at-container-registry/pkg/appview/handlers/auth.go

package handlers

import (
	"fmt"
	"html/template"
	"net/http"
)

// LoginHandler shows the OAuth login form
type LoginHandler struct {
	Templates *template.Template
}

func (h *LoginHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
	returnTo := r.URL.Query().Get("return_to")
	fmt.Printf("DEBUG [login]: GET request. return_to param=%s, full query=%s\n", returnTo, r.URL.RawQuery)
	if returnTo == "" {
		returnTo = "/"
	}

	data := struct {
		ReturnTo string
		Error    string
	}{
		ReturnTo: returnTo,
		Error:    r.URL.Query().Get("error"),
	}

	if err := h.Templates.ExecuteTemplate(w, "login", data); err != nil {
		http.Error(w, err.Error(), http.StatusInternalServerError)
		return
	}
}

// LoginSubmitHandler processes the login form submission
type LoginSubmitHandler struct {
}

func (h *LoginSubmitHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
	if r.Method != http.MethodPost {
		http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)
		return
	}

	handle := r.FormValue("handle")
	returnTo := r.FormValue("return_to")
	if returnTo == "" {
		returnTo = "/"
	}

	if handle == "" {
		http.Redirect(w, r, "/auth/oauth/login?return_to="+returnTo+"&error=handle_required", http.StatusFound)
		return
	}

	// Store return_to in cookie so callback can use it
	// Note: Secure flag depends on the request scheme (HTTP vs HTTPS)
	http.SetCookie(w, &http.Cookie{
		Name:     "oauth_return_to",
		Value:    returnTo,
		Path:     "/",
		MaxAge:   600, // 10 minutes
		HttpOnly: true,
		Secure:   r.URL.Scheme == "https" || r.Header.Get("X-Forwarded-Proto") == "https",
		SameSite: http.SameSiteLaxMode,
	})

	// Redirect to OAuth authorize with handle
	http.Redirect(w, r, "/auth/oauth/authorize?handle="+handle, http.StatusFound)
}