Login, logout, and middleware

Code

Login, logout, the protected dashboard

Now bring it alive. Five files as tabs, dependency order: dashboard.templ → auth.templ → auth.go → handlers.go → router.go (the protected page, the login form, the handlers, then the wiring). Four are new or modified from lesson 4.

1. internal/web/dashboard.templ (new) — the members-only page. It just greets nav.Email for now; the documents phase fills it in.

2. internal/web/auth.templ (modify) — Register gains the nav parameter, and a Login template joins it (email + password, one generic error slot).

3. internal/handlers/auth.go (modify) — the heart of the lesson:

func (h *Handlers) nav(r *http.Request) web.Nav { /* UserFrom → {LoggedIn, Email} */ }

func (h *Handlers) Login(w, r) {
	user, err := h.Queries.GetUserByEmail(...)         // unknown email → invalid()
	if !auth.CheckPassword(user.PasswordHash, pw) { invalid(); return }  // wrong pw → invalid()
	h.Sessions.Create(r.Context(), w, user.ID)          // same call register makes
	http.Redirect(w, r, "/dashboard", http.StatusSeeOther)
}

func (h *Handlers) Logout(w, r) {
	h.Sessions.Destroy(r.Context(), w, r)               // ← the one DELETE
	http.Redirect(w, r, "/", http.StatusSeeOther)
}

nav() is new; Register now threads h.nav(r) and redirects to /dashboard; Dashboard renders the protected page. invalid() is the single generic error.

4. internal/handlers/handlers.go (modify) — Home gains one branch: a signed-in visitor is redirected to /dashboard instead of seeing the public page.

5. internal/handlers/router.go (modify) — three changes: r.Use(h.LoadUser) (annotate every request), the login/logout routes, and the authenticated group:

r.Group(func(pr chi.Router) {
	pr.Use(h.RequireAuth)
	pr.Get("/dashboard", h.Dashboard)
})

Verify. templ generate && go run ./cmd/signflow, then:

Protected route, logged out. Visit http://localhost:8080/dashboard → you're bounced to /login. RequireAuth works.
Log in. Use the account from lesson 4. You land on the dashboard, and the header now shows your email and a Log out button — LoadUser resolved your cookie, nav rendered the state.

Log out. Click it. Back to the public home page, header shows Log in / Register. And server-side:

$ psql signflow -c "SELECT count(*) FROM sessions;"
 count
-------
     0          ← the row is gone. That's revocation a JWT can't do.

Generic error. On /login, try a wrong password, then a nonexistent email. Both say "Invalid email or password." — identical, so neither reveals whether the account exists.

Gotcha (redirect after POST). Notice login/logout/register all end in http.StatusSeeOther (303) redirects, never rendering directly on the POST. That's the POST/redirect/GET pattern: it means a browser refresh re-requests the dashboard (a GET), not a re-submission of the login form. Without it, "reload" would replay the POST — a classic double-submit bug.

dashboard.templ CREATE

Create this file in internal/web/

package web

// Dashboard is the signed-in landing page. This lesson shows just enough to
// prove auth works; the documents phase fills it with the owner's documents.
templ Dashboard(nav Nav) {
	@Layout("Dashboard", nav) {
		<section class="hero">
			<h1>Welcome back</h1>
			<p class="lead">You're signed in as <strong>{ nav.Email }</strong>.</p>
		</section>
		<section class="card">
			<h2>Your documents</h2>
			<p class="muted">Document upload arrives in the documents phase. For now,
				auth is live: your session is stored server-side and this page is
				protected by <code>RequireAuth</code>.</p>
		</section>
	}
}

auth.templ MODIFY 23 lines changed

Edit this file in internal/web/

package web

templ Register(nav Nav, email, errMsg string) {
	@Layout("Register", nav) {
		<div class="card auth-card">
			<h1>Create your account</h1>
			if errMsg != "" {
				<div class="flash flash-error">{ errMsg }</div>
			}
			<form method="post" action="/register" class="form">
				<div class="field">
					<label for="email">Email</label>
					<input id="email" name="email" type="email" value={ email } required autofocus/>
				</div>
				<div class="field">
					<label for="password">Password</label>
					<input id="password" name="password" type="password" minlength="8" maxlength="64" required/>
				</div>
				<div class="field">
					<label for="confirm">Confirm password</label>
					<input id="confirm" name="confirm" type="password" minlength="8" maxlength="64" required/>
				</div>
				<button class="btn btn-primary" type="submit">Create account</button>
			</form>
			<p class="muted">Already have an account? <a href="/login">Log in</a>.</p>
		</div>
	}
}

