File upload and SHA-256 in one pass

Code

Upload end to end, with a live progress bar

Eight files, presentation on top of the layer you just built: the view model, its mapper, the list partial, the upload handler, and the four small wiring changes that make it live. Order: documents_web.go → documents_view.go → documents.templ → documents.go → dashboard.templ → auth.go → router.go → layout.templ.

1. internal/web/documents_web.go (new) — DocumentView, the template-facing shape: plain strings and a bool, no pgtype. Templates never touch a db.Document directly.

2. internal/handlers/documents_view.go (new) — viewDocument maps a db.Document into a DocumentView (formatting the timestamp, humanizing the byte count), viewDocuments maps a slice, and humanizeBytes renders 1.4 MB.

3. internal/web/documents.templ (new) — DocumentList(docs), the partial with id="doc-list", and documentRow. This is the piece HTMX swaps: the upload form targets #doc-list and replaces it with the fresh list. (View and delete actions arrive next lesson, with the routes that back them.)

4. internal/handlers/documents.go (new) — Dashboard (moved here from auth.go, now listing the owner's documents) and UploadDocument:

r.Body = http.MaxBytesReader(w, r.Body, h.Cfg.MaxUploadBytes+1024)
file, header, err := r.FormFile("file")
// ...
key, size, hash, err := h.Store.Save(r.Context(), file) // stream + hash, one pass
doc, err := h.Queries.CreateDocument(r.Context(), db.CreateDocumentParams{ /* ... */ })
if err != nil {
	_ = h.Store.Delete(r.Context(), key) // don't orphan the blob
	// ...
}

If the row insert fails after the blob is written, Store.Delete removes the orphan — storage and database are kept in step. respondWithDocList returns the refreshed partial to HTMX callers and redirects a plain form post. sanitizeFilename strips path separators and control characters from the client-supplied name.

5. internal/web/dashboard.templ (modify) — the placeholder dashboard grows into the real thing: a hero, the upload card (hx-post="/documents", hx-encoding="multipart/form-data", hx-target="#doc-list", a <progress> bar), and @DocumentList(docs). A small script wires htmx's xhr:progress events to the progress element. Dashboard now takes docs []DocumentView.

6. internal/handlers/auth.go (modify) — the old placeholder Dashboard is removed here; it moved to documents.go, where it can list documents. Nothing else in auth.go changes.

7. internal/handlers/router.go (modify) — one route inside the authenticated group: pr.Post("/documents", h.UploadDocument).

8. internal/web/layout.templ (modify) — two additions that let HTMX posts pass CSRF: a <meta name="csrf-token"> and a tiny htmx:configRequest listener that copies the token into an X-CSRF-Token header. The upload form carries no hidden field, so the header is how gorilla/csrf sees the token — and it reads the header before parsing the body, so the multipart stream is not consumed twice.

The upload form has no hidden CSRF field

Every other form embeds gorilla.csrf.Token as a hidden input. A multipart upload cannot — the token would arrive after the file in the stream, and gorilla/csrf needs it first. The X-CSRF-Token header solves it: htmx attaches it to every request from the meta tag, and it is read before the body. Without this wiring the upload POST returns 403 Forbidden.

Verify — reseed, go run ./cmd/signflow, log in, and open /dashboard:

Choose a file and click Upload. The progress bar fills, and the document list swaps in place with your file — no full-page reload.
The row shows a humanized size and a draft pill.
Check the terminal:

level=INFO msg="document uploaded" id=… owner=you@example.com size=1048576 sha256=4a7d1ed414474e4033ac29ccb8653d9b...

Confirm the bytes and the hash landed:

$ ls uploads/
7f3a9c1e0b2d4f6a8c5e1b3d7f9a2c4e
$ psql "$DATABASE_URL" -c "select filename, size, status, storage_key from documents;"
   filename   |  size   | status |           storage_key
--------------+---------+--------+----------------------------------
 contract.pdf | 1048576 | draft  | 7f3a9c1e0b2d4f6a8c5e1b3d7f9a2c4e

The storage_key names the file on disk; it is not the row id. The file_hash was computed in the same pass that wrote those bytes.

