ch17

cmd/web/handlers.go

@@ -4,11 +4,14 @@ import (
 	"bytes"
 	"errors"
 	"fmt"
+	"io/fs"
 	"net/http"
 	"strconv"
+	"strings"
 
 	"gitea.local.lab/Lbenedar/snippetbox/internal/models"
 	"gitea.local.lab/Lbenedar/snippetbox/internal/validator"
+	"gitea.local.lab/Lbenedar/snippetbox/ui"
 	"github.com/julienschmidt/httprouter"
 )
 
@@ -32,6 +35,20 @@ type userLoginForm struct {
 	validator.Validator `form:"-"`
 }
 
+type accountViewForm struct {
+	Name                string `form:"name"`
+	Email               string `form:"email"`
+	Joined              string `form:"joined"`
+	validator.Validator `form:"-"`
+}
+
+type passwordChangeForm struct {
+	CurrentPassword     string `form:"curr_pass"`
+	NewPassword         string `form:"new_pass"`
+	ConfirmPassword     string `form:"conf_pass"`
+	validator.Validator `form:"-"`
+}
+
 func (app *application) render(w http.ResponseWriter, status int, page string, data *templateData) {
 	ts, ok := app.templateCache[page]
 	if !ok {
@@ -134,8 +151,9 @@ func (app *application) snippetCreatePost(w http.ResponseWriter, r *http.Request
 func (app *application) userSignupPost(w http.ResponseWriter, r *http.Request) {
 	var form userSignupForm
 	err := app.decodePostForm(r, &form)
+
 	if err != nil {
-		app.clientError(w, http.StatusBadRequest)
+		app.notFound(w)
 		return
 	}
 
@@ -209,7 +227,11 @@ func (app *application) userLoginPost(w http.ResponseWriter, r *http.Request) {
 	}
 
 	app.sessionManager.Put(r.Context(), "authenticatedUserID", id)
-
+	redirectPath := app.sessionManager.PopString(r.Context(), "redirectParent")
+	if redirectPath != "" {
+		http.Redirect(w, r, redirectPath, http.StatusSeeOther)
+		return
+	}
 	http.Redirect(w, r, "/snippet/create", http.StatusSeeOther)
 }
 
@@ -236,3 +258,77 @@ func (app *application) userLogin(w http.ResponseWriter, r *http.Request) {
 	data.Form = userLoginForm{}
 	app.render(w, http.StatusOK, "login.tmpl", data)
 }
+
+func ping(w http.ResponseWriter, r *http.Request) {
+	w.Write([]byte("OK"))
+}
+
+func (app *application) about(w http.ResponseWriter, r *http.Request) {
+	data := app.newTemplateData(r)
+	text, err := fs.ReadFile(ui.Files, "static/text/about.txt")
+	if err != nil {
+		app.serverError(w, err)
+		return
+	}
+	data.AboutText = string(text)
+	app.render(w, http.StatusOK, "about.tmpl", data)
+}
+
+func (app *application) accountView(w http.ResponseWriter, r *http.Request) {
+	data := app.newTemplateData(r)
+	id := app.sessionManager.Get(r.Context(), "authenticatedUserID").(int)
+
+	user, err := app.users.GetById(id)
+	if err != nil {
+		app.serverError(w, err)
+		return
+	}
+	data.Form = accountViewForm{Name: user.Name, Email: user.Email, Joined: humanDate(user.Created)}
+	app.render(w, http.StatusOK, "account.tmpl", data)
+}
+
+func (app *application) accountChangePassword(w http.ResponseWriter, r *http.Request) {
+	data := app.newTemplateData(r)
+	data.Form = passwordChangeForm{}
+	app.render(w, http.StatusOK, "password.tmpl", data)
+}
+
+func (app *application) accountChangePasswordPost(w http.ResponseWriter, r *http.Request) {
+	form := passwordChangeForm{}
+	err := app.decodePostForm(r, &form)
+	if err != nil {
+		app.clientError(w, http.StatusBadRequest)
+		return
+	}
+
+	form.CheckField(validator.NotBlank(form.CurrentPassword), "curr_pass", "This field cannot be blank")
+	form.CheckField(validator.NotBlank(form.NewPassword), "new_pass", "This field cannot be blank")
+	form.CheckField(validator.MinChars(form.NewPassword, 8), "new_pass", "Minimum password length is 8 symbols")
+	form.CheckField(validator.NotBlank(form.ConfirmPassword), "conf_pass", "This field cannot be blank")
+	form.CheckField(strings.Compare(form.NewPassword, form.ConfirmPassword) == 0, "conf_pass", "Confirm password does not match")
+
+	if !form.Valid() {
+		data := app.newTemplateData(r)
+		data.Form = form
+		app.render(w, http.StatusUnprocessableEntity, "password.tmpl", data)
+		return
+	}
+
+	id := app.sessionManager.Get(r.Context(), "authenticatedUserID").(int)
+	err = app.users.ChangePassword(id, form.CurrentPassword, form.NewPassword)
+	if err != nil {
+		if errors.Is(err, models.ErrInvalidCredentials) {
+			form.AddNonFieldError("Password is incorrect")
+
+			data := app.newTemplateData(r)
+			data.Form = form
+			app.render(w, http.StatusUnprocessableEntity, "password.tmpl", data)
+		} else {
+			app.serverError(w, err)
+		}
+		return
+	}
+
+	app.sessionManager.Put(r.Context(), "flash", "Password successfully changed!")
+	http.Redirect(w, r, "/account/view", http.StatusSeeOther)
+}

