Decouple SQL queries from logic

app/app.go

@@ -3,10 +3,12 @@ package app
 import (
 	"GoWeb/config"
 	"database/sql"
+	"embed"
 )
 
 // App contains and supplies available configurations and connections
 type App struct {
-	Config config.Configuration
-	Db     *sql.DB
+	Config config.Configuration // Configuration file
+	Db     *sql.DB              // Database connection
+	Res    *embed.FS            // Resources from the embedded filesystem
 }

config/config.go

@@ -9,11 +9,12 @@ import (
 
 type Configuration struct {
 	Db struct {
-		Ip       string `json:"DbIp"`
-		Port     string `json:"DbPort"`
-		Name     string `json:"DbName"`
-		User     string `json:"DbUser"`
-		Password string `json:"DbPassword"`
+		Ip          string `json:"DbIp"`
+		Port        string `json:"DbPort"`
+		Name        string `json:"DbName"`
+		User        string `json:"DbUser"`
+		Password    string `json:"DbPassword"`
+		AutoMigrate bool   `json:"DbAutoMigrate"`
 	}
 
 	Listen struct {

controllers/getController.go

@@ -2,7 +2,7 @@ package controllers
 
 import (
 	"GoWeb/app"
-	"GoWeb/database/models"
+	"GoWeb/models"
 	"GoWeb/security"
 	"GoWeb/templating"
 	"net/http"

controllers/postController.go

@@ -2,7 +2,7 @@ package controllers
 
 import (
 	"GoWeb/app"
-	"GoWeb/database/models"
+	"GoWeb/models"
 	"GoWeb/security"
 	"log"
 	"net/http"

database/databaseConnection.go

@@ -4,9 +4,8 @@ import (
 	"GoWeb/app"
 	"database/sql"
 	"fmt"
-	"log"
-
 	_ "github.com/lib/pq"
+	"log"
 )
 
 // ConnectDB returns a new database connection

database/migrate.go

@@ -0,0 +1,121 @@
+package database
+
+import (
+	"GoWeb/app"
+	"errors"
+	"fmt"
+	"github.com/lib/pq"
+	"log"
+	"reflect"
+)
+
+// Migrate given a dummy object of any type, it will create a table with the same name as the type and create columns with the same name as the fields of the object
+func Migrate(app *app.App, anyStruct interface{}) error {
+	valueOfStruct := reflect.ValueOf(anyStruct)
+	typeOfStruct := valueOfStruct.Type()
+
+	tableName := typeOfStruct.Name()
+	err := createTable(app, tableName)
+	if err != nil {
+		return err
+	}
+
+	for i := 0; i < valueOfStruct.NumField(); i++ {
+		fieldType := typeOfStruct.Field(i)
+		fieldName := fieldType.Name
+		if fieldName != "Id" && fieldName != "id" {
+			err := createColumn(app, tableName, fieldName, fieldType.Type.Name())
+			if err != nil {
+				return err
+			}
+		}
+	}
+
+	return nil
+}
+
+// createTable creates a table with the given name if it doesn't exist, it is assumed that id will be the primary key
+func createTable(app *app.App, tableName string) error {
+	// Check to see if the table already exists
+	var tableExists bool
+	err := app.Db.QueryRow("SELECT EXISTS (SELECT 1 FROM pg_catalog.pg_class c JOIN pg_catalog.pg_namespace n ON n.oid = c.relnamespace WHERE c.relname ~ $1 AND pg_catalog.pg_table_is_visible(c.oid))", "^"+tableName+"$").Scan(&tableExists)
+	if err != nil {
+		log.Println("Error checking if table exists: " + tableName)
+		return err
+	}
+
+	if tableExists {
+		log.Println("Table already exists: " + tableName)
+		return nil
+	} else {
+		sanitizedTableQuery := fmt.Sprintf("CREATE TABLE IF NOT EXISTS \"%s\" (\"Id\" serial primary key)", tableName)
+
+		_, err := app.Db.Query(sanitizedTableQuery)
+		if err != nil {
+			log.Println("Error creating table: " + tableName)
+			return err
+		}
+
+		log.Println("Table created successfully: " + tableName)
+		return nil
+	}
+}
+
+// createColumn creates a column with the given name and type if it doesn't exist
+func createColumn(app *app.App, tableName, columnName, columnType string) error {
+	// Check to see if the column already exists
+	var columnExists bool
+	err := app.Db.QueryRow("SELECT EXISTS (SELECT 1 FROM information_schema.columns WHERE table_name = $1 AND column_name = $2)", tableName, columnName).Scan(&columnExists)
+	if err != nil {
+		log.Println("Error checking if column exists: " + columnName + " in table: " + tableName)
+		return err
+	}
+
+	if columnExists {
+		log.Println("Column already exists: " + columnName + " in table: " + tableName)
+		return nil
+	} else {
+		postgresType, err := getPostgresType(columnType)
+		if err != nil {
+			log.Println("Error creating column: " + columnName + " in table: " + tableName + " with type: " + postgresType)
+			return err
+		}
+
+		sanitizedTableName := pq.QuoteIdentifier(tableName)
+		query := fmt.Sprintf("ALTER TABLE %s ADD COLUMN IF NOT EXISTS \"%s\" %s", sanitizedTableName, columnName, postgresType)
+
+		_, err = app.Db.Query(query)
+		if err != nil {
+			log.Println("Error creating column: " + columnName + " in table: " + tableName + " with type: " + postgresType)
+			return err
+		}
+
+		log.Println("Column created successfully:", columnName)
+
+		return nil
+	}
+}
+
+// Given a type in Go, return the corresponding type in Postgres
+func getPostgresType(goType string) (string, error) {
+	switch goType {
+	case "int", "int32", "uint", "uint32":
+		return "integer", nil
+	case "int64", "uint64":
+		return "bigint", nil
+	case "int16", "int8", "uint16", "uint8", "byte":
+		return "smallint", nil
+	case "string":
+		return "text", nil
+	case "float64":
+		return "double precision", nil
+	case "bool":
+		return "boolean", nil
+	case "Time":
+		return "timestamp", nil
+	case "[]byte":
+		return "bytea", nil
+	}
+
+	return "", errors.New("Unknown type: " + goType)
+}