Try a file over 25 MiB: the upload is refused with 413, and nothing is written to uploads/ or the table.

documents_web.go CREATE

Create this file in internal/web/

package web

// DocumentView is the template-facing shape of a document: plain strings, no
// pgtype. Handlers map db.Document into this.
type DocumentView struct {
	ID          string
	Filename    string
	ContentType string
	SizeHuman   string
	FileHash    string
	Status      string
	CreatedAt   string
	IsDraft     bool
}

documents_view.go CREATE

Create this file in internal/handlers/

package handlers

import (
	"fmt"

	"github.com/programuoki/signflow/internal/db"
	"github.com/programuoki/signflow/internal/web"
)

func viewDocument(d db.Document) web.DocumentView {
	return web.DocumentView{
		ID:          d.ID.String(),
		Filename:    d.Filename,
		ContentType: d.ContentType,
		SizeHuman:   humanizeBytes(d.Size),
		FileHash:    d.FileHash,
		Status:      d.Status,
		CreatedAt:   d.CreatedAt.Time.Format("2006-01-02 15:04"),
		IsDraft:     d.Status == "draft",
	}
}

func viewDocuments(docs []db.Document) []web.DocumentView {
	out := make([]web.DocumentView, 0, len(docs))
	for _, d := range docs {
		out = append(out, viewDocument(d))
	}
	return out
}

// humanizeBytes renders a byte count as e.g. "1.4 MB".
func humanizeBytes(n int64) string {
	const unit = 1024
	if n < unit {
		return fmt.Sprintf("%d B", n)
	}
	div, exp := int64(unit), 0
	for x := n / unit; x >= unit; x /= unit {
		div *= unit
		exp++
	}
	return fmt.Sprintf("%.1f %cB", float64(n)/float64(div), "KMGTPE"[exp])
}

documents.templ CREATE

Create this file in internal/web/

package web

// DocumentList is the swappable partial that HTMX refreshes after an upload.
// Its id="doc-list" is the hx-target the upload form swaps.
templ DocumentList(docs []DocumentView) {
	<section id="doc-list" class="card">
		<h2>Documents</h2>
		if len(docs) == 0 {
			<p class="muted">No documents yet. Upload one above to get started.</p>
		} else {
			<table class="table">
				<thead>
					<tr>
						<th>Name</th>
						<th>Status</th>
						<th>Size</th>
						<th>Uploaded</th>
					</tr>
				</thead>
				<tbody>
					for _, d := range docs {
						@documentRow(d)
					}
				</tbody>
			</table>
		}
	</section>
}

templ documentRow(d DocumentView) {
	<tr>
		<td>{ d.Filename }</td>
		<td><span class={ "pill", "pill-" + d.Status }>{ d.Status }</span></td>
		<td>{ d.SizeHuman }</td>
		<td>{ d.CreatedAt }</td>
	</tr>
}

documents.go CREATE

Create this file in internal/handlers/

package handlers

import (
	"net/http"
	"strings"

	"github.com/programuoki/signflow/internal/db"
	"github.com/programuoki/signflow/internal/web"
)

// Dashboard lists the signed-in user's documents.
func (h *Handlers) Dashboard(w http.ResponseWriter, r *http.Request) {
	user := mustUser(r)
	docs, err := h.Queries.ListDocumentsByOwner(r.Context(), user.ID)
	if err != nil {
		h.serverError(w, r, "list documents", err)
		return
	}
	render(w, r, http.StatusOK, web.Dashboard(h.nav(r), viewDocuments(docs)))
}

// UploadDocument accepts a multipart file, hashes and stores it, and records it
// as a draft owned by the current user.
func (h *Handlers) UploadDocument(w http.ResponseWriter, r *http.Request) {
	user := mustUser(r)

	// Cap the request body. +1KiB slack covers multipart field overhead so a
	// file exactly at the limit still succeeds.
	r.Body = http.MaxBytesReader(w, r.Body, h.Cfg.MaxUploadBytes+1024)

	file, header, err := r.FormFile("file")
	if err != nil {
		// Covers both "no file" and "too large" (MaxBytesReader error).
		h.Log.Warn("upload rejected", "err", err, "user", user.Email)
		http.Error(w, "upload failed: file missing or too large", http.StatusRequestEntityTooLarge)
		return
	}
	defer file.Close()

	if header.Size == 0 {
		http.Error(w, "upload failed: empty file", http.StatusBadRequest)
		return
	}

	contentType := header.Header.Get("Content-Type")
	if contentType == "" {
		contentType = "application/octet-stream"
	}

