Step 2 — Register: storing a password safely

1touch internal/user/user.go internal/user/service.go
2touch internal/user/repository.go internal/user/handler.go
3
4go build ./... && go run ./cmd/api
5
6# register
7curl -s -X POST localhost:8080/v1/auth/register \
8  -d '{"name":"Sahdev","email":"a@b.c","password":"password123"}' | jq
9
10# the same email again — must be a clean 409
11curl -si -X POST localhost:8080/v1/auth/register \
12  -d '{"name":"Sahdev","email":"a@b.c","password":"password123"}' | head -1
13
14# validation failures
15curl -s -X POST localhost:8080/v1/auth/register -d '{"email":"a@b.c","password":"password123"}'
16curl -s -X POST localhost:8080/v1/auth/register -d '{"name":"x","email":"a@b.c","password":"short"}'
17
18# confirm the hash is nowhere in the response, and look at it in the database
19docker exec -it exp-pg psql -U postgres -d expenses -c 'SELECT email, password_hash FROM users;'

1package user
2
3import (
4	"errors"
5	"time"
6)
7
8type User struct {
9	ID           int64     `json:"id"`
10	Name         string    `json:"name"`
11	Email        string    `json:"email"`
12	PasswordHash string    `json:"-"`          // "-" means: never put this in JSON
13	CreatedAt    time.Time `json:"created_at"`
14}
15
16// RegisterRequest is what a client may send. It is not the User type, so
17// nobody can post an "id" or a "password_hash" of their own.
18type RegisterRequest struct {
19	Name     string `json:"name"`
20	Email    string `json:"email"`
21	Password string `json:"password"`
22}
23
24var (
25	ErrNotFound           = errors.New("user not found")
26	ErrEmailTaken         = errors.New("email already registered")
27	ErrInvalidCredentials = errors.New("invalid credentials")
28	ErrValidation         = errors.New("invalid input")
29)

1func (r RegisterRequest) Validate() error {
2	if strings.TrimSpace(r.Name) == "" {
3		return fmt.Errorf("%w: name is required", ErrValidation)
4	}
5	if !strings.Contains(r.Email, "@") || len(r.Email) > 254 {
6		return fmt.Errorf("%w: a valid email is required", ErrValidation)
7	}
8	if len(r.Password) < 8 {
9		return fmt.Errorf("%w: password must be at least 8 characters", ErrValidation)
10	}
11	if len(r.Password) > 72 {
12		return fmt.Errorf("%w: password must be at most 72 characters", ErrValidation)
13	}
14	return nil
15}

1package user
2
3import (
4	"context"
5	"errors"
6	"strings"
7
8	"golang.org/x/crypto/bcrypt"
9)
10
11type Service struct{ repo *Repository }
12
13func NewService(r *Repository) *Service { return &Service{repo: r} }
14
15func (s *Service) Register(ctx context.Context, req RegisterRequest) (*User, error) {
16	if err := req.Validate(); err != nil {
17		return nil, err
18	}
19
20	// One line, and it does the salting and the slowness for you.
21	hash, err := bcrypt.GenerateFromPassword([]byte(req.Password), bcrypt.DefaultCost)
22	if err != nil {
23		return nil, err
24	}
25
26	u := &User{
27		Name:         strings.TrimSpace(req.Name),
28		Email:        strings.ToLower(strings.TrimSpace(req.Email)),
29		PasswordHash: string(hash),
30	}
31
32	if err := s.repo.Create(ctx, u); err != nil {
33		if errors.Is(err, ErrEmailTaken) {
34			return nil, ErrEmailTaken
35		}
36		return nil, err
37	}
38
39	// req.Password is never stored, logged or returned. It ends here.
40	return u, nil
41}

1func (r *Repository) Create(ctx context.Context, u *User) error {
2	err := r.db.QueryRowContext(ctx,
3		`INSERT INTO users (name, email, password_hash)
4		 VALUES ($1, $2, $3) RETURNING id, created_at`,
5		u.Name, u.Email, u.PasswordHash,
6	).Scan(&u.ID, &u.CreatedAt)
7
8	if isUniqueViolation(err) {
9		return ErrEmailTaken
10	}
11	return err
12}
13
14// Postgres reports a broken unique constraint as error code 23505.
15func isUniqueViolation(err error) bool {
16	var pgErr *pgconn.PgError
17	return errors.As(err, &pgErr) && pgErr.Code == "23505"
18}

1func (h *Handler) register(w http.ResponseWriter, r *http.Request) {
2	var in RegisterRequest
3
4	dec := json.NewDecoder(http.MaxBytesReader(w, r.Body, 1<<20))
5	dec.DisallowUnknownFields()          // a client typo becomes an error, not silence
6
7	if err := dec.Decode(&in); err != nil {
8		httpx.Error(w, 400, "invalid json")
9		return
10	}
11
12	u, err := h.svc.Register(r.Context(), in)
13	if err != nil {
14		switch {
15		case errors.Is(err, ErrEmailTaken):
16			httpx.Error(w, 409, "email already registered")
17		case errors.Is(err, ErrValidation):
18			httpx.Error(w, 422, err.Error())
19		default:
20			slog.Error("register failed", "err", err)   // detail to the log
21			httpx.Error(w, 500, "could not register")   // nothing useful to the client
22		}
23		return
24	}
25
26	httpx.JSON(w, 201, u)                // PasswordHash cannot appear here
27}