so much

cmd/api/context.go

@@ -0,0 +1,26 @@
+package main
+
+import (
+	"context"
+	"net/http"
+
+	"party.at/party/internal/data"
+)
+
+type contextKey string
+
+const userContextKey = "user"
+
+func (app *application) contextSetUser(r *http.Request, user *data.User) *http.Request {
+	ctx := context.WithValue(r.Context(), userContextKey, user)
+	return r.WithContext(ctx)
+}
+
+func (app *application) contextGetUser(r *http.Request) *data.User {
+	user, ok := r.Context().Value(userContextKey).(*data.User)
+	if !ok {
+		panic("missing user value in request context")
+	}
+
+	return user
+}

cmd/api/db.go

@@ -1,19 +1,19 @@
 package main
 
 import (
-	"context"
-	"github.com/jackc/pgx/v5"
+	// "context"
+	"database/sql"
 	"log"
 )
 
-func database_init(conn *pgx.Conn) {
+func database_init_dont_use(conn *sql.DB) {
 	sql := `DROP TABLE IF EXISTS vote;
 DROP TABLE IF EXISTS vote_token;
 DROP TABLE IF EXISTS option;
-DROP TABLE IF EXISTS issue;
+DROP TABLE IF EXISTS issues;
 DROP TABLE IF EXISTS account;`
 
-	_, err := conn.Exec(context.Background(), sql)
+	_, err := conn.Exec(sql)
 	if err != nil {
 		log.Fatal(err)
 	}
@@ -29,7 +29,7 @@ created TIMESTAMPTZ DEFAULT now() NOT NULL,
 last_login TIMESTAMPTZ
 )`
 	
-	_, err = conn.Exec(context.Background(), sql)
+	_, err = conn.Exec(sql)
 	if err != nil {
 		log.Fatal(err)
 	}
@@ -74,12 +74,12 @@ INSERT INTO account
 (username, password_hash, first_name, last_name, email, created)
 VALUES('yyZGFAsmPEBoSf', '$argon2id$v=19$m=65536,t=1,p=1$vLVm5ol6GQkXPU0BPut92g$Kyvp7/dl3lGUszXRiXfgsgB/IY0EKulZVpVttXQaDDU', 'svVjyPUaAkN', 'mdngeHlf', 'giyahyd4141@gmail.com', '2024-11-28 19:02:32.806');`
 
-	_, err = conn.Exec(context.Background(), sql)
+	_, err = conn.Exec(sql)
 	if err != nil {
 		log.Fatal(err)
 	}
 
-	sql = `CREATE TABLE issue (
+	sql = `CREATE TABLE issues (
 id BIGINT GENERATED ALWAYS AS IDENTITY PRIMARY KEY,
 title VARCHAR(255) NOT NULL,
 description TEXT,
@@ -88,32 +88,32 @@ end_time TIMESTAMPTZ NOT NULL,
 created_at TIMESTAMPTZ NOT NULL DEFAULT now()
 )`
 
-	_, err = conn.Exec(context.Background(), sql)
+	_, err = conn.Exec(sql)
 	if err != nil {
 		log.Fatal(err)
 	}
 
 	sql = `CREATE TABLE option (
 id BIGINT GENERATED ALWAYS AS IDENTITY PRIMARY KEY,
-issue_id BIGINT NOT NULL REFERENCES issue(id) ON DELETE CASCADE,
+issue_id BIGINT NOT NULL REFERENCES issues(id) ON DELETE CASCADE,
 label VARCHAR(255) NOT NULL,
 created_at TIMESTAMPTZ NOT NULL DEFAULT now()
 )`
 
-	_, err = conn.Exec(context.Background(), sql)
+	_, err = conn.Exec(sql)
 	if err != nil {
 		log.Fatal(err)
 	}
 
 	sql = `CREATE TABLE vote_token (
 id BIGINT GENERATED ALWAYS AS IDENTITY PRIMARY KEY,
-issue_id BIGINT NOT NULL REFERENCES issue(id) ON DELETE CASCADE,
+issue_id BIGINT NOT NULL REFERENCES issues(id) ON DELETE CASCADE,
 token UUID NOT NULL UNIQUE DEFAULT gen_random_uuid(),
 used BOOLEAN NOT NULL DEFAULT FALSE,
 created_at TIMESTAMPTZ NOT NULL DEFAULT now()
 )`
 
-	_, err = conn.Exec(context.Background(), sql)
+	_, err = conn.Exec(sql)
 	if err != nil {
 		log.Fatal(err)
 	}
@@ -125,7 +125,7 @@ option_id BIGINT NOT NULL REFERENCES option(id) ON DELETE CASCADE,
 voted_at TIMESTAMPTZ NOT NULL DEFAULT now()
 )`
 
-	_, err = conn.Exec(context.Background(), sql)
+	_, err = conn.Exec(sql)
 	if err != nil {
 		log.Fatal(err)
 	}
@@ -134,7 +134,7 @@ voted_at TIMESTAMPTZ NOT NULL DEFAULT now()
 CREATE INDEX idx_vote_tokens_issue_id ON vote_token(issue_id);
 CREATE INDEX idx_options_issue_id ON option(issue_id);`
 
-	_, err = conn.Exec(context.Background(), sql)
+	_, err = conn.Exec(sql)
 	if err != nil {
 		log.Fatal(err)
 	}

