Go for Grit Developers

package main

import "fmt"

func main() {
    fmt.Println("Hello, Grit!")
}

package main

import "fmt"

const AppName = "my-saas"

func main() {
    // Explicit declaration
    var name string = "Grit"
    var port int = 8080

    // Short assignment (type inferred)
    host := "localhost"
    debug := true
    price := 29.99

    // Multiple assignment
    width, height := 1920, 1080

    fmt.Println(name, host, port, debug, price, width, height)
    fmt.Println("App:", AppName)
}

package models

import (
    "time"
    "gorm.io/gorm"
)

type User struct {
    ID        uint           `gorm:"primarykey" json:"id"`
    Name      string         `gorm:"size:255;not null" json:"name" binding:"required"`
    Email     string         `gorm:"size:255;uniqueIndex;not null" json:"email" binding:"required,email"`
    Password  string         `gorm:"size:255;not null" json:"-"`
    Role      string         `gorm:"size:20;default:USER" json:"role"`
    Active    bool           `gorm:"default:true" json:"active"`
    CreatedAt time.Time      `json:"created_at"`
    UpdatedAt time.Time      `json:"updated_at"`
    DeletedAt gorm.DeletedAt `gorm:"index" json:"-"`
}

package main

import (
    "errors"
    "fmt"
)

// Functions return (result, error)
func divide(a, b float64) (float64, error) {
    if b == 0 {
        return 0, errors.New("cannot divide by zero")
    }
    return a / b, nil
}

func calculateDiscount(price, percent float64) (float64, error) {
    result, err := divide(price * percent, 100)
    if err != nil {
        // Wrap the error with context
        return 0, fmt.Errorf("calculating discount: %w", err)
    }
    return result, nil
}

func main() {
    discount, err := calculateDiscount(100.0, 20.0)
    if err != nil {
        fmt.Println("Error:", err)
        return
    }
    fmt.Println("Discount:", discount) // 20.0
}

package main

import "fmt"

type User struct {
    FirstName string
    LastName  string
    Email     string
}

// A regular function — takes User as an argument
func getFullName(u User) string {
    return u.FirstName + " " + u.LastName
}

// A method — attached to User with a value receiver
// Use value receiver when you only READ the struct
func (u User) FullName() string {
    return u.FirstName + " " + u.LastName
}

// A method with a pointer receiver
// Use pointer receiver when you MODIFY the struct
func (u *User) SetEmail(email string) {
    u.Email = email // Modifies the original, not a copy
}

func main() {
    user := User{FirstName: "John", LastName: "Doe"}

    // Calling a function — pass the struct as argument
    fmt.Println(getFullName(user)) // "John Doe"

    // Calling a method — use dot notation on the struct
    fmt.Println(user.FullName()) // "John Doe"

    // Pointer receiver method modifies the original
    user.SetEmail("john@example.com")
    fmt.Println(user.Email) // "john@example.com"
}

package main

import "fmt"

func main() {
    // Slices
    names := []string{"Alice", "Bob", "Charlie"}
    names = append(names, "Diana")

    for i, name := range names {
        fmt.Printf("%d: %s\n", i, name)
    }

    // Maps
    user := map[string]any{
        "id":    1,
        "name":  "Alice",
        "email": "alice@example.com",
    }

    for key, value := range user {
        fmt.Printf("%s = %v\n", key, value)
    }

    // Access a single value
    fmt.Println("Name:", user["name"])
}

package main

import "fmt"

// ---- THE JOB POSTING (Interface) ----
// This is like a job ad that says:
// "We need someone who can Drive() and Refuel()"
type TruckDriver interface {
    Drive() string
    Refuel() string
}

// ---- CANDIDATE 1: John (Struct) ----
// John never said "I am a TruckDriver"
// He just happens to know how to Drive() and Refuel()
type John struct {
    Name string
    Age  int
}

func (j John) Drive() string {
    return j.Name + " is driving the truck!"
}

func (j John) Refuel() string {
    return j.Name + " is refueling the truck!"
}

// ---- CANDIDATE 2: Robot (Struct) ----
// Robot also never said "I am a TruckDriver"
// But it also knows how to Drive() and Refuel()
type Robot struct {
    Model string
}

func (r Robot) Drive() string {
    return "Robot " + r.Model + " is driving the truck!"
}

func (r Robot) Refuel() string {
    return "Robot " + r.Model + " is refueling the truck!"
}

