chore: remove signup and account routes

internal/features/auth/handler.go

@@ -3,9 +3,7 @@ package auth
 import (
 	"errors"
 	"net/http"
-	"time"
 
-	"mal/internal/database"
 	"mal/internal/templates"
 )
 
@@ -15,38 +13,6 @@ type Handler struct {
 
 const rateLimitFormError = "Too many attempts in a short time. Please wait a minute and try again."
 
-const (
-	accountPasswordChangedMessage       = "Password updated successfully."
-	accountRecoveryKeyRotatedMessage    = "Recovery key rotated. Save this new key now."
-	accountPasswordErrorMessage         = "Unable to update password with those details."
-	accountRecoveryErrorMessage         = "Unable to rotate recovery key with those details."
-	accountUnexpectedErrorMessage       = "Something went wrong. Please try again."
-	accountMissingFieldsErrorMessage    = "Please complete all required fields."
-	accountPasswordMismatchErrorMessage = "New password and confirm password must match."
-)
-
-func (h *Handler) accountUserFromRequest(r *http.Request) (*database.User, bool) {
-	cookie, err := r.Cookie("session_id")
-	if err != nil {
-		return nil, false
-	}
-
-	user, err := h.authService.ValidateSession(r.Context(), cookie.Value)
-	if err != nil {
-		return nil, false
-	}
-
-	return user, true
-}
-
-func accountCreatedAt(createdAt time.Time) string {
-	return createdAt.Local().Format("Jan 2, 2006 at 15:04")
-}
-
-func renderAccountPage(w http.ResponseWriter, r *http.Request, user *database.User, passwordError string, passwordSuccess string, recoveryError string, recoverySuccess string, recoveryKey string) {
-	templates.Account(user.Username, accountCreatedAt(user.CreatedAt), passwordError, passwordSuccess, recoveryError, recoverySuccess, recoveryKey).Render(r.Context(), w)
-}
-
 func NewHandler(authService *Service) *Handler {
 	return &Handler{authService: authService}
 }
@@ -86,41 +52,6 @@ func (h *Handler) HandleLogin(w http.ResponseWriter, r *http.Request) {
 	http.Redirect(w, r, "/", http.StatusFound)
 }
 
-func (h *Handler) HandleRegister(w http.ResponseWriter, r *http.Request) {
-	if err := r.ParseForm(); err != nil {
-		templates.Register("Something went wrong. Please try again.", "").Render(r.Context(), w)
-		return
-	}
-
-	username := r.FormValue("username")
-	password := r.FormValue("password")
-
-	if username == "" || password == "" {
-		templates.Register("Please enter both email and password.", username).Render(r.Context(), w)
-		return
-	}
-
-	_, recoveryKey, err := h.authService.RegisterUser(r.Context(), username, password)
-	if err != nil {
-		if errors.Is(err, ErrInvalidPassword) || errors.Is(err, ErrUserExists) {
-			templates.Register("Unable to create account with those details.", username).Render(r.Context(), w)
-			return
-		}
-		templates.Register("Something went wrong. Please try again.", username).Render(r.Context(), w)
-		return
-	}
-
-	// Auto-login after successful registration
-	session, err := h.authService.Login(r.Context(), username, password)
-	if err != nil {
-		http.Redirect(w, r, "/login", http.StatusFound)
-		return
-	}
-
-	SetSessionCookie(w, session.ID, session.ExpiresAt)
-	templates.RegistrationRecoveryKey(recoveryKey).Render(r.Context(), w)
-}
-
 func (h *Handler) HandleLogout(w http.ResponseWriter, r *http.Request) {
 	cookie, err := r.Cookie("session_id")
 	if err == nil {
@@ -136,10 +67,6 @@ func (h *Handler) HandleLoginPage(w http.ResponseWriter, r *http.Request) {
 	templates.Login(rateLimitErrorFromQuery(r), "").Render(r.Context(), w)
 }
 