cmd/api/errors.go

@@ -0,0 +1,104 @@
+package main
+
+import (
+	"fmt"
+	"net/http"
+)
+
+// The logError() method is a generic helper for logging an error message. Later in the
+// book we'll upgrade this to use structured logging, and record additional information
+// about the request including the HTTP method and URL.
+func (app *application) logError(r *http.Request, err error) {
+	app.logger.PrintError(err, map[string]string{
+		"request_method": r.Method,
+		"request_url":    r.URL.String(),
+	})
+}
+
+// The errorResponse() method is a generic helper for sending JSON-formatted error
+// messages to the client with a given status code. Note that we're using an interface{}
+// type for the message parameter, rather than just a string type, as this gives us
+// more flexibility over the values that we can include in the response.
+func (app *application) errorResponse(w http.ResponseWriter, r *http.Request, status int, message interface{}) {
+	env := envelope{"error": message}
+	// Write the response using the writeJSON() helper. If this happens to return an
+	// error then log it, and fall back to sending the client an empty response with a
+	// 500 Internal Server Error status code.
+	err := app.writeJSON(w, status, env, nil)
+	if err != nil {
+		app.logError(r, err)
+		w.WriteHeader(500)
+	}
+}
+
+// The serverErrorResponse() method will be used when our application encounters an
+// unexpected problem at runtime. It logs the detailed error message, then uses the
+// errorResponse() helper to send a 500 Internal Server Error status code and JSON
+// response (containing a generic error message) to the client.
+func (app *application) serverErrorResponse(w http.ResponseWriter, r *http.Request, err error) {
+	app.logError(r, err)
+	message :=
+	"the server encountered a problem and could not process your request"
+	app.errorResponse(w, r, http.StatusInternalServerError, message)
+
+}
+
+
+// The notFoundResponse() method will be used to send a 404 Not Found status code and
+// JSON response to the client.
+func (app *application) notFoundResponse(w http.ResponseWriter, r *http.Request) {
+	message := "the requested resource could not be found"
+	app.errorResponse(w, r, http.StatusNotFound, message)
+}
+
+// The methodNotAllowedResponse() method will be used to send a 405 Method Not Allowed
+// status code and JSON response to the client.
+func (app *application) methodNotAllowedResponse(w http.ResponseWriter, r *http.Request) {
+	message := fmt.Sprintf("the %s method is not supported for this resource", r.Method)
+	app.errorResponse(w, r, http.StatusMethodNotAllowed, message)
+}
+
+func (app *application) badRequestResponse(w http.ResponseWriter, r *http.Request, err error) {
+	app.errorResponse(w, r, http.StatusBadRequest, err.Error())
+}
+
+func (app *application) failedValidationResponse(w http.ResponseWriter, r *http.Request, errors map[string]string) {
+	app.errorResponse(w, r, http.StatusUnprocessableEntity, errors)
+}
+
+func (app *application) editConflictResponse(w http.ResponseWriter, r *http.Request) {
+	message := "unable to update the record due to an edit conflict, please try again"
+	app.errorResponse(w, r, http.StatusConflict, message)
+}
+
+func (app *application) rateLimitExceededResponse(w http.ResponseWriter, r *http.Request) {
+	message := "rate limit exceeded"
+	app.errorResponse(w, r, http.StatusTooManyRequests, message)
+}
+
+func (app *application) invalidCredentialsResponse(w http.ResponseWriter, r *http.Request) {
+	message := "invalid authentication credentials"
+	app.errorResponse(w, r, http.StatusUnauthorized, message)
+}
+
+func (app *application) invalidAuthenticationTokenResponse(w http.ResponseWriter, r *http.Request) {
+	w.Header().Set("WWW-Authenticate", "Bearer")
+
+	message := "invalid or missing authentication token"
+	app.errorResponse(w, r, http.StatusUnauthorized, message)
+}
+
+func (app *application) authenticationRequiredResponse(w http.ResponseWriter, r *http.Request) {
+	message :="you must be authenticated to access this resource"
+	app.errorResponse(w, r, http.StatusUnauthorized, message)
+}
+
+func (app *application) inactiveAccountResponse(w http.ResponseWriter, r *http.Request) {
+	message := "your user account must be activated to access this resource"
+	app.errorResponse(w, r, http.StatusForbidden, message)
+}
+
+func (app *application) notPermittedResponse(w http.ResponseWriter, r *http.Request) {
+	message := "your user account doesn't have the necessary permissions to access this resource"
+	app.errorResponse(w, r, http.StatusForbidden, message)
+}

cmd/api/handlers.go

@@ -1,11 +1,17 @@
 package main
 
 import (
+	// "encoding/json"
 	"fmt"
+	"html/template"
+	"log"
 	"net/http"
 	"time"
-	"log"
-	"html/template"
+	// "github.com/julienschmidt/httprouter"
+	// "strconv"
+	// "errors"
+	// "party.at/party/internal/data"
+	// "party.at/party/internal/validator"
 )
 
 func home(w http.ResponseWriter, r *http.Request) {
@@ -48,7 +54,7 @@ func ws(w http.ResponseWriter, r *http.Request) {
 	done := make(chan struct{})
 
 	go func() {
-		ticker := time.NewTicker(1 * time.Second);
+		ticker := time.NewTicker(1 * time.Second)
 
 		for {
 			select {
@@ -60,7 +66,6 @@ func ws(w http.ResponseWriter, r *http.Request) {
 					"timestamp": t.Format(time.RFC3339),
 				}
 
-
 				if err := conn.WriteJSON(msg); err != nil {
 					fmt.Println("Write error:", err)
 					return
@@ -87,6 +92,33 @@ func ws(w http.ResponseWriter, r *http.Request) {
 	}
 }
 
+// func handleMobileLogin(w http.ResponseWriter, r *http.Request) {
+//     // 1. Get the token from the request header
+//     rawIDToken := r.Header.Get("Authorization")
+
+//     // 2. Initialize the verifier (pointing to ID Austria's keys)
+//     verifier := provider.Verifier(&oidc.Config{ClientID: "YOUR_APP_ID"})
+
+//     // 3. Verify the signature and expiration
+//     idToken, err := verifier.Verify(ctx, rawIDToken)
+//     if err != nil {
+//         http.Error(w, "Invalid Token", http.StatusUnauthorized)
+//         return
+//     }
+
+//     // 4. Extract User Data
+//     var claims struct {
+//         Subject string `json:"sub"` // This is the unique ID
+//         Name    string `json:"name"`
+//     }
+//     if err := idToken.Claims(&claims); err != nil {
+//         // Handle error
+//     }
+
+//     // 5. Create your own application session for the mobile app
+//     issueLocalSession(w, claims.Subject)
+// }
+
 func redirectToHTTPS(w http.ResponseWriter, r *http.Request) {
-	http.Redirect(w, r, "https://localhost:8443" + r.URL.RequestURI(), http.StatusMovedPermanently)
+	http.Redirect(w, r, "https://localhost:8443"+r.URL.RequestURI(), http.StatusMovedPermanently)
 }

cmd/api/healthcheck.go

@@ -1,12 +1,22 @@
 package main
 
 import (
-	"fmt"
+	// "encoding/json"
+	//"fmt"
 	"net/http"
 )
 
 func (app *application) healthcheckHandler(w http.ResponseWriter, r *http.Request) {
-	fmt.Fprintln(w, "status: available")
-	fmt.Fprintf(w, "environment: %s\n", app.config.env)
-	fmt.Fprintf(w, "version: %s\n", version)
+	env := envelope{
+		"status": "available",
+		"system_info": map[string]string{
+			"environment": app.config.env,
+			"version": version,
+		},
+	}
+
+	err := app.writeJSON(w, http.StatusOK, envelope{"health_check": env}, nil)
+	if err != nil {
+		app.serverErrorResponse(w,r, err)
+	}
 }