cmd/web/handlers_test.go

@@ -0,0 +1,228 @@
+package main
+
+import (
+	"net/http"
+	"net/url"
+	"testing"
+
+	"gitea.local.lab/Lbenedar/snippetbox/internal/assert"
+)
+
+func TestPing(t *testing.T) {
+	app := newTestApplication(t)
+
+	ts := newTestServer(t, app.routes())
+	defer ts.Close()
+
+	statusCode, _, body := ts.get(t, "/ping")
+
+	assert.Equal(t, statusCode, http.StatusOK)
+	assert.Equal(t, body, "OK")
+}
+
+func TestSnippetView(t *testing.T) {
+	app := newTestApplication(t)
+
+	ts := newTestServer(t, app.routes())
+	defer ts.Close()
+
+	tests := []struct {
+		name     string
+		urlPath  string
+		wantCode int
+		wantBody string
+	}{
+		{
+			name:     "Valid ID",
+			urlPath:  "/snippet/view/1",
+			wantCode: http.StatusOK,
+			wantBody: "An old silent pond...",
+		},
+		{
+			name:     "Non-existend ID",
+			urlPath:  "/snippet/view/2",
+			wantCode: http.StatusNotFound,
+		},
+		{
+			name:     "Negative ID",
+			urlPath:  "/snippet/view/-1",
+			wantCode: http.StatusNotFound,
+		},
+		{
+			name:     "Decimal ID",
+			urlPath:  "/snippet/view/1.23",
+			wantCode: http.StatusNotFound,
+		},
+		{
+			name:     "String ID",
+			urlPath:  "/snippet/view/foo",
+			wantCode: http.StatusNotFound,
+		},
+		{
+			name:     "Empty ID",
+			urlPath:  "/snippet/view/",
+			wantCode: http.StatusNotFound,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			code, _, body := ts.get(t, tt.urlPath)
+
+			assert.Equal(t, code, tt.wantCode)
+
+			if tt.wantBody != "" {
+				assert.StringContains(t, body, tt.wantBody)
+			}
+		})
+	}
+}
+
+func TestUserSignup(t *testing.T) {
+	app := newTestApplication(t)
+	ts := newTestServer(t, app.routes())
+	defer ts.Close()
+
+	_, _, body := ts.get(t, "/user/signup")
+	validCsrfToken := extractCSRFToken(t, body)
+	t.Logf("CsrfToken: %s", validCsrfToken)
+
+	const (
+		validName     = "Bob"
+		validPassword = "validPa$$word"
+		validEmail    = "bob@example.com"
+		formTag       = "<form action='/user/signup' method='POST' novalidate>"
+	)
+
+	tests := []struct {
+		name         string
+		userName     string
+		userEmail    string
+		userPassword string
+		csrfToken    string
+		wantCode     int
+		wantFormTag  string
+	}{
+		{
+			name:         "Valid submission",
+			userName:     validName,
+			userEmail:    validEmail,
+			userPassword: validPassword,
+			csrfToken:    validCsrfToken,
+			wantCode:     http.StatusSeeOther,
+		},
+		{
+			name:         "Invalid CSRF Token",
+			userName:     validName,
+			userEmail:    validEmail,
+			userPassword: validPassword,
+			csrfToken:    "wrongToken",
+			wantCode:     http.StatusBadRequest,
+		},
+		{
+			name:         "Empty name",
+			userName:     "",
+			userEmail:    validEmail,
+			userPassword: validPassword,
+			csrfToken:    validCsrfToken,
+			wantCode:     http.StatusUnprocessableEntity,
+			wantFormTag:  formTag,
+		},
+		{
+			name:         "Empty email",
+			userName:     validName,
+			userEmail:    "",
+			userPassword: validPassword,
+			csrfToken:    validCsrfToken,
+			wantCode:     http.StatusUnprocessableEntity,
+			wantFormTag:  formTag,
+		},
+		{
+			name:         "Empty password",
+			userName:     validName,
+			userEmail:    validEmail,
+			userPassword: "",