database/models/user.go

@@ -1,224 +0,0 @@
-package models
-
-import (
-	"GoWeb/app"
-	"crypto/rand"
-	"database/sql"
-	"encoding/hex"
-	"log"
-	"math"
-	"net/http"
-	"strconv"
-	"time"
-
-	"golang.org/x/crypto/bcrypt"
-)
-
-type User struct {
-	Id        int64
-	Username  string
-	Password  string
-	CreatedAt string
-	UpdatedAt string
-}
-
-// GetCurrentUser finds the currently logged-in user by session cookie
-func GetCurrentUser(app *app.App, r *http.Request) (User, error) {
-	cookie, err := r.Cookie("session")
-	if err != nil {
-		log.Println("Error getting session cookie")
-		log.Println(err)
-		return User{}, err
-	}
-
-	var userId int64
-
-	// Query row by session cookie
-	err = app.Db.QueryRow("SELECT user_id FROM sessions WHERE session = $1", cookie.Value).Scan(&userId)
-	if err != nil {
-		log.Println("Error querying session row with session: " + cookie.Value)
-		return User{}, err
-	}
-
-	return GetUserById(app, userId)
-}
-
-// GetUserById finds a users table row in the database by id and returns a struct representing this row
-func GetUserById(app *app.App, id int64) (User, error) {
-	user := User{}
-
-	// Query row by id
-	row, err := app.Db.Query("SELECT id, username, password, created_at, updated_at FROM users WHERE id = $1", id)
-	if err != nil {
-		log.Println("Error querying user row with id: " + strconv.FormatInt(id, 10))
-		return User{}, err
-	}
-
-	defer func(row *sql.Rows) {
-		err := row.Close()
-		if err != nil {
-			log.Println("Error closing database row")
-			log.Println(err)
-		}
-	}(row)
-
-	// Feed row data into user struct
-	row.Next()
-	err = row.Scan(&user.Id, &user.Username, &user.Password, &user.CreatedAt, &user.UpdatedAt)
-	if err != nil {
-		log.Println("Error reading queried row from database")
-		log.Println(err)
-		return User{}, err
-	}
-
-	return user, nil
-}
-
-// CreateUser creates a users table row in the database
-func CreateUser(app *app.App, username string, password string, createdAt time.Time, updatedAt time.Time) (User, error) {
-	// Hash password
-	hash, err := bcrypt.GenerateFromPassword([]byte(password), bcrypt.DefaultCost)
-	if err != nil {
-		log.Println("Error hashing password when creating user")
-		return User{}, err
-	}
-
-	var lastInsertId int64
-
-	sqlStatement := "INSERT INTO users (username, password, created_at, updated_at) VALUES ($1, $2, $3, $4) RETURNING id"
-	err = app.Db.QueryRow(sqlStatement, username, string(hash), createdAt, updatedAt).Scan(&lastInsertId)
-	if err != nil {
-		log.Println("Error creating user row")
-		log.Println(err)
-		return User{}, err
-	}
-
-	return GetUserById(app, lastInsertId)
-}
-
-// AuthenticateUser validates the password for the specified user if it matches a session cookie is created and returned
-func AuthenticateUser(app *app.App, w http.ResponseWriter, username string, password string) (string, error) {
-	var hashedPassword []byte
-
-	// Query row by username, scan password column
-	err := app.Db.QueryRow("SELECT password FROM users WHERE username = $1", username).Scan(&hashedPassword)
-	if err != nil {
-		log.Println("Unable to find row with username: " + username)
-		log.Println(err)
-		return "", err
-	}
-
-	// Validate password
-	err = bcrypt.CompareHashAndPassword(hashedPassword, []byte(password))
