Supabase login

Author: goatonabicycle

internal/admin/handlers.go

@@ -29,6 +29,20 @@ func NewHandler(templates TemplateRenderer) *Handler {
 }
 
 func (h *Handler) AdminHandler(c echo.Context) error {
+	cookie, err := c.Cookie("session")
+	if err != nil {
+		return h.templates.Render(c.Response().Writer, "admin/pages/login.html", map[string]interface{}{
+			"Title": "Admin Login - Millions of Words",
+		}, c)
+	}
+
+	user, err := loader.ValidateSession(cookie.Value)
+	if err != nil || user == nil {
+		return h.templates.Render(c.Response().Writer, "admin/pages/login.html", map[string]interface{}{
+			"Title": "Admin Login - Millions of Words",
+		}, c)
+	}
+
 	allAlbums, err := loader.LoadAllAlbumsData()
 	if err != nil {
 		log.Printf("Error loading albums: %v", err)
@@ -37,32 +51,33 @@ func (h *Handler) AdminHandler(c echo.Context) error {
 
 	return h.templates.Render(c.Response().Writer, "admin/pages/index.html", map[string]interface{}{
 		"Title":         "Admin - Millions of Words",
-		"Authenticated": false,
+		"Authenticated": true,
 		"Albums":        allAlbums,
 	}, c)
 }
 
 func (h *Handler) AdminAuthHandler(c echo.Context) error {
-	key := c.FormValue("authKey")
-	valid, err := loader.ValidateAuthKey(key)
-	if err != nil || !valid {
-		return c.HTML(http.StatusUnauthorized, `
-					<div class="text-red-500 text-center p-2">Invalid authentication key</div>
-			`)
-	}
+	email := c.FormValue("email")
+	password := c.FormValue("password")
 
-	allAlbums, err := loader.LoadAllAlbumsData()
+	user, err := loader.SignInWithEmail(email, password)
 	if err != nil {
-		log.Printf("Error loading albums: %v", err)
-		return err
+		return c.HTML(http.StatusUnauthorized, `
+			<div class="text-red-500 text-center p-2">Invalid email or password</div>
+		`)
 	}
 
-	return h.templates.Render(c.Response().Writer, "admin/pages/index.html", map[string]interface{}{
-		"Title":         "Admin - Millions of Words",
-		"Authenticated": true,
-		"AuthKey":       key,
-		"Albums":        allAlbums,
-	}, c)
+	c.SetCookie(&http.Cookie{
+		Name:     "session",
+		Value:    user.AccessToken,
+		HttpOnly: true,
+		Path:     "/",
+		Secure:   true,
+		SameSite: http.SameSiteStrictMode,
+		MaxAge:   86400, // 24 hours
+	})
+
+	return c.Redirect(http.StatusFound, "/admin")
 }
 
 func (h *Handler) AdminEditorHandler(c echo.Context) error {
@@ -76,7 +91,7 @@ func (h *Handler) AdminEditorHandler(c echo.Context) error {
 		return err
 	}
 
-	return h.templates.Render(c.Response().Writer, "admin/components/album-form", map[string]interface{}{
+	return h.templates.Render(c.Response().Writer, "admin/components/album-form.html", map[string]interface{}{
 		"Albums": allAlbums,
 	}, c)
 }
@@ -85,7 +100,8 @@ func (h *Handler) AdminImportHandler(c echo.Context) error {
 	if err := validateAuth(c); err != nil {
 		return err
 	}
-	return h.templates.Render(c.Response().Writer, "admin/components/import-form", nil, c)
+
+	return h.templates.Render(c.Response().Writer, "admin/components/import-form.html", nil, c)
 }
 
 func (h *Handler) AdminAlbumEditorHandler(c echo.Context) error {
@@ -98,7 +114,6 @@ func (h *Handler) AdminAlbumEditorHandler(c echo.Context) error {
 		return echo.NewHTTPError(http.StatusBadRequest, "No album ID provided")
 	}
 
