# 1. Buat database
mysql -h 127.0.0.1 -P 3306 -u root -e "CREATE DATABASE IF NOT EXISTS belajar_fiber CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;"

# 2. Siapkan env
cp .env.example .env
# ganti SESSION_KEY dengan hasil: openssl rand -base64 32

# 3. Install dependency
go mod tidy

# 4. Jalankan
go run .

mkdir belajar-fiber
cd belajar-fiber
go mod init belajar-fiber

module belajar-fiber

go 1.26.3

go get github.com/gofiber/fiber/v2@latest
go get github.com/joho/godotenv@latest
go get golang.org/x/crypto@latest
go get gorm.io/gorm@latest
go get gorm.io/driver/mysql@latest

module belajar-fiber

go 1.26.3

require (
	github.com/gofiber/fiber/v2 v2.52.14
	github.com/joho/godotenv v1.5.1
	golang.org/x/crypto v0.14.0
	gorm.io/driver/mysql v1.6.0
	gorm.io/gorm v1.31.2
)

go mod tidy

mkdir config controllers models middlewares helpers views routes
mkdir -p views/layouts views/auth

mysql -h 127.0.0.1 -P 3306 -u root -e "CREATE DATABASE IF NOT EXISTS belajar_fiber CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;"

cp .env.example .env
openssl rand -base64 32   # tempel hasilnya ke SESSION_KEY

APP_NAME=BelajarFiber
APP_PORT=3000
SESSION_KEY=ganti-dengan-kunci-rahasia-acak-panjang

DB_HOST=127.0.0.1
DB_PORT=3306
DB_USER=root
DB_PASSWORD=
DB_NAME=belajar_fiber

go build ./...        # compile semua package, cek error
go vet ./...          # static check (analog php artisan about --bugfix? lebih ke lint)
go run .              # analog php artisan serve

func Register(app *fiber.App) {
	app.Use(middlewares.MethodOverride)
	app.Use(middlewares.CSRF)

	app.Get("/", controllers.Home)
	app.Get("/login", controllers.ShowLogin)
	app.Post("/login", controllers.Login)
	app.Get("/register", controllers.ShowRegister)
	app.Post("/register", controllers.Register)

	auth := app.Group("", middlewares.Auth)
	auth.Post("/logout", controllers.Logout)
	auth.Get("/dashboard", controllers.Dashboard)

	auth.Get("/users", controllers.UserIndex)
	auth.Get("/users/create", controllers.UserCreate)
	auth.Post("/users", controllers.UserStore)
	auth.Get("/users/:id/edit", controllers.UserEdit)
	auth.Put("/users/:id", controllers.UserUpdate)
	auth.Delete("/users/:id", controllers.UserDelete)

	auth.Get("/categories", controllers.CategoryIndex)
	auth.Get("/categories/create", controllers.CategoryCreate)
	auth.Post("/categories", controllers.CategoryStore)
	auth.Get("/categories/:id/edit", controllers.CategoryEdit)
	auth.Put("/categories/:id", controllers.CategoryUpdate)
	auth.Delete("/categories/:id", controllers.CategoryDelete)

	auth.Get("/posts", controllers.PostIndex)
	auth.Get("/posts/create", controllers.PostCreate)
	auth.Post("/posts", controllers.PostStore)
	auth.Get("/posts/:id", controllers.PostShow)
	auth.Get("/posts/:id/edit", controllers.PostEdit)
	auth.Put("/posts/:id", controllers.PostUpdate)
	auth.Delete("/posts/:id", controllers.PostDelete)
}

Route::middleware('auth')->group(function () {
    Route::get('/dashboard', [DashboardController::class, 'index']);
});

auth := app.Group("", middlewares.Auth)
auth.Get("/dashboard", controllers.Dashboard)

func MethodOverride(c *fiber.Ctx) error {
	if c.Method() != fiber.MethodPost {
		return c.Next()
	}
	method := c.FormValue("_method")
	switch method {
	case fiber.MethodPut, fiber.MethodDelete, fiber.MethodPatch:
		c.Method(method)
	}
	return c.Next()
}

