at-container-registry/pkg/appview/handlers/auth.go

package handlers

import (
	"log/slog"
	"net/http"
)

// LoginHandler shows the OAuth login form
type LoginHandler struct {
	BaseUIHandler
}

func (h *LoginHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
	returnTo := r.URL.Query().Get("return_to")
	slog.Debug("Login GET request", "return_to", returnTo, "query", r.URL.RawQuery)
	if returnTo == "" {
		returnTo = "/"
	}

	meta := NewPageMeta(
		"Login - "+h.ClientShortName,
		"Sign in to "+h.ClientShortName+" with your AT Protocol account to push and pull container images",
	).WithCanonical("https://" + h.SiteURL + "/login").
		WithSiteName(h.ClientShortName)

	data := struct {
		PageData
		Meta     *PageMeta
		ReturnTo string
		Error    string
	}{
		PageData: NewPageData(r, &h.BaseUIHandler),
		Meta:     meta,
		ReturnTo: returnTo,
		Error:    r.URL.Query().Get("error"),
	}

	if err := h.Templates.ExecuteTemplate(w, "login", data); err != nil {
		http.Error(w, err.Error(), http.StatusInternalServerError)
		return
	}
}

// LoginSubmitHandler processes the login form submission
type LoginSubmitHandler struct {
	BaseUIHandler
}

func (h *LoginSubmitHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
	if r.Method != http.MethodPost {
		http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)
		return
	}

	handle := r.FormValue("handle")
	returnTo := r.FormValue("return_to")
	if returnTo == "" {
		returnTo = "/"
	}

	if handle == "" {
		http.Redirect(w, r, "/auth/oauth/login?return_to="+returnTo+"&error=handle_required", http.StatusFound)
		return
	}

	// Store return_to in cookie so callback can use it
	// Note: Secure flag depends on the request scheme (HTTP vs HTTPS)
	http.SetCookie(w, &http.Cookie{
		Name:     "oauth_return_to",
		Value:    returnTo,
		Path:     "/",
		MaxAge:   600, // 10 minutes
		HttpOnly: true,
		Secure:   r.URL.Scheme == "https" || r.Header.Get("X-Forwarded-Proto") == "https",
		SameSite: http.SameSiteLaxMode,
	})

	// Redirect to OAuth authorize with handle
	http.Redirect(w, r, "/auth/oauth/authorize?handle="+handle, http.StatusFound)
}