+			csrfToken:    validCsrfToken,
+			wantCode:     http.StatusUnprocessableEntity,
+			wantFormTag:  formTag,
+		},
+		{
+			name:         "Invalid email",
+			userName:     validName,
+			userEmail:    "bob@example.",
+			userPassword: validPassword,
+			csrfToken:    validCsrfToken,
+			wantCode:     http.StatusUnprocessableEntity,
+			wantFormTag:  formTag,
+		},
+		{
+			name:         "Short password",
+			userName:     validName,
+			userEmail:    validEmail,
+			userPassword: "pa$$",
+			csrfToken:    validCsrfToken,
+			wantCode:     http.StatusUnprocessableEntity,
+			wantFormTag:  formTag,
+		},
+		{
+			name:         "Duplicate email",
+			userName:     validName,
+			userEmail:    "dupe@example.com",
+			userPassword: validPassword,
+			csrfToken:    validCsrfToken,
+			wantCode:     http.StatusUnprocessableEntity,
+			wantFormTag:  formTag,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			form := url.Values{}
+			form.Add("name", tt.userName)
+			form.Add("email", tt.userEmail)
+			form.Add("password", tt.userPassword)
+			form.Add("csrf_token", tt.csrfToken)
+
+			code, _, body := ts.postForm(t, "/user/signup", form)
+
+			assert.Equal(t, code, tt.wantCode)
+			if tt.wantFormTag != "" {
+				assert.StringContains(t, body, tt.wantFormTag)
+			}
+		})
+	}
+}
+
+func TestSnippetCreate(t *testing.T) {
+	app := newTestApplication(t)
+	ts := newTestServer(t, app.routes())
+	defer ts.Close()
+
+	const (
+		validPassword = "validPa$$word"
+		validEmail    = "bob@example.com"
+	)
+
+	t.Run("Unauthenticated", func(t *testing.T) {
+		code, head, _ := ts.get(t, "/snippet/create")
+		assert.Equal(t, code, http.StatusSeeOther)
+		assert.Equal(t, head.Get("Location"), "/user/login")
+	})
+
+	t.Run("Authenticated", func(t *testing.T) {
+		_, _, body := ts.get(t, "/user/login")
+		validCsrfToken := extractCSRFToken(t, body)
+		t.Logf("CsrfToken: %s", validCsrfToken)
+
+		form := url.Values{}
+		form.Add("email", validEmail)
+		form.Add("password", validPassword)
+		form.Add("csrf_token", validCsrfToken)
+		code, _, _ := ts.postForm(t, "/user/login", form)
+		t.Logf("Auth result: %d", code)
+
+		code, _, body = ts.get(t, "/snippet/create")
+		assert.Equal(t, code, http.StatusOK)
+		assert.StringContains(t, body, "<form action='/snippet/create' method='POST'>")
+	})
+}

cmd/web/helpers.go

@@ -13,7 +13,13 @@ func (app *application) serverError(w http.ResponseWriter, err error) {
 	trace := fmt.Sprintf("%s\n%s", err.Error(), debug.Stack())
 	app.errorLog.Output(2, trace)
 
-	http.Error(w, http.StatusText(http.StatusInternalServerError), http.StatusInternalServerError)
+	var errorText string
+	if app.debug {
+		errorText = trace
+	} else {
+		errorText = http.StatusText(http.StatusInternalServerError)
+	}
+	http.Error(w, errorText, http.StatusInternalServerError)
 }
 
 func (app *application) clientError(w http.ResponseWriter, status int) {
@@ -24,13 +30,13 @@ func (app *application) notFound(w http.ResponseWriter) {
 	app.clientError(w, http.StatusNotFound)
 }
 
-func (app *application) decodePostForm(r *http.Request, snippetForm any) error {
+func (app *application) decodePostForm(r *http.Request, templateForm any) error {
 	err := r.ParseForm()
 	if err != nil {
 		return err
 	}
 
