login register

src/app.rs

@@ -17,8 +17,8 @@ use std::{path::Path, sync::Arc};
 #[allow(unused_imports)]
 use crate::{
     controllers::{
-        admin_categories, admin_dashboard, admin_form, admin_login, admin_orders,
-        admin_products, admin_shipping, auth, cart, checkout, home, i18n, media, shop,
+        admin_categories, admin_dashboard, admin_form, admin_orders,
+        admin_products, admin_shipping, auth, auth_pages, cart, checkout, home, i18n, media, shop,
     },
     initializers,
     models::_entities::users,
@@ -73,11 +73,11 @@ impl Hooks for App {
             .add_route(checkout::routes())
             // cross-cutting
             .add_route(auth::routes())
+            .add_route(auth_pages::routes())
             .add_route(i18n::routes())
             .add_route(media::routes())
             // admin
             .add_route(admin_dashboard::routes())
-            .add_route(admin_login::routes())
             .add_route(admin_products::routes())
             .add_route(admin_categories::routes())
             .add_route(admin_orders::routes())

src/controllers/admin_login.rs

@@ -1,86 +0,0 @@
-//! Cookie-based admin login/logout pages (separate from the JSON `/api/auth`
-//! flow used by the SPA/API).
-
-use axum_extra::extract::cookie::CookieJar;
-use loco_rs::prelude::*;
-use serde_json::json;
-
-use crate::{
-    controllers::auth as auth_controller,
-    models::users::{self, LoginParams},
-    controllers::i18n::current_lang,
-    shared::guard,
-};
-
-fn login_error(v: &TeraView, jar: &CookieJar) -> Result<Response> {
-    format::view(
-        v,
-        "admin/login.html",
-        json!({
-            "error": "Invalid credentials",
-            "logged_in_admin": false,
-            "lang": current_lang(jar),
-        }),
-    )
-}
-
-#[debug_handler]
-async fn login_page(
-    jar: CookieJar,
-    ViewEngine(v): ViewEngine<TeraView>,
-    State(ctx): State<AppContext>,
-) -> Result<Response> {
-    if guard::logged_in(&ctx, &jar).await {
-        return format::redirect("/admin/dashboard");
-    }
-
-    format::view(
-        &v,
-        "admin/login.html",
-        json!({
-            "error": null,
-            "logged_in_admin": false,
-            "lang": current_lang(&jar),
-        }),
-    )
-}
-
-#[debug_handler]
-async fn login(
-    jar: CookieJar,
-    ViewEngine(v): ViewEngine<TeraView>,
-    State(ctx): State<AppContext>,
-    Form(params): Form<LoginParams>,
-) -> Result<Response> {
-    let Ok(user) = users::Model::find_by_email(&ctx.db, &params.email).await else {
-        return login_error(&v, &jar);
-    };
-
-    if !user.verify_password(&params.password) || !guard::is_admin(&ctx, &user) {
-        return login_error(&v, &jar);
-    }
-
-    let jwt_secret = ctx.config.get_jwt_config()?;
-    let token = user
-        .generate_jwt(&jwt_secret.secret, jwt_secret.expiration)
-        .or_else(|_| unauthorized("unauthorized!"))?;
-
-    format::render()
-        .cookies(&[auth_controller::auth_cookie(&token, jwt_secret.expiration)])?
-        .redirect("/admin/dashboard")
-}
-
-#[debug_handler]
-async fn logout() -> Result<Response> {
-    format::render()
-        .cookies(&[auth_controller::clear_auth_cookie()])?
-        .redirect("/admin/login")
-}
-
-pub fn routes() -> Routes {
-    Routes::new()
-        .add("/admin", get(login_page))
-        .add("/admin/login", get(login_page))
-        .add("/admin/login", post(login))
-        .add("/admin/logout", post(logout))
-}

