Sessions & registration — server-side state

Code

Register, end to end

Now register, end to end. Six files as tabs, in dependency order: auth.templ → util.go → handlers.go → auth.go → router.go → main.go (the form, a helper, the struct that gains the session manager, the handler, the routes, the wiring). Three are modifications; the diffs carry lessons 1–3 forward.

1. internal/web/auth.templ (new) — the Register form. Plain HTML form fields with minlength/maxlength matching the 8–64 rule. (No CSRF field yet — lesson 6.)

2. internal/handlers/util.go (new) — one helper, isUniqueViolation, which recognises Postgres error 23505 (unique-constraint) so a duplicate-email race becomes a friendly message instead of a 500.

3. internal/handlers/handlers.go (modify) — the Handlers struct gains a Sessions *session.Manager field, New takes it, and a small serverError helper appears (log the real error, return a generic 500). Home and Health are unchanged.

4. internal/handlers/auth.go (new) — RegisterForm (render the form) and Register, which is the whole flow:

if !validEmail(emailAddr) { fail("Please enter a valid email address."); return }
if password != confirm    { fail("Passwords do not match."); return }
hash, err := auth.HashPassword(password)   // bcrypt; ErrPasswordLength → friendly message
// duplicate check (nice message) + CreateUser (handles the race via isUniqueViolation)
h.Sessions.Create(r.Context(), w, user.ID) // ← issues the session + sets the cookie
http.Redirect(w, r, "/", http.StatusSeeOther)

The redirect goes to / for now — the dashboard for signed-in users is lesson 5's job.

5. internal/handlers/router.go (modify) — two routes: GET /register (the form) and POST /register (the handler).

6. cmd/signflow/main.go (modify) — construct the manager and pass it in:

sessions := session.NewManager(queries, cfg.IsProd())
h := handlers.New(cfg, queries, sessions, log)

Verify. Regenerate and run:

sqlc generate && templ generate
go run ./cmd/signflow

Open http://localhost:8080/register, create an account (e.g. you@example.com / a password 8–64 chars). You're redirected home and the user count ticks up. Now inspect what happened:

$ psql signflow -c "SELECT email, left(password_hash, 7) AS hash_prefix FROM users;"
      email       | hash_prefix
------------------+-------------
 you@example.com  | $2a$12$          ← bcrypt, cost 12 ($2a$12$…)

$ psql signflow -c "SELECT left(token_hash, 12) AS stored, expires_at > now() AS live FROM sessions;"
    stored    | live
--------------+------
 3f9a1c2e...  | t             ← a SHA-256 HASH, not the cookie's token

And the cookie itself carries its flags:

$ curl -si -c /dev/null -X POST localhost:8080/register \
    -d 'email=x@y.co&password=password123&confirm=password123' | grep -i set-cookie
Set-Cookie: signflow_session=Xa9...; Path=/; Expires=...; HttpOnly; SameSite=Lax

HttpOnly and SameSite=Lax are present; Secure is absent because we're on http in dev (it appears in prod). The token in the cookie is not the value stored in the database — the DB has only its SHA-256.

Gotcha (bcrypt's 72-byte cliff). Try registering with a 100-character password: you get "Password must be between 8 and 64 characters." — rejected by our cap, before bcrypt would silently ignore everything past byte 72. Without the cap, two different long passwords sharing their first 72 bytes would be interchangeable at login. The fence matters.

auth.templ CREATE

Create this file in internal/web/

package web

templ Register(nav Nav, email, errMsg string) {
	@Layout("Register", nav) {
		<div class="card auth-card">
			<h1>Create your account</h1>
			if errMsg != "" {
				<div class="flash flash-error">{ errMsg }</div>
			}
			<form method="post" action="/register" class="form">
				<div class="field">
					<label for="email">Email</label>
					<input id="email" name="email" type="email" value={ email } required autofocus/>
				</div>
				<div class="field">
					<label for="password">Password</label>
					<input id="password" name="password" type="password" minlength="8" maxlength="64" required/>
				</div>
				<div class="field">
					<label for="confirm">Confirm password</label>
					<input id="confirm" name="confirm" type="password" minlength="8" maxlength="64" required/>
				</div>
				<button class="btn btn-primary" type="submit">Create account</button>
			</form>
			<p class="muted">Already have an account? <a href="/login">Log in</a>.</p>
		</div>
	}
}

util.go CREATE

Create this file in internal/handlers/

package handlers

import (
	"errors"

	"github.com/jackc/pgx/v5/pgconn"
)

// isUniqueViolation reports whether err is a Postgres unique-constraint error
// (SQLSTATE 23505), so we can turn a duplicate-email race into a friendly message.
func isUniqueViolation(err error) bool {
	var pgErr *pgconn.PgError
	return errors.As(err, &pgErr) && pgErr.Code == "23505"
}

handlers.go MODIFY 15 lines changed

Edit this file in internal/handlers/

// Package handlers holds the HTTP handlers. In this skeleton there is only the
// home page and a health check; later lessons add auth, documents, and signing.
package handlers

import (
	"log/slog"
	"net/http"