-	err = app.formDecoder.Decode(&snippetForm, r.PostForm)
+	err = app.formDecoder.Decode(&templateForm, r.PostForm)
 	if err != nil {
 		var invalidDecoderError *form.InvalidDecoderError
 		if errors.As(err, &invalidDecoderError) {

cmd/web/main.go

@@ -21,17 +21,19 @@ import (
 type application struct {
 	errorLog       *log.Logger
 	infoLog        *log.Logger
-	snippets       *models.SnippetModel
-	users          *models.UserModel
+	snippets       models.SnippetModelInterface
+	users          models.UserModelInterface
 	templateCache  map[string]*template.Template
 	formDecoder    *form.Decoder
 	sessionManager *scs.SessionManager
+	debug          bool
 }
 
 type config struct {
 	addr      string
 	staticDir string
 	dsn       string
+	debug     bool
 }
 
 func main() {
@@ -39,6 +41,7 @@ func main() {
 	flag.StringVar(&cfg.addr, "addr", ":4000", "HTTP network address")
 	flag.StringVar(&cfg.staticDir, "static-dir", "./ui/static", "Path to static assets")
 	flag.StringVar(&cfg.dsn, "dsn", "web:pass@/snippetbox?parseTime=true", "MySQL data source name")
+	flag.BoolVar(&cfg.debug, "debug", false, "Option to enable debug mode")
 	flag.Parse()
 
 	errorLog := log.New(os.Stderr, "ERROR\t", log.Ldate|log.Ltime|log.Lshortfile)
@@ -68,6 +71,7 @@ func main() {
 		templateCache:  templateCache,
 		formDecoder:    formDecoder,
 		sessionManager: sessionManager,
+		debug:          cfg.debug,
 	}
 
 	tlsConfig := &tls.Config{

cmd/web/middleware.go

@@ -13,8 +13,8 @@ func secureHeaders(next http.Handler) http.Handler {
 		w.Header().Set("Content-Security-Policy",
 			"default-src 'self'; style-src 'self' fonts.googleapis.com; font-src fonts.gstatic.com")
 		w.Header().Set("Referrer-Policy", "origin-when-cross-origin")
-		w.Header().Set("X-Content-Type-Options", "nosniff")
-		w.Header().Set("X-Frame-Options", "deny")
+		w.Header().Set("X-Content-Type-Options", "deny")
+		w.Header().Set("X-Frame-Options", "nosniff")
 		w.Header().Set("X-XSS-Protection", "0")
 
 		next.ServeHTTP(w, r)
@@ -24,9 +24,9 @@ func secureHeaders(next http.Handler) http.Handler {
 func noSurf(next http.Handler) http.Handler {
 	csrfHanlder := nosurf.New(next)
 	csrfHanlder.SetBaseCookie(http.Cookie{
-		HttpOnly: true,
+		HttpOnly: false,
 		Path:     "/",
-		Secure:   true,
+		Secure:   false,
 	})
 
 	return csrfHanlder
@@ -56,6 +56,7 @@ func (app *application) recoverPanic(next http.Handler) http.Handler {
 func (app *application) requireAuthentication(next http.Handler) http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		if !app.isAuthenticated(r) {
+			app.sessionManager.Put(r.Context(), "redirectParent", r.URL.Path)
 			http.Redirect(w, r, "/user/login", http.StatusSeeOther)
 			return
 		}

cmd/web/middleware_test.go

@@ -0,0 +1,46 @@
+package main
+
+import (
+	"bytes"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"gitea.local.lab/Lbenedar/snippetbox/internal/assert"
+)
+
+func TestSecureHeaders(t *testing.T) {
+	rr := httptest.NewRecorder()
+
+	r, err := http.NewRequest(http.MethodGet, "/", nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	next := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Write([]byte("OK"))
+	})
+	secureHeaders(next).ServeHTTP(rr, r)
+
+	rs := rr.Result()
+
+	expectedValue := "default-src 'self'; style-src 'self' fonts.googleapis.com; font-src fonts.gstatic.com"
+	assert.Equal(t, rs.Header.Get("Content-Security-Policy"), expectedValue)
+
+	expectedValue = "nosniff"
+	assert.Equal(t, rs.Header.Get("X-Frame-Options"), expectedValue)
+
+	expectedValue = "0"
+	assert.Equal(t, rs.Header.Get("X-XSS-Protection"), expectedValue)
+
+	assert.Equal(t, rs.StatusCode, http.StatusOK)
+
+	defer rs.Body.Close()
+	body, err := io.ReadAll(rs.Body)
+	if err != nil {
+		t.Fatal(err)
+	}
+	bytes.TrimSpace(body)
+
+	assert.Equal(t, string(body), "OK")
+}

cmd/web/routes.go

@@ -19,9 +19,12 @@ func (app *application) routes() http.Handler {
 	fileServer := http.FileServer(http.FS(ui.Files))
 	router.Handler(http.MethodGet, "/static/*filepath", fileServer)
 