// ---- THE COMPANY (Function that accepts the interface) ----
// The company doesn't care WHO you are.
// It only cares: "Can you Drive() and Refuel()?"
func HireDriver(d TruckDriver) {
    fmt.Println("Hired!")
    fmt.Println("  ", d.Drive())
    fmt.Println("  ", d.Refuel())
    fmt.Println()
}

func main() {
    // John applies — he can Drive() and Refuel() -> HIRED
    john := John{Name: "John", Age: 35}
    fmt.Println("John applies for the job:")
    HireDriver(john)

    // Robot applies — it can Drive() and Refuel() -> HIRED
    robot := Robot{Model: "TX-500"}
    fmt.Println("Robot applies for the job:")
    HireDriver(robot)
}

package main

import "fmt"

// Notifier — any type that can send a notification
type Notifier interface {
    Send(to string, message string) error
}

// EmailNotifier implements Notifier (implicitly)
type EmailNotifier struct {
    From string
}

func (e *EmailNotifier) Send(to string, message string) error {
    fmt.Printf("Email from %s to %s: %s\n", e.From, to, message)
    return nil
}

// SlackNotifier also implements Notifier
type SlackNotifier struct {
    Channel string
}

func (s *SlackNotifier) Send(to string, message string) error {
    fmt.Printf("Slack #%s -> %s: %s\n", s.Channel, to, message)
    return nil
}

// Works with ANY Notifier — email, slack, SMS, webhook...
func alert(n Notifier, user string) {
    n.Send(user, "Your report is ready")
}

func main() {
    email := &EmailNotifier{From: "noreply@app.com"}
    slack := &SlackNotifier{Channel: "alerts"}

    alert(email, "alice@example.com") // Email from noreply@app.com to alice@example.com: Your report is ready
    alert(slack, "alice")             // Slack #alerts -> alice: Your report is ready
}

package main

import (
    "bytes"
    "fmt"
    "io"
    "os"
)

// SaveData works with ANY io.Writer — files, buffers, HTTP responses, etc.
func SaveData(w io.Writer, data []byte) error {
    _, err := w.Write(data)
    return err
}

func main() {
    data := []byte("Hello, Grit!")

    // Write to a file
    file, _ := os.Create("output.txt")
    SaveData(file, data)
    file.Close()

    // Write to an in-memory buffer (same function!)
    var buf bytes.Buffer
    SaveData(&buf, data)
    fmt.Println(buf.String()) // Hello, Grit!

    // Write to stdout (same function!)
    SaveData(os.Stdout, data) // Hello, Grit!
}

package main

import "fmt"

func printAnything(v any) {
    fmt.Printf("Value: %v (type: %T)\n", v, v)
}

func main() {
    printAnything(42)          // Value: 42 (type: int)
    printAnything("hello")     // Value: hello (type: string)
    printAnything(true)        // Value: true (type: bool)
    printAnything(3.14)        // Value: 3.14 (type: float64)

    // Common in JSON-like data structures
    person := map[string]any{
        "name":  "Alice",
        "age":   30,
        "admin": true,
    }
    fmt.Println(person) // map[admin:true age:30 name:Alice]
}

package main

import "fmt"

func describe(v any) {
    // Two-return form — safe, won't panic
    if str, ok := v.(string); ok {
        fmt.Printf("String of length %d: %q\n", len(str), str)
        return
    }

    if num, ok := v.(int); ok {
        fmt.Printf("Integer: %d (doubled: %d)\n", num, num*2)
        return
    }

    fmt.Printf("Unknown type: %T\n", v)
}

func main() {
    describe("hello")  // String of length 5: "hello"
    describe(42)        // Integer: 42 (doubled: 84)
    describe(true)      // Unknown type: bool

