From 94345eff974f19e6a58914af1a0e2a575e5f6c3b Mon Sep 17 00:00:00 2001
From: lbenedar <lbenedar@local.lab>
Date: Fri, 6 Mar 2026 14:44:08 +0300
Subject: [PATCH] ch11.6

---
 cmd/web/handlers.go       |  2 +-
 cmd/web/helpers.go        |  4 ++++
 cmd/web/middleware.go     | 11 +++++++++++
 cmd/web/routes.go         |  9 ++++++---
 cmd/web/templates.go      | 16 +++++++++-------
 ui/html/partials/nav.tmpl | 17 +++++++++++------
 6 files changed, 42 insertions(+), 17 deletions(-)

diff --git a/cmd/web/handlers.go b/cmd/web/handlers.go
index 6cf4a9b..071a40d 100644
--- a/cmd/web/handlers.go
+++ b/cmd/web/handlers.go
@@ -219,7 +219,7 @@ func (app *application) userLogoutPost(w http.ResponseWriter, r *http.Request) {
 		app.serverError(w, err)
 		return
 	}
-	app.sessionManager.Remove(r.Context(), "authenticatedUserId")
+	app.sessionManager.Remove(r.Context(), "authenticatedUserID")
 	app.sessionManager.Put(r.Context(), "flash", "You've been logged out succefully!")
 
 	http.Redirect(w, r, "/", http.StatusSeeOther)
diff --git a/cmd/web/helpers.go b/cmd/web/helpers.go
index b356b49..6f57daf 100644
--- a/cmd/web/helpers.go
+++ b/cmd/web/helpers.go
@@ -40,3 +40,7 @@ func (app *application) decodePostForm(r *http.Request, snippetForm any) error {
 	}
 	return nil
 }
+
+func (app *application) isAuthenticated(r *http.Request) bool {
+	return app.sessionManager.Exists(r.Context(), "authenticatedUserID")
+}
diff --git a/cmd/web/middleware.go b/cmd/web/middleware.go
index d4ffad3..2fc5cae 100644
--- a/cmd/web/middleware.go
+++ b/cmd/web/middleware.go
@@ -38,3 +38,14 @@ func (app *application) recoverPanic(next http.Handler) http.Handler {
 		next.ServeHTTP(w, r)
 	})
 }
+
+func (app *application) requireAuthentication(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if !app.isAuthenticated(r) {
+			http.Redirect(w, r, "/user/login", http.StatusSeeOther)
+			return
+		}
+		w.Header().Set("Cache-Control", "no-store")
+		next.ServeHTTP(w, r)
+	})
+}
diff --git a/cmd/web/routes.go b/cmd/web/routes.go
index ef835ed..08786a6 100644
--- a/cmd/web/routes.go
+++ b/cmd/web/routes.go
@@ -21,14 +21,17 @@ func (app *application) routes() http.Handler {
 
 	router.Handler(http.MethodGet, "/", dynamic.ThenFunc(app.home))
 	router.Handler(http.MethodGet, "/snippet/view/:id", dynamic.ThenFunc(app.snippetView))
-	router.Handler(http.MethodGet, "/snippet/create", dynamic.ThenFunc(app.snippetCreate))
-	router.Handler(http.MethodPost, "/snippet/create", dynamic.ThenFunc(app.snippetCreatePost))
 
 	router.Handler(http.MethodGet, "/user/signup", dynamic.ThenFunc(app.userSignup))
 	router.Handler(http.MethodPost, "/user/signup", dynamic.ThenFunc(app.userSignupPost))
 	router.Handler(http.MethodGet, "/user/login", dynamic.ThenFunc(app.userLogin))
 	router.Handler(http.MethodPost, "/user/login", dynamic.ThenFunc(app.userLoginPost))
-	router.Handler(http.MethodPost, "/user/logout", dynamic.ThenFunc(app.userLogoutPost))
+
+	protected := dynamic.Append(app.requireAuthentication)
+
+	router.Handler(http.MethodGet, "/snippet/create", protected.ThenFunc(app.snippetCreate))
+	router.Handler(http.MethodPost, "/snippet/create", protected.ThenFunc(app.snippetCreatePost))
+	router.Handler(http.MethodPost, "/user/logout", protected.ThenFunc(app.userLogoutPost))
 
 	standard := alice.New(app.recoverPanic, app.logRequest, secureHeaders)
 	return standard.Then(router)
diff --git a/cmd/web/templates.go b/cmd/web/templates.go
index d6275b9..3667346 100644
--- a/cmd/web/templates.go
+++ b/cmd/web/templates.go
@@ -10,11 +10,12 @@ import (
 )
 
 type templateData struct {
-	CurrentYear int
-	Snippet     *models.Snippet
-	Snippets    []*models.Snippet
-	Form        any
-	Flash       string
+	CurrentYear     int
+	Snippet         *models.Snippet
+	Snippets        []*models.Snippet
+	Form            any
+	Flash           string
+	IsAuthenticated bool
 }
 
 func humanDate(t time.Time) string {
@@ -27,8 +28,9 @@ var functions = template.FuncMap{
 
 func (app *application) newTemplateData(r *http.Request) *templateData {
 	return &templateData{
-		CurrentYear: time.Now().Year(),
-		Flash:       app.sessionManager.PopString(r.Context(), "flash"),
+		CurrentYear:     time.Now().Year(),
+		Flash:           app.sessionManager.PopString(r.Context(), "flash"),
+		IsAuthenticated: app.isAuthenticated(r),
 	}
 }
 
diff --git a/ui/html/partials/nav.tmpl b/ui/html/partials/nav.tmpl
index a5250c4..ad98808 100644
--- a/ui/html/partials/nav.tmpl
+++ b/ui/html/partials/nav.tmpl
@@ -2,14 +2,19 @@
 <nav>
     <div>
         <a href='/'>Home</a>
-        <a href='/snippet/create'>Create snippet</a>
+        {{if .IsAuthenticated}}
+            <a href='/snippet/create'>Create snippet</a>
+        {{end}}
     </div>
     <div>
-        <a href='/user/signup'>Signup</a>
-        <a href='/user/login'>Login</a>
-        <form action='/user/logout' method='POST'>
-            <button>Logout</button>
-        </form>
+        {{if .IsAuthenticated}}
+            <form action='/user/logout' method='POST'>
+                <button>Logout</button>
+            </form>
+        {{else}}
+            <a href='/user/signup'>Signup</a>
+            <a href='/user/login'>Login</a>
+        {{end}}
     </div>
 </nav>
 {{end}}
\ No newline at end of file