<form method="post" action="/users/1">
  <input type="hidden" name="_method" value="PUT">
  ...
</form>

func CategoryStore(c *fiber.Ctx) error {
	name := c.FormValue("name")
	sess, err := helpers.GetSession(c)
	if err != nil {
		return err
	}
	if name == "" {
		helpers.SetFlash(sess, "error", "Nama kategori wajib diisi.")
		return c.Redirect("/categories/create")
	}
	slug := helpers.Slugify(name)
	if slug == "" {
		helpers.SetFlash(sess, "error", "Nama kategori tidak valid.")
		return c.Redirect("/categories/create")
	}
	var count int64
	config.DB.Model(&models.Category{}).Where("slug = ?", slug).Count(&count)
	if count > 0 {
		helpers.SetFlash(sess, "error", "Kategori dengan nama serupa sudah ada.")
		return c.Redirect("/categories/create")
	}

	category := models.Category{Name: name, Slug: slug}
	if err := config.DB.Create(&category).Error; err != nil {
		helpers.SetFlash(sess, "error", "Gagal menyimpan kategori: "+err.Error())
		return c.Redirect("/categories/create")
	}

	helpers.SetFlash(sess, "success", "Kategori berhasil dibuat.")
	return c.Redirect("/categories")
}

if name == "" { ... }
if !emailPattern.MatchString(email) { ... }
if len(password) < 6 { ... }

$name = $request->input('name');

name := c.FormValue("name")

public function edit(string $id) {
    $user = User::findOrFail($id);
}

id, err := strconv.ParseUint(c.Params("id"), 10, 64)
if err != nil {
    return c.Redirect("/users")
}
var user models.User
if err := config.DB.First(&user, id).Error; err != nil { ... }

return redirect()->back()->with('error', 'Kredensial tidak cocok.');

helpers.SetFlash(sess, "error", "Kredensial tidak cocok.")
return c.Redirect("/login")

return view('categories.create', compact('categories'));

return helpers.Render(c, "app", "views/categories/create.html", fiber.Map{
    "Title":      "Tambah Kategori",
    "Categories": categories,
})

type Category struct {
	ID        uint      `gorm:"primaryKey"`
	Name      string    `gorm:"size:100;not null"`
	Slug      string    `gorm:"size:120;uniqueIndex;not null"`
	Posts     []Post    `gorm:"foreignKey:CategoryID"`
	CreatedAt time.Time
	UpdatedAt time.Time
}

type Post struct {
	ID         uint      `gorm:"primaryKey"`
	Title      string    `gorm:"size:200;not null"`
	Slug       string    `gorm:"size:220;uniqueIndex;not null"`
	Content    string    `gorm:"type:text;not null"`
	UserID     uint      `gorm:"not null;index"`
	User       User      `gorm:"foreignKey:UserID"`
	CategoryID uint      `gorm:"not null;index"`
	Category   Category  `gorm:"foreignKey:CategoryID"`
	CreatedAt  time.Time
	UpdatedAt  time.Time
}

func InitDB() error {
	dsn := fmt.Sprintf("%s:%s@tcp(%s:%s)/%s?charset=utf8mb4&parseTime=True&loc=Local",
		App.DBUser, App.DBPassword, App.DBHost, App.DBPort, App.DBName)
	db, err := gorm.Open(mysql.Open(dsn), &gorm.Config{})
	if err != nil {
		return err
	}
	DB = db
	return DB.AutoMigrate(&models.User{}, &models.Category{}, &models.Post{})
}

$user = User::create([
    'name'  => $request->name,
    'email' => $request->email,
    'password' => Hash::make($request->password),
]);

hash, err := bcrypt.GenerateFromPassword([]byte(password), bcrypt.DefaultCost)
if err != nil { ... }
user := models.User{Name: name, Email: email, Password: string(hash)}
if err := config.DB.Create(&user).Error; err != nil { ... }

$posts = Post::with('user', 'category')->orderBy('created_at', 'desc')->get();
$user  = User::find($id);

var posts []models.Post
config.DB.Preload("User").Preload("Category").Order("created_at desc").Find(&posts)

var user models.User
config.DB.First(&user, id)

$user->name = $request->name;
$user->save();

user.Name = name
user.Email = email
config.DB.Save(&user)

$user->delete();

config.DB.Delete(&models.User{}, id)

$exists = User::where('email', $email)->exists();

var count int64
config.DB.Model(&models.User{}).Where("email = ?", email).Count(&count)
if count > 0 { ... }

func Auth(c *fiber.Ctx) error {
	sess, err := helpers.GetSession(c)
	if err != nil {
		return err
	}
	uid, ok := sess.Get("user_id").(uint)
	if !ok {
		helpers.SetFlash(sess, "error", "Silakan login terlebih dahulu.")
		return c.Redirect("/login")
	}
	var user models.User
	if err := config.DB.First(&user, uid).Error; err != nil {
		sess.Delete("user_id")
		_ = sess.Save()
		helpers.SetFlash(sess, "error", "Sesi tidak valid, silakan login ulang.")
		return c.Redirect("/login")
	}
	c.Locals("authUser", &user)
	c.Locals("userID", uid)
	return c.Next()
}

c.Locals("authUser", &user)

user := c.Locals("authUser").(*models.User)

data["AuthUser"] = c.Locals("authUser")