-	if err != nil { // Failed to validate password, doesn't match
-		log.Println("Authentication error (incorrect password) for user:" + username)
-		log.Println(err)
-		return "", err
-	} else {
-		return createSessionCookie(app, w, username)
-	}
-}
-
-// createSessionCookie creates a new session token and cookie and returns the token value
-func createSessionCookie(app *app.App, w http.ResponseWriter, username string) (string, error) {
-	// Generate random 64 character string (alpha-numeric)
-	buff := make([]byte, int(math.Ceil(float64(64)/2)))
-	_, err := rand.Read(buff)
-	if err != nil {
-		log.Println("Error creating random buffer for session token value")
-		log.Println(err)
-		return "", err
-	}
-	str := hex.EncodeToString(buff)
-	token := str[:64]
-
-	// If the auth_token column for any user matches the token, set existingAuthToken to true
-	var existingAuthToken bool
-	err = app.Db.QueryRow("SELECT EXISTS(SELECT 1 FROM users WHERE auth_token = $1)", token).Scan(&existingAuthToken)
-	if err != nil {
-		log.Println("Error checking for existing auth token")
-		log.Println(err)
-		return "", err
-	}
-
-	// If duplicate token found, recursively call function until unique token is generated
-	if existingAuthToken == true {
-		log.Println("Duplicate token found in sessions table")
-		return createSessionCookie(app, w, username)
-	}
-
-	// Store token in auth_token column of the users table
-	sqlStatement := "UPDATE users SET auth_token = $1 WHERE username = $2"
-	_, err = app.Db.Exec(sqlStatement, token, username)
-	if err != nil {
-		log.Println("Error setting auth_token column in users table")
-		log.Println(err)
-		return "", err
-	}
-
-	// Create session cookie, containing token
-	cookie := &http.Cookie{
-		Name:     "session",
-		Value:    token,
-		Path:     "/",
-		MaxAge:   86400,
-		HttpOnly: true,
-		Secure:   true,
-	}
-
-	http.SetCookie(w, cookie)
-
-	return token, nil
-}
-
-// ValidateSessionCookie validates the session cookie and returns the username of the user if valid
-func ValidateSessionCookie(app *app.App, r *http.Request) (string, error) {
-	// Get cookie from request
-	cookie, err := r.Cookie("session")
-	if err != nil {
-		log.Println("Error getting cookie from request")
-		log.Println(err)
-		return "", err
-	}
-
-	// Query row by token
-	var username string
-	err = app.Db.QueryRow("SELECT username FROM users WHERE auth_token = $1", cookie.Value).Scan(&username)
-	if err != nil {
-		log.Println("Error querying row by token")
-		log.Println(err)
-		return "", err
-	}
-
-	return username, nil
-}
-
-// LogoutUser deletes the session cookie and token from the database
-func LogoutUser(app *app.App, w http.ResponseWriter, r *http.Request) {
-	// Get cookie from request
-	cookie, err := r.Cookie("session")
-	if err != nil {
-		log.Println("Error getting cookie from request")
-		log.Println(err)
-		return
-	}
-
-	// Set token to empty string
-	sqlStatement := "UPDATE users SET auth_token = $1 WHERE auth_token = $2"
-	_, err = app.Db.Exec(sqlStatement, "", cookie.Value)
-	if err != nil {
-		log.Println("Error setting auth_token column in users table")
-		log.Println(err)
-		return
-	}
-
-	// Delete cookie
-	cookie = &http.Cookie{
-		Name:   "session",
-		Value:  "",
-		Path:   "/",
-		MaxAge: -1,
-	}
-
-	http.SetCookie(w, cookie)
-}

