Update README.md

.gitignore

@@ -1,4 +1,26 @@
+# GoWeb specific
 env.json
 logs/
 *.log
+
+# Binaries for programs and plugins
+*.exe
+*.exe~
+*.dll
+*.so
+*.dylib
+
+# Test binary, built with `go test -c`
+*.test
+
+# Output of the go coverage tool, specifically when used with LiteIDE
+*.out
+
+# Dependency directories
+vendor/
+
+# Go workspace file
+go.work
+
+# IDE files
 /.idea

README.md

@@ -0,0 +1,59 @@
+# GoWeb 🌐
+
+GoWeb is a simple Go web framework that aims to only use the standard library. The overall file structure and
+development flow is inspired by larger frameworks like Laravel. It is partially ready for smaller projects if you are
+fine with getting your hands dirty, but I plan on having it ready to go for more serious projects when it hits version
+2.0.
+
+<hr>
+
+## Current features 🚀
+
+- Routing/controllers
+- Templating
+- Simple database migration system
+- CSRF protection
+- Minimal user login/registration + sessions
+- Config file handling
+- Entire website compiles into a single binary (~10mb) (excluding env.json)
+- Minimal dependencies (just standard library, postgres driver, and experimental package for bcrypt)
+
+<hr>
+
+## When to use 🙂
+
+- You need to build a dynamic web application with persistent data
+- You need to build a dynamic website using Go and need a good starting point
+- You need to build an API in Go and don't know where to start
+- Pretty much any use-case where you would use Laravel, Django, or Flask
+
+## When not to use 🙃
+
+- You need a static website (see [Hugo](https://gohugo.io/))
+- You need a simple blog (see [Hugo](https://gohugo.io/))
+- You need a simple site for your projects' documentation (see [Hugo](https://gohugo.io/))
+
+## How to use 🤔
+
+1. Clone
+2. Run `go get` to install dependencies
+3. Copy env_example.json to env.json and fill in the values
+4. Run `go run main.go` to start the server
+5. Start building your app!
+
+## How to contribute 👨‍💻
+
+- Open an issue on GitHub if you find a bug or have a feature request.
+- [Email](mailto:contact@mpatterson.xyz) me a patch if you want to contribute code.
+    - Please include a good description of what the patch does and why it is needed, also include how you want to be
+      credited in the commit message.
+
+<hr>
+
+### License and disclaimer 😤
+
+- You are free to use this project under the terms of the MIT license. See LICENSE for more details.
+- You and you alone are responsible for the security and everything else regarding your application.
+- It is not required, but I ask that when you use this project you give me credit by linking to this repository.
+- I also ask that when releasing self-hosted or other end-user applications that you release it under
+  the [GPLv3](https://www.gnu.org/licenses/gpl-3.0.html) license. This too is not required, but I would appreciate it.

go.mod

@@ -4,5 +4,5 @@ go 1.20
 
 require (
 	github.com/lib/pq v1.10.7
-	golang.org/x/crypto v0.6.0
+	golang.org/x/crypto v0.7.0
 )

go.sum

@@ -1,4 +1,4 @@
 github.com/lib/pq v1.10.7 h1:p7ZhMD+KsSRozJr34udlUrhboJwWAgCg34+/ZZNvZZw=
 github.com/lib/pq v1.10.7/go.mod h1:AlVN5x4E4T544tWzH6hKfbfQvm3HdbOxrmggDNAPY9o=
-golang.org/x/crypto v0.6.0 h1:qfktjS5LUO+fFKeJXZ+ikTRijMmljikvG68fpMMruSc=
+golang.org/x/crypto v0.7.0 h1:AvwMYaRytfdeVt3u6mLaxYtErKYjxA2OXjJ1HHq6t3A=
-golang.org/x/crypto v0.6.0/go.mod h1:OFC/31mSvZgRz0V1QTNCzfAI1aIRzbiufJtkMIlEp58=
+golang.org/x/crypto v0.7.0/go.mod h1:pYwdfH91IfpZVANVyUOhSIPZaFoJGxTFbZhFTx+dXZU=

models/migrations.go

@@ -13,7 +13,6 @@ func RunAllMigrations(app *app.App) error {
 		Id:        1, // Id is handled automatically, but it is added here to show it will be skipped during column creation
 		Username:  "migrate",
 		Password:  "migrate",
-		AuthToken: "migrate",
 		CreatedAt: time.Now(),
 		UpdatedAt: time.Now(),
 	}
@@ -22,5 +21,16 @@ func RunAllMigrations(app *app.App) error {
 		return err
 	}
 
