build: bundle alpinejs and htmx during build but do not include in repository

.gitignore

···
 /node_modules/
 /tmp
 /static/css/styles.css
+/static/js/
 /internal/pkg/persistence
 .env

internal/pkg/routes/api/v1/blog_api.go

···
 
 	"github.com/google/uuid"
 
+	"github.com/STBoyden/go-portfolio/internal/pkg/common/consts"
 	"github.com/STBoyden/go-portfolio/internal/pkg/common/types"
 	"github.com/STBoyden/go-portfolio/internal/pkg/common/utils"
 	"github.com/STBoyden/go-portfolio/internal/pkg/middleware"
···
 	"github.com/STBoyden/go-portfolio/internal/pkg/routes/site/views/components"
 )
 
+//nolint:gochecknoglobals // These are only accessible in the v1 package, and are not globally accessible by other packages.
+var (
+	adminUsername string
+	adminPassword string
+)
+
+const blogAuthLogTag string = "blog-auth"
+
 func blogAdmin() *http.ServeMux {
-	r := http.NewServeMux()
+	mux := http.NewServeMux()
 
-	r.HandleFunc("POST /new-post/{slug}", func(_w http.ResponseWriter, r *http.Request) {
+	mux.HandleFunc("POST /new-post/{slug}", func(_w http.ResponseWriter, r *http.Request) {
 		w := utils.MustCast[middleware.AuthMiddleware](_w)
 
 		if _, authed := w.Details(); !authed {
+			w.Log(middleware.Info, "user is not authorised to create a new post")
 			w.PrepareHeader(http.StatusUnauthorized)
 			return
 		}
 
 		reader, err := r.GetBody()
 		if err != nil {
+			w.Log(middleware.Info, "given request has no body. body len <= 0")
 			w.PrepareHeader(http.StatusBadRequest)
 			return
 		}
···
 
 		buffer, err := io.ReadAll(reader)
 		if err != nil {
+			w.Log(middleware.Info, "body was malformed and could not be read properly")
 			w.PrepareHeader(http.StatusBadRequest)
 			return
 		}
 
 		slug := r.PathValue("slug")
 		if slug == "" {
+			w.Log(middleware.Info, "slug was not present in path")
 			w.PrepareHeader(http.StatusBadRequest)
 			return
 		}
···
 		blogContent := types.BlogContent{}
 		err = json.Unmarshal(buffer, &blogContent)
 		if err != nil {
+			w.Log(middleware.Info, "body was not in the correct format and could not be parsed: %v", err)
 			w.PrepareHeader(http.StatusBadRequest)
 			return
 		}
···
 		}
 	})
 
-	return r
-}
-
-func BlogAPI() *http.ServeMux {
-	adminUser := utils.MustEnv("ADMIN_USER")
-	adminPass := utils.MustEnv("ADMIN_PW")
+	mux.HandleFunc("GET /posts", func(_w http.ResponseWriter, r *http.Request) {
+		w := utils.MustCast[middleware.AuthMiddleware](_w)
 
-	r := http.NewServeMux()
+		if _, authed := w.Details(); !authed {
+			w.Log(middleware.Info, "user is not authorised to get unpublished posts")
+			w.PrepareHeader(http.StatusUnauthorized)
+			return
+		}
 
-	r.HandleFunc("GET /posts", func(w http.ResponseWriter, r *http.Request) {
 		queries := persistence.New(utils.Database)
-		posts, err := queries.GetPosts(r.Context())
+		posts, err := queries.GetAllPosts(r.Context())
 		if err != nil {
 			_ = components.Error().Render(r.Context(), w)
 			return
 		}
 
-		_ = components.PostList(posts).Render(r.Context(), w)
+		_ = components.PostList(posts, true).Render(r.Context(), w)
 	})
 
-	// responds with a status code relevant to the authentication status of the user.
-	// 200: the user is authenticated and cookie is outside of a 30 minute expiration warning.
-	// 202: the user is authenticated and cookie is within a 30 minute expiration warning.
-	// 401: the user is not authenticated.
-	r.HandleFunc("POST /check-authentication", func(_w http.ResponseWriter, r *http.Request) {
-		w := utils.MustCast[middleware.LoggingMiddleware](_w)
+	return mux
+}
 