cmd/api/helpers.go

@@ -0,0 +1,193 @@
+package main
+
+import (
+	"net/http"
+	"encoding/json"
+	"strings"
+	"errors"
+	"fmt"
+	"io"
+	"net/url"
+	"strconv"
+	"party.at/party/internal/validator"
+	"github.com/julienschmidt/httprouter"
+	
+)
+
+type envelope map[string]interface{}
+
+func (app *application) readString(qs url.Values, key string, defaultValue string) string {
+	// Extract the value for a given key from the query string. If no key exists this
+	// will return the empty string "".
+	s := qs.Get(key)
+	// If no key exists (or the value is empty) then return the default value.
+	if s == "" {
+		return defaultValue
+	}
+
+	// Otherwise return the string.
+	return s
+}
+
+func (app *application) readCSV(qs url.Values, key string, defaultValue []string) []string {
+	// Extract the value from the query string.
+	csv := qs.Get(key)
+
+	// If no key exists (or the value is empty) then return the default value.
+	if csv == "" {
+		return defaultValue
+	}
+
+	// Otherwise parse the value into a []string slice and return it.
+	return strings.Split(csv, ",")
+}
+
+func (app *application) readInt(qs url.Values, key string, defaultValue int, v *validator.Validator) int {
+	// Extract the value from the query string.
+	s := qs.Get(key)
+
+	// If no key exists (or the value is empty) then return the default value.
+	if s == "" {
+		return defaultValue
+	}
+
+	// Try to convert the value to an int. If this fails, add an error message to the
+	// validator instance and return the default value.
+	i, err := strconv.Atoi(s)
+	if err != nil {
+		v.AddError(key, "must be an integer value")
+		return defaultValue
+	}
+
+	// Otherwise, return the converted integer value.
+	return i
+}
+
+func (app *application) readIDParam(r *http.Request) (int64, error) {
+	params := httprouter.ParamsFromContext(r.Context())
+
+	id, err := strconv.ParseInt(params.ByName("id"), 10, 64)
+	if err != nil || id < 1 {
+		return 0, errors.New("invalid id parameter")
+	}
+
+	return id, nil
+}
+
+func (app *application) writeJSON(w http.ResponseWriter, status int, data envelope, headers http.Header) error {
+	// Encode the data to JSON, returning the error if there was one.
+	js, err := json.MarshalIndent(data, "", "\t")
+	if err != nil {
+		return err
+	}
+
+
+	// Append a newline to make it easier to view in terminal applications.
+	js = append(js, '\n')
+
+
+	// At this point, we know that we won't encounter any more errors before writing the
+	// response, so it's safe to add any headers that we want to include. We loop
+	// through the header map and add each header to the http.ResponseWriter header map.
+	// Note that it's OK if the provided header map is nil. Go doesn't throw an error
+	// if you try to range over (or generally, read from) a nil map.
+	for key, value := range headers {
+		w.Header()[key] = value
+	}
+
+
+	// Add the "Content-Type: application/json" header, then write the status code and
+	// JSON response.
+	w.Header().Set("Content-Type", "application/json")
+	w.WriteHeader(status)
+	w.Write(js)
+	
+	return nil
+}
+
+func (app *application) readJSON(w http.ResponseWriter, r *http.Request, dst interface{}) error {
+	maxBytes := 1048576
+
+	r.Body = http.MaxBytesReader(w, r.Body, int64(maxBytes))
+
+	// Initialize the json.Decoder, and call the DisallowUnknownFields() method on it
+	// before decoding. This means that if the JSON from the client now includes any
+	// field which cannot be mapped to the target destination, the decoder will return
+	// an error instead of just ignoring the field.
+	dec := json.NewDecoder(r.Body)
+	dec.DisallowUnknownFields()
+	// Decode the request body to the destination.
+	err := dec.Decode(dst)
+	if err != nil {
+		var syntaxError *json.SyntaxError
+		var unmarshalTypeError *json.UnmarshalTypeError
+		var invalidUnmarshalError *json.InvalidUnmarshalError
+		
+		switch {
+			case errors.As(err, &syntaxError):
+				return fmt.Errorf("body contains badly-formed JSON (at character %d)", syntaxError.Offset)
+		
+			case errors.Is(err, io.ErrUnexpectedEOF):
+				return errors.New("body contains badly-formed JSON")
+
+			case errors.As(err, &unmarshalTypeError):
+				if unmarshalTypeError.Field != "" {
+					return fmt.Errorf("body contains incorrect JSON type for field %q", unmarshalTypeError.Field)
+				}
+	
+				return fmt.Errorf("body contains incorrect JSON type (at character %d)", unmarshalTypeError.Offset)
+
+			case errors.Is(err, io.EOF):
+				return errors.New("body must not be empty")
+
+			// If the JSON contains a field which cannot be mapped to the target destination
+			// then Decode() will now return an error message in the format "json: unknown
+			// field "<name>"". We check for this, extract the field name from the error,
+			// and interpolate it into our custom error message. Note that there's an open
+			// issue at https://github.com/golang/go/issues/29035 regarding turning this
+			// into a distinct error type in the future.
+			case strings.HasPrefix(err.Error(), "json: unknown field "):
+				fieldName := strings.TrimPrefix(err.Error(), "json: unknown field ")
+				return fmt.Errorf("body contains unknown key %s", fieldName)
+
+				
+			// If the request body exceeds 1MB in size the decode will now fail with the
+			// error "http: request body too large". There is an open issue about turning
+			// this into a distinct error type at https://github.com/golang/go/issues/30715.
+			case err.Error() == "http: request body too large":
+				return fmt.Errorf("body must not be larger than %d bytes", maxBytes)
+	
+			case errors.As(err, &invalidUnmarshalError):
+				panic(err)
+			
+			default:
+				return err
+		}
+	}
+
+	// Call Decode() again, using a pointer to an empty anonymous struct as the
+	// destination. If the request body only contained a single JSON value this will
+	// return an io.EOF error. So if we get anything else, we know that there is
+	// additional data in the request body and we return our own custom error message.
+	err = dec.Decode(&struct{}{})
+	if err != io.EOF {
+		return errors.New("body must only contain a single JSON value")
+	}
+
+	return nil
+}
+
+func (app *application) background(fn func()) {
+	// Launch a background goroutine.
+	go func() {
+		// Recover any panic.
+		defer func() {
+			if err := recover(); err != nil {
+				app.logger.PrintError(fmt.Errorf("%s", err), nil)
+			}
+		}()
+
+		// Execute the arbitrary function that we passed as the parameter.
+		fn()
+	}()
+}