+	session := Session{
+		Id:        1,
+		UserId:    1,
+		AuthToken: "migrate",
+		CreatedAt: time.Now(),
+	}
+	err = database.Migrate(app, session)
+	if err != nil {
+		return err
+	}
+
 	return nil
 }

models/session.go

@@ -0,0 +1,114 @@
+package models
+
+import (
+	"GoWeb/app"
+	"crypto/rand"
+	"encoding/hex"
+	"log"
+	"net/http"
+	"time"
+)
+
+type Session struct {
+	Id        int64
+	UserId    int64
+	AuthToken string
+	CreatedAt time.Time
+}
+
+const sessionColumnsNoId = "\"UserId\", \"AuthToken\", \"CreatedAt\""
+const sessionColumns = "\"Id\", " + sessionColumnsNoId
+const sessionTable = "public.\"Session\""
+
+const (
+	selectSessionByAuthToken = "SELECT " + sessionColumns + " FROM " + sessionTable + " WHERE \"AuthToken\" = $1"
+	selectAuthTokenIfExists  = "SELECT EXISTS(SELECT 1 FROM " + sessionTable + " WHERE \"AuthToken\" = $1)"
+	insertSession            = "INSERT INTO " + sessionTable + " (" + sessionColumnsNoId + ") VALUES ($1, $2, $3) RETURNING \"Id\""
+	deleteSessionByAuthToken = "DELETE FROM " + sessionTable + " WHERE \"AuthToken\" = $1"
+)
+
+// CreateSession creates a new session for a user
+func CreateSession(app *app.App, w http.ResponseWriter, userId int64) (Session, error) {
+	session := Session{}
+	session.UserId = userId
+	session.AuthToken = generateAuthToken(app)
+	session.CreatedAt = time.Now()
+
+	// If the AuthToken column for any user matches the token, set existingAuthToken to true
+	var existingAuthToken bool
+	err := app.Db.QueryRow(selectAuthTokenIfExists, session.AuthToken).Scan(&existingAuthToken)
+	if err != nil {
+		log.Println("Error checking for existing auth token")
+		log.Println(err)
+		return Session{}, err
+	}
+
+	// If duplicate token found, recursively call function until unique token is generated
+	if existingAuthToken == true {
+		log.Println("Duplicate token found in sessions table, generating new token...")
+		return CreateSession(app, w, userId)
+	}
+
+	// Insert session into database
+	err = app.Db.QueryRow(insertSession, session.UserId, session.AuthToken, session.CreatedAt).Scan(&session.Id)
+	if err != nil {
+		log.Println("Error inserting session into database")
+		return Session{}, err
+	}
+
+	createSessionCookie(app, w, session)
+	return session, nil
+}
+
+// Generates a random 64-byte string
+func generateAuthToken(app *app.App) string {
+	// Generate random bytes
+	b := make([]byte, 64)
+	_, err := rand.Read(b)
+	if err != nil {
+		log.Println("Error generating random bytes")
+	}
+
+	// Convert random bytes to hex string
+	return hex.EncodeToString(b)
+}
+
+// createSessionCookie creates a new session cookie
+func createSessionCookie(app *app.App, w http.ResponseWriter, session Session) {
+	cookie := &http.Cookie{
+		Name:     "session",
+		Value:    session.AuthToken,
+		Path:     "/",
+		MaxAge:   86400,
+		HttpOnly: true,
+		Secure:   true,
+	}
+
+	http.SetCookie(w, cookie)
+}
+
+// deleteSessionCookie deletes the session cookie
+func deleteSessionCookie(app *app.App, w http.ResponseWriter) {
+	cookie := &http.Cookie{
+		Name:   "session",
+		Value:  "",
+		Path:   "/",
+		MaxAge: -1,
+	}
+
+	http.SetCookie(w, cookie)
+}
+
+// DeleteSessionByAuthToken deletes a session from the database by AuthToken
+func DeleteSessionByAuthToken(app *app.App, w http.ResponseWriter, authToken string) error {
+	// Delete session from database
+	_, err := app.Db.Exec(deleteSessionByAuthToken, authToken)
+	if err != nil {
+		log.Println("Error deleting session from database")
+		return err
+	}
+
+	deleteSessionCookie(app, w)
+
+	return nil
+}

