Registracija nuo pradžios iki galo

Dabar registracija nuo pradžios iki galo. Šeši failai kaip skirtukai, priklausomybių tvarka: auth.templ → util.go → handlers.go → auth.go → router.go → main.go (forma, pagalbininkas, struktūra, kuri gauna sesijų valdytoją, apdorotojas, maršrutai, sujungimas). Trys — pakeitimai; diff'ai perkelia 1–3 pamokas.

1. internal/web/auth.templ (naujas) — Register forma. Paprasti HTML laukai su minlength/maxlength, atitinkančiais 8–64 taisyklę. (Kol kas jokio CSRF lauko — 6 pamoka.)

2. internal/handlers/util.go (naujas) — vienas pagalbininkas, isUniqueViolation, atpažįstantis Postgres klaidą 23505 (unique-constraint), tad dublikato el. pašto lenktynės tampa draugišku pranešimu, o ne 500.

3. internal/handlers/handlers.go (modify) — Handlers struktūra gauna Sessions *session.Manager lauką, New jį ima, ir atsiranda mažas serverError pagalbininkas (užloguoja tikrą klaidą, grąžina bendrą 500). Home ir Health nepakito.

4. internal/handlers/auth.go (naujas) — RegisterForm (atvaizduoja formą) ir Register, kuris yra visas srautas:

if !validEmail(emailAddr) { fail("Please enter a valid email address."); return }
if password != confirm    { fail("Passwords do not match."); return }
hash, err := auth.HashPassword(password)   // bcrypt; ErrPasswordLength → draugiškas pranešimas
// dublikato patikra (gražus pranešimas) + CreateUser (lenktynes tvarko isUniqueViolation)
h.Sessions.Create(r.Context(), w, user.ID) // ← išduoda sesiją + nustato slapuką
http.Redirect(w, r, "/", http.StatusSeeOther)

Nukreipimas kol kas veda į / — skydelis prisijungusiems yra 5 pamokos darbas.

5. internal/handlers/router.go (modify) — du maršrutai: GET /register (forma) ir POST /register (apdorotojas).

6. cmd/signflow/main.go (modify) — sukurk valdytoją ir paduok jį:

sessions := session.NewManager(queries, cfg.IsProd())
h := handlers.New(cfg, queries, sessions, log)

Patikrink. Sugeneruok ir paleisk:

sqlc generate && templ generate
go run ./cmd/signflow

Atsidaryk http://localhost:8080/register, sukurk paskyrą (pvz. you@example.com / slaptažodis 8–64 simboliai). Būsi nukreiptas namo, o vartotojų skaičius paauga. Dabar apžiūrėk, kas nutiko:

$ psql signflow -c "SELECT email, left(password_hash, 7) AS hash_prefix FROM users;"
      email       | hash_prefix
------------------+-------------
 you@example.com  | $2a$12$          ← bcrypt, cost 12 ($2a$12$…)

$ psql signflow -c "SELECT left(token_hash, 12) AS stored, expires_at > now() AS live FROM sessions;"
    stored    | live
--------------+------
 3f9a1c2e...  | t             ← SHA-256 MAIŠA, ne slapuko žetonas

O pats slapukas neša savo vėliavas:

$ curl -si -c /dev/null -X POST localhost:8080/register \
    -d 'email=x@y.co&password=password123&confirm=password123' | grep -i set-cookie
Set-Cookie: signflow_session=Xa9...; Path=/; Expires=...; HttpOnly; SameSite=Lax

HttpOnly ir SameSite=Lax yra; Secure nėra, nes esam ant http dev aplinkoje (produkcijoje jis atsiranda). Slapuko žetonas nėra duomenų bazėje saugoma reikšmė — DB turi tik jo SHA-256.