    // DANGER: single-return form panics on mismatch!
    // s := someValue.(string) // panics if someValue isn't a string
}

package main

import "fmt"

func process(v any) string {
    switch val := v.(type) {
    case string:
        return fmt.Sprintf("string: %q", val)
    case int:
        return fmt.Sprintf("int: %d", val)
    case bool:
        if val {
            return "bool: yes"
        }
        return "bool: no"
    case []string:
        return fmt.Sprintf("string slice with %d items", len(val))
    default:
        return fmt.Sprintf("unhandled type: %T", val)
    }
}

func main() {
    fmt.Println(process("Go"))              // string: "Go"
    fmt.Println(process(2024))              // int: 2024
    fmt.Println(process(true))              // bool: yes
    fmt.Println(process([]string{"a","b"})) // string slice with 2 items
    fmt.Println(process(3.14))              // unhandled type: float64
}

package main

import "fmt"

// Implementing fmt.Stringer — controls how your type prints
type User struct {
    Name string
    Role string
}

func (u User) String() string {
    return fmt.Sprintf("%s (%s)", u.Name, u.Role)
}

// Implementing the error interface — custom error types
type ValidationError struct {
    Field   string
    Message string
}

func (e *ValidationError) Error() string {
    return fmt.Sprintf("validation failed on %s: %s", e.Field, e.Message)
}

func validateEmail(email string) error {
    if email == "" {
        return &ValidationError{Field: "email", Message: "cannot be empty"}
    }
    return nil
}

func main() {
    user := User{Name: "Alice", Role: "ADMIN"}
    fmt.Println(user) // Alice (ADMIN) — fmt.Stringer in action

    if err := validateEmail(""); err != nil {
        fmt.Println(err) // validation failed on email: cannot be empty
    }
}

package main

import "fmt"

// Small, focused interfaces
type Reader interface {
    Read(id string) ([]byte, error)
}

type Writer interface {
    Write(id string, data []byte) error
}

type Deleter interface {
    Delete(id string) error
}

// Compose them into a full storage interface
type Storage interface {
    Reader
    Writer
    Deleter
}

// A function that only needs to read — accepts the smallest interface
func loadConfig(r Reader) ([]byte, error) {
    return r.Read("config.json")
}

// MemoryStore implements all three — so it satisfies Storage
type MemoryStore struct {
    data map[string][]byte
}

func (m *MemoryStore) Read(id string) ([]byte, error) {
    d, ok := m.data[id]
    if !ok {
        return nil, fmt.Errorf("not found: %s", id)
    }
    return d, nil
}

func (m *MemoryStore) Write(id string, data []byte) error {
    m.data[id] = data
    return nil
}

func (m *MemoryStore) Delete(id string) error {
    delete(m.data, id)
    return nil
}

func main() {
    store := &MemoryStore{data: make(map[string][]byte)}
    store.Write("config.json", []byte("port=8080"))

    // Pass the full Storage where only Reader is needed — works fine
    config, _ := loadConfig(store)
    fmt.Println(string(config)) // port=8080
}

package main

import "fmt"

func doubleValue(n int) {
    n = n * 2 // Modifies the COPY, not the original
}

func doublePointer(n *int) {
    *n = *n * 2 // Modifies the ORIGINAL via pointer
}

func main() {
    x := 10

    doubleValue(x)
    fmt.Println(x) // Still 10 — the copy was doubled

    doublePointer(&x)
    fmt.Println(x) // Now 20 — modified through pointer

    // Nil pointer: indicates "no value"
    var name *string = nil
    if name == nil {
        fmt.Println("Name is not set")
    }
}

package main

import (
    "fmt"
    "time"
)

func sayHello(name string) {
    fmt.Printf("Hello, %s!\n", name)
}

func main() {
    // Synchronous — runs and completes before moving on
    sayHello("direct call")

    // Asynchronous — starts a new goroutine
    go sayHello("goroutine")

    // Anonymous goroutine — common pattern
    go func(msg string) {
        fmt.Println(msg)
    }("anonymous goroutine")

