Register(w http.ResponseWriter, r *http.Request) {
	emailAddr := normalizeEmail(r.FormValue("email"))
	password := r.FormValue("password")
	confirm := r.FormValue("confirm")

	fail := func(msg string) {
		render(w, r, http.StatusUnprocessableEntity, web.Register(h.nav(r), emailAddr, msg))
	}

	if !validEmail(emailAddr) {
		fail("Please enter a valid email address.")
		return
	}
	if password != confirm {
		fail("Passwords do not match.")
		return
	}
	hash, err := auth.HashPassword(password)
	if errors.Is(err, auth.ErrPasswordLength) {
		fail("Password must be between 8 and 64 characters.")
		return
	}
	if err != nil {
		h.serverError(w, r, "hash password", err)
		return
	}

	// The UNIQUE constraint on email is the real guard; check first for a nice
	// message, and still handle the race by inspecting the insert error.
	if _, err := h.Queries.GetUserByEmail(r.Context(), emailAddr); err == nil {
		fail("That email is already registered. Try logging in.")
		return
	} else if !errors.Is(err, pgx.ErrNoRows) {
		h.serverError(w, r, "lookup user", err)
		return
	}

	user, err := h.Queries.CreateUser(r.Context(), db.CreateUserParams{
		Email:        emailAddr,
		PasswordHash: hash,
	})
	if err != nil {
		if isUniqueViolation(err) {
			fail("That email is already registered. Try logging in.")
			return
		}
		h.serverError(w, r, "create user", err)
		return
	}

	if err := h.Sessions.Create(r.Context(), w, user.ID); err != nil {
		h.serverError(w, r, "create session", err)
		return
	}
	h.Log.Info("user registered", "email", user.Email)
	http.Redirect(w, r, "/dashboard", http.StatusSeeOther)
}

// --- Login / Logout ---

func (h *Handlers) LoginForm(w http.ResponseWriter, r *http.Request) {
	render(w, r, http.StatusOK, web.Login(h.nav(r), "", ""))
}

func (h *Handlers) Login(w http.ResponseWriter, r *http.Request) {
	emailAddr := normalizeEmail(r.FormValue("email"))
	password := r.FormValue("password")

	// One generic message for every failure mode avoids leaking which emails
	// are registered.
	invalid := func() {
		render(w, r, http.StatusUnprocessableEntity, web.Login(h.nav(r), emailAddr, "Invalid email or password."))
	}

	user, err := h.Queries.GetUserByEmail(r.Context(), emailAddr)
	if errors.Is(err, pgx.ErrNoRows) {
		invalid()
		return
	}
	if err != nil {
		h.serverError(w, r, "lookup user", err)
		return
	}
	if !auth.CheckPassword(user.PasswordHash, password) {
		invalid()
		return
	}

	if err := h.Sessions.Create(r.Context(), w, user.ID); err != nil {
		h.serverError(w, r, "create session", err)
		return
	}
	h.Log.Info("user logged in", "email", user.Email)
	http.Redirect(w, r, "/dashboard", http.StatusSeeOther)
}

func (h *Handlers) Logout(w http.ResponseWriter, r *http.Request) {
	if err := h.Sessions.Destroy(r.Context(), w, r); err != nil {
		h.serverError(w, r, "destroy session", err)
		return
	}
	http.Redirect(w, r, "/", http.StatusSeeOther)
}

// --- Dashboard ---

func (h *Handlers) Dashboard(w http.ResponseWriter, r *http.Request) {
	render(w, r, http.StatusOK, web.Dashboard(h.nav(r)))
}

// --- helpers ---

func normalizeEmail(s string) string { return strings.ToLower(strings.TrimSpace(s)) }

func validEmail(s string) bool {
	if s == "" || len(s) > 254 {
		return false
	}
	_, err := mail.ParseAddress(s)
	return err == nil
}

handlers.go MODIFIKUOTI 8 eilutės pakeistos

Redaguok šį failą kataloge internal/handlers/

// Package handlers holds the HTTP handlers. In this skeleton there is only the
// home page and a health check; later lessons add auth, documents, and signing.
package handlers

import (
	"log/slog"
	"net/http"

