Harry Culpan
dcf1230414
A JWT signing failure was silently ignored, leaving the user on the setup page with no auth cookie and no explanation for subsequent 401s. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
34 lines
800 B
Go
34 lines
800 B
Go
package main
|
|
|
|
import (
|
|
"context"
|
|
"net/http"
|
|
|
|
"github.com/hculpan/areweplaying/cmd/web/templates"
|
|
"github.com/hculpan/areweplaying/pkg/data"
|
|
)
|
|
|
|
func setupHandler(w http.ResponseWriter, r *http.Request) {
|
|
session, dataErr := data.ReadSessionData()
|
|
if dataErr != nil {
|
|
http.Error(w, dataErr.Error(), http.StatusInternalServerError)
|
|
return
|
|
}
|
|
|
|
if !ValidateJWTFromCookie(r, appKey) {
|
|
r.ParseForm()
|
|
pword := r.FormValue("password")
|
|
if len(pword) == 0 || pword != session.Password {
|
|
http.Error(w, "Unauthorized", http.StatusUnauthorized)
|
|
return
|
|
}
|
|
|
|
if err := GenerateJWTAndStoreInCookie(w, appKey); err != nil {
|
|
http.Error(w, "Failed to create session", http.StatusInternalServerError)
|
|
return
|
|
}
|
|
}
|
|
|
|
comp := templates.Setup(session)
|
|
comp.Render(context.Background(), w)
|
|
}
|