    // Without this sleep, main() would exit before
    // the goroutines have a chance to run!
    time.Sleep(100 * time.Millisecond)
    fmt.Println("main done")
}

package main

import (
    "fmt"
    "sync"
    "time"
)

func fetchData(source string, wg *sync.WaitGroup) {
    defer wg.Done() // Signal completion when function returns
    time.Sleep(100 * time.Millisecond) // Simulate work
    fmt.Println("Fetched from:", source)
}

func main() {
    var wg sync.WaitGroup

    sources := []string{"database", "cache", "api"}

    for _, src := range sources {
        wg.Add(1)           // Increment counter
        go fetchData(src, &wg) // Run concurrently
    }

    wg.Wait() // Block until all goroutines call Done()
    fmt.Println("All data fetched!")
    // All 3 goroutines run at the same time (~100ms total, not 300ms)
}

Time 0ms:
  main:       wg.Add(1), go fetchData("database")  → counter = 1
              wg.Add(1), go fetchData("cache")     → counter = 2
              wg.Add(1), go fetchData("api")       → counter = 3
              wg.Wait()  ← main is now BLOCKED

Time 0-100ms:
  goroutine1: sleeping... (database)
  goroutine2: sleeping... (cache)
  goroutine3: sleeping... (api)

Time ~100ms:
  goroutine1: wg.Done() → counter = 2
  goroutine2: wg.Done() → counter = 1
  goroutine3: wg.Done() → counter = 0  ← Wait() unblocks!

  main:       prints "All data fetched!"

Goroutine A  ── sends data ──→  [channel]  ──→  receives data ── Goroutine B

package main

import "fmt"

func main() {
    // Create an unbuffered channel of strings
    messages := make(chan string)

    // Launch a goroutine that sends a value
    go func() {
        messages <- "ping" // Send blocks until someone receives
    }()

    // Receive blocks until someone sends
    msg := <-messages
    fmt.Println(msg) // "ping"

    // --- Channel for returning results ---
    results := make(chan int)

    go func() {
        sum := 0
        for i := 1; i <= 100; i++ {
            sum += i
        }
        results <- sum // Send the computed result back
    }()

    total := <-results
    fmt.Println("Sum 1..100 =", total) // 5050
}

Time 0:
  main:       creates channel "messages"
              launches goroutine
              hits  msg := <-messages  ← BLOCKED (nothing sent yet)

  goroutine:  hits  messages <- "ping" ← finds main is waiting!

  ── handoff happens ──

  main:       msg now equals "ping", prints it
  goroutine:  finishes and exits

main:       creates channel "results"
              launches goroutine
              hits  total := <-results  ← BLOCKED (waiting for answer)

  goroutine:  calculates sum (1+2+...+100 = 5050)
              hits  results <- 5050     ← delivers the answer

  ── handoff happens ──

  main:       total now equals 5050, prints it

package main

import "fmt"

func main() {
    // Buffered channel — can hold up to 2 values
    ch := make(chan string, 2)

    // These sends don't block because the buffer has space
    ch <- "first"
    ch <- "second"

    // Receives pull values out in FIFO order
    fmt.Println(<-ch) // "first"
    fmt.Println(<-ch) // "second"
}

package main

import "fmt"

// producer can ONLY send to the channel
func producer(ch chan<- string, msg string) {
    ch <- msg
    // <-ch  // This would be a compile error!
}

// consumer can ONLY receive from the channel
func consumer(ch <-chan string) string {
    return <-ch
    // ch <- "x"  // This would be a compile error!
}

func main() {
    ch := make(chan string, 1)
    producer(ch, "hello from producer")
    msg := consumer(ch)
    fmt.Println(msg) // "hello from producer"
}

package main

import "fmt"

func generateNumbers(count int, ch chan<- int) {
    for i := 1; i <= count; i++ {
        ch <- i
    }
    close(ch) // Signal: no more values will be sent
}

func main() {
    ch := make(chan int)
    go generateNumbers(5, ch)

    // range automatically stops when channel is closed
    for num := range ch {
        fmt.Printf("Received: %d\n", num)
    }
    fmt.Println("Channel closed, done!")
    // Output:
    // Received: 1
    // Received: 2
    // Received: 3
    // Received: 4
    // Received: 5
    // Channel closed, done!
}

package main

import (
    "fmt"
    "time"
)

func main() {
    ch1 := make(chan string)
    ch2 := make(chan string)