	"github.com/programuoki/signflow/internal/config"
	"github.com/programuoki/signflow/internal/db"
	"github.com/programuoki/signflow/internal/session"
	"github.com/programuoki/signflow/internal/web"
)

// Handlers bundles the dependencies every handler needs. Constructed once in
// main; its methods are registered on the router. It gains a Sessions manager
// here; the mailer arrives in lesson 7.
type Handlers struct {
	Cfg      config.Config
	Queries  *db.Queries
	Sessions *session.Manager
	Log      *slog.Logger
}

func New(cfg config.Config, q *db.Queries, sessions *session.Manager, log *slog.Logger) *Handlers {
	return &Handlers{Cfg: cfg, Queries: q, Sessions: sessions, Log: log}
}

// Home renders the landing page. A signed-in visitor is sent to their dashboard;
// otherwise we show the public landing page with a live user count.
func (h *Handlers) Home(w http.ResponseWriter, r *http.Request) {
	if _, ok := UserFrom(r.Context()); ok {
		http.Redirect(w, r, "/dashboard", http.StatusSeeOther)
		return
	}
	count, err := h.Queries.CountUsers(r.Context())
	if err != nil {
		h.serverError(w, r, "count users", err)
		return
	}
	render(w, r, http.StatusOK, web.Home(h.nav(r), count))
}

// Health is a liveness probe for Railway / uptime checks. It also pings the DB,
// so an unreachable database reports unhealthy rather than silently serving 500s.
func (h *Handlers) Health(w http.ResponseWriter, r *http.Request) {
	if _, err := h.Queries.CountUsers(r.Context()); err != nil {
		http.Error(w, "db unavailable", http.StatusServiceUnavailable)
		return
	}
	w.Header().Set("Content-Type", "text/plain")
	_, _ = w.Write([]byte("ok"))
}

// serverError logs the underlying error and returns a generic 500 to the client.
func (h *Handlers) serverError(w http.ResponseWriter, r *http.Request, msg string, err error) {
	h.Log.Error(msg, "err", err, "path", r.URL.Path)
	http.Error(w, "internal server error", http.StatusInternalServerError)
}

router.go MODIFIKUOTI 15 eilučių pakeista

Redaguok šį failą kataloge internal/handlers/

package handlers

import (
	"io/fs"
	"net/http"

	"github.com/go-chi/chi/v5"
	"github.com/go-chi/chi/v5/middleware"
)

// Router builds the Chi router with the middleware stack and all routes.
func (h *Handlers) Router(staticFS fs.FS) http.Handler {
	r := chi.NewRouter()

	// Base middleware, outermost first.
	r.Use(middleware.RequestID)
	r.Use(middleware.RealIP)
	r.Use(middleware.Logger)    // request logging
	r.Use(middleware.Recoverer) // turn panics into 500s instead of crashing

	// Resolve the session cookie into the request context for every route.
	r.Use(h.LoadUser)

	// Static assets (CSS, vendored htmx), served from the embedded FS.
	r.Handle("/static/*", http.StripPrefix("/static/", http.FileServer(http.FS(staticFS))))

	// Public routes.
	r.Get("/", h.Home)
	r.Get("/healthz", h.Health)

	// Auth routes.
	r.Get("/register", h.RegisterForm)
	r.Post("/register", h.Register)
	r.Get("/login", h.LoginForm)
	r.Post("/login", h.Login)
	r.Post("/logout", h.Logout)

	// Authenticated routes.
	r.Group(func(pr chi.Router) {
		pr.Use(h.RequireAuth)
		pr.Get("/dashboard", h.Dashboard)
	})

	return r
}