Refactor authentication handlers and middleware

TODO.md

@@ -117,6 +117,7 @@
 - [ ] Error Handling
   - [ ] Proper error logging
   - [ ] User-friendly error messages
+  - [ ] A better way to handle the error page
 - [ ] Performance Optimization
 - [ ] API Documentation
 - [ ] Unit Tests

internal/auth/auth.go

@@ -11,9 +11,6 @@ import (
 	"github.com/Bronku/iroon/internal/store"
 )
 
-//go:embed  templates/login.html
-var loginPage string
-
 //go:embed templates/wrongPassword.html
 var wrongPassword string
 
@@ -34,42 +31,9 @@ func New(s *store.Store) *Authenticator {
 	return &out
 }
 
-func (a *Authenticator) login(w http.ResponseWriter, r *http.Request) {
+func (a *Authenticator) ensureAuth(in http.Handler) http.Handler {
-	if r.Method != http.MethodPost {
+	fmt.Println("ensureAuth called")
-		w.Header().Set("content-type", "text/html")
-		fmt.Fprint(w, loginPage)
-		return
-	}
-	err := r.ParseForm()
-	if err != nil {
-		w.Header().Set("content-type", "text/html")
-		fmt.Fprint(w, loginPage)
-		return
-	}
-	login := r.PostFormValue("login")
-	password := r.PostFormValue("password")
-	if login != "admin" || password != "secret" {
-		w.Header().Set("content-type", "text/html")
-		fmt.Fprint(w, wrongPassword)
-		return
-	}
-	cookie, err := a.newSession(login)
-	// #todo: change to a some sort of internal server error
-	if err != nil {
-		w.Header().Set("content-type", "text/html")
-		fmt.Fprint(w, "internal server error")
-		return
-	}
-	http.SetCookie(w, &cookie)
-	http.Redirect(w, r, "/", http.StatusFound)
-}
-
-func (a *Authenticator) Middleware(in http.Handler) http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		if r.URL.String() == "/login" {
-			a.login(w, r)
-			return
-		}
 		c, err := r.Cookie("token")
 		if err != nil {
 			http.Redirect(w, r, "/login", http.StatusSeeOther)
@@ -92,3 +56,11 @@ func (a *Authenticator) Middleware(in http.Handler) http.Handler {
 		in.ServeHTTP(w, r)
 	})
 }
+
+func (a *Authenticator) Middleware(in http.Handler) http.Handler {
+	handler := http.NewServeMux()
+	handler.HandleFunc("GET /login", getLogin)
+	handler.HandleFunc("POST /login", a.login)
+	handler.Handle("/", a.ensureAuth(in))
+	return handler
+}

internal/auth/credentials.go

@@ -0,0 +1,11 @@
+package auth
+
+import "errors"
+
+func (a *Authenticator) verifyCredentials(login, password string) error {
+
+	if login == "admin" && password == "secret" {
+		return nil
+	}
+	return errors.New("wrong credentials")
+}

internal/auth/get.go

@@ -0,0 +1,17 @@
+package auth
+
+import (
+	"fmt"
+	"net/http"
+
+	_ "embed"
+)
+
+//go:embed  templates/login.html
+var loginHTML string
+
+func getLogin(w http.ResponseWriter, r *http.Request) {
+	w.Header().Set("content-type", "text/html")
+	fmt.Fprint(w, loginHTML)
+	return
+}

internal/auth/post.go

@@ -0,0 +1,28 @@
+package auth
+
+import (
+	"fmt"
+	"net/http"
+)
+
+func (a *Authenticator) login(w http.ResponseWriter, r *http.Request) {
+	err := r.ParseForm()
+	if err != nil {
+		http.Redirect(w, r, "/login", http.StatusSeeOther)
+		return
+	}
+	login := r.PostFormValue("login")
+	password := r.PostFormValue("password")
+	if a.verifyCredentials(login, password) != nil {
+		http.Redirect(w, r, "/login", http.StatusSeeOther)
+		return
+	}
+	cookie, err := a.newSession(login)
+	if err != nil {
+		w.Header().Set("content-type", "text/html")
+		fmt.Fprint(w, "internal server error")
+		return
+	}
+	http.SetCookie(w, &cookie)
+	http.Redirect(w, r, "/", http.StatusFound)
+}