feat(auth): implement strict and secure user registration

internal/features/auth/handler.go

@@ -39,6 +39,47 @@ func (h *Handler) HandleLogin(w http.ResponseWriter, r *http.Request) {
 	http.Redirect(w, r, "/", http.StatusFound)
 }
 
+func (h *Handler) HandleRegister(w http.ResponseWriter, r *http.Request) {
+	if err := r.ParseForm(); err != nil {
+		http.Error(w, "invalid request", http.StatusBadRequest)
+		return
+	}
+
+	username := r.FormValue("username")
+	password := r.FormValue("password")
+
+	if username == "" || password == "" {
+		http.Error(w, "username and password are required", http.StatusBadRequest)
+		return
+	}
+
+	_, err := h.authService.RegisterUser(r.Context(), username, password)
+	if err != nil {
+		if err == ErrInvalidPassword {
+			http.Error(w, err.Error(), http.StatusBadRequest)
+			return
+		}
+		if err == ErrUserExists {
+			http.Error(w, "username already taken", http.StatusConflict)
+			return
+		}
+		http.Error(w, "registration failed", http.StatusInternalServerError)
+		return
+	}
+
+	// Auto-login after successful registration
+	session, err := h.authService.Login(r.Context(), username, password)
+	if err != nil {
+		http.Redirect(w, r, "/login", http.StatusFound)
+		return
+	}
+
+	SetSessionCookie(w, session.ID, session.ExpiresAt)
+
+	w.Header().Set("HX-Redirect", "/")
+	http.Redirect(w, r, "/", http.StatusFound)
+}
+
 func (h *Handler) HandleLogout(w http.ResponseWriter, r *http.Request) {
 	cookie, err := r.Cookie("session_id")
 	if err == nil {
@@ -53,3 +94,7 @@ func (h *Handler) HandleLogout(w http.ResponseWriter, r *http.Request) {
 func (h *Handler) HandleLoginPage(w http.ResponseWriter, r *http.Request) {
 	templates.Login().Render(r.Context(), w)
 }
+
+func (h *Handler) HandleRegisterPage(w http.ResponseWriter, r *http.Request) {
+	templates.Register().Render(r.Context(), w)
+}