package main
...
func (app *application) userSignup(w http.ResponseWriter, r *http.Request) {
	fmt.Fprintln(w, "Display a HTML form for signing up a new user...")
}
func (app *application) userSignupPost(w http.ResponseWriter, r *http.Request) {
	fmt.Fprintln(w, "Create a new user...")
}
func (app *application) userLogin(w http.ResponseWriter, r *http.Request) {
	fmt.Fprintln(w, "Display a HTML form for logging in a user...")
}
func (app *application) userLoginPost(w http.ResponseWriter, r *http.Request) {
	fmt.Fprintln(w, "Authenticate and login the user...")
}
func (app *application) userLogoutPost(w http.ResponseWriter, r *http.Request) {
	fmt.Fprintln(w, "Logout the user...")
}

package main

import (
	"net/http"

	"github.com/julienschmidt/httprouter"
	"github.com/justinas/alice" // New import
)

func (app *application) routes() http.Handler {

	router := httprouter.New()

	router.NotFound = http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		app.notFound(w)
	})

	fileServer := http.FileServer(http.Dir("./ui/static/"))
	router.Handler(http.MethodGet, "/static/*filepath", http.StripPrefix("/static", fileServer))

	dynamic := alice.New(app.sessionManager.LoadAndSave)

	router.Handler(http.MethodGet, "/", dynamic.ThenFunc(app.home))
	router.Handler(http.MethodGet, "/snippet/view/:id", dynamic.ThenFunc(app.snippetView))
	router.Handler(http.MethodGet, "/snippet/create", dynamic.ThenFunc(app.snippetCreate))
	router.Handler(http.MethodPost, "/snippet/create", dynamic.ThenFunc(app.snippetCreatePost))

	// Add the five new routes, all of which use our 'dynamic' middleware chain.
	router.Handler(http.MethodGet, "/user/signup", dynamic.ThenFunc(app.userSignup))
	router.Handler(http.MethodPost, "/user/signup", dynamic.ThenFunc(app.userSignupPost))
	router.Handler(http.MethodGet, "/user/login", dynamic.ThenFunc(app.userLogin))
	router.Handler(http.MethodPost, "/user/login", dynamic.ThenFunc(app.userLoginPost))
	router.Handler(http.MethodPost, "/user/logout", dynamic.ThenFunc(app.userLogoutPost))

	standard := alice.New(app.recoverPanic, app.logRequest, sercureHeaders)

	return standard.Then(router)
}

{{define "nav"}}
<nav>
  <div>
    <a href="/">Home</a>
    <a href="/snippet/create">Create snippet</a>
  </div>
  <div>
    <a href="/user/signup">Signup</a>
    <a href="/user/login">Login</a>
    <form action="/user/logout" method="POST">
      <button>Logout</button>
    </form>
  </div>
</nav>
{{end}}

sudo mysql

USE snippetbox;
CREATE TABLE users (
id INTEGER NOT NULL PRIMARY KEY AUTO_INCREMENT,
name VARCHAR(255) NOT NULL,
email VARCHAR(255) NOT NULL,
hashed_password CHAR(60) NOT NULL,
created DATETIME NOT NULL
);
ALTER TABLE users ADD CONSTRAINT users_uc_email UNIQUE (email);

package models

import "errors"

var (
	ErrNoRecord = errors.New("models: no matching record found")

	// Add a new ErrInvalidCredentials error. We'll use this later if a user
	// tries to login with an incorrect email address or password.
	ErrInvalidCredentials = errors.New("models: invalid credentials")
	// Add a new ErrDuplicateEmail error. We'll use this later if a user
	// tries to signup with an email address that's already in use.
	ErrDuplicateEmail = errors.New("models: duplicate email")
)

$ touch internal/models/users.go

package models

import (
	"database/sql"
	"time"
)

// Define a new User struct. Notice how the field names and types align
// with the columns in the database "users" table?
type User struct {
	ID             int
	Name           string
	Email          string
	HashedPassword []byte
	Created        time.Time
}

// Define a new UserModel struct which wraps a database connection pool.
type UserModel struct {
	DB *sql.DB
}

