redirect to desired page after authenticating

internal/site/auth.go

@@ -86,7 +86,8 @@ func (s *Server) authenticateAndAddIdentity(f response.HandlerFunc, assertions .
 	return func(r *http.Request) (response.Response, error) {
 		ck, err := r.Cookie("access_token")
 		if err != nil {
-			return response.TemporaryRedirect("/"), nil
+			return response.TemporaryRedirect("/").
+				JSON("no access_token cookie provided"), nil
 		}
 
 		ctx := r.Context()
@@ -96,7 +97,12 @@ func (s *Server) authenticateAndAddIdentity(f response.HandlerFunc, assertions .
 		claims, expiration, err := s.auth.GetAccessTokenClaimsAndExpiration(ctx, accessToken)
 		if err != nil {
 			if errors.Is(err, consts.ErrNotFound) {
-				return response.TemporaryRedirect("/"), nil
+				u, err := s.newLoginURL(ctx, r.URL.String())
+				if err != nil {
+					return nil, response.Errorf("failed to generate login url: %w", err)
+				}
+
+				return response.TemporaryRedirect(u), nil
 			}
 
 			return nil, response.Errorf("failed to authenticate: %w", err)
@@ -104,10 +110,6 @@ func (s *Server) authenticateAndAddIdentity(f response.HandlerFunc, assertions .
 
 		now := time.Now()
 
-		if expiration.Before(now) {
-			return response.TemporaryRedirect("/").Cookie(getExpiredCookie("access_token")), nil
-		}
-
 		// refresh tokens, when the access token is "old enough"
 
 		// id token lifetime is 48 hours, allowing a person to use the app everyday comfortably, with wiggle room, without having to log in.

internal/site/login.go

@@ -1,6 +1,7 @@
 package site
 
 import (
+	"context"
 	"fmt"
 	"net/http"
 	"ruben/inventory2/internal/site/response"
@@ -11,14 +12,23 @@ import (
 func (s *Server) loginPage(r *http.Request) (response.Response, error) {
 	ctx := r.Context()
 
-	state, err := s.auth.NewState(ctx)
+	u, err := s.newLoginURL(ctx, "/")
 	if err != nil {
-		return nil, response.Errorf("failed to generate random state: %w", err)
+		return nil, err
+	}
+
+	return response.TemporaryRedirect(u), nil
+}
+
+func (s *Server) newLoginURL(ctx context.Context, targetURI string) (string, error) {
+	state, err := s.auth.NewState(ctx, targetURI)
+	if err != nil {
+		return "", fmt.Errorf("failed to generate random state: %w", err)
 	}
 
 	base64EncodedState := fmt.Sprintf("%x", state[:])
 
-	return response.TemporaryRedirect(s.auth.AuthCodeURL(base64EncodedState)), nil
+	return s.auth.AuthCodeURL(base64EncodedState), nil
 }
 
 // POST /login
@@ -44,7 +54,7 @@ func (s *Server) loginCallback(r *http.Request) (response.Response, error) {
 
 	// obtain token and profile
 
-	accessToken, expiration, err := s.auth.Exchange(ctx, q.Get("state"), q.Get("code"))
+	accessToken, targetURI, expiration, err := s.auth.Exchange(ctx, q.Get("state"), q.Get("code"))
 	if err != nil {
 		return nil, response.Unauthorized().
 			Msg(fmt.Sprintf("Failed to exchange an authorization code for a token")).
@@ -53,7 +63,7 @@ func (s *Server) loginCallback(r *http.Request) (response.Response, error) {
 
 	// set access_token cookie and redirect to a reasonable place
 
-	return response.TemporaryRedirect("/").
+	return response.TemporaryRedirect(targetURI).
 		Cookie(newAccessTokenCookie(accessToken, expiration)), nil
 }
 

internal/site/server.go

@@ -115,7 +115,13 @@ func NewServer(
 	})))
 	mux.Handle("GET /styles/", http.StripPrefix("/styles", http.FileServer(http.Dir(contentDir+"/styles"))))
 
-	mux.HandleFunc("GET /", response.Handler(s.addIdentity(s.serveTemplates)))
+	// webpages
+
+	// all non-authenticated webpages
+	mux.HandleFunc("GET /{$}", response.Handler(s.addIdentity(s.serveTemplates)))
+
+	// all authenticated webpages
+	mux.HandleFunc("GET /", response.Handler(s.authenticateAndAddIdentity(s.serveTemplates)))
 
 	s.Handler = mux