	// The store hashes while it writes — the file is never fully in memory.
	key, size, hash, err := h.Store.Save(r.Context(), file)
	if err != nil {
		h.serverError(w, r, "store file", err)
		return
	}

	doc, err := h.Queries.CreateDocument(r.Context(), db.CreateDocumentParams{
		OwnerID:     user.ID,
		Filename:    sanitizeFilename(header.Filename),
		ContentType: contentType,
		Size:        size,
		FileHash:    hash,
		StorageKey:  key,
	})
	if err != nil {
		_ = h.Store.Delete(r.Context(), key) // don't orphan the blob
		h.serverError(w, r, "create document", err)
		return
	}
	h.Log.Info("document uploaded", "id", doc.ID.String(), "owner", user.Email, "size", size, "sha256", hash)

	h.respondWithDocList(w, r, user)
}

// respondWithDocList returns the refreshed list partial to HTMX callers, or
// redirects to the dashboard for a plain form post.
func (h *Handlers) respondWithDocList(w http.ResponseWriter, r *http.Request, user db.User) {
	if r.Header.Get("HX-Request") == "" {
		http.Redirect(w, r, "/dashboard", http.StatusSeeOther)
		return
	}
	docs, err := h.Queries.ListDocumentsByOwner(r.Context(), user.ID)
	if err != nil {
		h.serverError(w, r, "list documents", err)
		return
	}
	render(w, r, http.StatusOK, web.DocumentList(viewDocuments(docs)))
}

func mustUser(r *http.Request) db.User {
	u, _ := UserFrom(r.Context()) // routes are behind RequireAuth
	return u
}

// sanitizeFilename strips path separators and control characters so a filename
// can't traverse directories or inject headers.
func sanitizeFilename(name string) string {
	name = strings.ReplaceAll(name, "\\", "/")
	if i := strings.LastIndex(name, "/"); i >= 0 {
		name = name[i+1:]
	}
	name = strings.Map(func(rn rune) rune {
		if rn < 0x20 || rn == 0x7f || rn == '"' {
			return -1
		}
		return rn
	}, name)
	name = strings.TrimSpace(name)
	if name == "" {
		return "document"
	}
	return name
}

dashboard.templ MODIFY 37 lines changed

Edit this file in internal/web/

package web

// Dashboard is the signed-in home: an upload card plus the owner's document list.
templ Dashboard(nav Nav, docs []DocumentView) {
	@Layout("Dashboard", nav) {
		<section class="hero">
			<h1>Your documents</h1>
			<p class="lead">Upload a file, then invite signers. Any file type works —
				SignFlow hashes it on upload so you can prove it hasn't changed.</p>
		</section>
		<section class="card upload-card">
			<h2>Upload a document</h2>
			<form
				id="upload-form"
				hx-post="/documents"
				hx-encoding="multipart/form-data"
				hx-target="#doc-list"
				hx-swap="outerHTML"
				hx-on::after-request="if(event.detail.successful){this.reset();}"
			>
				<div class="upload-row">
					<input type="file" name="file" required/>
					<button class="btn btn-primary" type="submit">Upload</button>
				</div>
				<progress id="upload-progress" value="0" max="100"></progress>
			</form>
			<p id="upload-error" class="flash flash-error" hidden></p>
		</section>
		@DocumentList(docs)
		<script>
			(function () {
				var form = document.getElementById('upload-form');
				var prog = document.getElementById('upload-progress');
				var err = document.getElementById('upload-error');
				if (!form) return;
				form.addEventListener('htmx:xhr:loadstart', function () { prog.classList.add('active'); prog.value = 0; err.hidden = true; });
				form.addEventListener('htmx:xhr:progress', function (e) { if (e.detail.lengthComputable) prog.value = (e.detail.loaded / e.detail.total) * 100; });
				form.addEventListener('htmx:afterRequest', function (e) {
					prog.classList.remove('active');
					if (!e.detail.successful) { err.textContent = 'Upload failed (file too large, or an error occurred).'; err.hidden = false; }
				});
			})();
		</script>
	}
}

auth.go MODIFY

Edit this file in internal/handlers/

package handlers

import (
	"errors"
	"fmt"
	"net/http"
	"net/mail"
	"strings"
	"time"

	"github.com/gorilla/csrf"
	"github.com/jackc/pgx/v5"
	"github.com/jackc/pgx/v5/pgtype"

	"github.com/programuoki/signflow/internal/auth"
	"github.com/programuoki/signflow/internal/db"
	"github.com/programuoki/signflow/internal/email"
	"github.com/programuoki/signflow/internal/web"
)

// passwordResetTTL is how long a reset link stays valid.
const passwordResetTTL = time.Hour