-		cookie, err := r.Cookie("token")
-		if err != nil {
-			w.PrepareHeader(http.StatusUnauthorized)
-			return
-		}
+// checkAuthentication checks the authentication of the request and responds
+// with whether the request has valid authentication.
+func checkAuthentication(_w http.ResponseWriter, r *http.Request) {
+	w := utils.MustCast[middleware.LoggingMiddleware](_w)
 
-		if cookie.Expires.Before(time.Now()) {
-			w.PrepareHeader(http.StatusUnauthorized)
-			return
-		} else if cookie.Expires.Before(time.Now().Add(30 * time.Minute)) {
-			// if the cookie is about to expire, warn the user that they will
-			// need to re-authenticate soon. use a 202 status code to indicate
-			// this to the front-end.
-			w.PrepareHeader(http.StatusAccepted)
-		}
+	cookie, err := r.Cookie(consts.TokenCookieName)
+	if err != nil {
+		w.Log(middleware.Info, blogAuthLogTag, "token cookie was missing from client request")
+		w.PrepareHeader(http.StatusUnauthorized)
+		return
+	}
 
-		token, err := uuid.Parse(cookie.Value)
-		if err != nil {
-			w.PrepareHeader(http.StatusUnauthorized)
-			return
-		}
+	token, err := uuid.Parse(cookie.Value)
+	if err != nil {
+		w.Log(middleware.Info, blogAuthLogTag, "token form cookie was invalid")
+		w.PrepareHeader(http.StatusUnauthorized)
+		return
+	}
 
-		queries := persistence.New(utils.Database)
-		exists, err := queries.CheckAuthExists(r.Context(), token)
-		if !exists || err != nil {
-			w.PrepareHeader(http.StatusUnauthorized)
-			return
-		}
+	queries := persistence.New(utils.Database)
+	authorisation, err := queries.GetAuthByToken(r.Context(), token)
+	if err != nil {
+		w.Log(middleware.Warn, blogAuthLogTag, "internal error occurred: de-authing user just in case: could not get authorisation token: %v", err)
+		w.PrepareHeader(http.StatusUnauthorized)
+		return
+	}
 
-		expired, err := queries.CheckIfAuthExpired(r.Context(), token)
-		if expired || err != nil {
-			w.PrepareHeader(http.StatusUnauthorized)
-			return
-		}
-	})
+	if authorisation.Expiry.Before(time.Now()) {
+		w.Log(middleware.Info, blogAuthLogTag, "token associated with request has expired")
+		w.PrepareHeader(http.StatusUnauthorized)
+		return
+	} else if authorisation.Expiry.Before(time.Now().Add(30 * time.Minute)) {
+		// if the token is within 30 minutes of expiration, return a 202
+		// status code so that the front-end may warn the user.
+		w.PrepareHeader(http.StatusAccepted)
+	}
+}
 
-	r.HandleFunc("POST /authenticate", func(_w http.ResponseWriter, r *http.Request) {
-		w := utils.MustCast[middleware.LoggingMiddleware](_w)
+// authenticate creates a new authentication for a user if they have provided
+// the correct login details and returns a cookie with a auth token.
+func authenticate(_w http.ResponseWriter, r *http.Request) {
+	w := utils.MustCast[middleware.LoggingMiddleware](_w)
 
-		onError := func(statusCode int) {
-			w.PrepareHeader(statusCode)
-			_ = components.Error().Render(r.Context(), w)
-		}
+	onError := func(statusCode int) {
+		w.PrepareHeader(statusCode)
+		_ = components.Error().Render(r.Context(), w)
+	}
 
-		headerContent, ok := r.Header["Authorization"]
-		if !ok {
-			onError(http.StatusBadRequest)
-			return
-		}
+	headerContent, ok := r.Header["Authorization"]
+	if !ok {
+		w.Log(middleware.Info, blogAuthLogTag, "authorization header missing")
+		onError(http.StatusBadRequest)
+		return
+	}
 
-		authorisation := strings.Join(headerContent, " ")
-		if authorisation == "" {
-			onError(http.StatusBadRequest)
-			return
-		}
+	authorisation := strings.Join(headerContent, " ")
+	if authorisation == "" {
+		w.Log(middleware.Info, blogAuthLogTag, "authorization header content is empty")
+		onError(http.StatusBadRequest)
+		return
+	}
 