Spąstai (bcrypt 72 baitų skardis). Pabandyk registruotis su 100 simbolių slaptažodžiu: gausi „Password must be between 8 and 64 characters." — atmesta mūsų ribos, prieš tai, kai bcrypt tyliai ignoruotų viską po 72-o baito. Be ribos, du skirtingi ilgi slaptažodžiai, sutampantys pirmais 72 baitais, būtų sukeičiami prisijungiant. Tvora svarbi.

auth.templ SUKURTI

Sukurk šį failą kataloge internal/web/

package web

templ Register(nav Nav, email, errMsg string) {
	@Layout("Register", nav) {
		<div class="card auth-card">
			<h1>Create your account</h1>
			if errMsg != "" {
				<div class="flash flash-error">{ errMsg }</div>
			}
			<form method="post" action="/register" class="form">
				<div class="field">
					<label for="email">Email</label>
					<input id="email" name="email" type="email" value={ email } required autofocus/>
				</div>
				<div class="field">
					<label for="password">Password</label>
					<input id="password" name="password" type="password" minlength="8" maxlength="64" required/>
				</div>
				<div class="field">
					<label for="confirm">Confirm password</label>
					<input id="confirm" name="confirm" type="password" minlength="8" maxlength="64" required/>
				</div>
				<button class="btn btn-primary" type="submit">Create account</button>
			</form>
			<p class="muted">Already have an account? <a href="/login">Log in</a>.</p>
		</div>
	}
}

util.go SUKURTI

Sukurk šį failą kataloge internal/handlers/

package handlers

import (
	"errors"

	"github.com/jackc/pgx/v5/pgconn"
)

// isUniqueViolation reports whether err is a Postgres unique-constraint error
// (SQLSTATE 23505), so we can turn a duplicate-email race into a friendly message.
func isUniqueViolation(err error) bool {
	var pgErr *pgconn.PgError
	return errors.As(err, &pgErr) && pgErr.Code == "23505"
}

handlers.go MODIFIKUOTI 15 eilučių pakeista

Redaguok šį failą kataloge internal/handlers/

// Package handlers holds the HTTP handlers. In this skeleton there is only the
// home page and a health check; later lessons add auth, documents, and signing.
package handlers

import (
	"log/slog"
	"net/http"

	"github.com/programuoki/signflow/internal/config"
	"github.com/programuoki/signflow/internal/db"
	"github.com/programuoki/signflow/internal/session"
	"github.com/programuoki/signflow/internal/web"
)

// Handlers bundles the dependencies every handler needs. Constructed once in
// main; its methods are registered on the router. It gains a Sessions manager
// here; the mailer arrives in lesson 7.
type Handlers struct {
	Cfg      config.Config
	Queries  *db.Queries
	Sessions *session.Manager
	Log      *slog.Logger
}

func New(cfg config.Config, q *db.Queries, sessions *session.Manager, log *slog.Logger) *Handlers {
	return &Handlers{Cfg: cfg, Queries: q, Sessions: sessions, Log: log}
}

// Home renders the landing page, including a live user count read from Postgres
// — proof the whole stack is wired end to end.
func (h *Handlers) Home(w http.ResponseWriter, r *http.Request) {
	count, err := h.Queries.CountUsers(r.Context())
	if err != nil {
		h.Log.Error("count users", "err", err)
		http.Error(w, "internal error", http.StatusInternalServerError)
		return
	}
	render(w, r, http.StatusOK, web.Home(count))
}

// Health is a liveness probe for Railway / uptime checks. It also pings the DB,
// so an unreachable database reports unhealthy rather than silently serving 500s.
func (h *Handlers) Health(w http.ResponseWriter, r *http.Request) {
	if _, err := h.Queries.CountUsers(r.Context()); err != nil {
		http.Error(w, "db unavailable", http.StatusServiceUnavailable)
		return
	}
	w.Header().Set("Content-Type", "text/plain")
	_, _ = w.Write([]byte("ok"))
}

// serverError logs the underlying error and returns a generic 500 to the client.
func (h *Handlers) serverError(w http.ResponseWriter, r *http.Request, msg string, err error) {
	h.Log.Error(msg, "err", err, "path", r.URL.Path)
	http.Error(w, "internal server error", http.StatusInternalServerError)
}

auth.go SUKURTI

Sukurk šį failą kataloge internal/handlers/

package handlers

import (
	"errors"
	"net/http"
	"net/mail"
	"strings"