<span class="navbar-text text-white">{{.AuthUser.Name}}</span>

Route::middleware('auth')->group(function () {
    Route::get('/dashboard', ...);
});

auth := app.Group("", middlewares.Auth)
auth.Get("/dashboard", controllers.Dashboard)

app.Use(middlewares.MethodOverride)   // GLOBAL — semua request
app.Use(middlewares.CSRF)             // GLOBAL — semua request

auth := app.Group("", middlewares.Auth)  // HANYA route di group ini

<!DOCTYPE html>
<html>
<head><title>@yield('title')</title></head>
<body>
  <nav>...</nav>
  @yield('content')
</body>
</html>

@extends('layouts.app')
@section('content')
  <h1>Daftar User</h1>
@endsection

{{define "app"}}
<!DOCTYPE html>
<html lang="id">
<head>
  <title>{{if .Title}}{{.Title}} — {{end}}{{.AppName}}</title>
</head>
<body>
  <nav>...</nav>
  {{template "content" .}}
</body>
</html>
{{end}}

{{define "content"}}
<h1>Daftar User</h1>
{{end}}

func Render(c *fiber.Ctx, layout, viewPath string, data fiber.Map) error {
	t, err := template.New(viewPath).Funcs(funcMap).ParseFiles(layouts[layout], viewPath)
	...
	return t.ExecuteTemplate(c, layout, data)
}

helpers.Render(c, "app", "views/users/index.html", data)   // pakai layout app (navbar)
helpers.Render(c, "auth", "views/auth/login.html", data)   // pakai layout auth (tanpa navbar)

@foreach($users as $user)
  <tr><td>{{ $user->name }}</td></tr>
@endforeach

{{range .Users}}
  <tr><td>{{.Name}}</td></tr>
{{end}}

@if($flash)
  <div class="alert">{{ $flash }}</div>
@endif

{{if .Flash}}
  <div class="alert">{{.Flash.Message}}</div>
{{end}}

{{ $post->user->name }}
{{ $post->category->name }}

{{.Post.User.Name}}
{{.Post.Category.Name}}

{{range .Users}}
  <form action="/users/{{.ID}}">
    <input type="hidden" name="_token" value="{{$.CSRFToken}}">
  </form>
{{end}}

var funcMap = template.FuncMap{
	"formatDate": func(t time.Time) string {
		return t.Format("02 Jan 2006 15:04")
	},
	"truncate": func(s string, n int) string {
		r := []rune(s)
		if len(r) <= n {
			return s
		}
		return string(r[:n]) + "..."
	},
	"alertClass": func(flashType string) string {
		switch flashType {
		case "error":
			return "danger"
		case "success":
			return "success"
		default:
			return "primary"
		}
	},
}

{{formatDate .Post.CreatedAt}}          {{/* 10 Aug 2026 14:05 */}}
<div class="alert alert-{{alertClass .Flash.Type}}">{{.Flash.Message}}</div>

return view('users.index', ['users' => $users]);

return helpers.Render(c, "app", "views/users/index.html", fiber.Map{
	"Title": "Daftar User",
	"Users": users,
})

data["CSRFToken"] = GetCSRFToken(sess)
data["AuthUser"]  = c.Locals("authUser")
data["Flash"]     = GetFlash(sess)
data["AppName"]   = config.App.AppName

type Post struct {
	ID         uint      `gorm:"primaryKey"`
	Title      string    `gorm:"size:200;not null"`
	Slug       string    `gorm:"size:220;uniqueIndex;not null"`
	Content    string    `gorm:"type:text;not null"`
	UserID     uint      `gorm:"not null;index"`
	User       User      `gorm:"foreignKey:UserID"`
	CategoryID uint      `gorm:"not null;index"`
	Category   Category  `gorm:"foreignKey:CategoryID"`
	CreatedAt  time.Time
	UpdatedAt  time.Time
}

class Post extends Model {
    public function user() { return $this->belongsTo(User::class); }
    public function category() { return $this->belongsTo(Category::class); }
}

type User struct {
	...
	Posts []Post `gorm:"foreignKey:UserID"`
	...
}

class User extends Model {
    public function posts() { return $this->hasMany(Post::class); }
}