	"github.com/programuoki/signflow/internal/config"
	"github.com/programuoki/signflow/internal/db"
	"github.com/programuoki/signflow/internal/session"
	"github.com/programuoki/signflow/internal/web"
)

// Handlers bundles the dependencies every handler needs. Constructed once in
// main; its methods are registered on the router. It gains a Sessions manager
// here; the mailer arrives in lesson 7.
type Handlers struct {
	Cfg      config.Config
	Queries  *db.Queries
	Sessions *session.Manager
	Log      *slog.Logger
}

func New(cfg config.Config, q *db.Queries, sessions *session.Manager, log *slog.Logger) *Handlers {
	return &Handlers{Cfg: cfg, Queries: q, Sessions: sessions, Log: log}
}

// Home renders the landing page, including a live user count read from Postgres
// — proof the whole stack is wired end to end.
func (h *Handlers) Home(w http.ResponseWriter, r *http.Request) {
	count, err := h.Queries.CountUsers(r.Context())
	if err != nil {
		h.Log.Error("count users", "err", err)
		http.Error(w, "internal error", http.StatusInternalServerError)
		return
	}
	render(w, r, http.StatusOK, web.Home(count))
}

// Health is a liveness probe for Railway / uptime checks. It also pings the DB,
// so an unreachable database reports unhealthy rather than silently serving 500s.
func (h *Handlers) Health(w http.ResponseWriter, r *http.Request) {
	if _, err := h.Queries.CountUsers(r.Context()); err != nil {
		http.Error(w, "db unavailable", http.StatusServiceUnavailable)
		return
	}
	w.Header().Set("Content-Type", "text/plain")
	_, _ = w.Write([]byte("ok"))
}

// serverError logs the underlying error and returns a generic 500 to the client.
func (h *Handlers) serverError(w http.ResponseWriter, r *http.Request, msg string, err error) {
	h.Log.Error(msg, "err", err, "path", r.URL.Path)
	http.Error(w, "internal server error", http.StatusInternalServerError)
}

auth.go CREATE

Create this file in internal/handlers/

package handlers

import (
	"errors"
	"net/http"
	"net/mail"
	"strings"

	"github.com/jackc/pgx/v5"

	"github.com/programuoki/signflow/internal/auth"
	"github.com/programuoki/signflow/internal/db"
	"github.com/programuoki/signflow/internal/web"
)

func (h *Handlers) RegisterForm(w http.ResponseWriter, r *http.Request) {
	render(w, r, http.StatusOK, web.Register("", ""))
}

func (h *Handlers) Register(w http.ResponseWriter, r *http.Request) {
	emailAddr := normalizeEmail(r.FormValue("email"))
	password := r.FormValue("password")
	confirm := r.FormValue("confirm")

	fail := func(msg string) {
		render(w, r, http.StatusUnprocessableEntity, web.Register(emailAddr, msg))
	}

	if !validEmail(emailAddr) {
		fail("Please enter a valid email address.")
		return
	}
	if password != confirm {
		fail("Passwords do not match.")
		return
	}
	hash, err := auth.HashPassword(password)
	if errors.Is(err, auth.ErrPasswordLength) {
		fail("Password must be between 8 and 64 characters.")
		return
	}
	if err != nil {
		h.serverError(w, r, "hash password", err)
		return
	}

	// The UNIQUE constraint on email is the real guard; check first for a nice
	// message, and still handle the race by inspecting the insert error.
	if _, err := h.Queries.GetUserByEmail(r.Context(), emailAddr); err == nil {
		fail("That email is already registered. Try logging in.")
		return
	} else if !errors.Is(err, pgx.ErrNoRows) {
		h.serverError(w, r, "lookup user", err)
		return
	}

	user, err := h.Queries.CreateUser(r.Context(), db.CreateUserParams{
		Email:        emailAddr,
		PasswordHash: hash,
	})
	if err != nil {
		if isUniqueViolation(err) {
			fail("That email is already registered. Try logging in.")
			return
		}
		h.serverError(w, r, "create user", err)
		return
	}

	if err := h.Sessions.Create(r.Context(), w, user.ID); err != nil {
		h.serverError(w, r, "create session", err)
		return
	}
	h.Log.Info("user registered", "email", user.Email)
	// A dashboard for signed-in users arrives in lesson 5; for now, home.
	http.Redirect(w, r, "/", http.StatusSeeOther)
}

// --- helpers ---

func normalizeEmail(s string) string { return strings.ToLower(strings.TrimSpace(s)) }

func validEmail(s string) bool {
	if s == "" || len(s) > 254 {
		return false
	}
	_, err := mail.ParseAddress(s)
	return err == nil
}

router.go MODIFY 4 lines changed

Edit this file in internal/handlers/

package handlers

import (
	"io/fs"
	"net/http"

	"github.com/go-chi/chi/v5"
	"github.com/go-chi/chi/v5/middleware"
)