templ Login(nav Nav, email, errMsg string) {
	@Layout("Log in", nav) {
		<div class="card auth-card">
			<h1>Log in</h1>
			if errMsg != "" {
				<div class="flash flash-error">{ errMsg }</div>
			}
			<form method="post" action="/login" class="form">
				<div class="field">
					<label for="email">Email</label>
					<input id="email" name="email" type="email" value={ email } required autofocus/>
				</div>
				<div class="field">
					<label for="password">Password</label>
					<input id="password" name="password" type="password" required/>
				</div>
				<button class="btn btn-primary" type="submit">Log in</button>
			</form>
			<p class="muted">No account? <a href="/register">Register</a>.</p>
		</div>
	}
}

auth.go MODIFY 67 lines changed

Edit this file in internal/handlers/

package handlers

import (
	"errors"
	"net/http"
	"net/mail"
	"strings"

	"github.com/jackc/pgx/v5"

	"github.com/programuoki/signflow/internal/auth"
	"github.com/programuoki/signflow/internal/db"
	"github.com/programuoki/signflow/internal/web"
)

// nav builds the per-request nav model (current user) for templates. A CSRF
// token joins it in lesson 6.
func (h *Handlers) nav(r *http.Request) web.Nav {
	n := web.Nav{}
	if u, ok := UserFrom(r.Context()); ok {
		n.LoggedIn = true
		n.Email = u.Email
	}
	return n
}

// --- Register ---

func (h *Handlers) RegisterForm(w http.ResponseWriter, r *http.Request) {
	render(w, r, http.StatusOK, web.Register(h.nav(r), "", ""))
}

func (h *Handlers) Register(w http.ResponseWriter, r *http.Request) {
	emailAddr := normalizeEmail(r.FormValue("email"))
	password := r.FormValue("password")
	confirm := r.FormValue("confirm")

	fail := func(msg string) {
		render(w, r, http.StatusUnprocessableEntity, web.Register(h.nav(r), emailAddr, msg))
	}

	if !validEmail(emailAddr) {
		fail("Please enter a valid email address.")
		return
	}
	if password != confirm {
		fail("Passwords do not match.")
		return
	}
	hash, err := auth.HashPassword(password)
	if errors.Is(err, auth.ErrPasswordLength) {
		fail("Password must be between 8 and 64 characters.")
		return
	}
	if err != nil {
		h.serverError(w, r, "hash password", err)
		return
	}

	// The UNIQUE constraint on email is the real guard; check first for a nice
	// message, and still handle the race by inspecting the insert error.
	if _, err := h.Queries.GetUserByEmail(r.Context(), emailAddr); err == nil {
		fail("That email is already registered. Try logging in.")
		return
	} else if !errors.Is(err, pgx.ErrNoRows) {
		h.serverError(w, r, "lookup user", err)
		return
	}

	user, err := h.Queries.CreateUser(r.Context(), db.CreateUserParams{
		Email:        emailAddr,
		PasswordHash: hash,
	})
	if err != nil {
		if isUniqueViolation(err) {
			fail("That email is already registered. Try logging in.")
			return
		}
		h.serverError(w, r, "create user", err)
		return
	}

	if err := h.Sessions.Create(r.Context(), w, user.ID); err != nil {
		h.serverError(w, r, "create session", err)
		return
	}
	h.Log.Info("user registered", "email", user.Email)
	http.Redirect(w, r, "/dashboard", http.StatusSeeOther)
}

// --- Login / Logout ---

func (h *Handlers) LoginForm(w http.ResponseWriter, r *http.Request) {
	render(w, r, http.StatusOK, web.Login(h.nav(r), "", ""))
}

func (h *Handlers) Login(w http.ResponseWriter, r *http.Request) {
	emailAddr := normalizeEmail(r.FormValue("email"))
	password := r.FormValue("password")

	// One generic message for every failure mode avoids leaking which emails
	// are registered.
	invalid := func() {
		render(w, r, http.StatusUnprocessableEntity, web.Login(h.nav(r), emailAddr, "Invalid email or password."))
	}

	user, err := h.Queries.GetUserByEmail(r.Context(), emailAddr)
	if errors.Is(err, pgx.ErrNoRows) {
		invalid()
		return
	}
	if err != nil {
		h.serverError(w, r, "lookup user", err)
		return
	}
	if !auth.CheckPassword(user.PasswordHash, password) {
		invalid()
		return
	}

	if err := h.Sessions.Create(r.Context(), w, user.ID); err != nil {
		h.serverError(w, r, "create session", err)
		return
	}
	h.Log.Info("user logged in", "email", user.Email)
	http.Redirect(w, r, "/dashboard", http.StatusSeeOther)
}

func (h *Handlers) Logout(w http.ResponseWriter, r *http.Request) {
	if err := h.Sessions.Destroy(r.Context(), w, r); err != nil {
		h.serverError(w, r, "destroy session", err)
		return
	}
	http.Redirect(w, r, "/", http.StatusSeeOther)
}