$posts = Post::with('user', 'category')->get();

var posts []models.Post
config.DB.Preload("User").Preload("Category").Order("created_at desc").Find(&posts)

var recentPosts []models.Post
config.DB.Preload("User").Preload("Category").Order("created_at desc").Limit(5).Find(&recentPosts)

<td>{{ $post->user->name }}</td>
<td>{{ $post->category->name }}</td>

<td>{{.Post.User.Name}}</td>
<td>{{.Post.Category.Name}}</td>

{{range .Posts}}
<tr>
  <td>{{.ID}}</td>
  <td><a href="/posts/{{.ID}}">{{.Title}}</a></td>
  <td>{{.Category.Name}}</td>
  <td>{{.User.Name}}</td>
  ...
</tr>
{{end}}

SHOW CREATE TABLE posts;

CONSTRAINT `fk_users_posts` FOREIGN KEY (`user_id`) REFERENCES `users` (`id`),
CONSTRAINT `fk_categories_posts` FOREIGN KEY (`category_id`) REFERENCES `categories` (`id`)

// controllers/category_controller.go
var postCount int64
config.DB.Model(&models.Post{}).Where("category_id = ?", id).Count(&postCount)
if postCount > 0 {
	helpers.SetFlash(sess, "error", "Kategori masih dipakai post, hapus post-nya dulu.")
	return c.Redirect("/categories")
}

<form method="POST">
    @csrf
    <input name="title">
</form>

<form method="post" action="/posts">
  <input type="hidden" name="_token" value="{{.CSRFToken}}">
  ...
</form>

data["CSRFToken"] = GetCSRFToken(sess)

func CSRF(c *fiber.Ctx) error {
	if c.Method() == fiber.MethodGet ||
		c.Method() == fiber.MethodHead ||
		c.Method() == fiber.MethodOptions {
		return c.Next()
	}

	sess, err := helpers.GetSession(c)
	if err != nil {
		return err
	}
	token := c.FormValue("_token")
	if token == "" {
		token = c.Get("X-CSRF-TOKEN")
	}
	if !helpers.ValidateCSRF(sess, token) {
		c.Status(419)
		t, err := template.ParseFiles("views/errors/419.html")
		if err != nil {
			return err
		}
		return t.Execute(c, nil)
	}
	helpers.RegenerateCSRF(sess)
	return c.Next()
}

app.Use(middlewares.CSRF)

func GetCSRFToken(sess *session.Session) string {
	if tok, ok := sess.Get(csrfSessionKey).(string); ok && tok != "" {
		return tok
	}
	return GenerateCSRFToken(sess)
}

func GenerateCSRFToken(sess *session.Session) string {
	b := make([]byte, 32)
	_, _ = rand.Read(b)
	tok := hex.EncodeToString(b)
	sess.Set(csrfSessionKey, tok)
	_ = sess.Save()
	return tok
}

func ValidateCSRF(sess *session.Session, token string) bool {
	stored := GetCSRFToken(sess)
	if stored == "" || token == "" {
		return false
	}
	return subtle.ConstantTimeCompare([]byte(stored), []byte(token)) == 1
}

func Login(c *fiber.Ctx) error {
	...
	if bcrypt.CompareHashAndPassword([]byte(user.Password), []byte(password)) != nil {
		helpers.SetFlash(sess, "error", "Kredensial tidak cocok.")
		return c.Redirect("/login")
	}

	helpers.RegenerateCSRF(sess)   // <-- token baru setelah sukses login
	sess.Set("user_id", user.ID)
	_ = sess.Save()
	...
}

func InitSessionStore() {
	Store = session.New(session.Config{
		KeyLookup:  "cookie:belajar_fiber_session",
		Expiration: 24 * time.Hour,
	})
}

<h1 class="display-1 fw-bold text-muted">419</h1>
<h2 class="h4">Page Expired</h2>
<p class="text-muted">Token CSRF tidak valid atau sesi kedaluwarsa. Silakan kembali dan coba lagi.</p>

<form method="post" action="/posts/5">
  <input type="hidden" name="_method" value="PUT">
  <input type="hidden" name="_token" value="{{.CSRFToken}}">

auth.Get   ("/posts",          controllers.PostIndex)   // GET    → index
auth.Get   ("/posts/create",   controllers.PostCreate)  // GET    → create
auth.Post  ("/posts",          controllers.PostStore)   // POST   → store
auth.Get   ("/posts/:id",      controllers.PostShow)    // GET    → show
auth.Get   ("/posts/:id/edit", controllers.PostEdit)    // GET    → edit
auth.Put   ("/posts/:id",      controllers.PostUpdate)  // PUT    → update
auth.Delete("/posts/:id",      controllers.PostDelete)  // DELETE → destroy