+	router.HandlerFunc(http.MethodGet, "/ping", ping)
+
 	dynamic := alice.New(app.sessionManager.LoadAndSave, noSurf, app.authenticate)
 
 	router.Handler(http.MethodGet, "/", dynamic.ThenFunc(app.home))
+	router.Handler(http.MethodGet, "/about", dynamic.ThenFunc(app.about))
 	router.Handler(http.MethodGet, "/snippet/view/:id", dynamic.ThenFunc(app.snippetView))
 
 	router.Handler(http.MethodGet, "/user/signup", dynamic.ThenFunc(app.userSignup))
@@ -31,6 +34,9 @@ func (app *application) routes() http.Handler {
 
 	protected := dynamic.Append(app.requireAuthentication)
 
+	router.Handler(http.MethodGet, "/account/view", protected.ThenFunc(app.accountView))
+	router.Handler(http.MethodGet, "/account/password", protected.ThenFunc(app.accountChangePassword))
+	router.Handler(http.MethodPost, "/account/password", protected.ThenFunc(app.accountChangePasswordPost))
 	router.Handler(http.MethodGet, "/snippet/create", protected.ThenFunc(app.snippetCreate))
 	router.Handler(http.MethodPost, "/snippet/create", protected.ThenFunc(app.snippetCreatePost))
 	router.Handler(http.MethodPost, "/user/logout", protected.ThenFunc(app.userLogoutPost))

cmd/web/templates.go

@@ -20,6 +20,7 @@ type templateData struct {
 	Flash           string
 	IsAuthenticated bool
 	CSRFToken       string
+	AboutText       string
 }
 
 func humanDate(t time.Time) string {

cmd/web/testutils_test.go

@@ -0,0 +1,104 @@
+package main
+
+import (
+	"bytes"
+	"html"
+	"io"
+	"log"
+	"net/http"
+	"net/http/cookiejar"
+	"net/http/httptest"
+	"net/url"
+	"regexp"
+	"testing"
+	"time"
+
+	"gitea.local.lab/Lbenedar/snippetbox/internal/models/mocks"
+	"github.com/alexedwards/scs/v2"
+	"github.com/go-playground/form/v4"
+)
+
+var csrfTokenRX = regexp.MustCompile(`<input type='hidden' name='csrf_token' value='(.+)'>`)
+
+func extractCSRFToken(t *testing.T, body string) string {
+	t.Logf("Body: %s", body)
+	matches := csrfTokenRX.FindStringSubmatch(body)
+	if len(matches) < 2 {
+		t.Fatal("no csrf token found in body")
+	}
+
+	return html.UnescapeString(string(matches[1]))
+}
+
+func newTestApplication(t *testing.T) *application {
+	templateCache, err := newTemplateCache()
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	formDecoder := form.NewDecoder()
+
+	sessionManager := scs.New()
+	sessionManager.Lifetime = 12 * time.Hour
+	sessionManager.Cookie.Secure = true
+
+	return &application{
+		errorLog:       log.New(io.Discard, "", 0),
+		infoLog:        log.New(io.Discard, "", 0),
+		snippets:       &mocks.SnippetModel{},
+		users:          &mocks.UserModel{},
+		templateCache:  templateCache,
+		formDecoder:    formDecoder,
+		sessionManager: sessionManager,
+	}
+}
+
+type testServer struct {
+	*httptest.Server
+}
+
+func newTestServer(t *testing.T, h http.Handler) *testServer {
+	ts := httptest.NewTLSServer(h)
+	jar, err := cookiejar.New(nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	ts.Client().Jar = jar
+
+	ts.Client().CheckRedirect = func(req *http.Request, via []*http.Request) error {
+		return http.ErrUseLastResponse
+	}
+	return &testServer{ts}
+}
+
+func (ts *testServer) get(t *testing.T, urlPath string) (int, http.Header, string) {
+	rs, err := ts.Client().Get(ts.URL + urlPath)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	defer rs.Body.Close()
+	body, err := io.ReadAll(rs.Body)
+	if err != nil {
+		t.Fatal(err)
+	}
+	bytes.TrimSpace(body)
+
+	return rs.StatusCode, rs.Header, string(body)
+}
+
+func (ts *testServer) postForm(t *testing.T, urlPath string, form url.Values) (int, http.Header, string) {
+	rs, err := ts.Client().PostForm(ts.URL+urlPath, form)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	defer rs.Body.Close()
+	body, err := io.ReadAll(rs.Body)
+	if err != nil {
+		t.Fatal(err)
+	}
+	bytes.TrimSpace(body)
+	return rs.StatusCode, rs.Header, string(body)
+}

