feat: wire auth into the web layer (Schritt 2, part 2/2)

Registration creates a new account plus its first user; login
authenticates an existing one; both set a deklarix_session cookie
(HttpOnly, SameSite=Strict, Secure only when the request itself came
over TLS — hardcoding Secure=true would break local http://localhost
development, since browsers won't store a Secure cookie over plaintext).

requirePage protects full-page GETs (redirects to /login); requireAPI
protects the htmx/download endpoints (401, since those are only ever
called from an already-authenticated page — an unauthenticated hit
there is the exception, e.g. a session expiring mid-use).

handleCheck now creates submissions under the current account.
handleArchive and handleDossierDownload compare the submission's
account against the caller's and return 404 on mismatch — not 403,
which would confirm the ID exists to a different tenant. Login failure
uses the same message for "no such email" and "wrong password" to avoid
account enumeration.

Restructured templates along the way: layout.html now only holds
reusable fragments ("head", "nav"); each full page (index/login/register)
is its own top-level named template. The previous layout+content nesting
would have broken the moment a second page defined "content" — Go's
html/template keys blocks by name across the whole parsed set, not per
file, so two pages both defining "content" would silently overwrite each
other.

Verified against a real running instance (not just Go's test recorder):
started the compiled binary against a fresh Postgres and drove the whole
flow with curl — anonymous redirect, registration setting a real cookie,
authenticated page load, logout clearing both the cookie and the
server-side session row, and being locked out again afterward.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

This commit is contained in:

noroot

2026-08-27 15:56:11 +02:00

parent 2a16dc2200

commit 5156fe62da

12 changed files with 755 additions and 128 deletions

									
										8

internal/web/templates/index.html
									
												View File
												
				@@ -1,4 +1,8 @@

				{{define "content"}}

				{{define "index"}}<!doctype html>

				<html lang="de">

				<head>{{template "head" .}}</head>

				<body>

				{{template "nav" .}}

				<h1>Pre-Publish-Prüfung</h1>

				<p>Caption und Plattform eingeben, um auf Kennzeichnungsrisiken zu prüfen.</p>

				@@ -24,4 +28,6 @@

				</form>

				<div id="ergebnis"></div>

				</body>

				</html>

				{{end}}

feat: wire auth into the web layer (Schritt 2, part 2/2)

8 internal/web/templates/index.html Unescape Escape View File

8

internal/web/templates/index.html

View File