polish

css/swieta.css

@@ -170,6 +170,13 @@
             text-align: center;
         }
         & > form {
+            & > #form-errors {
+                grid-column: -1/1;
+                background-color: var(--surface);
+                &:empty{
+                    display: none;
+                }
+            }
             min-width: 0;
             display: grid;
             gap: 1rem;

go.mod

@@ -23,6 +23,7 @@ require (
 	golang.org/x/net v0.51.0 // indirect
 	golang.org/x/sync v0.16.0 // indirect
 	golang.org/x/sys v0.43.0 // indirect
+	golang.org/x/time v0.16.0 // indirect
 	golang.org/x/tools v0.35.0 // indirect
 )
 

go.sum

@@ -48,6 +48,8 @@ golang.org/x/sys v0.43.0 h1:Rlag2XtaFTxp19wS8MXlJwTvoh8ArU6ezoyFsMyCTNI=
 golang.org/x/sys v0.43.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
 golang.org/x/text v0.34.0 h1:oL/Qq0Kdaqxa1KbNeMKwQq0reLCCaFtqu2eNuSeNHbk=
 golang.org/x/text v0.34.0/go.mod h1:homfLqTYRFyVYemLBFl5GgL/DWEiH5wcsQ5gSh1yziA=
+golang.org/x/time v0.16.0 h1:vMb6ptszcQMkcwiRTAuNNU50gom6++Q/6gY2hDM6VDE=
+golang.org/x/time v0.16.0/go.mod h1:rVKOqvZeKvrDKTQiAHJ7wmwP0RzleSphoEA9RcdLA0s=
 golang.org/x/tools v0.35.0 h1:mBffYraMEf7aa0sB+NuKnuCy8qI/9Bughn8dC2Gu5r0=
 golang.org/x/tools v0.35.0/go.mod h1:NKdj5HkL/73byiZSJjqJgKn3ep7KjFkBOkR/Hps3VPw=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=

html/dziekujemy.templ

@@ -0,0 +1,11 @@
+package html
+
+templ Dziekujemy() {
+	@layout("Dziękujemy"){
+		<p>Dziękujemy! Numer zamówienia: <b id="order-id"></b>. Potwierdzimy zamówienie telefonicznie.</p>
+		<script>
+  			const id = new URLSearchParams(location.search).get('order');
+     	if (id) document.getElementById('order-id').textContent = id;
+      </script>
+	}
+}

html/errors.templ

@@ -0,0 +1,9 @@
+package html
+
+templ FormErrors(msgs []string) {
+	<ul role="alert">
+		for _, m := range msgs {
+			<li>{m}</li>
+		}
+	</ul>
+}

html/swieta.templ

@@ -54,7 +54,7 @@ templ Swieta(products []types.Product) {
 				<h2>Złóż zamówienie</h2>
 				<p>Odbiór wszystkich zamówień: <b>24 grudnia</b>. Zamówienia przyjmujemy do <b>15 grudnia</b>. Potwierdzimy zamówienie telefonicznie.</p>
 				<p>Wszystkie zamówienia obejmuje zaliczka o wysokości <b>50zł</b>. </p>
-				<form method="post" action="/order/" >
+				<form method="post" action="/order" hx-post="/order" hx-target="#form-errors" hx-swap="innerHTML" hx-disabled-elt="find button[type=submit]" >
 					<input name="name" type="text" required placeholder="Imie i Nazwisko"/>
 					<input name="phone" type="tel" required placeholder="Numer Telefonu"/>
 					<fieldset>
@@ -62,6 +62,7 @@ templ Swieta(products []types.Product) {
 							@product_form(product)
 						}
 					</fieldset>
+					<div id="form-errors" aria-live="polite"></div>
 					<span>Wartość zamówienia: <span id="total_price">0</span></span>
 					<button type="submit">Wyślij zamówienie</button>
 				</form>

js/order.js

@@ -30,4 +30,11 @@ function decrease(id) {
   calculate_total()
 }
 
+document.body.addEventListener('htmx:beforeSwap', e => {
+  if (e.detail.xhr.status >= 400) {
+    e.detail.shouldSwap = true;
+    e.detail.isError = false;
+  }
+});
+
 calculate_total()

main.go

@@ -18,6 +18,7 @@ import (
 	"sort"
 	"strings"
 	"sync"
+	"time"
 
 	"github.com/tdewolff/minify/v2"
 	mcss "github.com/tdewolff/minify/v2/css"
@@ -130,6 +131,7 @@ func generateHTML() {
 	saveFile(`kawiarnia`, html.Kawiarnia())
 	// saveFile(`swieta`, html.Swieta(data.Swieta))
 	saveFile(`wyroby`, html.Wyroby(data.Cakes, "wyroby"))
+	saveFile(`dziekujemy`, html.Dziekujemy())
 	saveFile(`wyroby/deserki`, html.Wyroby(data.Desserts, "wyroby/deserki"))
 	saveFile(`wyroby/torty`, html.WyrobyTorty())
 	saveFile(`wyroby/slodkie_stoly`, html.WyrobySlodkieStoly())
@@ -213,7 +215,7 @@ func main() {
 	mux := http.ServeMux{}
 