internal/assert/assert.go

@@ -0,0 +1,30 @@
+package assert
+
+import (
+	"strings"
+	"testing"
+)
+
+func Equal[T comparable](t *testing.T, actual, expected T) {
+	t.Helper()
+
+	if actual != expected {
+		t.Errorf("got: %v; want: %v", actual, expected)
+	}
+}
+
+func StringContains(t *testing.T, actual, expectedString string) {
+	t.Helper()
+
+	if !strings.Contains(actual, expectedString) {
+		t.Errorf("got: %q; expected to contain: %q", actual, expectedString)
+	}
+}
+
+func NilError(t *testing.T, actual error) {
+	t.Helper()
+
+	if actual != nil {
+		t.Errorf("got: %v; expected: nil", actual)
+	}
+}

internal/models/mocks/snippets.go

@@ -0,0 +1,34 @@
+package mocks
+
+import (
+	"time"
+
+	"gitea.local.lab/Lbenedar/snippetbox/internal/models"
+)
+
+var mockSnippet = &models.Snippet{
+	ID:      1,
+	Title:   "An old silent pond",
+	Content: "An old silent pond...",
+	Created: time.Now(),
+	Expires: time.Now(),
+}
+
+type SnippetModel struct{}
+
+func (m *SnippetModel) Insert(title string, content string, expires int) (int, error) {
+	return 2, nil
+}
+
+func (m *SnippetModel) Get(id int) (*models.Snippet, error) {
+	switch id {
+	case 1:
+		return mockSnippet, nil
+	default:
+		return nil, models.ErrNoRecord
+	}
+}
+
+func (m *SnippetModel) Latest() ([]*models.Snippet, error) {
+	return []*models.Snippet{mockSnippet}, nil
+}

internal/models/mocks/users.go

@@ -0,0 +1,39 @@
+package mocks
+
+import "gitea.local.lab/Lbenedar/snippetbox/internal/models"
+
+type UserModel struct{}
+
+func (m *UserModel) Insert(name, email, password string) error {
+	switch email {
+	case "dupe@example.com":
+		return models.ErrDuplicateEmail
+	default:
+		return nil
+	}
+}
+
+func (m *UserModel) Authenticate(email, password string) (int, error) {
+	if email == "alice@example.com" && password == "pa$$word" {
+		return 1, nil
+	}
+
+	return 0, models.ErrInvalidCredentials
+}
+
+func (m *UserModel) Exists(id int) (bool, error) {
+	switch id {
+	case 1:
+		return true, nil
+	default:
+		return false, nil
+	}
+}
+
+func (m *UserModel) GetById(id int) (*models.User, error) {
+	return nil, nil
+}
+
+func (a *UserModel) ChangePassword(id int, curr_pass, new_pass string) error {
+	return nil
+}

internal/models/snippets.go

@@ -13,7 +13,11 @@ type Snippet struct {
 	Created time.Time
 	Expires time.Time
 }
-
+type SnippetModelInterface interface {
+	Insert(title string, content string, expires int) (int, error)
+	Get(id int) (*Snippet, error)
+	Latest() ([]*Snippet, error)
+}
 type SnippetModel struct {
 	DB *sql.DB
 }