// Router builds the Chi router with the base middleware stack and serves the
// embedded static assets. Auth-protected route groups are added in lesson 5.
func (h *Handlers) Router(staticFS fs.FS) http.Handler {
	r := chi.NewRouter()

	// Base middleware, outermost first.
	r.Use(middleware.RequestID)
	r.Use(middleware.RealIP)
	r.Use(middleware.Logger)    // request logging
	r.Use(middleware.Recoverer) // turn panics into 500s instead of crashing

	// Static assets (CSS, vendored htmx), served from the embedded FS.
	r.Handle("/static/*", http.StripPrefix("/static/", http.FileServer(http.FS(staticFS))))

	r.Get("/", h.Home)
	r.Get("/healthz", h.Health)

	// Auth routes (login/logout arrive in lesson 5).
	r.Get("/register", h.RegisterForm)
	r.Post("/register", h.Register)

	return r
}

main.go MODIFY 3 lines changed

Edit this file in cmd/signflow/

// Command signflow is the HTTP server entrypoint.
//
// On startup it: loads config, runs embedded goose migrations, opens a pgx
// pool, builds the Chi router, and serves with graceful shutdown.
package main

import (
	"context"
	"errors"
	"fmt"
	"io/fs"
	"log/slog"
	"net/http"
	"os"
	"os/signal"
	"syscall"
	"time"

	"github.com/jackc/pgx/v5/stdlib"
	"github.com/pressly/goose/v3"

	migrations "github.com/programuoki/signflow/db"
	"github.com/programuoki/signflow/internal/config"
	"github.com/programuoki/signflow/internal/db"
	"github.com/programuoki/signflow/internal/handlers"
	"github.com/programuoki/signflow/internal/session"
	"github.com/programuoki/signflow/static"
)

func main() {
	log := slog.New(slog.NewTextHandler(os.Stdout, &slog.HandlerOptions{Level: slog.LevelInfo}))
	if err := run(log); err != nil {
		log.Error("fatal", "err", err)
		os.Exit(1)
	}
}

func run(log *slog.Logger) error {
	cfg, err := config.Load()
	if err != nil {
		return err
	}
	log.Info("starting signflow", "env", cfg.Env, "port", cfg.Port, "base_url", cfg.BaseURL)

	ctx := context.Background()

	// 1. Migrate. We use a throwaway database/sql handle (pgx stdlib driver)
	//    because goose speaks database/sql, then hand the app a pgx pool.
	if err := runMigrations(cfg.DatabaseURL, log); err != nil {
		return err
	}

	// 2. Connect the application pool the sqlc queries run against.
	pool, err := db.Connect(ctx, cfg.DatabaseURL)
	if err != nil {
		return err
	}
	defer pool.Close()

	queries := db.New(pool)
	sessions := session.NewManager(queries, cfg.IsProd())
	h := handlers.New(cfg, queries, sessions, log)

	staticFS, err := fs.Sub(static.FS, "assets")
	if err != nil {
		return err
	}

	srv := &http.Server{
		Addr:              ":" + cfg.Port,
		Handler:           h.Router(staticFS),
		ReadHeaderTimeout: 10 * time.Second,
	}

	// Graceful shutdown: stop accepting on SIGINT/SIGTERM, then drain in-flight
	// requests for up to 15s before exiting.
	shutdownCtx, stop := signal.NotifyContext(ctx, os.Interrupt, syscall.SIGTERM)
	defer stop()

	go func() {
		log.Info("listening", "addr", srv.Addr)
		if err := srv.ListenAndServe(); err != nil && !errors.Is(err, http.ErrServerClosed) {
			log.Error("server error", "err", err)
			stop()
		}
	}()

	<-shutdownCtx.Done()
	log.Info("shutting down")

	timeout, cancel := context.WithTimeout(context.Background(), 15*time.Second)
	defer cancel()
	return srv.Shutdown(timeout)
}

// runMigrations applies all pending goose migrations from the embedded FS.
func runMigrations(databaseURL string, log *slog.Logger) error {
	sqlDB, err := goose.OpenDBWithDriver("pgx", databaseURL)
	if err != nil {
		return err
	}
	defer sqlDB.Close()

	goose.SetBaseFS(migrations.FS)
	goose.SetLogger(gooseLogger{log})
	if err := goose.SetDialect("postgres"); err != nil {
		return err
	}
	return goose.Up(sqlDB, "migrations")
}

// gooseLogger adapts slog to goose's logger interface.
type gooseLogger struct{ log *slog.Logger }

func (g gooseLogger) Fatalf(format string, v ...interface{}) {
	g.log.Error("goose", "msg", fmt.Sprintf(format, v...))
}
func (g gooseLogger) Printf(format string, v ...interface{}) {
	g.log.Info("goose", "msg", fmt.Sprintf(format, v...))
}

// ensure the pgx stdlib driver is registered for goose.OpenDBWithDriver("pgx", ...)
var _ = stdlib.GetDefaultDriver