cmd/api/issues.go

@@ -0,0 +1,221 @@
+package main
+
+import (
+	// "encoding/json"
+	"fmt"
+	// "html/template"
+	// "log"
+	"net/http"
+	"time"
+	// "github.com/julienschmidt/httprouter"
+	// "strconv"
+	"errors"
+	"party.at/party/internal/data"
+	"party.at/party/internal/validator"
+)
+
+func (app *application) listIssuesHandler(w http.ResponseWriter, r *http.Request) {
+	// To keep things consistent with our other handlers, we'll define an input struct
+	// to hold the expected values from the request query string.
+	var input struct {
+		Title string
+		data.Filters
+	}
+
+	// Initialize a new Validator instance.
+	v := validator.New()
+	// Call r.URL.Query() to get the url.Values map containing the query string data.
+	qs := r.URL.Query()
+
+	// Use our helpers to extract the title and genres query string values, falling back
+	// to defaults of an empty string and an empty slice respectively if they are not
+	// provided by the client.
+	input.Title = app.readString(qs, "title", "")
+	// input.Genres = app.readCSV(qs, "genres", []string{})
+
+	// Get the page and page_size query string values as integers. Notice that we set
+	// the default page value to 1 and default page_size to 20, and that we pass the
+	// validator instance as the final argument here.
+	input.Filters.Page = app.readInt(qs, "page", 1, v)
+	input.Filters.PageSize = app.readInt(qs, "page_size", 20, v)
+
+	// Extract the sort query string value, falling back to "id" if it is not provided
+	// by the client (which will imply a ascending sort on issue ID).
+	input.Filters.Sort = app.readString(qs, "sort", "id")
+	input.Filters.SortSafelist = []string{"id", "-id", "title", "-title", "description", "-description"}
+
+	if data.ValidateFilters(v, input.Filters); !v.Valid() {
+		app.failedValidationResponse(w, r, v.Errors)
+		return
+	}
+
+	issues, metadata, err := app.models.Issues.GetAll(input.Title, input.Filters)
+	if err != nil {
+		app.serverErrorResponse(w, r, err)
+		return
+	}
+
+	err = app.writeJSON(w, http.StatusOK, envelope{"issues": issues, "metadata": metadata}, nil)
+	if err != nil {
+		app.serverErrorResponse(w, r, err)
+	}
+}
+
+func (app *application) createIssueHandler(w http.ResponseWriter, r *http.Request) {
+
+	var input struct {
+		Title       string    `json:"title"`
+		Description string    `json:"description"`
+		StartTime   time.Time `json:"start_time"`
+		EndTime     time.Time `json:"end_time"`
+	}
+
+	err := app.readJSON(w, r, &input)
+	if err != nil {
+		// Use the new badRequestResponse() helper.
+		app.badRequestResponse(w, r, err)
+		return
+	}
+
+	issue := &data.Issue{
+		Title: input.Title,
+		Description: input.Description,
+		StartTime: input.StartTime,
+		EndTime: input.EndTime,
+	}
+
+	v := validator.New()
+
+	if data.ValidateIssue(v, issue); !v.Valid() {
+		app.failedValidationResponse(w, r, v.Errors)
+		return
+	}
+
+	err = app.models.Issues.Insert(issue)
+	if err != nil {
+		app.serverErrorResponse(w, r, err)
+		return
+	}
+
+	headers := make(http.Header)
+	headers.Set("Location", fmt.Sprintf("/v1/issues/%d", issue.ID))
+
+	err = app.writeJSON(w, http.StatusCreated, envelope{"issue": issue}, headers)
+	if err != nil {
+		app.serverErrorResponse(w, r, err)
+	}
+}
+
+func (app *application) readIssueHandler(w http.ResponseWriter, r *http.Request) {
+	id, err := app.readIDParam(r)
+	if err != nil {
+		app.notFoundResponse(w, r)
+		return
+	}
+
+	issue, err := app.models.Issues.Get(id)
+	if err != nil {
+		switch {
+		case errors.Is(err, data.ErrRecordNotFound):
+			app.notFoundResponse(w, r)
+		default:
+			app.serverErrorResponse(w, r, err)
+		}
+		return
+	}
+
+	// Encode the struct to JSON and send it as the HTTP response.
+	err = app.writeJSON(w, http.StatusOK, envelope{"issue": issue}, nil)
+	if err != nil {
+		app.serverErrorResponse(w, r, err)
+	}
+}
+
+func (app *application) updateIssueHandler(w http.ResponseWriter, r *http.Request) {
+	id, err := app.readIDParam(r)
+	if err != nil {
+		app.notFoundResponse(w, r)
+		return
+	}
+
+	issue, err := app.models.Issues.Get(id)
+	if err != nil {
+		switch {
+		case errors.Is(err, data.ErrRecordNotFound):
+			app.notFoundResponse(w, r)
+		default:
+			app.serverErrorResponse(w, r, err)
+		}
+		return
+	}
+	
+	var input struct {
+		Title       *string    `json:"title"`
+		Description *string    `json:"description"`
+		StartTime   *time.Time `json:"start_time"`
+		EndTime     *time.Time `json:"end_time"`
+	}
+
+	err = app.readJSON(w, r, &input)
+	if err != nil {
+		app.badRequestResponse(w, r, err)
+		return
+	}
+
+	if input.Title != nil       { issue.Title       = *input.Title }
+	if input.Description != nil { issue.Description = *input.Description }
+	if input.StartTime != nil   { issue.StartTime   = *input.StartTime }
+	if input.StartTime != nil   { issue.EndTime     = *input.EndTime }
+
+	v := validator.New()
+	if data.ValidateIssue(v, issue); !v.Valid() {
+		app.failedValidationResponse(w, r, v.Errors)
+		return
+	}
+
+	err = app.models.Issues.Update(issue)
+	if err != nil {
+		switch {
+		case errors.Is(err, data.ErrEditConflict):
+			app.editConflictResponse(w, r)
+		default:
+			app.serverErrorResponse(w, r, err)
+		}
+
+		return
+	}
+
+	// Write the updated issue record in a JSON response.
+	err = app.writeJSON(w, http.StatusOK, envelope{"issue": issue}, nil)
+	if err != nil {
+		app.serverErrorResponse(w, r, err)
+	}
+}
+
+func (app *application) deleteIssueHandler(w http.ResponseWriter, r *http.Request) {
+	id, err := app.readIDParam(r)
+	if err != nil {
+		app.notFoundResponse(w, r)
+		return
+	}
+
+	// Delete the issue from the database, sending a 404 Not Found response to the
+	// client if there isn't a matching record.
+	err = app.models.Issues.Delete(id)
+	if err != nil {
+		switch {
+		case errors.Is(err, data.ErrRecordNotFound):
+			app.notFoundResponse(w, r)
+		default:
+			app.serverErrorResponse(w, r, err)
+		}
+
+		return
+	}
+
+	// Return a 200 OK status code along with a success message.
+	err = app.writeJSON(w, http.StatusOK, envelope{"message": "issue successfully deleted"}, nil)
+	if err != nil {
+		app.serverErrorResponse(w, r, err)
+	}
+}