// We'll use the Insert method to add a new record to the "users" table.
func (m *UserModel) Insert(name, email, password string) error {
	return nil
}

// We'll use the Authenticate method to verify whether a user exists with
// the provided email address and password. This will return the relevant
// user ID if they do.
func (m *UserModel) Authenticate(email, password string) (int, error) {
	return 0, nil
}

// We'll use the Exists method to check if a user exists with a specific ID.
func (m *UserModel) Exists(id int) (bool, error) {
	return false, nil
}

package main

  ...
  type application struct {
  	logger         *slog.Logger
  	snippets       models.SnippetModel
+  	users          models.UserModel
  	templateCache  map[string]*template.Template
  	formDecoder    *form.Decoder
  	sessionManager *scs.SessionManager
  }
  
  func main() {
  	addr := flag.String("addr", ":4000", "HTTP network address")
  
  	dsn := flag.String("dsn", "web:t0m0c4f3@/snippetbox?parseTime=true", "HTTP network address")
  
  	flag.Parse()
  
  	logger := slog.New(slog.NewTextHandler(os.Stdout, nil))
  
  	db, err := openDB(*dsn)
  	if err != nil {
  		logger.Error(err.Error())
  		os.Exit(1)
  	}
  
  	defer db.Close()
  	templateCache, err := newTemplateCache()
  	if err != nil {
  		logger.Error(err.Error())
  		os.Exit(1)
  	}
  
  	formDecoder := form.NewDecoder()
  
  	sessionManager := scs.New()
  	sessionManager.Store = mysqlstore.New(db)
  	sessionManager.Lifetime = 12 * time.Hour
  	sessionManager.Cookie.Secure = true
  
  	app := &application{
  		logger:         logger,
  		snippets:       &models.SnippetModel{DB: db},
+ 		users:          &models.UserModel{DB: db},
  		templateCache:  templateCache,
  		formDecoder:    formDecoder,
  		sessionManager: sessionManager,
  	}
  
  	tlsConfig := &tls.Config{
  		CurvePreferences: []tls.CurveID{tls.X25519, tls.CurveP256},
  	}
  	srv := &http.Server{
  		Addr:      *addr,
  		Handler:   app.routes(),
  		ErrorLog:  slog.NewLogLogger(logger.Handler(), slog.LevelError),
  		TLSConfig: tlsConfig,
  		IdleTimeout:  time.Minute,
  		ReadTimeout:  5 * time.Second,
  		WriteTimeout: 10 * time.Second,
  	}
  
  	logger.Info("Starting server", "addr", *addr)
  
  	err = srv.ListenAndServeTLS("tls/cert.pem", "tls/key.pem")
  	logger.Error(err.Error())
  	os.Exit(1)
  }
  
  ...

$ touch ui/html/pages/signup.html

{{define "title"}}Signup{{end}} {{define "main"}}
<form action="/user/signup" method="POST" novalidate>
  <div>
    <label>Name:</label>
    {{with .Form.FieldErrors.name}}
    <label class="error">{{.}}</label>
    {{end}}
    <input type="text" name="name" value="{{.Form.Name}}" />
  </div>
  <div>
    <label>Email:</label>
    {{with .Form.FieldErrors.email}}
    <label class="error">{{.}}</label>
    {{end}}
    <input type="email" name="email" value="{{.Form.Email}}" />
  </div>
  <div>
    <label>Password:</label>
    {{with .Form.FieldErrors.password}}
    <label class="error">{{.}}</label>
    {{end}}
    <input type="password" name="password" />
  </div>
  <div>
    <input type="submit" value="Signup" />
  </div>
</form>
{{end}}

package main
...
// Create a new userSignupForm struct.
type userSignupForm struct {
	Name                string `form:"name"`
	Email               string `form:"email"`
	Password            string `form:"password"`
	validator.Validator `form:"-"`
}

func (app *application) userSignup(w http.ResponseWriter, r *http.Request) {
	data := app.newTemplateData(r)
	data.Form = userSignupForm{}
	app.render(w, r, http.StatusOK, "signup.html", data)
}
...

package validator

... 

import (
"regexp" // New import
"slices"
"strings"
"unicode/utf8"
)
...