-func (h *Handler) HandleRegisterPage(w http.ResponseWriter, r *http.Request) {
-	templates.Register(rateLimitErrorFromQuery(r), "").Render(r.Context(), w)
-}
-
 func (h *Handler) HandleRecoverPage(w http.ResponseWriter, r *http.Request) {
 	templates.Recover(rateLimitErrorFromQuery(r), "", "").Render(r.Context(), w)
 }
@@ -171,98 +98,3 @@ func (h *Handler) HandleRecover(w http.ResponseWriter, r *http.Request) {
 
 	templates.RecoveryComplete(newRecoveryKey).Render(r.Context(), w)
 }
-
-func (h *Handler) HandleAccountPage(w http.ResponseWriter, r *http.Request) {
-	if r.Method != http.MethodGet {
-		http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)
-		return
-	}
-
-	user, ok := h.accountUserFromRequest(r)
-	if !ok {
-		http.Redirect(w, r, "/login", http.StatusFound)
-		return
-	}
-
-	renderAccountPage(w, r, user, "", "", "", "", "")
-}
-
-func (h *Handler) HandleAccountPassword(w http.ResponseWriter, r *http.Request) {
-	if r.Method != http.MethodPost {
-		http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)
-		return
-	}
-
-	user, ok := h.accountUserFromRequest(r)
-	if !ok {
-		http.Redirect(w, r, "/login", http.StatusFound)
-		return
-	}
-
-	if err := r.ParseForm(); err != nil {
-		renderAccountPage(w, r, user, accountUnexpectedErrorMessage, "", "", "", "")
-		return
-	}
-
-	currentPassword := r.FormValue("current_password")
-	newPassword := r.FormValue("new_password")
-	confirmNewPassword := r.FormValue("confirm_new_password")
-
-	if currentPassword == "" || newPassword == "" || confirmNewPassword == "" {
-		renderAccountPage(w, r, user, accountMissingFieldsErrorMessage, "", "", "", "")
-		return
-	}
-
-	if newPassword != confirmNewPassword {
-		renderAccountPage(w, r, user, accountPasswordMismatchErrorMessage, "", "", "", "")
-		return
-	}
-
-	err := h.authService.ChangePassword(r.Context(), user.ID, currentPassword, newPassword)
-	if err != nil {
-		if errors.Is(err, ErrInvalidCredentials) || errors.Is(err, ErrInvalidPassword) {
-			renderAccountPage(w, r, user, accountPasswordErrorMessage, "", "", "", "")
-			return
-		}
-		renderAccountPage(w, r, user, accountUnexpectedErrorMessage, "", "", "", "")
-		return
-	}
-
-	renderAccountPage(w, r, user, "", accountPasswordChangedMessage, "", "", "")
-}
-
-func (h *Handler) HandleAccountRecoveryKey(w http.ResponseWriter, r *http.Request) {
-	if r.Method != http.MethodPost {
-		http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)
-		return
-	}
-
-	user, ok := h.accountUserFromRequest(r)
-	if !ok {
-		http.Redirect(w, r, "/login", http.StatusFound)
-		return
-	}
-
-	if err := r.ParseForm(); err != nil {
-		renderAccountPage(w, r, user, "", "", accountUnexpectedErrorMessage, "", "")
-		return
-	}
-
-	password := r.FormValue("password")
-	if password == "" {
-		renderAccountPage(w, r, user, "", "", accountMissingFieldsErrorMessage, "", "")
-		return
-	}
-
-	newRecoveryKey, err := h.authService.RegenerateRecoveryKey(r.Context(), user.ID, password)
-	if err != nil {
-		if errors.Is(err, ErrInvalidCredentials) {
-			renderAccountPage(w, r, user, "", "", accountRecoveryErrorMessage, "", "")
-			return
-		}
-		renderAccountPage(w, r, user, "", "", accountUnexpectedErrorMessage, "", "")
-		return
-	}
-
-	renderAccountPage(w, r, user, "", "", "", accountRecoveryKeyRotatedMessage, newRecoveryKey)
-}