 	mux.Handle("/", http.FileServer(http.Dir("www")))
-	mux.HandleFunc("POST /order/", orders.OrderHandler)
+	mux.Handle("POST /order", orders.Limit(http.HandlerFunc(orders.OrderHandler), 10*time.Second, 5))
 	mux.HandleFunc("POST /webhook", orders.WebhookHandler(os.Getenv("STRIPE_WEBHOOK_SECRET")))
 
 	log.Println("listening on :8000")

orders/error_handler.go

@@ -0,0 +1,23 @@
+package orders
+
+import (
+	"net/http"
+	"piekarnikgosipl/html"
+)
+
+func errorMessages(err error) []string {
+	if j, ok := err.(interface{ Unwrap() []error }); ok {
+		var out []string
+		for _, e := range j.Unwrap() {
+			out = append(out, e.Error())
+		}
+		return out
+	}
+	return []string{err.Error()}
+}
+
+func writeErrors(w http.ResponseWriter, r *http.Request, status int, msgs ...string) {
+	w.Header().Set("Content-Type", "text/html; charset=utf-8")
+	w.WriteHeader(status)
+	html.FormErrors(msgs).Render(r.Context(), w)
+}

orders/order.go

@@ -97,6 +97,9 @@ func startCheckout(w http.ResponseWriter, r *http.Request, o order) {
 	id := newOrderID()
 	log.Println("ORDER_PENDING", id, o)
 
+	url := r.URL.RequestURI()
+	log.Println(url)
+
 	s, err := session.New(&stripe.CheckoutSessionParams{
 		Mode:              stripe.String("payment"),
 		ClientReferenceID: stripe.String(id),
@@ -111,12 +114,12 @@ func startCheckout(w http.ResponseWriter, r *http.Request, o order) {
 				},
 			},
 		}},
-		SuccessURL: stripe.String("https://piekarnikgosi.pl/dziekujemy"),
+		SuccessURL: stripe.String("https://piekarnikgosi.pl/dziekujemy?order=" + id),
 		CancelURL:  stripe.String("https://piekarnikgosi.pl/"),
 	})
 	if err != nil {
 		log.Println("ORDER_STRIPE_ERROR", id, err)
-		http.Error(w, "payment error", http.StatusInternalServerError)
+		writeErrors(w, r, http.StatusInternalServerError, "Nie udało się przejść do płatności. Spróbuj ponownie lub zadzwoń: 690 214 515.")
 		return
 	}
 	if r.Header.Get("HX-Request") == "true" {
@@ -128,10 +131,15 @@ func startCheckout(w http.ResponseWriter, r *http.Request, o order) {
 }
 
 func OrderHandler(w http.ResponseWriter, r *http.Request) {
+	r.Body = http.MaxBytesReader(w, r.Body, 16<<10)
+	if err := r.ParseForm(); err != nil {
+		writeErrors(w, r, http.StatusRequestEntityTooLarge, "Formularz jest nieprawidłowy.")
+		return
+	}
 	o, err := parseOrder(r)
 	if err != nil {
 		log.Println("ORDER_INVALID", o, err)
-		http.Error(w, err.Error(), http.StatusBadRequest)
+		writeErrors(w, r, http.StatusUnprocessableEntity, errorMessages(err)...)
 		return
 	}
 	startCheckout(w, r, o)

orders/ratelimit.go

@@ -0,0 +1,62 @@
+package orders
+
+import (
+	"net"
+	"net/http"
+	"strings"
+	"sync"
+	"time"
+
+	"golang.org/x/time/rate"
+)
+
+type visitor struct {
+	lim  *rate.Limiter
+	seen time.Time
+}
+
+func Limit(next http.Handler, every time.Duration, burst int) http.Handler {
+	var mu sync.Mutex
+	visitors := map[string]*visitor{}
+
+	go func() {
+		for range time.Tick(10 * time.Minute) {
+			mu.Lock()
+			for ip, v := range visitors {
+				if time.Since(v.seen) > 10*time.Minute {
+					delete(visitors, ip)
+				}
+			}
+			mu.Unlock()
+		}
+	}()
+
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		ip := clientIP(r)
+		mu.Lock()
+		v, ok := visitors[ip]
+		if !ok {
+			v = &visitor{lim: rate.NewLimiter(rate.Every(every), burst)}
+			visitors[ip] = v
+		}
+		v.seen = time.Now()
+		allowed := v.lim.Allow()
+		mu.Unlock()
+
+		if !allowed {
+			http.Error(w, "Zbyt wiele prób. Spróbuj ponownie za chwilę.", http.StatusTooManyRequests)
+			return
+		}
+		next.ServeHTTP(w, r)
+	})
+}
+
+func clientIP(r *http.Request) string {
+	host, _, _ := net.SplitHostPort(r.RemoteAddr)
+	if ip := net.ParseIP(host); ip != nil && ip.IsLoopback() {
+		if xff := r.Header.Get("X-Forwarded-For"); xff != "" {
+			return strings.TrimSpace(strings.Split(xff, ",")[0])
+		}
+	}
+	return host
+}