models/user.go

@@ -2,11 +2,7 @@ package models
 
 import (
 	"GoWeb/app"
-	"crypto/rand"
-	"database/sql"
-	"encoding/hex"
 	"log"
-	"math"
 	"net/http"
 	"strconv"
 	"time"
@@ -18,24 +14,33 @@ type User struct {
 	Id        int64
 	Username  string
 	Password  string
-	AuthToken string
 	CreatedAt time.Time
 	UpdatedAt time.Time
 }
 
+const userColumnsNoId = "\"Username\", \"Password\", \"CreatedAt\", \"UpdatedAt\""
+const userColumns = "\"Id\", " + userColumnsNoId
+const userTable = "public.\"User\""
+
+const (
+	selectSessionIdByAuthToken = "SELECT \"Id\" FROM public.\"Session\" WHERE \"AuthToken\" = $1"
+	selectUserById             = "SELECT " + userColumns + " FROM " + userTable + " WHERE \"Id\" = $1"
+	selectUserByUsername       = "SELECT " + userColumns + " FROM " + userTable + " WHERE \"Username\" = $1"
+	insertUser                 = "INSERT INTO " + userTable + " (" + userColumnsNoId + ") VALUES ($1, $2, $3, $4) RETURNING \"Id\""
+)
+
 // GetCurrentUser finds the currently logged-in user by session cookie
 func GetCurrentUser(app *app.App, r *http.Request) (User, error) {
 	cookie, err := r.Cookie("session")
 	if err != nil {
 		log.Println("Error getting session cookie")
-		log.Println(err)
 		return User{}, err
 	}
 
 	var userId int64
 
-	// Query row by session cookie
+	// Query row by AuthToken
-	err = app.Db.QueryRow("SELECT \"Id\" FROM public.\"User\" WHERE \"AuthToken\" = $1", cookie.Value).Scan(&userId)
+	err = app.Db.QueryRow(selectSessionIdByAuthToken, cookie.Value).Scan(&userId)
 	if err != nil {
 		log.Println("Error querying session row with session: " + cookie.Value)
 		return User{}, err
@@ -44,46 +49,35 @@ func GetCurrentUser(app *app.App, r *http.Request) (User, error) {
 	return GetUserById(app, userId)
 }
 
-// GetUserById finds a users table row in the database by id and returns a struct representing this row
+// GetUserById finds a User table row in the database by id and returns a struct representing this row
 func GetUserById(app *app.App, id int64) (User, error) {
 	user := User{}
 
 	// Query row by id
-	row, err := app.Db.Query("SELECT \"Id\", \"Username\", \"Password\", \"AuthToken\", \"CreatedAt\", \"UpdatedAt\" FROM public.\"User\" WHERE \"Id\" = $1", id)
+	err := app.Db.QueryRow(selectUserById, id).Scan(&user.Id, &user.Username, &user.Password, &user.CreatedAt, &user.UpdatedAt)
 	if err != nil {
-		log.Println("Error querying user row with id: " + strconv.FormatInt(id, 10))
+		log.Println("Get user error (user not found) for user id:" + strconv.FormatInt(id, 10))
 		return User{}, err
 	}
 
