5156fe62da
Registration creates a new account plus its first user; login authenticates an existing one; both set a deklarix_session cookie (HttpOnly, SameSite=Strict, Secure only when the request itself came over TLS — hardcoding Secure=true would break local http://localhost development, since browsers won't store a Secure cookie over plaintext). requirePage protects full-page GETs (redirects to /login); requireAPI protects the htmx/download endpoints (401, since those are only ever called from an already-authenticated page — an unauthenticated hit there is the exception, e.g. a session expiring mid-use). handleCheck now creates submissions under the current account. handleArchive and handleDossierDownload compare the submission's account against the caller's and return 404 on mismatch — not 403, which would confirm the ID exists to a different tenant. Login failure uses the same message for "no such email" and "wrong password" to avoid account enumeration. Restructured templates along the way: layout.html now only holds reusable fragments ("head", "nav"); each full page (index/login/register) is its own top-level named template. The previous layout+content nesting would have broken the moment a second page defined "content" — Go's html/template keys blocks by name across the whole parsed set, not per file, so two pages both defining "content" would silently overwrite each other. Verified against a real running instance (not just Go's test recorder): started the compiled binary against a fresh Postgres and drove the whole flow with curl — anonymous redirect, registration setting a real cookie, authenticated page load, logout clearing both the cookie and the server-side session row, and being locked out again afterward. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
31 lines
991 B
HTML
31 lines
991 B
HTML
{{define "register"}}<!doctype html>
|
|
<html lang="de">
|
|
<head>{{template "head" .}}</head>
|
|
<body>
|
|
<h1>Registrieren</h1>
|
|
{{if .Error}}<p class="fehler">{{.Error}}</p>{{end}}
|
|
<form method="post" action="/register">
|
|
<label for="account_name">Name (Creator, Agentur, Marke oder Kanzlei)</label>
|
|
<input type="text" id="account_name" name="account_name" required>
|
|
|
|
<label for="role">Rolle</label>
|
|
<select id="role" name="role" required>
|
|
<option value="creator">Creator</option>
|
|
<option value="agentur">Agentur</option>
|
|
<option value="marke">Marke</option>
|
|
<option value="kanzlei">Kanzlei</option>
|
|
</select>
|
|
|
|
<label for="email">E-Mail</label>
|
|
<input type="email" id="email" name="email" required>
|
|
|
|
<label for="password">Passwort (mind. 8 Zeichen)</label>
|
|
<input type="password" id="password" name="password" minlength="8" required>
|
|
|
|
<button type="submit">Konto anlegen</button>
|
|
</form>
|
|
<p><a href="/login">Schon ein Konto? Anmelden</a></p>
|
|
</body>
|
|
</html>
|
|
{{end}}
|