-		username, password, ok := r.BasicAuth()
-		if username == "" || password == "" || !ok {
-			onError(http.StatusBadRequest)
-			return
-		}
+	username, password, ok := r.BasicAuth()
+	if username == "" || password == "" || !ok {
+		w.Log(middleware.Info, blogAuthLogTag, "given username and/or password are empty")
+		onError(http.StatusBadRequest)
+		return
+	}
 
-		h := sha512.Sum512([]byte(password))
-		passwordHashed := hex.EncodeToString(h[:])
+	h := sha512.Sum512([]byte(password))
+	passwordHashed := hex.EncodeToString(h[:])
 
-		if username != adminUser || passwordHashed != adminPass {
-			onError(http.StatusUnauthorized)
-			return
-		}
+	if username != adminUsername || passwordHashed != adminPassword {
+		w.Log(middleware.Info, blogAuthLogTag, "given username and/or password hash does not match administrator details")
+		onError(http.StatusUnauthorized)
+		return
+	}
 
+	queries := persistence.New(utils.Database)
+	auth, err := queries.NewAuth(r.Context())
+	if err != nil {
+		panic(fmt.Sprintf("unable to create a new token: %v", err))
+	}
+
+	w.Header().Add("HX-Trigger", "login-page-reload")
+	http.SetCookie(w, &http.Cookie{
+		Name:     consts.TokenCookieName,
+		Value:    auth.ID.String(),
+		Expires:  auth.Expiry,
+		Path:     "/",
+		Secure:   true,
+		HttpOnly: true,
+		SameSite: http.SameSiteLaxMode,
+	})
+
+	w.Log(middleware.Info, blogAuthLogTag, "setting cookie %s", consts.TokenCookieName)
+}
+
+func BlogAPI() *http.ServeMux {
+	adminUsername = utils.MustEnv("ADMIN_USER")
+	adminPassword = utils.MustEnv("ADMIN_PW")
+
+	mux := http.NewServeMux()
+
+	mux.HandleFunc("GET /posts", func(w http.ResponseWriter, r *http.Request) {
 		queries := persistence.New(utils.Database)
-		auth, err := queries.NewAuth(r.Context())
+		posts, err := queries.GetPublishedPosts(r.Context())
 		if err != nil {
-			panic(fmt.Sprintf("unable to create a new token: %v", err))
+			_ = components.Error().Render(r.Context(), w)
+			return
 		}
 
-		http.SetCookie(w, &http.Cookie{
-			Name:    "token",
-			Value:   auth.ID.String(),
-			Expires: auth.Expiry,
-		})
-
-		w.PrepareHeader(http.StatusOK)
+		_ = components.PostList(posts, false).Render(r.Context(), w)
 	})
 
-	r.Handle("/admin/", middleware.Handlers.Authorisation(http.StripPrefix("/admin", blogAdmin())))
+	mux.Handle("/admin/", middleware.Handlers.Authorisation(http.StripPrefix("/admin", blogAdmin())))
 
-	return r
+	// responds with a status code relevant to the authentication status of the user.
+	// 200: the user is authenticated and cookie is outside of a 30 minute
+	// 		expiration warning.
+	// 202: the user is authenticated and cookie is within a 30 minute
+	// 		expiration warning.
+	// 401: the user is not authenticated.
+	mux.HandleFunc("POST /check-authentication", checkAuthentication)
+
+	// authenticates a user to be able to use the /admin/ endpoints and redirects to the page
+	mux.HandleFunc("POST /authenticate", authenticate)
+
+	return mux
 }

internal/pkg/routes/site/views/root.templ

···
 		<head>
 			<title>Samuel Boyden</title>
 			<link href="/static/css/styles.css" rel="stylesheet"/>
-			<script src="https://unpkg.com/htmx.org@2.0.4" integrity="sha384-HGfztofotfshcF7+8n44JQL2oJmowVChPTg48S+jvZoztPfvwD79OC/LTtG6dMp+" crossorigin="anonymous"></script>
-			<script src="//unpkg.com/alpinejs" defer></script>
+			<script src="/static/js/htmx.min.js"></script>
+			<script src="/static/js/alpinejs.min.js" defer></script>
 			<meta name="viewport" content="width=device-width, initial-scale=1.0"/>
 		</head>
 		<body>

justfile

···
 install_deps:
     pnpm install
+    mkdir -p static/js
+    cp node_modules/htmx.org/dist/htmx.min.js static/js
+    cp node_modules/alpinejs/dist/cdn.min.js static/js/alpinejs.min.js
     go mod download
     go mod verify
 