cmd/api/main.go

@@ -3,31 +3,63 @@ package main
 import (
 	"context"
 	"log"
+	"strings"
+
 	//"html/template"
-	"net/http"
 	"flag"
+	"net/http"
 
 	"github.com/gorilla/websocket"
 
-	"github.com/jackc/pgx/v5"
-)
-
-import (
-	"fmt"
 	"os"
 	"time"
+
+	"database/sql"
+
+	_ "github.com/lib/pq"
+
+	"party.at/party/internal/data"
+	"party.at/party/internal/mailer"
+	"party.at/party/internal/jsonlog"
 )
 
 const version = "1.0.0"
 
 type config struct {
 	port int
-	env string
+	env  string
+
+	db struct {
+		dsn          string
+		maxOpenConns int
+		maxIdleConns int
+		maxIdleTime  string
+	}
+
+	limiter struct {
+		rps     float64
+		burst   int
+		enabled bool
+	}
+
+	smtp struct {
+		host     string
+		port     int
+		username string
+		password string
+		sender   string
+	}
+
+	cors struct {
+		trustedOrigins []string
+	}
 }
 
 type application struct {
 	config config
-	logger *log.Logger
+	logger *jsonlog.Logger
+	models data.Models
+	mailer mailer.Mailer
 }
 
 type Message struct {
@@ -47,39 +79,84 @@ func main() {
 	var cfg config
 
 	flag.IntVar(&cfg.port, "port", 4000, "API server port")
-	flag.StringVar(&cfg.env, "env",	"development", "Environment (development|staging|production)")
+	flag.StringVar(&cfg.env, "env", "development", "Environment (development|staging|production)")
+	flag.StringVar(&cfg.db.dsn, "db-dsn", os.Getenv("PARTY_DB_DSN"), "PostgreSQL DSN")
 	//addr := flag.String("addr", ":8443", "HTTP network address")
+
+	flag.IntVar(&cfg.db.maxOpenConns, "db-max-open-conns", 25, "PostgreSQL max open connections")
+	flag.IntVar(&cfg.db.maxIdleConns, "db-max-idle-conns", 25, "PostgreSQL max idle connections")
+	flag.StringVar(&cfg.db.maxIdleTime, "db-max-idle-time", "15m", "PostgreSQL max connection idle time")
+
+	flag.StringVar(&cfg.smtp.host, "smtp-host", "smtp.mailtrap.io", "SMTP host")
+	flag.IntVar(&cfg.smtp.port, "smtp-port", 25, "SMTP port")
+	flag.StringVar(&cfg.smtp.username, "smtp-username", "98cf60028d7fcb", "SMTP username")
+	flag.StringVar(&cfg.smtp.password, "smtp-password", "b9d4a35372e971", "SMTP password")
+	flag.StringVar(&cfg.smtp.sender, "smtp-sender", "Greenlight <no-reply@greenlight.alexedwards.net>", "SMTP sender")
+
+	flag.Float64Var(&cfg.limiter.rps, "limiter-rps", 2, "Rate limiter maximum requests per second")
+	flag.IntVar(&cfg.limiter.burst, "limiter-burst", 4, "Rate limiter maximum burst")
+	flag.BoolVar(&cfg.limiter.enabled, "limiter-enabled", true, "Enable rate limiter")
+
+	flag.Func("cors-trusted-origins", "Trusted CORS origins (space separated)", func(val string) error {
+		cfg.cors.trustedOrigins = strings.Fields(val)
+		return nil
+	})
+
 	flag.Parse()
 
-	logger := log.New(os.Stdout, "", log.Ldate | log.Ltime)
+	logger := jsonlog.New(os.Stdout, jsonlog.LevelInfo)
 
+	log.Printf("%s\n", cfg.db.dsn)
+	
+	db, err := openDB(cfg)
+	if err != nil {
+		logger.PrintFatal(err, nil)
+	}
+	
+	defer db.Close()
+	
 	app := &application{
 		config: cfg,
 		logger: logger,
+		models: data.NewModels(db),
+		mailer: mailer.New(cfg.smtp.host, cfg.smtp.port, cfg.smtp.username, cfg.smtp.password, cfg.smtp.sender),
 	}
+	
+	log.Println("Hello, Sailor!")
 
-	conn, err := pgx.Connect(context.Background(), "postgres://party:iK2SoVbDhdCki5n3LxGyP6zKpLspt4@losandesgames.com:5432/party")
+
+	err = app.serve()
 	if err != nil {
-		log.Fatal(err)
-	}
-
-	defer conn.Close(context.Background())
-
-	database_init(conn)
-
-	srv := &http.Server{
-		Addr: fmt.Sprintf(":%d", cfg.port),
-		Handler: app.routes(),
-		IdleTimeout: time.Minute,
-		ReadTimeout: 10 * time.Second,
-		WriteTimeout: 30 * time.Second,
-	}
-
-	logger.Printf("starting %s server on %s", cfg.env, srv.Addr);
-
-	// Start HTTPS server (requires cert.pem and key.pem in current dir)
-	err = srv.ListenAndServe()
-	if err != nil {
-		panic(err)
+		logger.PrintFatal(err, nil)
 	}
 }
+
+func openDB(cfg config) (*sql.DB, error) {
+	db, err := sql.Open("postgres", cfg.db.dsn)
+	if err != nil {
+		return nil, err
+	}
+
+
+	db.SetMaxOpenConns(cfg.db.maxOpenConns)
+	db.SetMaxIdleConns(cfg.db.maxIdleConns)
+	duration, err := time.ParseDuration(cfg.db.maxIdleTime)
+	if err != nil {
+		return nil, err
+	}
+	db.SetConnMaxIdleTime(duration)
+
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+
+	// Use PingContext() to establish a new connection to the database, passing in the
+	// context we created above as a parameter. If the connection couldn't be
+	// established successfully within the 5 second deadline, then this will return an
+	// error.
+	err = db.PingContext(ctx)
+	if err != nil {
+		return nil, err
+	}
+
+	return db, nil
+}