// Use the regexp.MustCompile() function to parse a regular expression pattern
// for sanity checking the format of an email address. This returns a pointer to
// a 'compiled' regexp.Regexp type, or panics in the event of an error. Parsing
// this pattern once at startup and storing the compiled *regexp.Regexp in a
// variable is more performant than re-parsing the pattern each time we need it.
var EmailRX = regexp.MustCompile("^[a-zA-Z0-9.!#$%&'*+/=?^_`{|}~-]+@[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(?:\\.[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?)*$")



// MinChars() returns true if a value contains at least n characters.
func MinChars(value string, n int) bool {
	return utf8.RuneCountInString(value) >= n
}

// Matches() returns true if a value matches a provided compiled regular
// expression pattern.
func Matches(value string, rx *regexp.Regexp) bool {
	return rx.MatchString(value)
}

...
func (app *application) userSignupPost(w http.ResponseWriter, r *http.Request) {
	// Declare an zero-valued instance of our userSignupForm struct.
	var form userSignupForm
	// Parse the form data into the userSignupForm struct.
	err := app.decodePostForm(r, &form)
	if err != nil {
		app.clientError(w, http.StatusBadRequest)
		return
	}
	// Validate the form contents using our helper functions.
	form.CheckField(validator.NotBlank(form.Name), "name", "This field cannot be blank")
	form.CheckField(validator.NotBlank(form.Email), "email", "This field cannot be blank")
	form.CheckField(validator.Matches(form.Email, validator.EmailRX), "email", "This field must be a valid email address")
	form.CheckField(validator.NotBlank(form.Password), "password", "This field cannot be blank")
	form.CheckField(validator.MinChars(form.Password, 8), "password", "This field must be at least 8 characters long")
	// If there are any errors, redisplay the signup form along with a 422
	// status code.
	if !form.Valid() {
		data := app.newTemplateData(r)
		data.Form = form
		app.render(w, r, http.StatusUnprocessableEntity, "signup.html", data)
		return
	}
	// Otherwise send the placeholder response (for now!).
	fmt.Fprintln(w, "Create a new user...")
}
...

$ go get golang.org/x/crypto/bcrypt@latest
go: downloading golang.org/x/crypto v0.13.0
go get: added golang.org/x/crypto v0.13.0

hash, err := bcrypt.GenerateFromPassword([]byte("my plain text password"), 12)

$2a$12$NuTjWXm3KKntReFwyBVHyuf/to.HEwTy.eS206TNfkGfr6HzGJSWG

hash := []byte("$2a$12$NuTjWXm3KKntReFwyBVHyuf/to.HEwTy.eS206TNfkGfr6GzGJSWG")
err := bcrypt.CompareHashAndPassword(hash, []byte("my plain text password"))

// We'll use the Insert method to add a new record to the "users" table.
func (m *UserModel) Insert(name, email, password string) error {
	// Create a bcrypt hash of the plain-text password.
	hashedPassword, err := bcrypt.GenerateFromPassword([]byte(password), 12)
	if err != nil {
		return err
	}
	stmt := `INSERT INTO users (name, email, hashed_password, created)
	VALUES(?, ?, ?, UTC_TIMESTAMP())`
	// Use the Exec() method to insert the user details and hashed password
	// into the users table.
	_, err = m.DB.Exec(stmt, name, email, string(hashedPassword))
	if err != nil {
		// If this returns an error, we use the errors.As() function to check
		// whether the error has the type *mysql.MySQLError. If it does, the
		// error will be assigned to the mySQLError variable. We can then check
		// whether or not the error relates to our users_uc_email key by
		// checking if the error code equals 1062 and the contents of the error
		// message string. If it does, we return an ErrDuplicateEmail error.
		var mySQLError *mysql.MySQLError
		if errors.As(err, &mySQLError) {
			if mySQLError.Number == 1062 && strings.Contains(mySQLError.Message, "users_uc_email") {
				return ErrDuplicateEmail
			}
		}
		return err
	}
	return nil
}

package main

...