env_example.json

@@ -4,7 +4,8 @@
     "DbPort": "5432",
     "DbName": "database",
     "DbUser": "user",
-    "DbPassword": "password"
+    "DbPassword": "password",
+    "DbAutoMigrate": true
   },
   "Listen": {
     "HttpIp": "127.0.0.1",

go.mod

@@ -1,8 +1,8 @@
 module GoWeb
 
-go 1.19
+go 1.20
 
 require (
 	github.com/lib/pq v1.10.7
-	golang.org/x/crypto v0.1.0
+	golang.org/x/crypto v0.6.0
 )

go.sum

@@ -1,4 +1,4 @@
 github.com/lib/pq v1.10.7 h1:p7ZhMD+KsSRozJr34udlUrhboJwWAgCg34+/ZZNvZZw=
 github.com/lib/pq v1.10.7/go.mod h1:AlVN5x4E4T544tWzH6hKfbfQvm3HdbOxrmggDNAPY9o=
-golang.org/x/crypto v0.1.0 h1:MDRAIl0xIo9Io2xV565hzXHw3zVseKrJKodhohM5CjU=
-golang.org/x/crypto v0.1.0/go.mod h1:RecgLatLF4+eUMCP1PoPZQb+cVrJcOPbHkTkbkB9sbw=
+golang.org/x/crypto v0.6.0 h1:qfktjS5LUO+fFKeJXZ+ikTRijMmljikvG68fpMMruSc=
+golang.org/x/crypto v0.6.0/go.mod h1:OFC/31mSvZgRz0V1QTNCzfAI1aIRzbiufJtkMIlEp58=

main.go

@@ -4,13 +4,21 @@ import (
 	"GoWeb/app"
 	"GoWeb/config"
 	"GoWeb/database"
+	"GoWeb/models"
 	"GoWeb/routes"
+	"context"
+	"embed"
 	"log"
 	"net/http"
 	"os"
+	"os/signal"
+	"syscall"
 	"time"
 )
 
+//go:embed templates static
+var res embed.FS
+
 func main() {
 	// Create instance of App
 	appLoaded := app.App{}
@@ -18,30 +26,55 @@ func main() {
 	// Load config file to application
 	appLoaded.Config = config.LoadConfig()
 
+	// Load templates
+	appLoaded.Res = &res
+
 	// Create logs directory if it doesn't exist
 	if _, err := os.Stat("logs"); os.IsNotExist(err) {
 		err := os.Mkdir("logs", 0755)
 		if err != nil {
-			panic("Failed to create log directory")
+			log.Println("Failed to create log directory")
+			log.Println(err)
+			return
 		}
 	}
 
 	// Create log file and set output
-	file, _ := os.Create("logs/log-" + time.Now().String() + ".log")
+	file, err := os.OpenFile("logs/"+time.Now().Format("2006-01-02")+".log", os.O_CREATE|os.O_WRONLY|os.O_APPEND, 0666)
 	log.SetOutput(file)
 
-	// Connect to database
+	// Connect to database and run migrations
 	appLoaded.Db = database.ConnectDB(&appLoaded)
+	if appLoaded.Config.Db.AutoMigrate {
+		err = models.RunAllMigrations(&appLoaded)
+		if err != nil {
+			log.Println(err)
+			return
+		}
+	}
 
 	// Define Routes
 	routes.GetRoutes(&appLoaded)
 	routes.PostRoutes(&appLoaded)
 
 	// Start server
-	log.Println("Starting server and listening on " + appLoaded.Config.Listen.Ip + ":" + appLoaded.Config.Listen.Port)
-	err := http.ListenAndServe(appLoaded.Config.Listen.Ip+":"+appLoaded.Config.Listen.Port, nil)
+	server := &http.Server{Addr: appLoaded.Config.Listen.Ip + ":" + appLoaded.Config.Listen.Port}
+	go func() {
+		log.Println("Starting server and listening on " + appLoaded.Config.Listen.Ip + ":" + appLoaded.Config.Listen.Port)
+		err := server.ListenAndServe()
+		if err != nil && err != http.ErrServerClosed {
+			log.Fatalf("Could not listen on %s: %v\n", appLoaded.Config.Listen.Ip+":"+appLoaded.Config.Listen.Port, err)
+		}
+	}()
+
+	// Wait for interrupt signal and shut down the server
+	interrupt := make(chan os.Signal, 1)
+	signal.Notify(interrupt, os.Interrupt, syscall.SIGTERM)
+	<-interrupt
+	log.Println("Interrupt signal received. Shutting down server...")
+
+	err = server.Shutdown(context.Background())
 	if err != nil {
-		log.Println(err)
-		return
+		log.Fatalf("Could not gracefully shutdown the server: %v\n", err)
 	}
 }