cmd/api/middleware.go

@@ -0,0 +1,215 @@
+package main
+
+import (
+	"fmt"
+	"net"
+	"net/http"
+	"sync"
+	"time"
+	"strings"
+	"errors"
+
+	"golang.org/x/time/rate"
+	"party.at/party/internal/data"
+	"party.at/party/internal/validator"
+)
+
+func (app *application) recoverPanic(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		// Create a deferred function (which will always be run in the event of a panic
+		// as Go unwinds the stack).
+		defer func() {
+			// Use the builtin recover function to check if there has been a panic or
+			// not.
+			if err := recover(); err != nil {
+			// If there was a panic, set a "Connection: close" header on the
+			// response. This acts as a trigger to make Go's HTTP server
+			// automatically close the current connection after a response has been
+			// sent.
+			w.Header().Set("Connection", "close")
+			// The value returned by recover() has the type interface{}, so we use
+			// fmt.Errorf() to normalize it into an error and call our
+			// serverErrorResponse() helper. In turn, this will log the error using
+			// our custom Logger type at the ERROR level and send the client a 500
+			// Internal Server Error response.
+			app.serverErrorResponse(w, r, fmt.Errorf("%s", err))
+		}
+		}()
+		next.ServeHTTP(w, r)
+	})
+}
+
+func (app *application) rateLimit(next http.Handler) http.Handler {
+
+	type client struct {
+		limiter *rate.Limiter
+		lastSeen time.Time
+	}
+	
+	var mu sync.Mutex
+	var clients = make(map[string]*client)
+	
+	go func() {
+		for {
+			time.Sleep(time.Minute)
+
+			// Lock the mutex to prevent any rate limiter checks from happening while
+			// the cleanup is taking place.
+			mu.Lock()
+
+			// Loop through all clients. If they haven't been seen within the last three
+			// minutes, delete the corresponding entry from the map.
+			for ip, client := range clients {
+				if time.Since(client.lastSeen) > 3*time.Minute {
+					delete(clients, ip)
+				}
+			}
+
+			// Importantly, unlock the mutex when the cleanup is complete.
+			mu.Unlock()
+		}
+	}()
+
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		
+		if app.config.limiter.enabled {
+			ip, _, err := net.SplitHostPort(r.RemoteAddr)
+			if err != nil {
+				app.serverErrorResponse(w, r, err)
+				return
+			}
+
+			mu.Lock()
+
+			if _, found := clients[ip]; !found {
+				clients[ip] = &client{limiter: rate.NewLimiter(rate.Limit(app.config.limiter.rps), app.config.limiter.burst)}
+			}
+
+			clients[ip].lastSeen = time.Now()
+
+			if !clients[ip].limiter.Allow() {
+				mu.Unlock()
+				app.rateLimitExceededResponse(w, r)
+				return
+			}
+
+			mu.Unlock()
+		}
+		
+		next.ServeHTTP(w, r)
+	})
+}
+
+func (app *application) authenticate(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Add("Vary", "Authorization")
+
+		authorizationHeader := r.Header.Get("Authorization")
+
+		if authorizationHeader == "" {
+			r = app.contextSetUser(r, data.AnonymousUser)
+			next.ServeHTTP(w, r)
+			return
+		}
+
+		headerParts := strings.Split(authorizationHeader, " ")
+		if len(headerParts) != 2 || headerParts[0] != "Bearer" {
+			app.invalidAuthenticationTokenResponse(w, r)
+			return
+		}
+
+		token := headerParts[1]
+
+		v := validator.New()
+
+		if data.ValidateTokenPlaintext(v, token); !v.Valid() {
+			app.invalidAuthenticationTokenResponse(w, r)
+			return
+		}
+
+		userIdentity, err := app.models.UserIdentities.GetForToken(data.ScopeAuthentication, token)
+		if err != nil {
+			switch {
+			case errors.Is(err, data.ErrRecordNotFound):
+				app.invalidAuthenticationTokenResponse(w, r)
+			default:
+				app.serverErrorResponse(w, r, err)
+			}
+			return
+		}
+
+		user, err := app.models.Users.Get(userIdentity.UserID)
+		if err != nil {
+			switch {
+				case errors.Is(err, data.ErrRecordNotFound):
+					app.invalidCredentialsResponse(w, r)
+				default:
+					app.serverErrorResponse(w, r, err)
+			}
+			return
+		}
+
+		// Call the contextSetUser() helper to add the user information to the request
+		// context.
+		r = app.contextSetUser(r, user)
+		// Call the next handler in the chain.
+		next.ServeHTTP(w, r)
+	})
+}
+
+func (app *application) requireAuthenticatedUser(next http.HandlerFunc) http.HandlerFunc {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		user := app.contextGetUser(r)
+		if user.IsAnonymous() {
+			app.authenticationRequiredResponse(w, r)
+			return
+		}
+
+		next.ServeHTTP(w, r)
+	})
+}
+
+func (app *application) requireActivatedUser(next http.HandlerFunc) http.HandlerFunc {
+	// Rather than returning this http.HandlerFunc we assign it to the variable fn.
+	fn := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		user := app.contextGetUser(r)
+
+		// Check that a user is activated.
+		if !user.Activated {
+			app.inactiveAccountResponse(w, r)
+			return
+		}
+		next.ServeHTTP(w, r)
+	})
+
+	// Wrap fn with the requireAuthenticatedUser() middleware before returning it.
+	return app.requireAuthenticatedUser(fn)
+}
+
+func (app *application) requirePermission(code string, next http.HandlerFunc) http.HandlerFunc {
+	fn := func(w http.ResponseWriter, r *http.Request) {
+		// Retrieve the user from the request context.
+		user := app.contextGetUser(r)
+
+		// Get the slice of permissions for the user.
+		permissions, err := app.models.Permissions.GetAllForUser(user.ID)
+		if err != nil {
+			app.serverErrorResponse(w, r, err)
+			return
+		}
+
+		// Check if the slice includes the required permission. If it doesn't, then
+		// return a 403 Forbidden response.
+		if !permissions.Include(code) {
+			app.notPermittedResponse(w, r)
+			return
+		}
+
+		// Otherwise they have the required permission so we call the next handler in
+		// the chain.
+		next.ServeHTTP(w, r)
+	}
+
+	// Wrap this with the requireActivatedUser() middleware before returning it.
+	return app.requireActivatedUser(fn)
+}

cmd/api/routes.go

@@ -5,18 +5,34 @@ import (
 	"github.com/julienschmidt/httprouter"
 )
 