func (app *application) userSignupPost(w http.ResponseWriter, r *http.Request) {
	// Declare an zero-valued instance of our userSignupForm struct.
	var form userSignupForm
	// Parse the form data into the userSignupForm struct.
	err := app.decodePostForm(r, &form)
	if err != nil {
		app.clientError(w, http.StatusBadRequest)
		return
	}

	form.CheckField(validator.NotBlank(form.Name), "name", "This field cannot be blank")
	form.CheckField(validator.NotBlank(form.Email), "email", "This field cannot be blank")
	form.CheckField(validator.Matches(form.Email, validator.EmailRX), "email", "This field must be a valid email address")
	form.CheckField(validator.NotBlank(form.Password), "password", "This field cannot be blank")
	form.CheckField(validator.MinChars(form.Password, 8), "password", "This field must be at least 8 characters long")

	if !form.Valid() {
		data := app.newTemplateData(r)
		data.Form = form
		app.render(w, r, http.StatusUnprocessableEntity, "signup.html", data)
		return
	}

	// Try to create a new user record in the database. If the email already
	// exists then add an error message to the form and re-display it.
	err = app.users.Insert(form.Name, form.Email, form.Password)
	if err != nil {
		if errors.Is(err, models.ErrDuplicateEmail) {
			form.AddFieldError("email", "Email address is already in use")
			data := app.newTemplateData(r)
			data.Form = form
			app.render(w, r, http.StatusUnprocessableEntity, "signup.html", data)
		} else {
			app.serverError(w, r, err)
		}
		return
	}
	// Otherwise add a confirmation flash message to the session confirming that
	// their signup worked.
	app.sessionManager.Put(r.Context(), "flash", "Your signup was successful. Please log in.")
	// And redirect the user to the login page.
	http.Redirect(w, r, "/user/login", http.StatusSeeOther)
}

...

sudo mysql 
use snippetbox;

mysql> SELECT * FROM users;
+----+-----------+-----------------+--------------------------------------------------------------+---------------------+
| id | name
| email
| hashed_password
| created
|
+----+-----------+-----------------+--------------------------------------------------------------+---------------------+
| 1 | Nahuel | nahuel@gmail.com | $2a$12$mNXQrOwVWp/TqAzCCyDoyegtpV40EXwrzVLnbFpHPpWdvnmIoZ.Q. | 2023-09-07 07:07:35 |
+----+-----------+-----------------+--------------------------------------------------------------+---------------------+
1 row in set (0.01 sec)

  package main
  
  ... 
  
  // Define a new Validator struct which contains a map of validation error messages
  // for our form fields.
  type Validator struct {
+  	NonFieldErrors []string
  	FieldErrors    map[string]string
  }
  
  // Valid() returns true if the FieldErrors map doesn't contain any entries.
  func (v *Validator) Valid() bool {
+  	return len(v.FieldErrors) == 0 && len(v.NonFieldErrors) == 0
  }
  
+  // Create an AddNonFieldError() helper for adding error messages to the new
+  // NonFieldErrors slice.
+  func (v *Validator) AddNonFieldError(message string) {
+  	v.NonFieldErrors = append(v.NonFieldErrors, message)
+  }
  
  ...

$ touch ui/html/pages/login.html

{{define "title"}}Login{{end}} {{define "main"}}
<form action="/user/login" method="POST" novalidate>
  <!-- Notice that here we are looping over the NonFieldErrors and displaying
them, if any exist -->
  {{range .Form.NonFieldErrors}}
  <div class="error">{{.}}</div>
  {{end}}
  <div>
    <label>Email:</label>
    {{with .Form.FieldErrors.email}}
    <label class="error">{{.}}</label>
    {{end}}
    <input type="email" name="email" value="{{.Form.Email}}" />
  </div>
  <div>
    <label>Password:</label>
    {{with .Form.FieldErrors.password}}
    <label class="error">{{.}}</label>
    {{end}}
    <input type="password" name="password" />
  </div>
  <div>
    <input type="submit" value="Login" />
  </div>
</form>
{{end}}

  package main
  
  ... 
  // Create a new userLoginForm struct.
  type userLoginForm struct {
  	Email               string `form:"email"`
  	Password            string `form:"password"`
  	validator.Validator `form:"-"`
  }

 func (app *application) userLogin(w http.ResponseWriter, r *http.Request) {
	data := app.newTemplateData(r)
	data.Form = userLoginForm{}
	app.render(w, r, http.StatusOK, "login.html", data)
}  
  ...

