Add member accounts: invites, registration, login, sessions, ban

Step 2 of the build order. The admin mints an invite link, the recipient registers with it, and from then on has a session. - The invite is spent in the same transaction that creates the account, so a failed signup leaves the code usable - Sessions are idle timeouts, 24h or 30 days with remember me, read from a cookie or a bearer header, extended at most once a minute - Ban is a reversible toggle that drops the member's live sessions - No password minimum; login is rate limited instead, 10 failures per email in 15 minutes, cleared by a correct password - Invite codes render as links carrying ?code=, which the register form prefills; PUBLIC_URL makes them pasteable from the loopback admin panel Tests cover invite spending, the idle timeout, ban, and the rate limiter.
2026-07-31 20:57:13 +03:00
parent 0a8c36fd82
commit 41c8a2914f
18 changed files with 1274 additions and 8 deletions
@@ -0,0 +1,29 @@
+<!doctype html>
+<html lang="fi">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
+  <title>{{.Title}} — Levyraati</title>
+  <link rel="stylesheet" href="/static/style.css">
+</head>
+<body>
+  <header>
+    <a class="brand" href="/">Levyraati{{if .Admin}} <span class="tag">ylläpito</span>{{end}}</a>
+    <nav>
+      {{if .Admin}}
+        <a href="/admin">Ylläpito</a>
+      {{else if .Member}}
+        <a href="/">Jono</a>
+        <span class="avatar" title="{{.Member.Name}}">{{.Member.Initials}}</span>
+        <form method="post" action="/logout"><button class="link">Kirjaudu ulos</button></form>
+      {{else}}
+        <a href="/login">Kirjaudu</a>
+      {{end}}
+    </nav>
+  </header>
+
+  {{with .Flash}}<p class="flash">{{.}}</p>{{end}}
+
+  <main>{{template "content" .}}</main>
+</body>
+</html>