-func (app *application) routes() *httprouter.Router {
+func (app *application) routes() http.Handler {
 
 	router := httprouter.New()
 
+	router.NotFound = http.HandlerFunc(app.notFoundResponse)
+	router.MethodNotAllowed = http.HandlerFunc(app.methodNotAllowedResponse)
+
 	fileServer := http.FileServer(http.Dir("ui/static"))
 
-	router.HandlerFunc(http.MethodGet, "/", home)
-	router.HandlerFunc(http.MethodGet, "/ws", ws)
-	router.Handler(http.MethodGet, "/static/", http.StripPrefix("/static", fileServer))
-	router.HandlerFunc(http.MethodGet, "/v1/healthcheck", app.healthcheckHandler)
-	// router.HandlerFunc(http.MethodPost, "/v1/movies", app.createMovieHandler)
-	// router.HandlerFunc(http.MethodGet, "/v1/movies/:id", app.showMovieHandler)
+	router.HandlerFunc(http.MethodGet,    "/", home)
+	router.HandlerFunc(http.MethodGet,    "/ws", ws)
+	router.Handler    (http.MethodGet,    "/static/", http.StripPrefix("/static", fileServer))
+	router.HandlerFunc(http.MethodGet,    "/v1/healthcheck", app.healthcheckHandler)
+	
+	router.HandlerFunc(http.MethodGet,    "/v1/issues", app.requirePermission("issues:read", app.listIssuesHandler))
 
-	return router
+	router.HandlerFunc(http.MethodPost,   "/v1/issues",     app.requirePermission("issues:write", app.createIssueHandler))
+	router.HandlerFunc(http.MethodGet,    "/v1/issues/:id", app.requirePermission("issues:read", app.readIssueHandler))
+	router.HandlerFunc(http.MethodPatch,  "/v1/issues/:id", app.requirePermission("issues:write", app.updateIssueHandler))
+	router.HandlerFunc(http.MethodDelete, "/v1/issues/:id", app.requirePermission("issues:write", app.deleteIssueHandler))
+
+	router.HandlerFunc(http.MethodPost,  "/v1/users",     app.createUserHandler)
+	// router.HandlerFunc(http.MethodGet,   "/v1/users/:id", app.readUserHandler)
+	// router.HandlerFunc(http.MethodPatch, "/v1/users/:id", app.updateUserHandler)
+	router.HandlerFunc(http.MethodDelete,  "/v1/users/:id", app.deleteUserHandler)
+	router.HandlerFunc(http.MethodPut, "/v1/users/activated", app.activateUserHandler)
+
+	router.HandlerFunc(http.MethodPost, "/v1/tokens/authentication", app.createAuthenticationTokenHandler)
+
+	return app.recoverPanic(app.enableCORS(app.rateLimit(app.authenticate(router))))
 }

cmd/api/server.go

@@ -0,0 +1,67 @@
+package main
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"net/http"
+	"time"
+	"log"
+	"os"
+	"os/signal"
+	"syscall"
+)
+
+func (app *application) serve() error {
+	// Declare a HTTP server using the same settings as in our main() function.
+	srv := &http.Server{
+		Addr:         fmt.Sprintf(":%d", app.config.port),
+		Handler:      app.routes(),
+		ErrorLog:     log.New(app.logger, "", 0),
+		IdleTimeout:  time.Minute,
+		ReadTimeout:  10 * time.Second,
+		WriteTimeout: 30 * time.Second,
+	}
+
+	shutdownError := make(chan error)
+
+	go func() {
+
+		quit := make(chan os.Signal, 1)
+
+		signal.Notify(quit, syscall.SIGINT, syscall.SIGTERM)
+
+		s := <-quit
+
+		app.logger.PrintInfo("shutting down server", map[string]string{
+			"signal": s.String(),
+		})
+
+		ctx, cancel := context.WithTimeout(context.Background(), 5 * time.Second)
+		defer cancel()
+
+		shutdownError <- srv.Shutdown(ctx)
+	}()
+
+	// Likewise log a "starting server" message.
+	app.logger.PrintInfo("starting server", map[string]string{
+		"addr": srv.Addr,
+		"env": app.config.env,
+	})
+
+	err := srv.ListenAndServe()
+	if !errors.Is(err, http.ErrServerClosed) {
+		return err
+	}
+
+	err = <-shutdownError
+	if err != nil {
+		return err
+	}
+
+	app.logger.PrintInfo("stopped server", map[string]string{
+		"addr": srv.Addr,
+	})
+
+	return nil
+}

cmd/api/tokens.go

@@ -0,0 +1,77 @@
+package main
+
+import (
+	"errors"
+	"net/http"
+	"time"
+	"party.at/party/internal/data"
+	"party.at/party/internal/validator"
+)
+
+func (app *application) createAuthenticationTokenHandler(w http.ResponseWriter, r *http.Request) {
+	var input struct {
+		Email    string `json:"email"`
+		Password string `json:"password"`
+	}
+
+	err := app.readJSON(w, r, &input)
+	if err != nil {
+		app.badRequestResponse(w, r, err)
+		return
+	}
+
+	// Validate the email and password provided by the client.
+	v := validator.New()
+
+	data.ValidateEmail(v, input.Email)
+	data.ValidatePasswordPlaintext(v, input.Password)
+
+	if !v.Valid() {
+		app.failedValidationResponse(w, r, v.Errors)
+		return
+	}
+
+	user, err := app.models.Users.GetByEmail(input.Email)
+	if err != nil {
+		switch {
+			case errors.Is(err, data.ErrRecordNotFound):
+				app.invalidCredentialsResponse(w, r)
+			default:
+				app.serverErrorResponse(w, r, err)
+		}
+		return
+	}
+
+	identities, err := app.models.UserIdentities.GetByUser(user.ID)
+
+	var authenticatedIdentity *data.UserIdentity
+
+	for _, user_identity := range identities {
+		match, err := user_identity.Password.Matches(input.Password)
+		if err != nil {
+			app.serverErrorResponse(w, r, err)
+			return
+		}
+
+		if match {
+			authenticatedIdentity = user_identity
+            break
+		}
+	}
+
+	if authenticatedIdentity == nil {
+        app.invalidCredentialsResponse(w, r)
+        return
+    }
+
+	token, err := app.models.Tokens.New(user.ID, authenticatedIdentity.ID, 24 * time.Hour, data.ScopeAuthentication)
+	if err != nil {
+		app.serverErrorResponse(w, r, err)
+		return
+	}
+
+	err = app.writeJSON(w, http.StatusCreated, envelope{"authentication_token": token}, nil)
+	if err != nil {
+		app.serverErrorResponse(w, r, err)
+	}
+}