// nav builds the per-request nav model (current user + CSRF token) for templates.
func (h *Handlers) nav(r *http.Request) web.Nav {
	n := web.Nav{CSRFToken: csrf.Token(r)}
	if u, ok := UserFrom(r.Context()); ok {
		n.LoggedIn = true
		n.Email = u.Email
	}
	return n
}

// --- Register ---

func (h *Handlers) RegisterForm(w http.ResponseWriter, r *http.Request) {
	render(w, r, http.StatusOK, web.Register(h.nav(r), "", ""))
}

func (h *Handlers) Register(w http.ResponseWriter, r *http.Request) {
	emailAddr := normalizeEmail(r.FormValue("email"))
	password := r.FormValue("password")
	confirm := r.FormValue("confirm")

	fail := func(msg string) {
		render(w, r, http.StatusUnprocessableEntity, web.Register(h.nav(r), emailAddr, msg))
	}

	if !validEmail(emailAddr) {
		fail("Please enter a valid email address.")
		return
	}
	if password != confirm {
		fail("Passwords do not match.")
		return
	}
	hash, err := auth.HashPassword(password)
	if errors.Is(err, auth.ErrPasswordLength) {
		fail("Password must be between 8 and 64 characters.")
		return
	}
	if err != nil {
		h.serverError(w, r, "hash password", err)
		return
	}

	if _, err := h.Queries.GetUserByEmail(r.Context(), emailAddr); err == nil {
		fail("That email is already registered. Try logging in.")
		return
	} else if !errors.Is(err, pgx.ErrNoRows) {
		h.serverError(w, r, "lookup user", err)
		return
	}

	user, err := h.Queries.CreateUser(r.Context(), db.CreateUserParams{
		Email:        emailAddr,
		PasswordHash: hash,
	})
	if err != nil {
		if isUniqueViolation(err) {
			fail("That email is already registered. Try logging in.")
			return
		}
		h.serverError(w, r, "create user", err)
		return
	}

	if err := h.Sessions.Create(r.Context(), w, user.ID); err != nil {
		h.serverError(w, r, "create session", err)
		return
	}
	h.Log.Info("user registered", "email", user.Email)
	http.Redirect(w, r, "/dashboard", http.StatusSeeOther)
}

// --- Login / Logout ---

func (h *Handlers) LoginForm(w http.ResponseWriter, r *http.Request) {
	render(w, r, http.StatusOK, web.Login(h.nav(r), "", ""))
}

func (h *Handlers) Login(w http.ResponseWriter, r *http.Request) {
	emailAddr := normalizeEmail(r.FormValue("email"))
	password := r.FormValue("password")

	invalid := func() {
		render(w, r, http.StatusUnprocessableEntity, web.Login(h.nav(r), emailAddr, "Invalid email or password."))
	}

	user, err := h.Queries.GetUserByEmail(r.Context(), emailAddr)
	if errors.Is(err, pgx.ErrNoRows) {
		invalid()
		return
	}
	if err != nil {
		h.serverError(w, r, "lookup user", err)
		return
	}
	if !auth.CheckPassword(user.PasswordHash, password) {
		invalid()
		return
	}

	if err := h.Sessions.Create(r.Context(), w, user.ID); err != nil {
		h.serverError(w, r, "create session", err)
		return
	}
	h.Log.Info("user logged in", "email", user.Email)
	http.Redirect(w, r, "/dashboard", http.StatusSeeOther)
}

func (h *Handlers) Logout(w http.ResponseWriter, r *http.Request) {
	if err := h.Sessions.Destroy(r.Context(), w, r); err != nil {
		h.serverError(w, r, "destroy session", err)
		return
	}
	http.Redirect(w, r, "/", http.StatusSeeOther)
}

// --- Password reset ---

func (h *Handlers) ForgotForm(w http.ResponseWriter, r *http.Request) {
	render(w, r, http.StatusOK, web.Forgot(h.nav(r), false, ""))
}

func (h *Handlers) Forgot(w http.ResponseWriter, r *http.Request) {
	emailAddr := normalizeEmail(r.FormValue("email"))

	// Always show the same confirmation regardless of whether the account
	// exists — no account enumeration. Do the real work only if it does.
	if validEmail(emailAddr) {
		if err := h.sendResetLink(r, emailAddr); err != nil {
			h.Log.Error("send reset link", "err", err, "email", emailAddr)
			// Still show the generic confirmation; don't reveal internal errors.
		}
	}
	render(w, r, http.StatusOK, web.Forgot(h.nav(r), true, emailAddr))
}

