type comment struct {
	username   string
	text       string
	dateString string
}

var comments []comment

var validUsers = map[string]string{                             // 1
	"bill": "abc123",
}

func login(username, password string) bool {                    // 2
	if validPassword, ok := validUsers[username]; ok {
		return validPassword == password
	}
	return false
}

func postComments(w http.ResponseWriter, r *http.Request) {
	username, password, auth := r.BasicAuth()                   // 3

	if !auth || !login(username, password) {                    // 4
		w.WriteHeader(http.StatusUnauthorized)
		return
	}

	commentText, err := io.ReadAll(r.Body)
	if err != nil {
		w.WriteHeader(http.StatusInternalServerError)
		return
	}

	comments = append(comments, comment{
		username:   username,
		text:       string(commentText),
		dateString: time.Now().Format(time.RFC3339),
	})
	w.WriteHeader(http.StatusOK)
}

func getComments(w http.ResponseWriter, r *http.Request) {
	commentBody := ""
	for i := range comments {
		commentBody += fmt.Sprintf("%s (%s) - @%s\n",
			comments[i].text, comments[i].dateString, comments[i].username)
	}
	fmt.Fprintln(w, fmt.Sprintf("Comments: \n%s", commentBody))
}

func main() {
	http.HandleFunc("GET /comments", getComments)
	http.HandleFunc("POST /comments", postComments)

	if err := http.ListenAndServe(":8000", nil); err != nil {
		panic(err)
	}
}

curl -X POST -u bill:abc123 http://localhost:8000/comments \
     -d "This is my first comment"

curl -X POST http://localhost:8000/comments -d "No credentials"

curl http://localhost:8000/comments

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.
eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkFsaWNlIiwiYWRtaW4iOnRydWUsImV4cCI6MTcxMDAwMDAwMH0.
h1sRrK3T9T64aY0o9fGlfi0OvlrKXrXjZzUMgC8M6sE

var SIGNING_KEY = []byte("secret-pem-key-value") 							// 1

type claim struct { 														// 2
	jwt.RegisteredClaims
}

func generateClaim() (string, error) { 										// 3
	claims := claim{
		jwt.RegisteredClaims{
			ExpiresAt: jwt.NewNumericDate(time.Now().Add(time.Hour)),
			IssuedAt:  jwt.NewNumericDate(time.Now()),
			NotBefore: jwt.NewNumericDate(time.Now()),
			Subject:   "nobody@example.com",
		},
	}

	token := jwt.NewWithClaims(jwt.SigningMethodES256, claims) 				// 4
	ss, err := token.SignedString(SIGNING_KEY) 								// 5
	if err != nil {
		return "", err
	}
	return ss, nil
}

func main() {
	if signed, err := generateClaim(); err != nil { 						// 6
		panic(err)
	} else {
		token, err := jwt.Parse(signed, func(t *jwt.Token) (any, error) { 	// 7
			return SIGNING_KEY, nil
		})
		if err != nil {
			panic(err)
		}
		if validatedClaims, ok := token.Claims.(jwt.MapClaims); ok && token.Valid { 	// 8
			log.Println(validatedClaims["sub"])
		} else {
			panic("error getting claims")
		}
	}
}

package main

import (
	"fmt"
	"net/http"
	"time"

	"github.com/golang-jwt/jwt/v5"
)

var jwtKey = []byte("my_secret_key")

// Create claims structure
type Claims struct {
	Username string `json:"username"`
	jwt.RegisteredClaims
}

func loginHandler(w http.ResponseWriter, r *http.Request) {
	username := r.FormValue("username")

	// Create JWT claims
	claims := &Claims{
		Username: username,
		RegisteredClaims: jwt.RegisteredClaims{
			ExpiresAt: jwt.NewNumericDate(time.Now().Add(15 * time.Minute)),
			IssuedAt:  jwt.NewNumericDate(time.Now()),
		},
	}

	// Create token
	token := jwt.NewWithClaims(jwt.SigningMethodHS256, claims)
	tokenString, err := token.SignedString(jwtKey)
	if err != nil {
		http.Error(w, "could not create token", http.StatusInternalServerError)
		return
	}

	// Set JWT inside a cookie
	http.SetCookie(w, &http.Cookie{
		Name:     "token",
		Value:    tokenString,
		HttpOnly: true,
		Secure:   false, // set true in production (HTTPS)
		Path:     "/",
	})
	fmt.Fprintln(w, "Logged in, JWT set in cookie")
}

func homeHandler(w http.ResponseWriter, r *http.Request) {
	// Read cookie
	cookie, err := r.Cookie("token")
	if err != nil {
		http.Error(w, "no token", http.StatusUnauthorized)
		return
	}

	// Parse JWT
	tokenStr := cookie.Value
	claims := &Claims{}

	token, err := jwt.ParseWithClaims(tokenStr, claims, func(t *jwt.Token) (interface{}, error) {
		return jwtKey, nil
	})

	if err != nil || !token.Valid {
		http.Error(w, "invalid token", http.StatusUnauthorized)
		return
	}

	// Token is valid → access granted
	fmt.Fprintf(w, "Welcome %s!", claims.Username)
}

func main() {
	http.HandleFunc("/login", loginHandler)
	http.HandleFunc("/home", homeHandler)

	fmt.Println("Server running on http://localhost:8080")
	http.ListenAndServe(":8080", nil)
}