Implement basic auth

web/main.go

@@ -16,9 +16,11 @@ import (
 	"github.com/dominicf2001/comfychan/internal/database"
 	"github.com/dominicf2001/comfychan/internal/util"
 	"github.com/dominicf2001/comfychan/web/views"
+	"github.com/dominicf2001/comfychan/web/views/admin"
 	"github.com/go-chi/chi/v5"
 	"github.com/go-chi/chi/v5/middleware"
 	_ "github.com/mattn/go-sqlite3"
+	"golang.org/x/crypto/bcrypt"
 )
 
 var dev = true
@@ -324,7 +326,7 @@ func main() {
 	// -----------------
 
 	// -----------------
-	// PARTIALS (htmx)
+	// PARTIAL ROUTES (htmx)
 	// -----------------
 
 	// CATALOG
@@ -402,6 +404,82 @@ func main() {
 
 	// -----------------
 
+	// -----------------
+	// ADMIN ROUTES (htmx)
+	// -----------------
+
+	r.Get("/admin/login", func(w http.ResponseWriter, r *http.Request) {
+		fmt.Println(util.AdminSessions)
+		admin.AdminLogin().Render(r.Context(), w)
+	})
+
+	r.Post("/admin/login", func(w http.ResponseWriter, r *http.Request) {
+		username := r.FormValue("username")
+		password := r.FormValue("password")
+
+		admin, err := database.GetAdmin(db, username)
+		if err != nil {
+			http.Error(w, "Invalid login", http.StatusUnauthorized)
+			return
+		}
+
+		err = bcrypt.CompareHashAndPassword([]byte(admin.Password), []byte(password))
+		if err != nil {
+			http.Error(w, "Invalid login", http.StatusUnauthorized)
+			return
+		}
+
+		token, err := util.GenToken()
+		if err != nil {
+			http.Error(w, "Failed to generate token", http.StatusInternalServerError)
+			return
+		}
+
+		tokenValidUntil := time.Now().Add(time.Hour)
+		util.CreateAdminSession(token, util.AdminSession{
+			Username:   username,
+			Expiration: tokenValidUntil,
+		})
+
+		http.SetCookie(w, &http.Cookie{
+			Name:     "comfy_admin",
+			Value:    token,
+			HttpOnly: true,
+			Secure:   !dev,
+			Expires:  tokenValidUntil,
+			SameSite: http.SameSiteStrictMode,
+			Path:     "/",
+		})
+
+	})
+
+	r.Post("/admin/logout", func(w http.ResponseWriter, r *http.Request) {
+		if c, err := r.Cookie("comfy_admin"); err == nil {
+			util.DeleteAdminSession(c.Value)
+		}
+		http.SetCookie(w, &http.Cookie{
+			Name:     "comfy_admin",
+			Value:    "",
+			HttpOnly: true,
+			Secure:   !dev,
+			Expires:  time.Now(),
+			SameSite: http.SameSiteStrictMode,
+			Path:     "/",
+		})
+	})
+
+	r.Get("/admin/me", func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "text/plain; charset=utf-8")
+
+		if c, err := r.Cookie("comfy_admin"); err == nil && util.IsAdminSessionValid(c.Value) {
+			w.Write([]byte("true"))
+		} else {
+			w.Write([]byte("false"))
+		}
+	})
+
+	// -----------------
+
 	// -----------------
 	// CLEANUP
 	// -----------------

web/static/index.css

@@ -277,6 +277,24 @@ body {
     color: #D00;
 }
 
+/* ADMIN */
+
+
+.admin-login-container {
+    width: max-content;
+    margin: auto;
+    margin-top: 32px;
+}
+
+#adminLoginForm form {
+    margin: auto;
+}
+
+#adminLoginForm button {
+    display: block;
+    margin-left: auto;
+}
+
 /* GENERAL LAYOUT */
 
 .container {

web/views/admin/login.templ

@@ -0,0 +1,44 @@
+package admin
+
+import "github.com/dominicf2001/comfychan/web/views/shared"
+
+templ AdminLogin() {
+	@shared.Layout() {
+		<div class="admin-login-container">
+			<div style="display: none" id="adminLoginWarning" class="warning"></div>
+			<form
+				hx-post="/admin/login"
+				hx-swap="none"
+				id="adminLoginForm"
+				_="
+					on htmx:beforeRequest toggle @disabled on <button/> until htmx:afterRequest
+					on htmx:afterRequest
+					if event.detail.xhr.status is 401 
+						show #adminLoginWarning
+						put event.detail.xhr.responseText into #adminLoginWarning
+					else
+						go to url / 
+					end
+				  "
+			>
+				<table>
+					<tbody>
+						<tr
+							class="new-post-form-field"
+						>
+							<th>Username</th>
+							<td><input required name="username"/></td>
+						</tr>
+						<tr
+							class="new-post-form-field"
+						>
+							<th>Password</th>
+							<td><input type="password" required name="password"/></td>
+						</tr>
+					</tbody>
+				</table>
+				<button type="submit">Submit</button>
+			</form>
+		</div>
+	}
+}

web/views/shared/form.templ

@@ -14,7 +14,6 @@ templ NewPostForm(board database.Board, endpoint string, isForThread bool) {
 		hx-post={ endpoint }
 		_="
 			on htmx:beforeRequest toggle @disabled on <button/> until htmx:afterRequest
-
 			on htmx:afterRequest
 			  if isHttpWarningStatus(event.detail.xhr.status)
 				show #newPostWarning