src/controllers/auth_pages.rs

@@ -0,0 +1,216 @@
+//! Cookie-based HTML auth pages (login, registration, email verification) for
+//! all users. There is no role column — an "admin" is simply the user whose
+//! email matches `settings.admin_email` (see [`guard::is_admin`]). On login,
+//! admins are redirected to the admin dashboard and everyone else to the
+//! storefront; both share the same `auth_token` cookie that the admin handlers
+//! already validate. This is the unified replacement for the former
+//! admin-only `/admin/login`. The JSON `/api/auth` flow in `auth.rs` is
+//! separate and untouched.
+
+use axum_extra::extract::cookie::CookieJar;
+use loco_rs::prelude::*;
+use serde_json::json;
+
+use crate::{
+    controllers::auth as auth_controller,
+    controllers::i18n::current_lang,
+    mailers::auth::AuthMailer,
+    models::users::{self, LoginParams, RegisterParams},
+    shared::guard,
+};
+
+/// Where a freshly-authenticated `user` should land.
+fn home_for(ctx: &AppContext, user: &users::Model) -> &'static str {
+    if guard::is_admin(ctx, user) {
+        "/admin/dashboard"
+    } else {
+        "/"
+    }
+}
+
+fn login_view(v: &TeraView, jar: &CookieJar, error: Option<&str>) -> Result<Response> {
+    format::view(
+        v,
+        "auth/login.html",
+        json!({
+            "error": error,
+            "logged_in_admin": false,
+            "lang": current_lang(jar),
+        }),
+    )
+}
+
+fn register_view(v: &TeraView, jar: &CookieJar, error: Option<&str>) -> Result<Response> {
+    format::view(
+        v,
+        "auth/register.html",
+        json!({
+            "error": error,
+            "logged_in_admin": false,
+            "lang": current_lang(jar),
+        }),
+    )
+}
+
+#[debug_handler]
+async fn login_page(
+    jar: CookieJar,
+    ViewEngine(v): ViewEngine<TeraView>,
+    State(ctx): State<AppContext>,
+) -> Result<Response> {
+    if let Some(user) = guard::current_user(&ctx, &jar).await {
+        return format::redirect(home_for(&ctx, &user));
+    }
+    login_view(&v, &jar, None)
+}
+
+#[debug_handler]
+async fn login(
+    jar: CookieJar,
+    ViewEngine(v): ViewEngine<TeraView>,
+    State(ctx): State<AppContext>,
+    Form(params): Form<LoginParams>,
+) -> Result<Response> {
+    let Ok(user) = users::Model::find_by_email(&ctx.db, &params.email).await else {
+        return login_view(&v, &jar, Some("invalid"));
+    };
+
+    if !user.verify_password(&params.password) {
+        return login_view(&v, &jar, Some("invalid"));
+    }
+
+    // Registration requires email verification before the account can sign in.
+    if user.email_verified_at.is_none() {
+        return login_view(&v, &jar, Some("unverified"));
+    }
+
+    let jwt_secret = ctx.config.get_jwt_config()?;
+    let token = user
+        .generate_jwt(&jwt_secret.secret, jwt_secret.expiration)
+        .or_else(|_| unauthorized("unauthorized!"))?;
+
+    format::render()
+        .cookies(&[auth_controller::auth_cookie(&token, jwt_secret.expiration)])?
+        .redirect(home_for(&ctx, &user))
+}
+
+#[debug_handler]
+async fn register_page(
+    jar: CookieJar,
+    ViewEngine(v): ViewEngine<TeraView>,
+    State(ctx): State<AppContext>,
+) -> Result<Response> {
+    if let Some(user) = guard::current_user(&ctx, &jar).await {
+        return format::redirect(home_for(&ctx, &user));
+    }
+    register_view(&v, &jar, None)
+}
+
+#[debug_handler]
+async fn register(
+    jar: CookieJar,
+    ViewEngine(v): ViewEngine<TeraView>,
+    State(ctx): State<AppContext>,
+    Form(params): Form<RegisterParams>,
+) -> Result<Response> {
+    let user = match users::Model::create_with_password(&ctx.db, &params).await {
+        Ok(user) => user,
+        Err(ModelError::EntityAlreadyExists {}) => {
+            return register_view(&v, &jar, Some("exists"));
+        }
+        Err(err) => {
+            // Most commonly a validation failure (name too short / invalid email).
+            tracing::info!(
+                message = err.to_string(),
+                user_email = &params.email,
+                "could not register user",
+            );
+            return register_view(&v, &jar, Some("invalid"));
+        }
+    };
+
+    let user = user
+        .into_active_model()
+        .set_email_verification_sent(&ctx.db)
+        .await?;
+
+    // The account already exists; a failed email send shouldn't 500 the page —
+    // log it and let the user fall back to resend-verification.
+    if let Err(err) = AuthMailer::send_welcome(&ctx, &user).await {
+        tracing::error!(
+            error = err.to_string(),
+            user_email = &user.email,
+            "failed to send verification email",
+        );
+    }
+
+    format::view(
+        &v,
+        "auth/verify_sent.html",
+        json!({
+            "email": user.email,
+            "logged_in_admin": false,
+            "lang": current_lang(&jar),
+        }),
+    )
+}
+
+#[debug_handler]
+async fn verify(
+    jar: CookieJar,
+    ViewEngine(v): ViewEngine<TeraView>,
+    State(ctx): State<AppContext>,
+    Path(token): Path<String>,
+) -> Result<Response> {
+    let Ok(user) = users::Model::find_by_verification_token(&ctx.db, &token).await else {
+        return verified_view(&v, &jar, false);
+    };
+
+    if user.email_verified_at.is_none() {
+        user.into_active_model().verified(&ctx.db).await?;
+    }
+
+    verified_view(&v, &jar, true)
+}
+
+fn verified_view(v: &TeraView, jar: &CookieJar, ok: bool) -> Result<Response> {
+    format::view(
+        v,
+        "auth/verified.html",
+        json!({
+            "ok": ok,
+            "logged_in_admin": false,
+            "lang": current_lang(jar),
+        }),
+    )
+}
+
+#[debug_handler]
+async fn logout() -> Result<Response> {
+    format::render()
+        .cookies(&[auth_controller::clear_auth_cookie()])?
+        .redirect("/login")
+}
+
+/// Backwards-compatible entry point: `/admin` sends admins to their dashboard
+/// and everyone else to the unified login.
+#[debug_handler]
+async fn admin_entry(jar: CookieJar, State(ctx): State<AppContext>) -> Result<Response> {
+    if let Some(user) = guard::current_user(&ctx, &jar).await {
+        if guard::is_admin(&ctx, &user) {
+            return format::redirect("/admin/dashboard");
+        }
+    }
+    format::redirect("/login")
+}
+
+pub fn routes() -> Routes {
+    Routes::new()
+        .add("/login", get(login_page))
+        .add("/login", post(login))
+        .add("/register", get(register_page))
+        .add("/register", post(register))
+        .add("/verify/{token}", get(verify))
+        .add("/logout", post(logout))
+        .add("/admin", get(admin_entry))
+}

