authorization enforced on webpages

internal/site/site.go

@@ -19,7 +19,7 @@ import (
 )
 
 type Server struct {
-	mux        *http.ServeMux
+	http.Handler
 	contentDir string
 	templater  *templater.Templater
 	rawEvents  *raw_events.Store
@@ -35,8 +35,9 @@ func NewServer(
 	etsy *etsy_platform.Platform,
 	auth *authentication.Authenticator,
 ) *Server {
+	mux := http.NewServeMux()
+
 	s := &Server{
-		mux:        http.NewServeMux(),
 		contentDir: contentDir,
 		templater: templater.NewTemplater(
 			contentDir+"/templates",
@@ -91,36 +92,32 @@ func NewServer(
 
 	// api routes
 
-	s.mux.HandleFunc("GET /login", response.Handler(s.loginPage))
-	s.mux.HandleFunc("GET /login/callback", response.Handler(s.loginCallback))
-	s.mux.HandleFunc("GET /logout", response.Handler(s.logoutPage))
-	s.mux.Handle("POST /accounts", response.Handler(s.authenticate(s.createAccount)))
+	mux.Handle("GET /login", response.Handler(s.loginPage))
+	mux.Handle("GET /login/callback", response.Handler(s.loginCallback))
+	mux.Handle("GET /logout", response.Handler(s.logoutPage))
+	mux.Handle("POST /accounts", response.Handler(s.authenticateAndAddIdentity(s.createAccount)))
 
 	// TODO: eliminate once no longer used.
-	s.mux.HandleFunc("POST /login", response.Handler(s.login))
+	mux.HandleFunc("POST /login", response.Handler(s.login))
 
 	// TODO: get rid of this, once we're confident this isn't needed...
-	s.mux.Handle("GET /test-auth", response.Handler(s.authenticate(s.testAuthEndpoint)))
+	mux.Handle("GET /test-auth", response.Handler(s.authenticateAndAddIdentity(s.testAuthEndpoint)))
 
 	// webpage content
 
 	scfs := http.FileServer(http.Dir(contentDir + "/scripts"))
-	s.mux.Handle("GET /scripts/", http.StripPrefix("/scripts", http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+	mux.Handle("GET /scripts/", http.StripPrefix("/scripts", http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		w.Header().Set("Content-Type", "text/javascript")
 		if path.Ext(r.URL.Path) == ".gz" {
 			w.Header().Set("Content-Encoding", "gzip")
 		}
 		scfs.ServeHTTP(w, r)
 	})))
-	s.mux.Handle("GET /styles/", http.StripPrefix("/styles", http.FileServer(http.Dir(contentDir+"/styles"))))
+	mux.Handle("GET /styles/", http.StripPrefix("/styles", http.FileServer(http.Dir(contentDir+"/styles"))))
 
-	// TODO: put auth on individual templates, somehow...
-	s.mux.HandleFunc("GET /", s.serveTemplates)
+	mux.HandleFunc("GET /", response.Handler(s.addIdentity(s.serveTemplates)))
+
+	s.Handler = mux
 
 	return s
 }
-
-// http.Handler implementation
-func (s *Server) ServeHTTP(w http.ResponseWriter, r *http.Request) {
-	s.mux.ServeHTTP(w, r)
-}