models/migrations.go

@@ -0,0 +1,36 @@
+package models
+
+import (
+	"GoWeb/app"
+	"GoWeb/database"
+	"time"
+)
+
+// RunAllMigrations defines the structs that should be represented in the database
+func RunAllMigrations(app *app.App) error {
+	// Declare new dummy user for reflection
+	user := User{
+		Id:        1, // Id is handled automatically, but it is added here to show it will be skipped during column creation
+		Username:  "migrate",
+		Password:  "migrate",
+		CreatedAt: time.Now(),
+		UpdatedAt: time.Now(),
+	}
+	err := database.Migrate(app, user)
+	if err != nil {
+		return err
+	}
+
+	session := Session{
+		Id:        1,
+		UserId:    1,
+		AuthToken: "migrate",
+		CreatedAt: time.Now(),
+	}
+	err = database.Migrate(app, session)
+	if err != nil {
+		return err
+	}
+
+	return nil
+}

models/session.go

@@ -0,0 +1,114 @@
+package models
+
+import (
+	"GoWeb/app"
+	"crypto/rand"
+	"encoding/hex"
+	"log"
+	"net/http"
+	"time"
+)
+
+type Session struct {
+	Id        int64
+	UserId    int64
+	AuthToken string
+	CreatedAt time.Time
+}
+
+const sessionColumnsNoId = "\"UserId\", \"AuthToken\", \"CreatedAt\""
+const sessionColumns = "\"Id\", " + sessionColumnsNoId
+const sessionTable = "public.\"Session\""
+
+const (
+	selectSessionByAuthToken = "SELECT " + sessionColumns + " FROM " + sessionTable + " WHERE \"AuthToken\" = $1"
+	selectAuthTokenIfExists  = "SELECT EXISTS(SELECT 1 FROM " + sessionTable + " WHERE \"AuthToken\" = $1)"
+	insertSession            = "INSERT INTO " + sessionTable + " (" + sessionColumnsNoId + ") VALUES ($1, $2, $3) RETURNING \"Id\""
+	deleteSessionByAuthToken = "DELETE FROM " + sessionTable + " WHERE \"AuthToken\" = $1"
+)
+
+// CreateSession creates a new session for a user
+func CreateSession(app *app.App, w http.ResponseWriter, userId int64) (Session, error) {
+	session := Session{}
+	session.UserId = userId
+	session.AuthToken = generateAuthToken(app)
+	session.CreatedAt = time.Now()
+
+	// If the AuthToken column for any user matches the token, set existingAuthToken to true
+	var existingAuthToken bool
+	err := app.Db.QueryRow(selectAuthTokenIfExists, session.AuthToken).Scan(&existingAuthToken)
+	if err != nil {
+		log.Println("Error checking for existing auth token")
+		log.Println(err)
+		return Session{}, err
+	}
+
+	// If duplicate token found, recursively call function until unique token is generated
+	if existingAuthToken == true {
+		log.Println("Duplicate token found in sessions table, generating new token...")
+		return CreateSession(app, w, userId)
+	}
+
+	// Insert session into database
+	err = app.Db.QueryRow(insertSession, session.UserId, session.AuthToken, session.CreatedAt).Scan(&session.Id)
+	if err != nil {
+		log.Println("Error inserting session into database")
+		return Session{}, err
+	}
+
+	createSessionCookie(app, w, session)
+	return session, nil
+}
+
+// Generates a random 64-byte string
+func generateAuthToken(app *app.App) string {
+	// Generate random bytes
+	b := make([]byte, 64)
+	_, err := rand.Read(b)
+	if err != nil {
+		log.Println("Error generating random bytes")
+	}
+
+	// Convert random bytes to hex string
+	return hex.EncodeToString(b)
+}
+
+// createSessionCookie creates a new session cookie
+func createSessionCookie(app *app.App, w http.ResponseWriter, session Session) {
+	cookie := &http.Cookie{
+		Name:     "session",
+		Value:    session.AuthToken,
+		Path:     "/",
+		MaxAge:   86400,
+		HttpOnly: true,
+		Secure:   true,
+	}
+
+	http.SetCookie(w, cookie)
+}
+
+// deleteSessionCookie deletes the session cookie
+func deleteSessionCookie(app *app.App, w http.ResponseWriter) {
+	cookie := &http.Cookie{
+		Name:   "session",
+		Value:  "",
+		Path:   "/",
+		MaxAge: -1,
+	}
+
+	http.SetCookie(w, cookie)
+}
+
+// DeleteSessionByAuthToken deletes a session from the database by AuthToken
+func DeleteSessionByAuthToken(app *app.App, w http.ResponseWriter, authToken string) error {
+	// Delete session from database
+	_, err := app.Db.Exec(deleteSessionByAuthToken, authToken)
+	if err != nil {
+		log.Println("Error deleting session from database")
+		return err
+	}
+
+	deleteSessionCookie(app, w)
+
+	return nil
+}