	"github.com/jackc/pgx/v5"

	"github.com/programuoki/signflow/internal/auth"
	"github.com/programuoki/signflow/internal/db"
	"github.com/programuoki/signflow/internal/web"
)

func (h *Handlers) RegisterForm(w http.ResponseWriter, r *http.Request) {
	render(w, r, http.StatusOK, web.Register("", ""))
}

func (h *Handlers) Register(w http.ResponseWriter, r *http.Request) {
	emailAddr := normalizeEmail(r.FormValue("email"))
	password := r.FormValue("password")
	confirm := r.FormValue("confirm")

	fail := func(msg string) {
		render(w, r, http.StatusUnprocessableEntity, web.Register(emailAddr, msg))
	}

	if !validEmail(emailAddr) {
		fail("Please enter a valid email address.")
		return
	}
	if password != confirm {
		fail("Passwords do not match.")
		return
	}
	hash, err := auth.HashPassword(password)
	if errors.Is(err, auth.ErrPasswordLength) {
		fail("Password must be between 8 and 64 characters.")
		return
	}
	if err != nil {
		h.serverError(w, r, "hash password", err)
		return
	}

	// The UNIQUE constraint on email is the real guard; check first for a nice
	// message, and still handle the race by inspecting the insert error.
	if _, err := h.Queries.GetUserByEmail(r.Context(), emailAddr); err == nil {
		fail("That email is already registered. Try logging in.")
		return
	} else if !errors.Is(err, pgx.ErrNoRows) {
		h.serverError(w, r, "lookup user", err)
		return
	}

	user, err := h.Queries.CreateUser(r.Context(), db.CreateUserParams{
		Email:        emailAddr,
		PasswordHash: hash,
	})
	if err != nil {
		if isUniqueViolation(err) {
			fail("That email is already registered. Try logging in.")
			return
		}
		h.serverError(w, r, "create user", err)
		return
	}

	if err := h.Sessions.Create(r.Context(), w, user.ID); err != nil {
		h.serverError(w, r, "create session", err)
		return
	}
	h.Log.Info("user registered", "email", user.Email)
	// A dashboard for signed-in users arrives in lesson 5; for now, home.
	http.Redirect(w, r, "/", http.StatusSeeOther)
}

// --- helpers ---

func normalizeEmail(s string) string { return strings.ToLower(strings.TrimSpace(s)) }

func validEmail(s string) bool {
	if s == "" || len(s) > 254 {
		return false
	}
	_, err := mail.ParseAddress(s)
	return err == nil
}

router.go MODIFIKUOTI 4 eilutės pakeistos

Redaguok šį failą kataloge internal/handlers/

package handlers

import (
	"io/fs"
	"net/http"

	"github.com/go-chi/chi/v5"
	"github.com/go-chi/chi/v5/middleware"
)

// Router builds the Chi router with the base middleware stack and serves the
// embedded static assets. Auth-protected route groups are added in lesson 5.
func (h *Handlers) Router(staticFS fs.FS) http.Handler {
	r := chi.NewRouter()

	// Base middleware, outermost first.
	r.Use(middleware.RequestID)
	r.Use(middleware.RealIP)
	r.Use(middleware.Logger)    // request logging
	r.Use(middleware.Recoverer) // turn panics into 500s instead of crashing

	// Static assets (CSS, vendored htmx), served from the embedded FS.
	r.Handle("/static/*", http.StripPrefix("/static/", http.FileServer(http.FS(staticFS))))

	r.Get("/", h.Home)
	r.Get("/healthz", h.Health)