-	authKey := c.QueryParam("authKey")
 	albums, err := loader.LoadAllAlbumsData()
 	if err != nil {
 		return echo.NewHTTPError(http.StatusInternalServerError, "Error loading albums")
@@ -107,8 +122,7 @@ func (h *Handler) AdminAlbumEditorHandler(c echo.Context) error {
 	for _, album := range albums {
 		if album.ID == albumID {
 			return h.templates.Render(c.Response().Writer, "admin/components/album-editor-content.html", map[string]interface{}{
-				"Album":   album,
-				"AuthKey": authKey,
+				"Album": album,
 			}, c)
 		}
 	}
@@ -151,14 +165,8 @@ func (h *Handler) UpdateTrackHandler(c echo.Context) error {
 }
 
 func (h *Handler) ImportAlbumHandler(c echo.Context) error {
-	key := c.FormValue("authKey")
-	valid, err := loader.ValidateAuthKey(key)
-	if err != nil || !valid {
-		return c.HTML(http.StatusUnauthorized, `
-					<div class="bg-red-500/10 border border-red-500 text-red-500 p-4 rounded">
-							Invalid authentication
-					</div>
-			`)
+	if err := validateAuth(c); err != nil {
+		return err
 	}
 
 	urls := strings.Split(c.FormValue("bandcampUrls"), "\n")
@@ -177,56 +185,56 @@ func (h *Handler) ImportAlbumHandler(c echo.Context) error {
 
 		if !strings.Contains(url, "bandcamp.com") {
 			results = append(results, fmt.Sprintf(`
-							<div class="bg-red-500/10 border border-red-500 text-red-500 p-2 rounded text-sm">
-									Invalid Bandcamp URL: %s
-							</div>`, url))
+				<div class="bg-red-500/10 border border-red-500 text-red-500 p-2 rounded text-sm">
+					Invalid Bandcamp URL: %s
+				</div>`, url))
 			continue
 		}
 
 		exists, err := loader.AlbumUrlExists(url)
 		if err != nil {
 			results = append(results, fmt.Sprintf(`
-							<div class="bg-red-500/10 border border-red-500 text-red-500 p-2 rounded text-sm">
-									Error checking database for %s: %v
-							</div>`, url, err))
+				<div class="bg-red-500/10 border border-red-500 text-red-500 p-2 rounded text-sm">
+					Error checking database for %s: %v
+				</div>`, url, err))
 			continue
 		}
 
 		if exists {
 			results = append(results, fmt.Sprintf(`
-							<div class="bg-yellow-500/10 border border-yellow-500 text-yellow-500 p-2 rounded text-sm">
-									%s has already been imported
-							</div>`, url))
+				<div class="bg-yellow-500/10 border border-yellow-500 text-yellow-500 p-2 rounded text-sm">
+					%s has already been imported
+				</div>`, url))
 			continue
 		}
 
 		albumData, err := fetch.FetchFromBandcamp(url)
 		if err != nil {
 			results = append(results, fmt.Sprintf(`
-							<div class="bg-red-500/10 border border-red-500 text-red-500 p-2 rounded text-sm">
-									Error fetching %s: %v
-							</div>`, url, err))
+				<div class="bg-red-500/10 border border-red-500 text-red-500 p-2 rounded text-sm">
+					Error fetching %s: %v
+				</div>`, url, err))
 			continue
 		}
 
 		if err := loader.SaveAlbum(albumData); err != nil {
 			results = append(results, fmt.Sprintf(`
-							<div class="bg-red-500/10 border border-red-500 text-red-500 p-2 rounded text-sm">
-									Error saving %s: %v
-							</div>`, url, err))
+				<div class="bg-red-500/10 border border-red-500 text-red-500 p-2 rounded text-sm">
+					Error saving %s: %v
+				</div>`, url, err))
 			continue
 		}
 
 		results = append(results, fmt.Sprintf(`
-					<div class="bg-green-500/10 border border-green-500 text-green-500 p-2 rounded text-sm">
-							Successfully imported %s - %s
-					</div>`, albumData.ArtistName, albumData.AlbumName))
+			<div class="bg-green-500/10 border border-green-500 text-green-500 p-2 rounded text-sm">
+				Successfully imported %s - %s
+			</div>`, albumData.ArtistName, albumData.AlbumName))
 
 		progressMsg := fmt.Sprintf(`
-					<div class="text-gray-400 text-sm text-right">
-							Processed %d of %d
-					</div>
-			`, i+1, total)
+			<div class="text-gray-400 text-sm text-right">
+				Processed %d of %d
+			</div>
+		`, i+1, total)
 
 		log.Printf("Writing progress update to response")
 		_, err = c.Response().Write([]byte(strings.Join(results, "\n") + progressMsg))
@@ -247,49 +255,48 @@ func (h *Handler) FetchMetalArchivesHandler(c echo.Context) error {
 		return err
 	}
 