func (m *UserModel) Authenticate(email, password string) (int, error) {
	// Retrieve the id and hashed password associated with the given email. If
	// no matching email exists we return the ErrInvalidCredentials error.
	var id int
	var hashedPassword []byte
	stmt := "SELECT id, hashed_password FROM users WHERE email = ?"
	err := m.DB.QueryRow(stmt, email).Scan(&id, &hashedPassword)
	if err != nil {
		if errors.Is(err, sql.ErrNoRows) {
			return 0, ErrInvalidCredentials
		} else {
			return 0, err
		}
	}
	// Check whether the hashed password and plain-text password provided match.
	// If they don't, we return the ErrInvalidCredentials error.
	err = bcrypt.CompareHashAndPassword(hashedPassword, []byte(password))
	if err != nil {
		if errors.Is(err, bcrypt.ErrMismatchedHashAndPassword) {
			return 0, ErrInvalidCredentials
		} else {
			return 0, err
		}
	}
	// Otherwise, the password is correct. Return the user ID.
	return id, nil
}

func (app *application) userLoginPost(w http.ResponseWriter, r *http.Request) {
	// Decode the form data into the userLoginForm struct.// Decode the form data into the userLoginForm struct.
	var form userLoginForm
	err := app.decodePostForm(r, &form)
	if err != nil {
		app.clientError(w, http.StatusBadRequest)
		return
	}
	// Do some validation checks on the form. We check that both email and
	// password are provided, and also check the format of the email address as
	// a UX-nicety (in case the user makes a typo).
	form.CheckField(validator.NotBlank(form.Email), "email", "This field cannot be blank")
	form.CheckField(validator.Matches(form.Email, validator.EmailRX), "email", "This field must be a valid email address")
	form.CheckField(validator.NotBlank(form.Password), "password", "This field cannot be blank")
	if !form.Valid() {
		data := app.newTemplateData(r)
		data.Form = form
		app.render(w, r, http.StatusUnprocessableEntity, "login.html", data)
		return
	}
	// Check whether the credentials are valid. If they're not, add a generic
	// non-field error message and re-display the login page.
	id, err := app.users.Authenticate(form.Email, form.Password)
	if err != nil {
		if errors.Is(err, models.ErrInvalidCredentials) {
			form.AddNonFieldError("Email or password is incorrect")
			data := app.newTemplateData(r)
			data.Form = form
			app.render(w, r, http.StatusUnprocessableEntity, "login.html", data)
		} else {
			app.serverError(w, r, err)
		}
		return
	}
	// Use the RenewToken() method on the current session to change the session
	// ID. It's good practice to generate a new session ID when the
	// authentication state or privilege levels changes for the user (e.g. login
	// and logout operations).
	err = app.sessionManager.RenewToken(r.Context())
	if err != nil {
		app.serverError(w, r, err)
		return
	}
	// Add the ID of the current user to the session, so that they are now
	// 'logged in'.
	app.sessionManager.Put(r.Context(), "authenticatedUserID", id)
	// Redirect the user to the create snippet page.
	http.Redirect(w, r, "/snippet/create", http.StatusSeeOther)
}

func (app *application) userLogoutPost(w http.ResponseWriter, r *http.Request) {
	// Use the RenewToken() method on the current session to change the session
	// ID again.
	err := app.sessionManager.RenewToken(r.Context())
	if err != nil {
		app.serverError(w, r, err)
		return
	}
	// Remove the authenticatedUserID from the session data so that the user is
	// 'logged out'.
	app.sessionManager.Remove(r.Context(), "authenticatedUserID")
	// Add a flash message to the session to confirm to the user that they've been
	// logged out.
	app.sessionManager.Put(r.Context(), "flash", "You've been logged out successfully!")
	// Redirect the user to the application home page.
	http.Redirect(w, r, "/", http.StatusSeeOther)
}

package main
...
// Return true if the current request is from an authenticated user, otherwise
// return false.
func (app *application) isAuthenticated(r *http.Request) bool {
return app.sessionManager.Exists(r.Context(), "authenticatedUserID")
}

package main

...