-generate:
+generate: install_deps
     go generate ./internal/pkg/routes/site
     node_modules/.bin/tailwindcss -i ./static/css/_styles.css -o ./static/css/styles.css
 

package.json

···
     ]
   },
   "devDependencies": {
+    "alpinejs": "^3.14.9",
     "daisyui": "^5.0.6",
+    "htmx.org": "^1.9.12",
     "rust-just": "^1.40.0"
   },
   "dependencies": {

pnpm-lock.yaml

···
         specifier: ^4.0.14
         version: 4.0.14
     devDependencies:
+      alpinejs:
+        specifier: ^3.14.9
+        version: 3.14.9
       daisyui:
         specifier: ^5.0.6
         version: 5.0.6
+      htmx.org:
+        specifier: ^1.9.12
+        version: 1.9.12
       rust-just:
         specifier: ^1.40.0
         version: 1.40.0
···
     resolution: {integrity: sha512-M8VCNyO/NBi5vJ2cRcI9u8w7Si+i76a7o1vveoGtbbjpEYJZYiyc7f2VGps/DqawO56l3tImIbq2OT/533jcrA==}
     engines: {node: '>= 10'}
 
+  '@vue/reactivity@3.1.5':
+    resolution: {integrity: sha512-1tdfLmNjWG6t/CsPldh+foumYFo3cpyCHgBYQ34ylaMsJ+SNHQ1kApMIa8jN+i593zQuaw3AdWH0nJTARzCFhg==}
+
+  '@vue/shared@3.1.5':
+    resolution: {integrity: sha512-oJ4F3TnvpXaQwZJNF3ZK+kLPHKarDmJjJ6jyzVNDKH9md1dptjC7lWR//jrGuLdek/U6iltWxqAnYOu8gCiOvA==}
+
+  alpinejs@3.14.9:
+    resolution: {integrity: sha512-gqSOhTEyryU9FhviNqiHBHzgjkvtukq9tevew29fTj+ofZtfsYriw4zPirHHOAy9bw8QoL3WGhyk7QqCh5AYlw==}
+
   ansi-regex@5.0.1:
     resolution: {integrity: sha512-quJQXlTSUGL2LH9SUXo8VwsY4soanhgo6LNSm84E1LBcE8s3O0wpdiRzyR9z/ZZJMlMWv37qOOb9pdJlMUEKFQ==}
     engines: {node: '>=8'}
···
 
   graceful-fs@4.2.11:
     resolution: {integrity: sha512-RbJ5/jmFcNNCcDV5o9eTnBLJ/HszWV0P73bc+Ff4nS/rJj+YaS6IGyiOL0VoBYX+l1Wrl3k63h/KrH+nhJ0XvQ==}
+
+  htmx.org@1.9.12:
+    resolution: {integrity: sha512-VZAohXyF7xPGS52IM8d1T1283y+X4D+Owf3qY1NZ9RuBypyu9l8cGsxUMAG5fEAb/DhT7rDoJ9Hpu5/HxFD3cw==}
 
   human-signals@8.0.0:
     resolution: {integrity: sha512-/1/GPCpDUCCYwlERiYjxoczfP0zfvZMU/OWgQPMya9AbAE24vseigFdhAMObpc8Q4lc/kjutPfUddDYyAmejnA==}
···
       '@tailwindcss/oxide-win32-arm64-msvc': 4.0.14
       '@tailwindcss/oxide-win32-x64-msvc': 4.0.14
 
+  '@vue/reactivity@3.1.5':
+    dependencies:
+      '@vue/shared': 3.1.5
+
+  '@vue/shared@3.1.5': {}
+
+  alpinejs@3.14.9:
+    dependencies:
+      '@vue/reactivity': 3.1.5
+
   ansi-regex@5.0.1: {}
 
   ansi-styles@4.3.0:
···
       is-stream: 4.0.1
 
   graceful-fs@4.2.11: {}
+
+  htmx.org@1.9.12: {}
 
   human-signals@8.0.0: {}