internal/server/routes.go

@@ -68,13 +68,6 @@ func NewRouter(cfg Config) http.Handler {
 			middleware.RateLimitAuth(middleware.VerifyOrigin(http.HandlerFunc(authHandler.HandleLogin))).ServeHTTP(w, r)
 		}
 	})
-	mux.HandleFunc("/register", func(w http.ResponseWriter, r *http.Request) {
-		if r.Method == http.MethodGet {
-			authHandler.HandleRegisterPage(w, r)
-		} else {
-			middleware.RateLimitAuth(middleware.VerifyOrigin(http.HandlerFunc(authHandler.HandleRegister))).ServeHTTP(w, r)
-		}
-	})
 	mux.HandleFunc("/recover", func(w http.ResponseWriter, r *http.Request) {
 		if r.Method == http.MethodGet {
 			authHandler.HandleRecoverPage(w, r)
@@ -85,13 +78,6 @@ func NewRouter(cfg Config) http.Handler {
 	mux.HandleFunc("/logout", func(w http.ResponseWriter, r *http.Request) {
 		middleware.VerifyOrigin(http.HandlerFunc(authHandler.HandleLogout)).ServeHTTP(w, r)
 	})
-	mux.HandleFunc("/account", authHandler.HandleAccountPage)
-	mux.HandleFunc("/account/password", func(w http.ResponseWriter, r *http.Request) {
-		middleware.VerifyOrigin(http.HandlerFunc(authHandler.HandleAccountPassword)).ServeHTTP(w, r)
-	})
-	mux.HandleFunc("/account/recovery-key", func(w http.ResponseWriter, r *http.Request) {
-		middleware.VerifyOrigin(http.HandlerFunc(authHandler.HandleAccountRecoveryKey)).ServeHTTP(w, r)
-	})
 
 	// Watchlist Endpoints
 	mux.HandleFunc("/api/watchlist/export", watchlistHandler.HandleExportWatchlist)

internal/shared/middleware/auth.go

@@ -59,8 +59,8 @@ func RequireAuth(next http.Handler) http.Handler {
 
 func RequireGlobalAuth(next http.Handler) http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		// Allow unauthenticated access to login, register, search, and static files
+		// Allow unauthenticated access to auth pages, search, and static files
-		if r.URL.Path == "/login" || r.URL.Path == "/register" || r.URL.Path == "/recover" ||
+		if r.URL.Path == "/login" || r.URL.Path == "/recover" ||
 			strings.HasPrefix(r.URL.Path, "/static/") || strings.HasPrefix(r.URL.Path, "/dist/") ||
 			r.URL.Path == "/search" || r.URL.Path == "/api/search" || r.URL.Path == "/api/search-quick" ||
 			r.URL.Path == "/" {

internal/templates/auth.templ

@@ -20,9 +20,6 @@ templ Login(formError string, username string) {
 						<p class="mt-2 text-xs text-(--danger)" role="alert" aria-live="polite">{ formError }</p>
 					}
 				</form>
-				<p class="mt-5 mb-0 text-center text-sm text-(--text-muted)">
-					Don't have an account? <a class="text-(--accent)" href="/register">Register</a>
-				</p>
 				<p class="mt-5 mb-0 text-center text-sm text-(--text-muted)">
 					Lost access? <a class="text-(--accent)" href="/recover">Recover account</a>
 				</p>
@@ -31,56 +28,6 @@ templ Login(formError string, username string) {
 	}
 }
 