-	defer func(row *sql.Rows) {
-		err := row.Close()
-		if err != nil {
-			log.Println("Error closing database row")
-			log.Println(err)
-		}
-	}(row)
-
-	// Feed row data into user struct
-	row.Next()
-	var authToken sql.NullString
-	err = row.Scan(&user.Id, &user.Username, &user.Password, &authToken, &user.CreatedAt, &user.UpdatedAt)
-	if err != nil {
-		log.Println("Error reading queried row from database")
-		log.Println(err)
-		return User{}, err
-	}
-
-	// If the AuthToken column is null in the database it is handled here by setting user.authToken to an empty string
-	if authToken.Valid {
-		user.AuthToken = authToken.String
-	} else {
-		user.AuthToken = ""
-	}
-
 	return user, nil
 }
 
-// CreateUser creates a users table row in the database
+// GetUserByUsername finds a User table row in the database by username and returns a struct representing this row
+func GetUserByUsername(app *app.App, username string) (User, error) {
+	user := User{}
+
+	// Query row by username
+	err := app.Db.QueryRow(selectUserByUsername, username).Scan(&user.Id, &user.Username, &user.Password, &user.CreatedAt, &user.UpdatedAt)
+	if err != nil {
+		log.Println("Get user error (user not found) for user:" + username)
+		return User{}, err
+	}
+
+	return user, nil
+}
+
+// CreateUser creates a User table row in the database
 func CreateUser(app *app.App, username string, password string, createdAt time.Time, updatedAt time.Time) (User, error) {
 	// Hash password
 	hash, err := bcrypt.GenerateFromPassword([]byte(password), bcrypt.DefaultCost)
@@ -94,8 +88,7 @@ func CreateUser(app *app.App, username string, password string, createdAt time.T
 
 	var lastInsertId int64
 
-	sqlStatement := "INSERT INTO public.\"User\" (\"Username\", \"Password\", \"CreatedAt\", \"UpdatedAt\") VALUES ($1, $2, $3, $4) RETURNING \"Id\""
+	err = app.Db.QueryRow(insertUser, username, string(hash), createdAt, updatedAt).Scan(&lastInsertId)
-	err = app.Db.QueryRow(sqlStatement, username, string(hash), createdAt, updatedAt).Scan(&lastInsertId)
 	if err != nil {
 		log.Println("Error creating user row")
 		return User{}, err
@@ -104,118 +97,40 @@ func CreateUser(app *app.App, username string, password string, createdAt time.T
 	return GetUserById(app, lastInsertId)
 }
 
-// AuthenticateUser validates the password for the specified user if it matches a session cookie is created and returned
+// AuthenticateUser validates the password for the specified user
-func AuthenticateUser(app *app.App, w http.ResponseWriter, username string, password string) (string, error) {
+func AuthenticateUser(app *app.App, w http.ResponseWriter, username string, password string) (Session, error) {
-	var hashedPassword []byte
+	var user User
 
-	// Query row by username, scan password column
+	// Query row by username
-	err := app.Db.QueryRow("SELECT \"Password\" FROM public.\"User\" WHERE \"Username\" = $1", username).Scan(&hashedPassword)
+	err := app.Db.QueryRow(selectUserByUsername, username).Scan(&user.Id, &user.Username, &user.Password, &user.CreatedAt, &user.UpdatedAt)
 	if err != nil {
-		log.Println("Unable to find row with username: " + username)
+		log.Println("Authentication error (user not found) for user:" + username)
-		log.Println(err)
+		return Session{}, err
-		return "", err
 	}
 
 	// Validate password
-	err = bcrypt.CompareHashAndPassword(hashedPassword, []byte(password))
+	err = bcrypt.CompareHashAndPassword([]byte(user.Password), []byte(password))
 	if err != nil { // Failed to validate password, doesn't match
 		log.Println("Authentication error (incorrect password) for user:" + username)
-		log.Println(err)
+		return Session{}, err
-		return "", err
 	} else {
-		return createSessionCookie(app, w, username)
+		return CreateSession(app, w, user.Id)
 	}
 }
 