    // Goroutine 1: slow operation (200ms)
    go func() {
        time.Sleep(200 * time.Millisecond)
        ch1 <- "result from service A"
    }()

    // Goroutine 2: fast operation (100ms)
    go func() {
        time.Sleep(100 * time.Millisecond)
        ch2 <- "result from service B"
    }()

    // Receive results from whichever finishes first
    for i := 0; i < 2; i++ {
        select {
        case msg1 := <-ch1:
            fmt.Println("Got:", msg1)
        case msg2 := <-ch2:
            fmt.Println("Got:", msg2)
        }
    }
    // Output (service B finishes first):
    // Got: result from service B
    // Got: result from service A
}

package main

import (
    "fmt"
    "time"
)

// Simulates fetching data from different services
func fetch(service string, ch chan<- string) {
    time.Sleep(100 * time.Millisecond) // Simulate network call
    ch <- fmt.Sprintf("data from %s", service)
}

func main() {
    ch := make(chan string)

    // Fan-out: launch 3 goroutines concurrently
    services := []string{"users-api", "orders-api", "payments-api"}
    for _, svc := range services {
        go fetch(svc, ch)
    }

    // Fan-in: collect all results
    for i := 0; i < len(services); i++ {
        result := <-ch
        fmt.Println(result)
    }
    // All 3 fetches run in parallel (~100ms total, not 300ms)
}

apps/api/
├── cmd/server/
│   └── main.go          # Entry point (package main)
├── cmd/migrate/
│   └── main.go          # Migration CLI (go run cmd/migrate)
├── cmd/seed/
│   └── main.go          # Seeder CLI (go run cmd/seed)
├── internal/
│   ├── config/
│   │   └── config.go    # package config — Config struct, Load()
│   ├── database/
│   │   ├── database.go  # package database — Connect()
│   │   ├── migrate.go   # DropAll() for fresh migrations
│   │   └── seed.go      # Seed() — populate dev data
│   ├── models/
│   │   ├── user.go      # package models — User struct (exported)
│   │   └── upload.go    # package models — Upload struct (exported)
│   ├── handlers/
│   │   ├── auth.go      # package handlers — Login(), Register()
│   │   └── user.go      # package handlers — UserHandler CRUD
│   ├── services/
│   │   └── auth.go      # package services — AuthService (JWT)
│   ├── middleware/
│   │   ├── auth.go      # package middleware — Auth(), RequireRole()
│   │   ├── cors.go      # CORS configuration
│   │   └── logger.go    # Request logging
│   └── routes/
│       └── routes.go    # package routes — Setup() wires everything
└── go.mod               # Module definition

package config

import (
    "os"
    "strconv"
    "github.com/joho/godotenv"
)

type Config struct {
    Port       int
    DBHost     string
    DBPort     int
    DBName     string
    DBUser     string
    DBPassword string
    JWTSecret  string
    Debug      bool
}

func Load() *Config {
    // Load .env file (ignored in production)
    godotenv.Load()

    port, _ := strconv.Atoi(getEnv("PORT", "8080"))
    dbPort, _ := strconv.Atoi(getEnv("DB_PORT", "5432"))

    return &Config{
        Port:       port,
        DBHost:     getEnv("DB_HOST", "localhost"),
        DBPort:     dbPort,
        DBName:     getEnv("DB_NAME", "grit_dev"),
        DBUser:     getEnv("DB_USER", "postgres"),
        DBPassword: getEnv("DB_PASSWORD", "postgres"),
        JWTSecret:  getEnv("JWT_SECRET", "change-me"),
        Debug:      getEnv("DEBUG", "false") == "true",
    }
}

func getEnv(key, fallback string) string {
    if value := os.Getenv(key); value != "" {
        return value
    }
    return fallback
}

package main

import (
    "net/http"
    "github.com/gin-gonic/gin"
)

func main() {
    // Create a Gin engine (bare, no default middleware)
    r := gin.New()