src/controllers/mod.rs

@@ -1,8 +1,8 @@
 pub mod auth;
+pub mod auth_pages;
 pub mod admin_categories;
 pub mod admin_dashboard;
 pub mod admin_form;
-pub mod admin_login;
 pub mod admin_orders;
 pub mod admin_products;
 pub mod admin_shipping;

src/initializers/admin_seeder.rs

@@ -1,4 +1,5 @@
 use async_trait::async_trait;
+use chrono::offset::Local;
 use loco_rs::prelude::*;
 use loco_rs::hash;
 use sea_orm::{ActiveModelTrait, IntoActiveModel, Set};
@@ -30,10 +31,13 @@ impl Initializer for AdminSeeder {
             let mut am = user.into_active_model();
             am.password = Set(hash);
             am.name = Set(name);
+            // The admin signs in through the same /login flow as everyone else,
+            // which requires a verified email — keep the seeded admin verified.
+            am.email_verified_at = Set(Some(Local::now().into()));
             am.update(&ctx.db).await?;
             tracing::info!(admin = %email, "admin password synced from .env");
         } else {
-            users::Model::create_with_password(
+            let user = users::Model::create_with_password(
                 &ctx.db,
                 &RegisterParams {
                     email: email.clone(),
@@ -42,6 +46,10 @@ impl Initializer for AdminSeeder {
                 },
             )
             .await?;
+            // Auto-verify so the seeded admin can log in without an email round-trip.
+            let mut am = user.into_active_model();
+            am.email_verified_at = Set(Some(Local::now().into()));
+            am.update(&ctx.db).await?;
             tracing::info!(admin = %email, "admin user seeded");
         }
 

src/mailers/auth/welcome/html.t

@@ -4,7 +4,7 @@
   Dear {{name}},
   Welcome to Loco! You can now log in to your account.
   Before you get started, please verify your account by clicking the link below:
-  <a href="{{domain}}/api/auth/verify/{{verifyToken}}">
+  <a href="{{domain}}/verify/{{verifyToken}}">
     Verify Your Account
   </a>
   <p>Best regards,<br>The Loco Team</p>

src/mailers/auth/welcome/text.t

@@ -1,4 +1,4 @@
 Welcome {{name}}, you can now log in.
   Verify your account with the link below:
 
-  {{domain}}/api/auth/verify/{{verifyToken}}
+  {{domain}}/verify/{{verifyToken}}

src/shared/guard.rs

@@ -23,21 +23,25 @@ pub async fn current_admin(auth: auth::JWT, ctx: &AppContext) -> Result<users::M
     Ok(user)
 }
 
+/// Soft auth for public pages: returns the user behind a valid auth cookie, or
+/// `None`. Never errors — used to decide chrome and post-login redirects, not
+/// to gate protected handlers (use [`current_admin`] for that).
+pub async fn current_user(ctx: &AppContext, jar: &CookieJar) -> Option<users::Model> {
+    let cookie = jar.get(AUTH_COOKIE)?;
+    let jwt_config = ctx.config.get_jwt_config().ok()?;
+    let claims = loco_rs::auth::jwt::JWT::new(&jwt_config.secret)
+        .validate(cookie.value())
+        .ok()?;
+    users::Model::find_by_pid(&ctx.db, &claims.claims.pid)
+        .await
+        .ok()
+}
+
 /// Soft check for public pages: does the request carry a valid admin auth
 /// cookie? Never errors — used only to decide whether to show admin chrome.
 pub async fn logged_in(ctx: &AppContext, jar: &CookieJar) -> bool {
-    let Some(cookie) = jar.get(AUTH_COOKIE) else {
-        return false;
-    };
-    let Ok(jwt_config) = ctx.config.get_jwt_config() else {
-        return false;
-    };
-    let Ok(claims) = loco_rs::auth::jwt::JWT::new(&jwt_config.secret).validate(cookie.value())
-    else {
-        return false;
-    };
-    let Ok(user) = users::Model::find_by_pid(&ctx.db, &claims.claims.pid).await else {
-        return false;
-    };
-    is_admin(ctx, &user)
+    match current_user(ctx, jar).await {
+        Some(user) => is_admin(ctx, &user),
+        None => false,
+    }
 }