-// createSessionCookie creates a new session token and cookie and returns the token value
+// LogoutUser deletes the session cookie and AuthToken from the database
-func createSessionCookie(app *app.App, w http.ResponseWriter, username string) (string, error) {
-	// Generate random 64 character string (alpha-numeric)
-	buff := make([]byte, int(math.Ceil(float64(64)/2)))
-	_, err := rand.Read(buff)
-	if err != nil {
-		log.Println("Error creating random buffer for session token value")
-		log.Println(err)
-		return "", err
-	}
-	str := hex.EncodeToString(buff)
-	token := str[:64]
-
-	// If the auth_token column for any user matches the token, set existingAuthToken to true
-	var existingAuthToken bool
-	err = app.Db.QueryRow("SELECT EXISTS(SELECT 1 FROM public.\"User\" WHERE \"AuthToken\" = $1)", token).Scan(&existingAuthToken)
-	if err != nil {
-		log.Println("Error checking for existing auth token")
-		log.Println(err)
-		return "", err
-	}
-
-	// If duplicate token found, recursively call function until unique token is generated
-	if existingAuthToken == true {
-		log.Println("Duplicate token found in sessions table")
-		return createSessionCookie(app, w, username)
-	}
-
-	// Store token in auth_token column of the users table
-	_, err = app.Db.Exec("UPDATE public.\"User\" SET \"AuthToken\" = $1 WHERE \"Username\" = $2", token, username)
-	if err != nil {
-		log.Println("Error setting auth_token column in users table")
-		log.Println(err)
-		return "", err
-	}
-
-	// Create session cookie, containing token
-	cookie := &http.Cookie{
-		Name:     "session",
-		Value:    token,
-		Path:     "/",
-		MaxAge:   86400,
-		HttpOnly: true,
-		Secure:   true,
-	}
-
-	http.SetCookie(w, cookie)
-
-	return token, nil
-}
-
-// ValidateSessionCookie validates the session cookie and returns the username of the user if valid
-func ValidateSessionCookie(app *app.App, r *http.Request) (string, error) {
-	// Get cookie from request
-	cookie, err := r.Cookie("session")
-	if err != nil {
-		log.Println("Error getting cookie from request")
-		log.Println(err)
-		return "", err
-	}
-
-	// Query row by token
-	var username string
-	err = app.Db.QueryRow("SELECT \"Username\" FROM public.\"User\" WHERE \"AuthToken\" = $1", cookie.Value).Scan(&username)
-	if err != nil {
-		log.Println("Error querying row by token")
-		log.Println(err)
-		return "", err
-	}
-
-	return username, nil
-}
-
-// LogoutUser deletes the session cookie and token from the database
 func LogoutUser(app *app.App, w http.ResponseWriter, r *http.Request) {
 	// Get cookie from request
 	cookie, err := r.Cookie("session")
 	if err != nil {
 		log.Println("Error getting cookie from request")
-		log.Println(err)
 		return
 	}
 
 	// Set token to empty string
-	sqlStatement := "UPDATE public.\"User\" SET \"AuthToken\" = $1 WHERE \"AuthToken\" = $2"
+	err = DeleteSessionByAuthToken(app, w, cookie.Value)
-	_, err = app.Db.Exec(sqlStatement, "", cookie.Value)
 	if err != nil {
-		log.Println("Error setting auth_token column in users table")
+		log.Println("Error deleting session by AuthToken")
-		log.Println(err)
 		return
 	}
 

routes/getRoutes.go

@@ -3,6 +3,7 @@ package routes
 import (
 	"GoWeb/app"
 	"GoWeb/controllers"
+	"io/fs"
 	"log"
 	"net/http"
 )
@@ -15,8 +16,14 @@ func GetRoutes(app *app.App) {
 	}
 
 	// Serve static files
-	http.Handle("/file/", http.FileServer(http.Dir("./static")))
+	staticFS, err := fs.Sub(app.Res, "static")
-	log.Println("Serving static files from: ./static")
+	if err != nil {
+		log.Println(err)
+		return
+	}
+	staticHandler := http.FileServer(http.FS(staticFS))
+	http.Handle("/static/", http.StripPrefix("/static/", staticHandler))
+	log.Println("Serving static files from embedded file system /static")
 