-templ Register(formError string, username string) {
-	@Layout("Register", false) {
-		<div class="w-full max-w-xl">
-			<div class="mx-auto w-full bg-(--panel) p-6">
-				<h2 class="m-0 text-2xl">Register</h2>
-				<p class="my-3 mb-5 text-sm text-(--text-muted)">Create a new account to track anime.</p>
-				<form action="/register" method="POST" class="grid gap-4">
-					<div class="grid gap-1">
-						<label for="username">Username / Email</label>
-						<input class="h-10 border border-transparent bg-(--surface-search) px-3 text-(--text) transition-colors duration-120 focus:border-(--surface-search-focus-border) focus:outline-none" type="text" id="username" name="username" required placeholder="you@example.com" value={ username }/>
-					</div>
-					<div class="grid gap-1">
-						<label for="password">Password</label>
-						<input class="h-10 border border-transparent bg-(--surface-search) px-3 text-(--text) transition-colors duration-120 focus:border-(--surface-search-focus-border) focus:outline-none" type="password" id="password" name="password" required placeholder="Minimum 12 chars"/>
-					</div>
-					<p class="m-0 text-xs leading-normal text-(--text-faint)">
-						Password must be at least 12 characters and include an uppercase letter, lowercase letter, number, and special character.
-					</p>
-					<button type="submit" class="h-10 cursor-pointer border-0 bg-(--accent) text-sm font-semibold text-(--text-on-accent) hover:brightness-95">Create account</button>
-					if formError != "" {
-						<p class="mt-2 text-xs text-(--danger)" role="alert" aria-live="polite">{ formError }</p>
-					}
-				</form>
-				<p class="mt-5 mb-0 text-center text-sm text-(--text-muted)">
-					Already have an account? <a class="text-(--accent)" href="/login">Sign in</a>
-				</p>
-			</div>
-		</div>
-	}
-}
-
-templ RegistrationRecoveryKey(recoveryKey string) {
-	@Layout("Save recovery key", false) {
-		<div class="w-full max-w-xl">
-			<div class="mx-auto w-full bg-(--panel) p-6">
-				<h2>Save your recovery key</h2>
-				<p class="my-3 mb-5 text-sm text-(--text-muted)">Store this key somewhere safe. It is shown only once.</p>
-				<div class="grid gap-2">
-					<p class="m-0 break-all border border-(--surface-search-focus-border) bg-(--surface-search) p-3 text-sm text-(--text)" id="registration-recovery-key">{ recoveryKey }</p>
-					<button type="button" class="min-w-0 justify-self-start border border-(--surface-search-focus-border) bg-(--surface-search) px-3 py-1.5 text-xs leading-none text-(--text) hover:bg-(--surface-input-focus)" onclick="copyRecoveryKey('registration-recovery-key', 'registration-copy-feedback')">Copy key</button>
-				</div>
-				<p class="mt-2 min-h-5 text-xs leading-normal text-(--text-faint)" id="registration-copy-feedback" aria-live="polite"></p>
-				<p class="m-0 text-xs leading-normal text-(--text-faint)">If you lose your password, this key is the only way to recover your account without email.</p>
-				<p class="mt-5 mb-0 text-center text-sm text-(--text-muted)">
-					<a href="/" class="inline-flex min-h-10 items-center justify-center border border-(--surface-search-focus-border) bg-(--surface-search) px-4 text-(--text) no-underline hover:bg-(--panel-soft) hover:no-underline">I saved it, continue</a>
-				</p>
-			</div>
-		</div>
-	}
-}
 