type templateData struct {
	CurrentYear     int
	Snippet         models.Snippet
	Snippets        []models.Snippet
	Form            any
	Flash           string
	IsAuthenticated bool
}

...

package main

...

func (app *application) newTemplateData(r *http.Request) *templateData {
	return &templateData{
		CurrentYear:     time.Now().Year(),
		Flash:           app.sessionManager.PopString(r.Context(), "flash"),
		IsAuthenticated: app.isAuthenticated(r),
	}

...

  {{define "nav"}}
  <nav>
    <div>
      <a href="/">Home</a>
+      <!-- Toggle the link based on authentication status -->
+      {{if .IsAuthenticated}}
      <a href="/snippet/create">Create snippet</a>
+      {{end}}
    </div>
    <div>
+      <!-- Toggle the links based on authentication status -->
+      {{if .IsAuthenticated}}
       <form action="/user/logout" method="POST">
        <button>Logout</button>
      </form>
+     {{else}}
      <a href="/user/signup">Signup</a>
      <a href="/user/login">Login</a>
      {{end}}
    </div>
  </nav>
  {{end}}

package main

... 

func (app *application) requireAuthentication(next http.Handler) http.Handler {
	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		// If the user is not authenticated, redirect them to the login page and
		// return from the middleware chain so that no subsequent handlers in
		// the chain are executed.
		if !app.isAuthenticated(r) {
			http.Redirect(w, r, "/user/login", http.StatusSeeOther)
			return
		}
		// Otherwise set the "Cache-Control: no-store" header so that pages
		// require authentication are not stored in the users browser cache (or
		// other intermediary cache).
		w.Header().Add("Cache-Control", "no-store")
		// And call the next handler in the chain.
		next.ServeHTTP(w, r)
	})
}

func (app *application) routes() http.Handler {

	router := httprouter.New()

	router.NotFound = http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		app.notFound(w)
	})

	fileServer := http.FileServer(http.Dir("./ui/static/"))
	router.Handler(http.MethodGet, "/static/*filepath", http.StripPrefix("/static", fileServer))

	// Unprotected application routes using the "dynamic" middleware chain.
	dynamic := alice.New(app.sessionManager.LoadAndSave)

	router.Handler(http.MethodGet, "/", dynamic.ThenFunc(app.home))
	router.Handler(http.MethodGet, "/snippet/view/:id", dynamic.ThenFunc(app.snippetView))
	router.Handler(http.MethodGet, "/user/signup", dynamic.ThenFunc(app.userSignup))
	router.Handler(http.MethodPost, "/user/signup", dynamic.ThenFunc(app.userSignupPost))
	router.Handler(http.MethodGet, "/user/login", dynamic.ThenFunc(app.userLogin))
	router.Handler(http.MethodPost, "/user/login", dynamic.ThenFunc(app.userLoginPost))

	// Protected (authenticated-only) application routes, using a new "protected"
	// middleware chain which includes the requireAuthentication middleware.
	protected := dynamic.Append(app.requireAuthentication)
	router.Handler(http.MethodGet, "/snippet/create", protected.ThenFunc(app.snippetCreate))
	router.Handler(http.MethodPost, "/snippet/create", protected.ThenFunc(app.snippetCreatePost))
	router.Handler(http.MethodPost, "/user/logout", protected.ThenFunc(app.userLogoutPost))

	standard := alice.New(app.recoverPanic, app.logRequest, sercureHeaders)

	return standard.Then(router)
}

$ curl -ki -X POST https://localhost:4000/snippet/create
HTTP/2 303
content-security-policy: default-src 'self'; style-src 'self' fonts.googleapis.com; font-src fonts.gstatic.com
location: /user/login
referrer-policy: origin-when-cross-origin
vary: Cookie
x-content-type-options: nosniff
x-frame-options: deny
x-xss-protection: 0
content-length: 0
date: Thu, 07 Sep 2023 14:39:51 GMT