models/user.go

@@ -0,0 +1,146 @@
+package models
+
+import (
+	"GoWeb/app"
+	"log"
+	"net/http"
+	"strconv"
+	"time"
+
+	"golang.org/x/crypto/bcrypt"
+)
+
+type User struct {
+	Id        int64
+	Username  string
+	Password  string
+	CreatedAt time.Time
+	UpdatedAt time.Time
+}
+
+const userColumnsNoId = "\"Username\", \"Password\", \"CreatedAt\", \"UpdatedAt\""
+const userColumns = "\"Id\", " + userColumnsNoId
+const userTable = "public.\"User\""
+
+const (
+	selectSessionIdByAuthToken = "SELECT \"Id\" FROM public.\"Session\" WHERE \"AuthToken\" = $1"
+	selectUserById             = "SELECT " + userColumns + " FROM " + userTable + " WHERE \"Id\" = $1"
+	selectUserByUsername       = "SELECT " + userColumns + " FROM " + userTable + " WHERE \"Username\" = $1"
+	insertUser                 = "INSERT INTO " + userTable + " (" + userColumnsNoId + ") VALUES ($1, $2, $3, $4) RETURNING \"Id\""
+)
+
+// GetCurrentUser finds the currently logged-in user by session cookie
+func GetCurrentUser(app *app.App, r *http.Request) (User, error) {
+	cookie, err := r.Cookie("session")
+	if err != nil {
+		log.Println("Error getting session cookie")
+		return User{}, err
+	}
+
+	var userId int64
+
+	// Query row by AuthToken
+	err = app.Db.QueryRow(selectSessionIdByAuthToken, cookie.Value).Scan(&userId)
+	if err != nil {
+		log.Println("Error querying session row with session: " + cookie.Value)
+		return User{}, err
+	}
+
+	return GetUserById(app, userId)
+}
+
+// GetUserById finds a User table row in the database by id and returns a struct representing this row
+func GetUserById(app *app.App, id int64) (User, error) {
+	user := User{}
+
+	// Query row by id
+	err := app.Db.QueryRow(selectUserById, id).Scan(&user.Id, &user.Username, &user.Password, &user.CreatedAt, &user.UpdatedAt)
+	if err != nil {
+		log.Println("Get user error (user not found) for user id:" + strconv.FormatInt(id, 10))
+		return User{}, err
+	}
+
+	return user, nil
+}
+
+// GetUserByUsername finds a User table row in the database by username and returns a struct representing this row
+func GetUserByUsername(app *app.App, username string) (User, error) {
+	user := User{}
+
+	// Query row by username
+	err := app.Db.QueryRow(selectUserByUsername, username).Scan(&user.Id, &user.Username, &user.Password, &user.CreatedAt, &user.UpdatedAt)
+	if err != nil {
+		log.Println("Get user error (user not found) for user:" + username)
+		return User{}, err
+	}
+
+	return user, nil
+}
+
+// CreateUser creates a User table row in the database
+func CreateUser(app *app.App, username string, password string, createdAt time.Time, updatedAt time.Time) (User, error) {
+	// Hash password
+	hash, err := bcrypt.GenerateFromPassword([]byte(password), bcrypt.DefaultCost)
+	if err != nil {
+		log.Println("Error hashing password when creating user")
+		return User{}, err
+	}
+
+	var lastInsertId int64
+
+	err = app.Db.QueryRow(insertUser, username, string(hash), createdAt, updatedAt).Scan(&lastInsertId)
+	if err != nil {
+		log.Println("Error creating user row")
+		return User{}, err
+	}
+
+	return GetUserById(app, lastInsertId)
+}
+
+// AuthenticateUser validates the password for the specified user
+func AuthenticateUser(app *app.App, w http.ResponseWriter, username string, password string) (Session, error) {
+	var user User
+
+	// Query row by username
+	err := app.Db.QueryRow(selectUserByUsername, username).Scan(&user.Id, &user.Username, &user.Password, &user.CreatedAt, &user.UpdatedAt)
+	if err != nil {
+		log.Println("Authentication error (user not found) for user:" + username)
+		return Session{}, err
+	}
+
+	// Validate password
+	err = bcrypt.CompareHashAndPassword([]byte(user.Password), []byte(password))
+	if err != nil { // Failed to validate password, doesn't match
+		log.Println("Authentication error (incorrect password) for user:" + username)
+		return Session{}, err
+	} else {
+		return CreateSession(app, w, user.Id)
+	}
+}
+
+// LogoutUser deletes the session cookie and AuthToken from the database
+func LogoutUser(app *app.App, w http.ResponseWriter, r *http.Request) {
+	// Get cookie from request
+	cookie, err := r.Cookie("session")
+	if err != nil {
+		log.Println("Error getting cookie from request")
+		return
+	}
+
+	// Set token to empty string
+	err = DeleteSessionByAuthToken(app, w, cookie.Value)
+	if err != nil {
+		log.Println("Error deleting session by AuthToken")
+		return
+	}
+
+	// Delete cookie
+	cookie = &http.Cookie{
+		Name:   "session",
+		Value:  "",
+		Path:   "/",
+		MaxAge: -1,
+	}
+
+	http.SetCookie(w, cookie)
+}