-	url := c.FormValue("url")
+	url := c.FormValue("metalArchivesUrl")
 	if url == "" {
-		return echo.NewHTTPError(http.StatusBadRequest, "URL is required")
+		return echo.NewHTTPError(http.StatusBadRequest, "Metal Archives URL is required")
 	}
 
-	album, err := fetch.FetchFromMetalArchives(url)
+	data, err := fetch.FetchFromMetalArchives(url)
 	if err != nil {
-		return echo.NewHTTPError(http.StatusInternalServerError, fmt.Sprintf("Failed to fetch album: %v", err))
-	}
-
-	if err := loader.SaveAlbum(album); err != nil {
-		return echo.NewHTTPError(http.StatusInternalServerError, fmt.Sprintf("Failed to save album: %v", err))
+		return echo.NewHTTPError(http.StatusInternalServerError, fmt.Sprintf("Failed to fetch data: %v", err))
 	}
 
-	return c.JSON(http.StatusOK, album)
+	return h.templates.Render(c.Response().Writer, "admin/components/metal-archives-preview.html", map[string]interface{}{
+		"Data": data,
+	}, c)
 }
 
 func (h *Handler) ValidateMetalArchivesUrlHandler(c echo.Context) error {
 	if err := validateAuth(c); err != nil {
 		return err
 	}
 
-	url := c.FormValue("url")
+	url := c.FormValue("metalArchivesUrl")
 	if url == "" {
-		return echo.NewHTTPError(http.StatusBadRequest, "URL is required")
+		return c.HTML(http.StatusOK, "")
 	}
 
-	if !strings.Contains(url, "metal-archives.com") {
-		return echo.NewHTTPError(http.StatusBadRequest, "Invalid Metal Archives URL")
+	if !strings.HasPrefix(url, "https://www.metal-archives.com/albums/") {
+		return c.HTML(http.StatusOK, `<div class="text-red-500">Invalid Metal Archives URL format</div>`)
 	}
 
-	return c.JSON(http.StatusOK, map[string]string{"status": "valid"})
+	return c.HTML(http.StatusOK, "")
 }
 
 func validateAuth(c echo.Context) error {
-	key := c.QueryParam("authKey")
-	if key == "" {
-		key = c.FormValue("authKey")
+	cookie, err := c.Cookie("session")
+	if err != nil {
+		return echo.NewHTTPError(http.StatusUnauthorized, "Not authenticated")
 	}
 
-	valid, err := loader.ValidateAuthKey(key)
-	if err != nil || !valid {
-		return echo.NewHTTPError(http.StatusUnauthorized, "Invalid auth key")
+	user, err := loader.ValidateSession(cookie.Value)
+	if err != nil || user == nil {
+		return echo.NewHTTPError(http.StatusUnauthorized, "Invalid session")
 	}
+
 	return nil
 }

loaders/sqlite/loader.go

@@ -162,32 +162,7 @@ func calculateAverage(total, count int) int {
 	return 0
 }
 
-func ValidateAuthKey(key string) (bool, error) {
-	db, err := sql.Open("sqlite", dbPath)
-	if err != nil {
-		return false, fmt.Errorf("error opening database: %w", err)
-	}
-	defer db.Close()
-
-	var exists bool
-	err = db.QueryRow("SELECT EXISTS(SELECT 1 FROM auth_keys WHERE key = ?)", key).Scan(&exists)
-	if err != nil {
-		log.Printf("Error checking auth key: %v", err)
-		return false, fmt.Errorf("error checking auth key: %w", err)
-	}
-
-	return exists, nil
-}
-
 func UpdateTrackLyrics(req models.UpdateTrackRequest) error {
-	valid, err := ValidateAuthKey(req.AuthKey)
-	if err != nil {
-		return fmt.Errorf("error validating auth: %w", err)
-	}
-	if !valid {
-		return fmt.Errorf("invalid auth key")
-	}
-
 	cleanLyrics := strings.TrimSpace(req.Lyrics)
 	if strings.HasPrefix(strings.ToLower(cleanLyrics), "lyrics") {
 		cleanLyrics = ""