$ go get github.com/justinas/nosurf@v1
go: downloading github.com/justinas/nosurf v1.1.1
go get: added github.com/justinas/nosurf v1.1.1

// Create a NoSurf middleware function which uses a customized CSRF cookie with
// the Secure, Path and HttpOnly attributes set.
func noSurf(next http.Handler) http.Handler {
	csrfHandler := nosurf.New(next)
	csrfHandler.SetBaseCookie(http.Cookie{
		HttpOnly: true,
		Path:     "/",
		Secure:   true,
	})
	return csrfHandler
}

  func (app *application) routes() http.Handler {
  
  	router := httprouter.New()
  
  	router.NotFound = http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
  		app.notFound(w)
  	})
  
  	fileServer := http.FileServer(http.Dir("./ui/static/"))
  	router.Handler(http.MethodGet, "/static/*filepath", http.StripPrefix("/static", fileServer))
  
+  	// Use the nosurf middleware on all our 'dynamic' routes.
+  	dynamic := alice.New(app.sessionManager.LoadAndSave, noSurf)
  
  	router.Handler(http.MethodGet, "/", dynamic.ThenFunc(app.home))
  	router.Handler(http.MethodGet, "/snippet/view/:id", dynamic.ThenFunc(app.snippetView))
  	router.Handler(http.MethodGet, "/user/signup", dynamic.ThenFunc(app.userSignup))
  	router.Handler(http.MethodPost, "/user/signup", dynamic.ThenFunc(app.userSignupPost))
  	router.Handler(http.MethodGet, "/user/login", dynamic.ThenFunc(app.userLogin))
  	router.Handler(http.MethodPost, "/user/login", dynamic.ThenFunc(app.userLoginPost))
  
+ 	// Because the 'protected' middleware chain appends to the 'dynamic' chain
+  	// the noSurf middleware will also be used on the three routes below too.
  	protected := dynamic.Append(app.requireAuthentication)
  	router.Handler(http.MethodGet, "/snippet/create", protected.ThenFunc(app.snippetCreate))
  	router.Handler(http.MethodPost, "/snippet/create", protected.ThenFunc(app.snippetCreatePost))
  	router.Handler(http.MethodPost, "/user/logout", protected.ThenFunc(app.userLogoutPost))
  
  	standard := alice.New(app.recoverPanic, app.logRequest, sercureHeaders)
  
  	return standard.Then(router)
}

package main

import (
	"html/template"
	"path/filepath"
	"time"

	"github.com/nahueldev23/snippetbox/internal/models"
)

type templateData struct {
	CurrentYear     int
	Snippet         models.Snippet
	Snippets        []models.Snippet
	Form            any
	Flash           string
	IsAuthenticated bool
	CSRFToken       string
}

...

package main

import (
	"bytes"
	"errors"
	"fmt"
	"net/http"
	"time"

	"github.com/go-playground/form/v4"
	"github.com/justinas/nosurf"
)
...

func (app *application) newTemplateData(r *http.Request) *templateData {
	return &templateData{
		CurrentYear:     time.Now().Year(),
		Flash:           app.sessionManager.PopString(r.Context(), "flash"),
		IsAuthenticated: app.isAuthenticated(r),
		CSRFToken:       nosurf.Token(r),
	}
}
...