 templ Recover(formError string, username string, recoveryKey string) {
 	@Layout("Recover account", false) {
@@ -133,80 +80,3 @@ templ RecoveryComplete(newRecoveryKey string) {
 		</div>
 	}
 }
-
-templ Account(username string, createdAt string, passwordError string, passwordSuccess string, recoveryError string, recoverySuccess string, recoveryKey string) {
-	@Layout("mal - account", true) {
-		<div class="mx-auto grid w-full max-w-3xl gap-4">
-			<section class="grid gap-3 bg-(--panel) p-5">
-				<h2>Account</h2>
-				<div class="grid gap-2">
-					<div class="grid gap-1">
-						<span class="text-xs text-(--text-faint)">Email / Username</span>
-						<span class="text-sm text-(--text)">{ username }</span>
-					</div>
-					<div class="grid gap-1">
-						<span class="text-xs text-(--text-faint)">Created</span>
-						<span class="text-sm text-(--text)">{ createdAt }</span>
-					</div>
-				</div>
-			</section>
-
-			<section class="grid gap-3 bg-(--panel) p-5">
-				<h3>Change password</h3>
-				<form action="/account/password" method="POST" class="grid gap-3" onsubmit="return confirmDangerAction('Change your password now?')">
-					<div class="grid gap-1">
-						<label for="current_password">Current password</label>
-						<input class="h-10 w-full border border-transparent bg-(--surface-search) px-3 text-(--text) transition-colors duration-120 focus:border-(--surface-search-focus-border) focus:outline-none" type="password" id="current_password" name="current_password" required/>
-					</div>
-					<div class="grid gap-1">
-						<label for="new_password">New password</label>
-						<input class="h-10 w-full border border-transparent bg-(--surface-search) px-3 text-(--text) transition-colors duration-120 focus:border-(--surface-search-focus-border) focus:outline-none" type="password" id="new_password" name="new_password" required placeholder="Minimum 12 chars"/>
-					</div>
-					<div class="grid gap-1">
-						<label for="confirm_new_password">Confirm new password</label>
-						<input class="h-10 w-full border border-transparent bg-(--surface-search) px-3 text-(--text) transition-colors duration-120 focus:border-(--surface-search-focus-border) focus:outline-none" type="password" id="confirm_new_password" name="confirm_new_password" required/>
-					</div>
-					<button type="submit" class="h-10 cursor-pointer border border-(--surface-search-focus-border) bg-(--surface-search) px-4 text-(--text) hover:bg-(--panel-soft)">Update password</button>
-					if passwordError != "" {
-						<p class="mt-2 text-xs text-(--danger)" role="alert" aria-live="polite">{ passwordError }</p>
-					}
-					if passwordSuccess != "" {
-						<p class="m-0 text-xs text-(--accent)" role="status" aria-live="polite">{ passwordSuccess }</p>
-					}
-				</form>
-			</section>
-
-			<section class="grid gap-3 bg-(--panel) p-5">
-				<h3>Recovery key</h3>
-				<p class="m-0 text-xs leading-normal text-(--text-faint)">To view a new recovery key, confirm your current password. This rotates your old key.</p>
-				<form action="/account/recovery-key" method="POST" class="grid gap-3" onsubmit="return confirmDangerAction('Rotate recovery key now? Your old key will stop working.')">
-					<div class="grid gap-1">
-						<label for="recovery_password">Current password</label>
-						<input class="h-10 w-full border border-transparent bg-(--surface-search) px-3 text-(--text) transition-colors duration-120 focus:border-(--surface-search-focus-border) focus:outline-none" type="password" id="recovery_password" name="password" required/>
-					</div>
-					<button type="submit" class="h-10 cursor-pointer border border-(--surface-search-focus-border) bg-(--surface-search) px-4 text-(--text) hover:bg-(--panel-soft)">Show new recovery key</button>
-					if recoveryError != "" {
-						<p class="mt-2 text-xs text-(--danger)" role="alert" aria-live="polite">{ recoveryError }</p>
-					}
-					if recoverySuccess != "" {
-						<p class="m-0 text-xs text-(--accent)" role="status" aria-live="polite">{ recoverySuccess }</p>
-					}
-				</form>
-				if recoveryKey != "" {
-					<div class="grid gap-2">
-						<p class="m-0 break-all border border-(--surface-search-focus-border) bg-(--surface-search) p-3 text-sm text-(--text)" id="account-recovery-key">{ recoveryKey }</p>
-						<button type="button" class="min-w-0 justify-self-start border border-(--surface-search-focus-border) bg-(--surface-search) px-3 py-1.5 text-xs leading-none text-(--text) hover:bg-(--surface-input-focus)" onclick="copyRecoveryKey('account-recovery-key', 'account-copy-feedback')">Copy key</button>
-					</div>
-					<p class="mt-2 min-h-5 text-xs leading-normal text-(--text-faint)" id="account-copy-feedback" aria-live="polite"></p>
-				}
-			</section>
-
-			<section class="grid gap-3 bg-(--panel) p-5">
-				<h3>Danger zone</h3>
-				<form action="/logout" method="POST" class="inline-flex" onsubmit="return confirmDangerAction('Log out of this account now?')">
-					<button type="submit" class="h-10 cursor-pointer border border-(--surface-search-focus-border) bg-(--surface-search) px-4 text-(--text) hover:bg-(--panel-soft)">Log out</button>
-				</form>
-			</section>
-		</div>
-	}
-}

internal/templates/layout.templ

@@ -31,7 +31,6 @@ templ Layout(title string, showHeader bool) {
 								<a class="text-(--text-muted) no-underline hover:text-(--text) hover:no-underline" href="/discover">Discover</a>
 								<a class="text-(--text-muted) no-underline hover:text-(--text) hover:no-underline" href="/notifications">Notifications</a>
 								<a class="text-(--text-muted) no-underline hover:text-(--text) hover:no-underline" href="/watchlist">Watchlist</a>
-								<a class="text-(--text-muted) no-underline hover:text-(--text) hover:no-underline" href="/account">Account</a>
 							</div>
 						</div>
 						<div class="relative ml-auto min-w-60 w-full max-w-md max-lg:ml-0" data-search-root>