cmd/api/users.go

@@ -0,0 +1,197 @@
+package main
+
+import (
+	"errors"
+	"net/http"
+	"party.at/party/internal/data"
+	"party.at/party/internal/validator"
+	"database/sql"
+	"time"
+)
+
+func (app *application) createUserHandler(w http.ResponseWriter, r *http.Request) {
+
+	var input struct {
+		ProviderId int64 `json:"provider_id"`
+		Username   string `json:"username"`
+		Email      string `json:"email"`
+		Password   string `json:"password"`
+		Name       string `json:"name"`
+		AltName    string `json:"alt_name"`
+	}
+
+	err := app.readJSON(w, r, &input)
+	if err != nil {
+		app.badRequestResponse(w, r, err)
+		return
+	}
+
+	user := &data.User{
+		Email: input.Email,
+		Name: input.Name,
+		AltName: sql.NullString{String: input.AltName, Valid: true},
+		Activated: false,
+	}
+
+	userIdentity := &data.UserIdentity{
+		ProviderID: input.ProviderId,
+		ProviderUserID: input.Username,
+	}
+
+	err = userIdentity.Password.Set(input.Password)
+	if err != nil {
+		app.serverErrorResponse(w, r, err)
+		return
+	}
+
+	v := validator.New()
+	if data.ValidateUser(v, user); !v.Valid() {
+		app.failedValidationResponse(w, r, v.Errors)
+		return
+	}
+
+	if data.ValidateUserIdentity(v, userIdentity); !v.Valid() {
+		app.failedValidationResponse(w, r, v.Errors)
+		return
+	}
+
+	err = app.models.Users.ExecuteRegistrationTx(user, userIdentity)
+	if err != nil {
+		switch {
+		case errors.Is(err, data.ErrDuplicateEmail):
+			v.AddError("email", "a user with this email address already exists")
+			app.failedValidationResponse(w, r, v.Errors)
+		case errors.Is(err, data.ErrDuplicateUser):
+			v.AddError("username", "a user with this username already exists")
+			app.failedValidationResponse(w, r, v.Errors)
+		default:
+			app.serverErrorResponse(w, r, err)
+		}
+
+		return
+	}
+
+	err = app.models.Permissions.AddForUser(user.ID, "issues:read")
+	if err != nil {
+		app.serverErrorResponse(w, r, err)
+		return
+	}
+
+	token, err := app.models.Tokens.New(user.ID, userIdentity.ID, 3 * 24 * time.Hour, data.ScopeActivation)
+	if err != nil {
+		app.serverErrorResponse(w, r, err)
+		return
+	}
+
+	app.background(func() {
+		data := map[string]interface{}{
+			"token": token.Plaintext,
+			"userID": user.ID,
+		}
+
+		err = app.mailer.Send(user.Email, "user_welcome.tmpl", data)
+		if err != nil {
+			app.logger.PrintError(err, nil)
+		}
+	})
+
+	// Write a JSON response containing the user data along with a 201 Created status
+	// code.
+	err = app.writeJSON(w, http.StatusCreated, envelope{"user": user}, nil)
+	if err != nil {
+		app.serverErrorResponse(w, r, err)
+	}
+}
+
+func (app *application) deleteUserHandler(w http.ResponseWriter, r *http.Request) {
+	id, err := app.readIDParam(r)
+	if err != nil {
+		app.notFoundResponse(w, r)
+		return
+	}
+
+	// Delete the issue from the database, sending a 404 Not Found response to the
+	// client if there isn't a matching record.
+	err = app.models.Users.Delete(id)
+	if err != nil {
+		switch {
+		case errors.Is(err, data.ErrRecordNotFound):
+			app.notFoundResponse(w, r)
+		default:
+			app.serverErrorResponse(w, r, err)
+		}
+
+		return
+	}
+
+	// Return a 200 OK status code along with a success message.
+	err = app.writeJSON(w, http.StatusOK, envelope{"message": "user successfully deleted"}, nil)
+	if err != nil {
+		app.serverErrorResponse(w, r, err)
+	}
+}
+
+func (app *application) activateUserHandler(w http.ResponseWriter, r *http.Request) {
+	// Parse the plaintext activation token from the request body.
+	var input struct {
+		TokenPlaintext string `json:"token"`
+	}
+
+	err := app.readJSON(w, r, &input)
+	if err != nil {
+		app.badRequestResponse(w, r, err)
+		return
+	}
+
+	// Validate the plaintext token provided by the client.
+	v := validator.New()
+	if data.ValidateTokenPlaintext(v, input.TokenPlaintext); !v.Valid() {
+		app.failedValidationResponse(w, r, v.Errors)
+		return
+	}
+
+	// Retrieve the details of the user associated with the token using the
+	// GetForToken() method (which we will create in a minute). If no matching record
+	// is found, then we let the client know that the token they provided is not valid.
+	user, err := app.models.Users.GetForToken(data.ScopeActivation, input.TokenPlaintext)
+	if err != nil {
+		switch {
+		case errors.Is(err, data.ErrRecordNotFound):
+			v.AddError("token", "invalid or expired activation token")
+			app.failedValidationResponse(w, r, v.Errors)
+		default:
+			app.serverErrorResponse(w, r, err)
+		}
+		return
+	}
+
+	// Update the user's activation status.
+	user.Activated = true
+
+	// Save the updated user record in our database, checking for any edit conflicts in
+	// the same way that we did for our movie records.
+	err = app.models.Users.Update(user)
+	if err != nil {
+	switch {
+		case errors.Is(err, data.ErrEditConflict):
+			app.editConflictResponse(w, r)
+		default:
+			app.serverErrorResponse(w, r, err)
+		}
+		return
+	}
+
+	// If everything went successfully, then we delete all activation tokens for the
+	// user.
+	err = app.models.Tokens.DeleteAllForUser(data.ScopeActivation, user.ID)
+	if err != nil {
+		app.serverErrorResponse(w, r, err)
+		return
+	}
+
+	// Send the updated user details to the client in a JSON response.
+	err = app.writeJSON(w, http.StatusOK, envelope{"user": user}, nil)
+	if err != nil {
+		app.serverErrorResponse(w, r, err)
+	}
+}