internal/models/testdata/setup.sql

@@ -0,0 +1,26 @@
+CREATE TABLE snippets (
+    id INTEGER NOT NULL PRIMARY KEY AUTO_INCREMENT,
+    title VARCHAR(100) NOT NULL,
+    content TEXT NOT NULL,
+    created DATETIME NOT NULL,
+    expires DATETIME NOT NULL
+);
+
+CREATE INDEX idx_snippets_created ON snippets(created);
+
+CREATE TABLE users (
+    id INTEGER NOT NULL PRIMARY KEY AUTO_INCREMENT,
+    name VARCHAR(255) NOT NULL,
+    email VARCHAR(255) NOT NULL,
+    hashed_password CHAR(60) NOT NULL,
+    created DATETIME NOT NULL
+);
+
+ALTER TABLE users ADD CONSTRAINT users_uc_email UNIQUE (email);
+
+INSERT INTO users (name, email, hashed_password, created) VALUES (
+    'Alice Jones',
+    'alice@example.com',
+    '$2a$12$NuTjWXm3KKntReFwyBVHyuf/to.HEwTy.eS206TNfkGfr6HzGJSWG',
+    '2022-01-01 10:00:00'
+);

internal/models/testdata/teardown.sql

@@ -0,0 +1,3 @@
+DROP TABLE users;
+
+DROP TABLE snippets;

internal/models/testutils_test.go

@@ -0,0 +1,37 @@
+package models
+
+import (
+	"database/sql"
+	"os"
+	"testing"
+)
+
+func newTestDB(t *testing.T) *sql.DB {
+	db, err := sql.Open("mysql", "test_web:pass@/test_snippetbox?parseTime=true&multiStatements=true")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	script, err := os.ReadFile("./testdata/setup.sql")
+	if err != nil {
+		t.Fatal(err)
+	}
+	_, err = db.Exec(string(script))
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	t.Cleanup(func() {
+		script, err := os.ReadFile("./testdata/teardown.sql")
+		if err != nil {
+			t.Fatal(err)
+		}
+		_, err = db.Exec(string(script))
+		if err != nil {
+			t.Fatal(err)
+		}
+
+		db.Close()
+	})
+	return db
+}

internal/models/users.go

@@ -18,6 +18,14 @@ type User struct {
 	Created        time.Time
 }
 
+type UserModelInterface interface {
+	Insert(name, email, password string) error
+	Authenticate(email, password string) (int, error)
+	Exists(id int) (bool, error)
+	GetById(id int) (*User, error)
+	ChangePassword(id int, curr_pass, new_pass string) error
+}
+
 type UserModel struct {
 	DB *sql.DB
 }
@@ -76,3 +84,46 @@ func (m *UserModel) Exists(id int) (bool, error) {
 	err := m.DB.QueryRow(stmt, id).Scan(&exists)
 	return exists, err
 }
+
+func (a *UserModel) GetById(id int) (*User, error) {
+	acc := User{}
+
+	stmt := `SELECT name, email, created FROM users WHERE id = ?`
+	err := a.DB.QueryRow(stmt, id).Scan(&acc.Name, &acc.Email, &acc.Created)
+	if err != nil {
+		if errors.Is(err, sql.ErrNoRows) {
+			return nil, ErrInvalidCredentials
+		}
+		return nil, err
+	}
+
+	return &acc, nil
+}
+
+func (a *UserModel) ChangePassword(id int, curr_pass, new_pass string) error {
+	hashedNewPassword, err := bcrypt.GenerateFromPassword([]byte(new_pass), 12)
+	if err != nil {
+		return err
+	}
+
+	var hashedDBPassword []byte
+	stmt := `SELECT hashed_password FROM users WHERE id = ?`
+	err = a.DB.QueryRow(stmt, id).Scan(&hashedDBPassword)
+	if err != nil {
+		return err
+	}
+	err = bcrypt.CompareHashAndPassword(hashedDBPassword, []byte(curr_pass))
+	if err != nil {
+		if errors.Is(err, bcrypt.ErrMismatchedHashAndPassword) {
+			return ErrInvalidCredentials
+		}
+		return err
+	}
+
+	stmt = `UPDATE users SET hashed_password = ? WHERE id = ?`
+	_, err = a.DB.Exec(stmt, hashedNewPassword, id)
+	if err != nil {
+		return err
+	}
+	return nil
+}

internal/models/users_test.go

@@ -0,0 +1,45 @@
+package models
+
+import (
+	"testing"
+
+	"gitea.local.lab/Lbenedar/snippetbox/internal/assert"
+)
+
+func TestUserModelExists(t *testing.T) {
+	if testing.Short() {
+		t.Skip("models: skipping integration test")
+	}
+
+	tests := []struct {
+		name   string
+		userID int
+		want   bool
+	}{
+		{
+			name:   "Valid ID",
+			userID: 1,
+			want:   true,
+		},
+		{
+			name:   "Zero ID",
+			userID: 0,
+			want:   false,
+		},
+		{
+			name:   "Non-existent ID",
+			userID: 2,
+			want:   false,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			db := newTestDB(t)
+			m := UserModel{DB: db}
+
+			exists, err := m.Exists(tt.userID)
+			assert.Equal(t, exists, tt.want)
+			assert.NilError(t, err)
+		})
+	}
+}