// sendResetLink creates a reset token for an existing user and emails the link.
// A no-op (nil) if the email isn't registered.
func (h *Handlers) sendResetLink(r *http.Request, emailAddr string) error {
	user, err := h.Queries.GetUserByEmail(r.Context(), emailAddr)
	if errors.Is(err, pgx.ErrNoRows) {
		return nil
	}
	if err != nil {
		return err
	}

	raw, hash, err := auth.GenerateToken()
	if err != nil {
		return err
	}
	if _, err := h.Queries.CreatePasswordReset(r.Context(), db.CreatePasswordResetParams{
		TokenHash: hash,
		UserID:    user.ID,
		ExpiresAt: pgtype.Timestamptz{Time: time.Now().Add(passwordResetTTL), Valid: true},
	}); err != nil {
		return err
	}

	link := h.Cfg.BaseURL + "/reset/" + raw
	text := fmt.Sprintf(
		"Someone requested a password reset for your SignFlow account.\n\n"+
			"Reset your password (link valid for 1 hour):\n%s\n\n"+
			"If this wasn't you, you can safely ignore this email.",
		link,
	)
	return h.Mailer.Send(r.Context(), email.Message{
		To:      user.Email,
		Subject: "Reset your SignFlow password",
		Text:    text,
		HTML:    fmt.Sprintf(`<p>Reset your SignFlow password (valid 1 hour):</p><p><a href="%s">%s</a></p>`, link, link),
	})
}

func (h *Handlers) ResetForm(w http.ResponseWriter, r *http.Request) {
	token := chiURLParam(r, "token")
	if _, err := h.Queries.GetValidPasswordReset(r.Context(), auth.HashToken(token)); err != nil {
		render(w, r, http.StatusOK, web.ResetInvalid(h.nav(r)))
		return
	}
	render(w, r, http.StatusOK, web.ResetPassword(h.nav(r), token, ""))
}

func (h *Handlers) Reset(w http.ResponseWriter, r *http.Request) {
	token := chiURLParam(r, "token")
	password := r.FormValue("password")
	confirm := r.FormValue("confirm")

	prt, err := h.Queries.GetValidPasswordReset(r.Context(), auth.HashToken(token))
	if err != nil {
		render(w, r, http.StatusOK, web.ResetInvalid(h.nav(r)))
		return
	}

	fail := func(msg string) {
		render(w, r, http.StatusUnprocessableEntity, web.ResetPassword(h.nav(r), token, msg))
	}
	if password != confirm {
		fail("Passwords do not match.")
		return
	}
	hash, err := auth.HashPassword(password)
	if errors.Is(err, auth.ErrPasswordLength) {
		fail("Password must be between 8 and 64 characters.")
		return
	}
	if err != nil {
		h.serverError(w, r, "hash password", err)
		return
	}

	if err := h.Queries.UpdateUserPassword(r.Context(), db.UpdateUserPasswordParams{
		ID:           prt.UserID,
		PasswordHash: hash,
	}); err != nil {
		h.serverError(w, r, "update password", err)
		return
	}
	// Burn this token and any other outstanding ones, and log the user out of
	// all existing sessions — a password change should invalidate them.
	_ = h.Queries.MarkPasswordResetUsed(r.Context(), prt.ID)
	_ = h.Queries.InvalidateUserPasswordResets(r.Context(), prt.UserID)
	_ = h.Queries.DeleteSessionsForUser(r.Context(), prt.UserID)

	h.Log.Info("password reset completed", "user_id", prt.UserID.String())
	http.Redirect(w, r, "/login", http.StatusSeeOther)
}

// --- helpers ---

func normalizeEmail(s string) string { return strings.ToLower(strings.TrimSpace(s)) }

func validEmail(s string) bool {
	if s == "" || len(s) > 254 {
		return false
	}
	_, err := mail.ParseAddress(s)
	return err == nil
}

router.go MODIFY 1 line changed

Edit this file in internal/handlers/

package handlers

import (
	"io/fs"
	"net/http"

	"github.com/go-chi/chi/v5"
	"github.com/go-chi/chi/v5/middleware"
	"github.com/gorilla/csrf"
)

// Router builds the Chi router with the middleware stack and all routes.
//
// csrfKey must be 32 bytes; it authenticates the CSRF token cookie.
func (h *Handlers) Router(staticFS fs.FS, csrfKey []byte) http.Handler {
	r := chi.NewRouter()