 	// Pages
 	http.HandleFunc("/", getController.ShowHome)

static/css/style.css

@@ -0,0 +1,75 @@
+body {
+    font-family: Arial, sans-serif;
+    background-color: lightblue;
+    color: #333;
+    margin: 0;
+}
+
+.container {
+    display: flex;
+    justify-content: center;
+    align-items: center;
+    width: 80%;
+    padding: 20px;
+    margin: 0 auto;
+}
+
+.footer-container {
+    display: flex;
+    justify-content: center;
+    align-items: center;
+    height: 80px;
+    background-color: lightblue;
+}
+
+footer {
+    color: #0077be;
+    font-size: 14px;
+}
+
+form label {
+    display: block;
+    font-weight: bold;
+    margin-bottom: 5px;
+}
+
+form input[type="text"],
+form input[type="password"] {
+    padding: 10px;
+    font-size: 16px;
+    border-radius: 5px;
+    border: none;
+    margin-bottom: 10px;
+    width: 100%;
+    box-sizing: border-box;
+}
+
+form input[type="submit"] {
+    display: inline-block;
+    padding: 10px 20px;
+    background-color: #0077be;
+    color: #fff;
+    border-radius: 5px;
+    text-decoration: none;
+    border: none;
+    cursor: pointer;
+}
+
+form input[type="submit"]:hover {
+    background-color: #005fa3;
+}
+
+h1, h2, h3, h4, h5, h6 {
+    font-weight: bold;
+    color: #333;
+    text-align: center;
+}
+
+a {
+    color: #0077be;
+    text-decoration: none;
+}
+
+a:hover {
+    text-decoration: underline;
+}

templates/base.html

@@ -3,11 +3,14 @@
 <head>
     <meta charset="UTF-8">
     <title>SiteName - {{ template "pageTitle" }}</title>
+    <link rel="stylesheet" href="/static/css/style.css">
 </head>
 <body>
 {{ template "content" . }}
+<div class="footer-container">
+    <footer>
+        <p>SiteName - Powered by GoWeb!</p>
+    </footer>
+</div>
 </body>
-<footer>
-    <p>SiteName - Powered by Go!</p>
-</footer>
 </html>

templates/pages/login.html

@@ -1,13 +1,16 @@
 {{ define "pageTitle" }}Login{{ end }}
 
 {{ define "content" }}
-<form action="/login-handle" method="post">
+<h1>Login</h1>
-    <input name="csrf_token" type="hidden" value="{{ .CsrfToken }}">
+<div class="container">
+    <form action="/login-handle" method="post">
+        <input name="csrf_token" type="hidden" value="{{ .CsrfToken }}">
 
-    <label for="username">Username:</label><br>
+        <label for="username">Username:</label><br>
-    <input id="username" name="username" type="text" value="John"><br><br>
+        <input id="username" name="username" type="text" placeholder="John"><br><br>
-    <label for="password">Password:</label><br>
+        <label for="password">Password:</label><br>
-    <input id="password" name="password" type="password"><br><br>
+        <input id="password" name="password" type="password"><br><br>
-    <input type="submit" value="Submit">
+        <input type="submit" value="Submit">
-</form>
+    </form>
+</div>
 {{ end }}

templates/pages/register.html

@@ -1,13 +1,16 @@
 {{ define "pageTitle" }}Register{{ end }}
 
 {{ define "content" }}
-<form action="/register-handle" method="post">
+<h1>Register</h1>
-    <input name="csrf_token" type="hidden" value="{{ .CsrfToken }}">
+<div class="container">
+    <form action="/register-handle" method="post">
+        <input name="csrf_token" type="hidden" value="{{ .CsrfToken }}">
 
-    <label for="username">Username:</label><br>
+        <label for="username">Username:</label><br>
-    <input id="username" name="username" type="text" value="John"><br><br>
+        <input id="username" name="username" type="text" placeholder="John"><br><br>
-    <label for="password">Password:</label><br>
+        <label for="password">Password:</label><br>
-    <input id="password" name="password" type="password"><br><br>
+        <input id="password" name="password" type="password"><br><br>
-    <input type="submit" value="Submit">
+        <input type="submit" value="Submit">
-</form>
+    </form>
+</div>
 {{ end }}