// --- Dashboard ---

func (h *Handlers) Dashboard(w http.ResponseWriter, r *http.Request) {
	render(w, r, http.StatusOK, web.Dashboard(h.nav(r)))
}

// --- helpers ---

func normalizeEmail(s string) string { return strings.ToLower(strings.TrimSpace(s)) }

func validEmail(s string) bool {
	if s == "" || len(s) > 254 {
		return false
	}
	_, err := mail.ParseAddress(s)
	return err == nil
}

handlers.go MODIFY 8 lines changed

Edit this file in internal/handlers/

// Package handlers holds the HTTP handlers. In this skeleton there is only the
// home page and a health check; later lessons add auth, documents, and signing.
package handlers

import (
	"log/slog"
	"net/http"

	"github.com/programuoki/signflow/internal/config"
	"github.com/programuoki/signflow/internal/db"
	"github.com/programuoki/signflow/internal/session"
	"github.com/programuoki/signflow/internal/web"
)

// Handlers bundles the dependencies every handler needs. Constructed once in
// main; its methods are registered on the router. It gains a Sessions manager
// here; the mailer arrives in lesson 7.
type Handlers struct {
	Cfg      config.Config
	Queries  *db.Queries
	Sessions *session.Manager
	Log      *slog.Logger
}

func New(cfg config.Config, q *db.Queries, sessions *session.Manager, log *slog.Logger) *Handlers {
	return &Handlers{Cfg: cfg, Queries: q, Sessions: sessions, Log: log}
}

// Home renders the landing page. A signed-in visitor is sent to their dashboard;
// otherwise we show the public landing page with a live user count.
func (h *Handlers) Home(w http.ResponseWriter, r *http.Request) {
	if _, ok := UserFrom(r.Context()); ok {
		http.Redirect(w, r, "/dashboard", http.StatusSeeOther)
		return
	}
	count, err := h.Queries.CountUsers(r.Context())
	if err != nil {
		h.serverError(w, r, "count users", err)
		return
	}
	render(w, r, http.StatusOK, web.Home(h.nav(r), count))
}

// Health is a liveness probe for Railway / uptime checks. It also pings the DB,
// so an unreachable database reports unhealthy rather than silently serving 500s.
func (h *Handlers) Health(w http.ResponseWriter, r *http.Request) {
	if _, err := h.Queries.CountUsers(r.Context()); err != nil {
		http.Error(w, "db unavailable", http.StatusServiceUnavailable)
		return
	}
	w.Header().Set("Content-Type", "text/plain")
	_, _ = w.Write([]byte("ok"))
}

// serverError logs the underlying error and returns a generic 500 to the client.
func (h *Handlers) serverError(w http.ResponseWriter, r *http.Request, msg string, err error) {
	h.Log.Error(msg, "err", err, "path", r.URL.Path)
	http.Error(w, "internal server error", http.StatusInternalServerError)
}

router.go MODIFY 15 lines changed

Edit this file in internal/handlers/

package handlers

import (
	"io/fs"
	"net/http"

	"github.com/go-chi/chi/v5"
	"github.com/go-chi/chi/v5/middleware"
)

// Router builds the Chi router with the middleware stack and all routes.
func (h *Handlers) Router(staticFS fs.FS) http.Handler {
	r := chi.NewRouter()

	// Base middleware, outermost first.
	r.Use(middleware.RequestID)
	r.Use(middleware.RealIP)
	r.Use(middleware.Logger)    // request logging
	r.Use(middleware.Recoverer) // turn panics into 500s instead of crashing

	// Resolve the session cookie into the request context for every route.
	r.Use(h.LoadUser)

	// Static assets (CSS, vendored htmx), served from the embedded FS.
	r.Handle("/static/*", http.StripPrefix("/static/", http.FileServer(http.FS(staticFS))))

	// Public routes.
	r.Get("/", h.Home)
	r.Get("/healthz", h.Health)

	// Auth routes.
	r.Get("/register", h.RegisterForm)
	r.Post("/register", h.Register)
	r.Get("/login", h.LoginForm)
	r.Post("/login", h.Login)
	r.Post("/logout", h.Logout)

	// Authenticated routes.
	r.Group(func(pr chi.Router) {
		pr.Use(h.RequireAuth)
		pr.Get("/dashboard", h.Dashboard)
	})

	return r
}