feat: add user authentication check and redirect to login for protected views

backend/cmd/app/main.go

@@ -197,6 +197,19 @@ func main() {
 	mux.HandleFunc("GET /terminal-sim", adminHanlder.TerminalSimView) // kept public since it's a sim
 	mux.HandleFunc("POST /v1/terminal-sim/transact", adminHanlder.TerminalSimTransactionHandler)
 
+	// Catch-all route for 404
+	mux.HandleFunc("/", func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusNotFound)
+		if tpl != nil {
+			err := tpl.ExecuteTemplate(w, "404.html", nil)
+			if err != nil {
+				http.Error(w, "404 page not found", http.StatusNotFound)
+			}
+		} else {
+			http.Error(w, "404 page not found", http.StatusNotFound)
+		}
+	})
+
 	// Wrap mux with custom handler for root redirect
 	customHandler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		if r.URL.Path == "/" {

backend/internal/user/customer_card.go

@@ -12,10 +12,18 @@ func (h *Handler) CardView(w http.ResponseWriter, r *http.Request) {
 	fmt.Println("Card view is running...")
 
 	username := r.PathValue("username")
+	user, err := h.GetDashboardUser(username)
+	if err != nil {
+		http.Redirect(w, r, "/login", http.StatusSeeOther)
+		return
+	}
+
 	data := struct {
 		Username string
+		User     DashboardUser
 	}{
 		Username: username,
+		User:     user,
 	}
 
 	h.Tpl.ExecuteTemplate(w, "card.html", data)

backend/internal/user/customer_profile.go

@@ -61,10 +61,18 @@ func (h *Handler) ProfileView(w http.ResponseWriter, r *http.Request) {
 
 	// Extract the username from the URL path
 	username := r.PathValue("username")
+	user, err := h.GetDashboardUser(username)
+	if err != nil {
+		http.Redirect(w, r, "/login", http.StatusSeeOther)
+		return
+	}
+
 	data := struct {
 		Username string
+		User     DashboardUser
 	}{
 		Username: username,
+		User:     user,
 	}
 
 	// Render the profile template with the username data

backend/internal/user/customer_topup.go

@@ -43,12 +43,19 @@ const ConvenienceFee = 15.00
 func (h *Handler) TopUpView(w http.ResponseWriter, r *http.Request) {
 	fmt.Println("TopUp view is running...")
 
-	// get username from url parameter
 	username := r.PathValue("username")
+	user, err := h.GetDashboardUser(username)
+	if err != nil {
+		http.Redirect(w, r, "/login", http.StatusSeeOther)
+		return
+	}
+
 	data := struct {
 		Username string
+		User     DashboardUser
 	}{
 		Username: username,
+		User:     user,
 	}
 
 	h.Tpl.ExecuteTemplate(w, "customer_topup.html", data)

backend/internal/user/dashboard.go

@@ -46,33 +46,7 @@ type DashboardUser struct {
 	RecentTransactions []Transaction   `json:"recent_transactions"` // Add recent transactions to the dashboard response
 }
 
-func (h *Handler) DashboardView(w http.ResponseWriter, r *http.Request) {
-	fmt.Println("Dashboard view is running...")
-
-	username := r.PathValue("username")
-	data := struct {
-		Username string
-	}{
-		Username: username,
-	}
-
-	h.Tpl.ExecuteTemplate(w, "dashboard.html", data)
-}
-
-func (h *Handler) DashboardHandler(w http.ResponseWriter, r *http.Request) {
-	fmt.Println("Dashboard JSON handler is running...")
-
-	// Get user ID from path param (No cookies for now)
-	userID := r.PathValue("username")
-	if userID == "" {
-		jsonwrite.WriteJSON(w, http.StatusBadRequest, jsonwrite.APIResponse{
-			Success: false,
-			Message: "user is required",
-		})
-		return
-	}
-
-	// Fetch user and card details
+func (h *Handler) GetDashboardUser(userID string) (DashboardUser, error) {
 	var (
 		id            int
 		username      string
@@ -110,17 +84,7 @@ func (h *Handler) DashboardHandler(w http.ResponseWriter, r *http.Request) {
 	var userStatus string
 	err := h.Store.QueryRow(stmt, userID).Scan(&id, &username, &fullName, &email, &pendingEmail, &phone, &userType, &balance, &loyaltyPoints, &cardNumber, &expiryDate, &cardStatus, &userStatus)
 	if err != nil {
-		if err == sql.ErrNoRows {
-			fmt.Printf("User %s not found in DB\n", userID)
-		} else {
-			fmt.Printf("Error fetching user %s from DB: %v\n", userID, err)
-		}
-		// Clear invalid session cookie (Removed)
-		jsonwrite.WriteJSON(w, http.StatusUnauthorized, jsonwrite.APIResponse{
-			Success: false,
-			Message: "Unauthorized: User not found",
-		})
-		return
+		return DashboardUser{}, err
 	}
 