security/csrf.go

@@ -21,7 +21,6 @@ func GenerateCsrfToken(w http.ResponseWriter, _ *http.Request) (string, error) {
 	str := hex.EncodeToString(buff)
 	token := str[:64]
 
-	// Create session cookie, containing token
 	cookie := &http.Cookie{
 		Name:     "csrf_token",
 		Value:    token,
@@ -38,7 +37,6 @@ func GenerateCsrfToken(w http.ResponseWriter, _ *http.Request) (string, error) {
 
 // VerifyCsrfToken verifies the csrf token
 func VerifyCsrfToken(r *http.Request) (bool, error) {
-	// Get csrf cookie
 	cookie, err := r.Cookie("csrf_token")
 	if err != nil {
 		log.Println("Error getting csrf_token cookie")
@@ -46,10 +44,8 @@ func VerifyCsrfToken(r *http.Request) (bool, error) {
 		return false, err
 	}
 
-	// Get csrf token from form
 	token := r.FormValue("csrf_token")
 
-	// Compare csrf cookie and csrf token
 	if cookie.Value == token {
 		return true, nil
 	}

templating/templateHelper.go

@@ -7,11 +7,39 @@ import (
 	"net/http"
 )
 
+// RenderTemplate renders and serves a template from the embedded filesystem optionally with given data
 func RenderTemplate(app *app.App, w http.ResponseWriter, contentPath string, data any) {
 	templatePath := app.Config.Template.BaseName
 
-	t, _ := template.ParseFiles(templatePath, contentPath)
-	err := t.Execute(w, data)
+	templateContent, err := app.Res.ReadFile(templatePath)
+	if err != nil {
+		log.Println(err)
+		http.Error(w, err.Error(), 500)
+		return
+	}
+
+	t, err := template.New(templatePath).Parse(string(templateContent))
+	if err != nil {
+		log.Println(err)
+		http.Error(w, err.Error(), 500)
+		return
+	}
+
+	content, err := app.Res.ReadFile(contentPath)
+	if err != nil {
+		log.Println(err)
+		http.Error(w, err.Error(), 500)
+		return
+	}
+
+	t, err = t.Parse(string(content))
+	if err != nil {
+		log.Println(err)
+		http.Error(w, err.Error(), 500)
+		return
+	}
+
+	err = t.Execute(w, data)
 	if err != nil {
 		log.Println(err)
 		http.Error(w, err.Error(), 500)