	// Auth routes (login/logout arrive in lesson 5).
	r.Get("/register", h.RegisterForm)
	r.Post("/register", h.Register)

	return r
}

main.go MODIFIKUOTI 3 eilutės pakeistos

Redaguok šį failą kataloge cmd/signflow/

// Command signflow is the HTTP server entrypoint.
//
// On startup it: loads config, runs embedded goose migrations, opens a pgx
// pool, builds the Chi router, and serves with graceful shutdown.
package main

import (
	"context"
	"errors"
	"fmt"
	"io/fs"
	"log/slog"
	"net/http"
	"os"
	"os/signal"
	"syscall"
	"time"

	"github.com/jackc/pgx/v5/stdlib"
	"github.com/pressly/goose/v3"

	migrations "github.com/programuoki/signflow/db"
	"github.com/programuoki/signflow/internal/config"
	"github.com/programuoki/signflow/internal/db"
	"github.com/programuoki/signflow/internal/handlers"
	"github.com/programuoki/signflow/internal/session"
	"github.com/programuoki/signflow/static"
)

func main() {
	log := slog.New(slog.NewTextHandler(os.Stdout, &slog.HandlerOptions{Level: slog.LevelInfo}))
	if err := run(log); err != nil {
		log.Error("fatal", "err", err)
		os.Exit(1)
	}
}

func run(log *slog.Logger) error {
	cfg, err := config.Load()
	if err != nil {
		return err
	}
	log.Info("starting signflow", "env", cfg.Env, "port", cfg.Port, "base_url", cfg.BaseURL)

	ctx := context.Background()

	// 1. Migrate. We use a throwaway database/sql handle (pgx stdlib driver)
	//    because goose speaks database/sql, then hand the app a pgx pool.
	if err := runMigrations(cfg.DatabaseURL, log); err != nil {
		return err
	}

	// 2. Connect the application pool the sqlc queries run against.
	pool, err := db.Connect(ctx, cfg.DatabaseURL)
	if err != nil {
		return err
	}
	defer pool.Close()

	queries := db.New(pool)
	sessions := session.NewManager(queries, cfg.IsProd())
	h := handlers.New(cfg, queries, sessions, log)

	staticFS, err := fs.Sub(static.FS, "assets")
	if err != nil {
		return err
	}

	srv := &http.Server{
		Addr:              ":" + cfg.Port,
		Handler:           h.Router(staticFS),
		ReadHeaderTimeout: 10 * time.Second,
	}

	// Graceful shutdown: stop accepting on SIGINT/SIGTERM, then drain in-flight
	// requests for up to 15s before exiting.
	shutdownCtx, stop := signal.NotifyContext(ctx, os.Interrupt, syscall.SIGTERM)
	defer stop()

	go func() {
		log.Info("listening", "addr", srv.Addr)
		if err := srv.ListenAndServe(); err != nil && !errors.Is(err, http.ErrServerClosed) {
			log.Error("server error", "err", err)
			stop()
		}
	}()

	<-shutdownCtx.Done()
	log.Info("shutting down")

	timeout, cancel := context.WithTimeout(context.Background(), 15*time.Second)
	defer cancel()
	return srv.Shutdown(timeout)
}

// runMigrations applies all pending goose migrations from the embedded FS.
func runMigrations(databaseURL string, log *slog.Logger) error {
	sqlDB, err := goose.OpenDBWithDriver("pgx", databaseURL)
	if err != nil {
		return err
	}
	defer sqlDB.Close()

	goose.SetBaseFS(migrations.FS)
	goose.SetLogger(gooseLogger{log})
	if err := goose.SetDialect("postgres"); err != nil {
		return err
	}
	return goose.Up(sqlDB, "migrations")
}

// gooseLogger adapts slog to goose's logger interface.
type gooseLogger struct{ log *slog.Logger }

func (g gooseLogger) Fatalf(format string, v ...interface{}) {
	g.log.Error("goose", "msg", fmt.Sprintf(format, v...))
}
func (g gooseLogger) Printf(format string, v ...interface{}) {
	g.log.Info("goose", "msg", fmt.Sprintf(format, v...))
}

// ensure the pgx stdlib driver is registered for goose.OpenDBWithDriver("pgx", ...)
var _ = stdlib.GetDefaultDriver