    // Add middleware globally
    r.Use(gin.Logger())    // Log every request
    r.Use(gin.Recovery())  // Recover from panics

    // Simple route
    r.GET("/api/health", func(c *gin.Context) {
        c.JSON(http.StatusOK, gin.H{
            "status": "ok",
        })
    })

    // Start server on port 8080
    r.Run(":8080")
}

// Public routes — no authentication
auth := r.Group("/api/auth")
{
    auth.POST("/register", authHandler.Register)
    auth.POST("/login", authHandler.Login)
    auth.POST("/refresh", authHandler.Refresh)
}

// Protected routes — requires valid JWT token
protected := r.Group("/api")
protected.Use(middleware.Auth(db, authService))  // Apply auth middleware
{
    protected.GET("/auth/me", authHandler.Me)
    protected.GET("/users/:id", userHandler.GetByID)
}

// Admin routes — requires ADMIN role
admin := r.Group("/api")
admin.Use(middleware.Auth(db, authService))
admin.Use(middleware.RequireRole("ADMIN"))        // Stack middleware
{
    admin.GET("/users", userHandler.List)
    admin.POST("/users", userHandler.Create)
    admin.PUT("/users/:id", userHandler.Update)
    admin.DELETE("/users/:id", userHandler.Delete)
}

func exampleHandler(c *gin.Context) {
    // ── Reading the request ──────────────────────────────
    id := c.Param("id")                     // URL param: /users/:id
    page := c.Query("page")                 // Query string: ?page=2
    page = c.DefaultQuery("page", "1")      // With default value

    var input CreateUserInput
    err := c.ShouldBindJSON(&input)         // Parse + validate JSON body

    token := c.GetHeader("Authorization")   // Read a header

    // ── Sending responses ────────────────────────────────
    c.JSON(200, gin.H{"data": "hello"})     // Send JSON
    c.JSON(404, gin.H{                      // Send error
        "error": gin.H{
            "code":    "NOT_FOUND",
            "message": "User not found",
        },
    })

    // ── Middleware data ──────────────────────────────────
    c.Set("user_id", uint(42))              // Store data (middleware → handler)
    userID, _ := c.Get("user_id")           // Retrieve data

    // ── Control flow ────────────────────────────────────
    c.Abort()                               // Stop the middleware chain
    c.Next()                                // Continue to next middleware/handler
}

// Gin validates this struct automatically
type CreateUserInput struct {
    Name     string `json:"name" binding:"required"`           // Must be present
    Email    string `json:"email" binding:"required,email"`    // Must be valid email
    Password string `json:"password" binding:"required,min=8"` // Min 8 characters
    Age      int    `json:"age" binding:"gte=18,lte=120"`      // Between 18-120
    Role     string `json:"role" binding:"oneof=USER EDITOR"`  // Must be one of these
}

func createUser(c *gin.Context) {
    var input CreateUserInput
    if err := c.ShouldBindJSON(&input); err != nil {
        // Gin returns detailed validation errors automatically
        c.JSON(422, gin.H{
            "error": gin.H{
                "code":    "VALIDATION_ERROR",
                "message": err.Error(),
            },
        })
        return
    }

    // input is now validated and safe to use
    fmt.Println(input.Name, input.Email)
}

// A middleware is just a gin.HandlerFunc that calls c.Next()
func Logger() gin.HandlerFunc {
    return func(c *gin.Context) {
        start := time.Now()

        c.Next() // ← Run the next handler/middleware

        // This runs AFTER the handler returns
        duration := time.Since(start)
        status := c.Writer.Status()
        log.Printf("%s %s → %d (%v)", c.Request.Method, c.Request.URL.Path, status, duration)
    }
}

// Middleware that blocks requests (c.Abort)
func RequireAPIKey() gin.HandlerFunc {
    return func(c *gin.Context) {
        key := c.GetHeader("X-API-Key")
        if key != "valid-key" {
            c.JSON(401, gin.H{"error": "Invalid API key"})
            c.Abort() // ← Stop the chain, handler never runs
            return
        }
        c.Next()
    }
}

Request → Logger → CORS → Auth → RequireRole → Handler
                                                         ↓
Response ← Logger ← CORS ← Auth ← RequireRole ← Handler