	// Base middleware, outermost first.
	r.Use(middleware.RequestID)
	r.Use(middleware.RealIP)
	r.Use(middleware.Logger)    // request logging
	r.Use(middleware.Recoverer) // turn panics into 500s instead of crashing

	// In dev we serve plaintext HTTP on localhost. gorilla/csrf otherwise assumes
	// TLS and enforces a strict Origin/Referer check that rejects http:// origins.
	// Marking dev requests plaintext relaxes that ONE check while keeping the
	// token check. Production (HTTPS at Railway's edge) is NOT marked, so it keeps
	// the full strict-origin protection.
	if !h.Cfg.IsProd() {
		r.Use(func(next http.Handler) http.Handler {
			return http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {
				next.ServeHTTP(w, csrf.PlaintextHTTPRequest(req))
			})
		})
	}

	// CSRF: enforced on all unsafe methods (POST/PUT/PATCH/DELETE). Safe methods
	// pass through but get the token cookie set so forms can embed it. The field
	// name matches the hidden input our templates render.
	csrfMW := csrf.Protect(
		csrfKey,
		csrf.Secure(h.Cfg.IsProd()),
		csrf.Path("/"),
		csrf.SameSite(csrf.SameSiteLaxMode),
		csrf.FieldName("gorilla.csrf.Token"),
	)
	r.Use(csrfMW)

	// Resolve the session cookie into the request context for every route.
	r.Use(h.LoadUser)

	// Static assets (CSS, vendored htmx), served from the embedded FS.
	r.Handle("/static/*", http.StripPrefix("/static/", http.FileServer(http.FS(staticFS))))

	// Public routes.
	r.Get("/", h.Home)
	r.Get("/healthz", h.Health)

	// Auth routes.
	r.Get("/register", h.RegisterForm)
	r.Post("/register", h.Register)
	r.Get("/login", h.LoginForm)
	r.Post("/login", h.Login)
	r.Post("/logout", h.Logout)
	r.Get("/forgot", h.ForgotForm)
	r.Post("/forgot", h.Forgot)
	r.Get("/reset/{token}", h.ResetForm)
	r.Post("/reset/{token}", h.Reset)

	// Authenticated routes.
	r.Group(func(pr chi.Router) {
		pr.Use(h.RequireAuth)
		pr.Get("/dashboard", h.Dashboard)
		pr.Post("/documents", h.UploadDocument)
	})

	return r
}

layout.templ MODIFY 10 lines changed

Edit this file in internal/web/

package web

// Layout is the shared HTML shell. Page templates call it and pass their body
// as children. htmx is vendored under /static/js so the app has no runtime CDN
// dependency.
templ Layout(title string, nav Nav) {
	<!DOCTYPE html>
	<html lang="en">
		<head>
			<meta charset="utf-8"/>
			<meta name="viewport" content="width=device-width, initial-scale=1"/>
			<meta name="csrf-token" content={ nav.CSRFToken }/>
			<title>{ title } · SignFlow</title>
			<link rel="stylesheet" href="/static/css/style.css"/>
			<script src="/static/js/htmx.min.js"></script>
			<script>
				// Attach the CSRF token to every htmx request as a header. gorilla/csrf
				// reads X-CSRF-Token before touching the body, so multipart uploads
				// aren't parsed twice.
				document.addEventListener('htmx:configRequest', function (e) {
					var m = document.querySelector('meta[name="csrf-token"]');
					if (m) e.detail.headers['X-CSRF-Token'] = m.getAttribute('content');
				});
			</script>
		</head>
		<body>
			<header class="topbar">
				<a href="/" class="brand">✍️ SignFlow</a>
				<nav class="topnav">
					if nav.LoggedIn {
						<a href="/dashboard">Dashboard</a>
						<span class="who">{ nav.Email }</span>
						<form method="post" action="/logout" class="inline-form">
							<input type="hidden" name="gorilla.csrf.Token" value={ nav.CSRFToken }/>
							<button type="submit" class="btn btn-ghost btn-sm">Log out</button>
						</form>
					} else {
						<a href="/login">Log in</a>
						<a href="/register" class="btn btn-primary btn-sm">Register</a>
					}
				</nav>
			</header>
			<main class="container">
				{ children... }
			</main>
			<footer class="footer">
				<p>SignFlow — reference app for the Programuoki server-side web track.</p>
			</footer>
		</body>
	</html>
}