 	// Generate Initials
@@ -182,9 +146,7 @@ func (h *Handler) DashboardHandler(w http.ResponseWriter, r *http.Request) {
 `
 	rows, err := h.Store.Query(txnQuery, userID, userID)
 	var transactions []Transaction
-	if err != nil {
-		fmt.Printf("Error fetching transactions: %v\n", err)
-	} else {
+	if err == nil {
 		defer rows.Close()
 		for rows.Next() {
 			var t Transaction
@@ -205,7 +167,6 @@ func (h *Handler) DashboardHandler(w http.ResponseWriter, r *http.Request) {
 				&merchantId,
 				&pointsEarned,
 			); err != nil {
-				fmt.Printf("Error scanning transaction row: %v\n", err)
 				continue
 			}
 			t.Date = formatDate(createdAt)
@@ -254,6 +215,55 @@ func (h *Handler) DashboardHandler(w http.ResponseWriter, r *http.Request) {
 		RecentTransactions: transactions,
 	}
 
+	return dashboardUser, nil
+}
+
+func (h *Handler) DashboardView(w http.ResponseWriter, r *http.Request) {
+	fmt.Println("Dashboard view is running...")
+
+	username := r.PathValue("username")
+	user, err := h.GetDashboardUser(username)
+	if err != nil {
+		http.Redirect(w, r, "/login", http.StatusSeeOther)
+		return
+	}
+
+	data := struct {
+		Username string
+		User     DashboardUser
+	}{
+		Username: username,
+		User:     user,
+	}
+
+	h.Tpl.ExecuteTemplate(w, "dashboard.html", data)
+}
+
+func (h *Handler) DashboardHandler(w http.ResponseWriter, r *http.Request) {
+	// Get user ID from path param (No cookies for now)
+	userID := r.PathValue("username")
+	if userID == "" {
+		jsonwrite.WriteJSON(w, http.StatusBadRequest, jsonwrite.APIResponse{
+			Success: false,
+			Message: "user is required",
+		})
+		return
+	}
+
+	dashboardUser, err := h.GetDashboardUser(userID)
+	if err != nil {
+		if err == sql.ErrNoRows {
+			fmt.Printf("User %s not found in DB\n", userID)
+		} else {
+			fmt.Printf("Error fetching user %s from DB: %v\n", userID, err)
+		}
+		jsonwrite.WriteJSON(w, http.StatusUnauthorized, jsonwrite.APIResponse{
+			Success: false,
+			Message: "Unauthorized: User not found",
+		})
+		return
+	}
+
 	jsonwrite.WriteJSON(w, http.StatusOK, dashboardUser)
 }
 

backend/internal/user/settings.go

@@ -10,10 +10,18 @@ func (h *Handler) SettingsView(w http.ResponseWriter, r *http.Request) {
 	fmt.Println("Settings view is running...")
 
 	username := r.PathValue("username")
+	user, err := h.GetDashboardUser(username)
+	if err != nil {
+		http.Redirect(w, r, "/login", http.StatusSeeOther)
+		return
+	}
+
 	data := struct {
 		Username string
+		User     DashboardUser
 	}{
 		Username: username,
+		User:     user,
 	}
 
 	h.Tpl.ExecuteTemplate(w, "settings.html", data)

backend/internal/user/transaction.go

@@ -15,10 +15,18 @@ func (h *Handler) TransactionView(w http.ResponseWriter, r *http.Request) {
 	fmt.Println("Transaction view is running...")
 
 	username := r.PathValue("username")
+	user, err := h.GetDashboardUser(username)
+	if err != nil {
+		http.Redirect(w, r, "/login", http.StatusSeeOther)
+		return
+	}
+
 	data := struct {
 		Username string
+		User     DashboardUser
 	}{
 		Username: username,
+		User:     user,
 	}
 
 	h.Tpl.ExecuteTemplate(w, "transaction.html", data)