{{define "title"}}Create a New Snippet{{end}} {{define "main"}}
<form action="/snippet/create" method="POST">
  <!-- Include the CSRF token -->
  <input type='hidden' name='csrf_token' value='{{.CSRFToken}}'>
  <div>
    <label>Title:</label>
    <!-- Use the `with` action to render the value of .Form.FieldErrors.title
if it is not empty. -->
    {{with .Form.FieldErrors.title}}
    <label class="error">{{.}}</label>
    {{end}}
    <!-- Re-populate the title data by setting the `value` attribute. -->
    <input type="text" name="title" value="{{.Form.Title}}" />
  </div>
  <div>
    <label>Content:</label>
    <!-- Likewise render the value of .Form.FieldErrors.content if it is not
empty. -->
    {{with .Form.FieldErrors.content}}
    <label class="error">{{.}}</label>
    {{end}}
    <!-- Re-populate the content data as the inner HTML of the textarea. -->
    <textarea name="content">{{.Form.Content}}</textarea>
  </div>
  <div>
    <label>Delete in:</label>
    <!-- And render the value of .Form.FieldErrors.expires if it is not empty. -->
    {{with .Form.FieldErrors.expires}}
    <label class="error">{{.}}</label>
    {{end}}
    <!-- Here we use the `if` action to check if the value of the re-populated
expires field equals 365. If it does, then we render the `checked`
attribute so that the radio input is re-selected. -->
    <input type="radio" name="expires" value="365" {{if (eq .Form.Expires 365)}}checked{{end}} />
    One Year
    <!-- And we do the same for the other possible values too... -->
    <input type="radio" name="expires" value="7" {{if (eq .Form.Expires 7)}}checked{{end}} />
    One Week
    <input type="radio" name="expires" value="1" {{if (eq .Form.Expires 1)}}checked{{end}} />
    One Day
  </div>
  <div>
    <input type="submit" value="Publish snippet" />
  </div>
</form>
{{end}}

{{define "title"}}Login{{end}} {{define "main"}}
<form action="/user/login" method="POST" novalidate>
  <input type='hidden' name='csrf_token' value='{{.CSRFToken}}'>
  {{range .Form.NonFieldErrors}}
  <div class="error">{{.}}</div>
  {{end}}
  <div>
    <label>Email:</label>
    {{with .Form.FieldErrors.email}}
    <label class="error">{{.}}</label>
    {{end}}
    <input type="email" name="email" value="{{.Form.Email}}" />
  </div>
  <div>
    <label>Password:</label>
    {{with .Form.FieldErrors.password}}
    <label class="error">{{.}}</label>
    {{end}}
    <input type="password" name="password" />
  </div>
  <div>
    <input type="submit" value="Login" />
  </div>
</form>
{{end}}

{{define "title"}}Signup{{end}} {{define "main"}}
<form action="/user/signup" method="POST" novalidate>
  <!-- Include the CSRF token -->
  <input type='hidden' name='csrf_token' value='{{.CSRFToken}}'>
  <div>
    <label>Name:</label>
    {{with .Form.FieldErrors.name}}
    <label class="error">{{.}}</label>
    {{end}}
    <input type="text" name="name" value="{{.Form.Name}}" />
  </div>
  <div>
    <label>Email:</label>
    {{with .Form.FieldErrors.email}}
    <label class="error">{{.}}</label>
    {{end}}
    <input type="email" name="email" value="{{.Form.Email}}" />
  </div>
  <div>
    <label>Password:</label>
    {{with .Form.FieldErrors.password}}
    <label class="error">{{.}}</label>
    {{end}}
    <input type="password" name="password" />
  </div>
  <div>
    <input type="submit" value="Signup" />
  </div>
</form>
{{end}}

{{define "nav"}}
<nav>
  <div>
    <a href="/">Home</a>
    <!-- Toggle the link based on authentication status -->
    {{if .IsAuthenticated}}
    <a href="/snippet/create">Create snippet</a>
    {{end}}
  </div>
  <div>
    <!-- Toggle the links based on authentication status -->
    {{if .IsAuthenticated}}
    <form action="/user/logout" method="POST">
      <!-- Include the CSRF token -->
      <input type='hidden' name='csrf_token' value='{{.CSRFToken}}'>
      <button>Logout</button>
    </form>
    {{else}}
    <a href="/user/signup">Signup</a>
    <a href="/user/login">Login</a>
    {{end}}
  </div>
</nav>
{{end}}

sessionManager := scs.New()
sessionManager.Cookie.SameSite = http.SameSiteStrictMode

tlsConfig := &tls.Config{
  MinVersion: tls.VersionTLS13,
}