// If Auth calls c.Abort():
Request → Logger → CORS → Auth ✗ (returns 401, handler never runs)

r := gin.New()

// Global middleware — runs on EVERY request
r.Use(middleware.Logger())
r.Use(gin.Recovery())
r.Use(middleware.CORS(cfg.CORSOrigins))

// Group middleware — runs only on routes in this group
protected := r.Group("/api")
protected.Use(middleware.Auth(db, authService))   // Only protected routes
{
    protected.GET("/users/:id", userHandler.GetByID)
}

// Stacking middleware — multiple on one group
admin := r.Group("/api")
admin.Use(middleware.Auth(db, authService))        // Must be logged in
admin.Use(middleware.RequireRole("ADMIN"))          // AND must be admin
{
    admin.DELETE("/users/:id", userHandler.Delete)
}

package middleware

import (
    "strings"
    "github.com/gin-gonic/gin"
)

// CORS returns middleware that allows cross-origin requests.
func CORS(allowedOrigins string) gin.HandlerFunc {
    origins := strings.Split(allowedOrigins, ",")

    return func(c *gin.Context) {
        origin := c.GetHeader("Origin")

        // Check if the request origin is allowed
        for _, allowed := range origins {
            if strings.TrimSpace(allowed) == origin {
                c.Header("Access-Control-Allow-Origin", origin)
                c.Header("Access-Control-Allow-Methods", "GET, POST, PUT, DELETE, OPTIONS")
                c.Header("Access-Control-Allow-Headers", "Content-Type, Authorization")
                c.Header("Access-Control-Allow-Credentials", "true")
                break
            }
        }

        // Handle preflight requests
        if c.Request.Method == "OPTIONS" {
            c.AbortWithStatus(204)
            return
        }

        c.Next()
    }
}

# Comma-separated list of allowed frontend origins
CORS_ORIGINS=http://localhost:3000,http://localhost:3001

package handlers

import (
    "net/http"

    "github.com/gin-gonic/gin"
    "gorm.io/gorm"

    "myapp/apps/api/internal/models"
    "myapp/apps/api/internal/services"
)

// Handler struct holds dependencies
type AuthHandler struct {
    DB          *gorm.DB
    AuthService *services.AuthService
}

// Request struct — what the client sends
type loginRequest struct {
    Email    string `json:"email" binding:"required,email"`
    Password string `json:"password" binding:"required"`
}

// Login authenticates a user and returns JWT tokens.
func (h *AuthHandler) Login(c *gin.Context) {
    // 1. Parse & validate
    var req loginRequest
    if err := c.ShouldBindJSON(&req); err != nil {
        c.JSON(http.StatusUnprocessableEntity, gin.H{
            "error": gin.H{
                "code":    "VALIDATION_ERROR",
                "message": err.Error(),
            },
        })
        return
    }

    // 2. Find user in database
    var user models.User
    if err := h.DB.Where("email = ?", req.Email).First(&user).Error; err != nil {
        c.JSON(http.StatusUnauthorized, gin.H{
            "error": gin.H{
                "code":    "INVALID_CREDENTIALS",
                "message": "Invalid email or password",
            },
        })
        return
    }

    // 3. Check password (delegate to model method)
    if !user.CheckPassword(req.Password) {
        c.JSON(http.StatusUnauthorized, gin.H{
            "error": gin.H{
                "code":    "INVALID_CREDENTIALS",
                "message": "Invalid email or password",
            },
        })
        return
    }

    // 4. Generate tokens (delegate to auth service)
    tokens, err := h.AuthService.GenerateTokenPair(user.ID, user.Email, user.Role)
    if err != nil {
        c.JSON(http.StatusInternalServerError, gin.H{
            "error": gin.H{
                "code":    "TOKEN_ERROR",
                "message": "Failed to generate tokens",
            },
        })
        return
    }

    // 5. Respond
    c.JSON(http.StatusOK, gin.H{
        "data": gin.H{
            "user":   user,
            "tokens": tokens,
        },
        "message": "Logged in successfully",
    })
}