ui/html/pages/about.tmpl

@@ -0,0 +1,8 @@
+{{define "title"}}About{{end}}
+
+{{define "main"}}
+    <h2>About</h2>
+    <div class='about'>
+        {{.AboutText}}
+    </div>
+{{end}}

ui/html/pages/account.tmpl

@@ -0,0 +1,28 @@
+{{define "title"}}Account{{end}}
+
+{{define "main"}}
+    <h2>Account</h2>
+    {{if .Form}}
+    <table>
+        <tr>
+            <th>Name</th>
+            <th>{{.Form.Name}}</th>
+        </tr>
+        <tr>
+            <th>Email</th>
+            <th>{{.Form.Email}}</th>
+        </tr>
+        <tr>
+            <th>Joined</th>
+            <th>{{.Form.Joined}}</th>
+        </tr>
+    </table>
+    {{else}}
+        <p>There's nothing to see here... yet!</p>
+    {{end}}
+    <form action='/account/password' method='GET'>
+        <div>
+            <input type='submit' value='Change password'>
+        </div>
+    </form>
+{{end}}

ui/html/pages/password.tmpl

@@ -0,0 +1,35 @@
+{{define "title"}}Change Password{{end}}
+
+{{define "main"}}
+    <h2>Change Password</h2>
+    <form action='/account/password' method='POST' novalidate>
+        <input type='hidden' name='csrf_token' value='{{.CSRFToken}}'>
+        {{range .Form.NonFieldErrors}}
+            <div class='error'>{{.}}</div>
+        {{end}}
+        <div>
+            <label>Current password:</label>
+            {{with .Form.FieldErrors.curr_pass}}
+                <label class='error'>{{.}}</label>
+            {{end}}
+            <input type='password' name='curr_pass' value=''>
+        </div>
+        <div>
+            <label>New password:</label>
+            {{with .Form.FieldErrors.new_pass}}
+                <label class='error'>{{.}}</label>
+            {{end}}
+            <input type='password' name='new_pass'>
+        </div>
+        <div>
+            <label>Confirm new password:</label>
+            {{with .Form.FieldErrors.conf_pass}}
+                <label class='error'>{{.}}</label>
+            {{end}}
+            <input type='password' name='conf_pass'>
+        </div>
+        <div>
+            <input type='submit' value='Change password'>
+        </div>
+    </form>
+{{end}}

ui/html/partials/nav.tmpl

@@ -2,12 +2,14 @@
 <nav>
     <div>
         <a href='/'>Home</a>
+        <a href='/about'>About</a>
         {{if .IsAuthenticated}}
             <a href='/snippet/create'>Create snippet</a>
         {{end}}
     </div>
     <div>
         {{if .IsAuthenticated}}
+            <a href='/account/view'>Account</a>
             <form action='/user/logout' method='POST'>
                 <input type='hidden' name='csrf_token' value='{{.CSRFToken}}'>
                 <button>Logout</button>

ui/static/text/about.txt

@@ -0,0 +1 @@
+Lorem ipsum dolor sit amet, consectetur adipiscing elit. Phasellus magna quam, eleifend a metus at, tincidunt commodo enim. Integer ac mattis ipsum. Pellentesque habitant morbi tristique senectus et netus et malesuada fames ac turpis egestas. Maecenas non purus ullamcorper, tristique diam vel, sagittis neque. Fusce quam dolor, accumsan non leo sed, auctor rutrum felis. Duis semper tristique tellus, sed sagittis est lobortis nec. Curabitur porttitor lacus eget semper sodales. Duis diam nisl, maximus eu felis id, placerat pulvinar erat. Etiam elementum elit tellus, at auctor ante accumsan vitae. Nulla elit magna, molestie vitae nibh ut, vehicula accumsan ipsum. Ut id consequat ipsum, volutpat volutpat orci. Aenean rhoncus tellus lacus, nec tempor risus interdum sed. Proin quis quam in metus imperdiet lobortis. Duis euismod sem enim, volutpat mollis tortor posuere sed. Morbi condimentum eget dolor at accumsan.