APP_NAME=BelajarFiber
APP_PORT=3000
SESSION_KEY=ganti-dengan-kunci-rahasia-acak-panjang

DB_HOST=127.0.0.1
DB_PORT=3306
DB_USER=root
DB_PASSWORD=
DB_NAME=belajar_fiber

cp .env.example .env
openssl rand -base64 32

package config

import (
	"os"

	"github.com/joho/godotenv"
)

type Config struct {
	AppName    string
	AppPort    string
	SessionKey string
	DBHost     string
	DBPort     string
	DBUser     string
	DBPassword string
	DBName     string
}

var App *Config

func Load() error {
	_ = godotenv.Load()
	App = &Config{
		AppName:    getEnv("APP_NAME", "BelajarFiber"),
		AppPort:    getEnv("APP_PORT", "3000"),
		SessionKey: getEnv("SESSION_KEY", ""),
		DBHost:     getEnv("DB_HOST", "127.0.0.1"),
		DBPort:     getEnv("DB_PORT", "3306"),
		DBUser:     getEnv("DB_USER", "root"),
		DBPassword: getEnv("DB_PASSWORD", ""),
		DBName:     getEnv("DB_NAME", "belajar_fiber"),
	}
	return nil
}

func getEnv(key, fallback string) string {
	if v := os.Getenv(key); v != "" {
		return v
	}
	return fallback
}

package config

import (
	"fmt"

	"gorm.io/driver/mysql"
	"gorm.io/gorm"

	"belajar-fiber/models"
)

var DB *gorm.DB

func InitDB() error {
	dsn := fmt.Sprintf("%s:%s@tcp(%s:%s)/%s?charset=utf8mb4&parseTime=True&loc=Local",
		App.DBUser, App.DBPassword, App.DBHost, App.DBPort, App.DBName)
	db, err := gorm.Open(mysql.Open(dsn), &gorm.Config{})
	if err != nil {
		return err
	}
	DB = db
	return DB.AutoMigrate(&models.User{}, &models.Category{}, &models.Post{})
}

package config

import (
	"time"

	"github.com/gofiber/fiber/v2/middleware/session"
)

var Store *session.Store

func InitSessionStore() {
	Store = session.New(session.Config{
		KeyLookup:  "cookie:belajar_fiber_session",
		Expiration: 24 * time.Hour,
	})
}

package main

import (
	"log"

	"github.com/gofiber/fiber/v2"

	"belajar-fiber/config"
	"belajar-fiber/routes"
)

func main() {
	if err := config.Load(); err != nil {
		log.Fatal("gagal memuat konfigurasi:", err)
	}
	config.InitSessionStore()
	if err := config.InitDB(); err != nil {
		log.Fatal("gagal koneksi database:", err)
	}

	app := fiber.New(fiber.Config{
		AppName: config.App.AppName,
	})
	routes.Register(app)

	log.Fatal(app.Listen(":" + config.App.AppPort))
}

package routes

import "github.com/gofiber/fiber/v2"

func Register(app *fiber.App) {
	app.Get("/", func(c *fiber.Ctx) error {
		return c.SendString("Fiber jalan")
	})
}

go mod tidy
go build ./...
go run .

mysql -h 127.0.0.1 -P 3306 -u root -e "SHOW DATABASES LIKE 'belajar_fiber';"

package models

import "time"

type User struct {
	ID        uint      `gorm:"primaryKey"`
	Name      string    `gorm:"size:100;not null"`
	Email     string    `gorm:"size:150;uniqueIndex;not null"`
	Password  string    `gorm:"not null"`
	Posts     []Post    `gorm:"foreignKey:UserID"`
	CreatedAt time.Time
	UpdatedAt time.Time
}

package models

import "time"

type Category struct {
	ID        uint      `gorm:"primaryKey"`
	Name      string    `gorm:"size:100;not null"`
	Slug      string    `gorm:"size:120;uniqueIndex;not null"`
	Posts     []Post    `gorm:"foreignKey:CategoryID"`
	CreatedAt time.Time
	UpdatedAt time.Time
}

package models

import "time"

type Post struct {
	ID         uint      `gorm:"primaryKey"`
	Title      string    `gorm:"size:200;not null"`
	Slug       string    `gorm:"size:220;uniqueIndex;not null"`
	Content    string    `gorm:"type:text;not null"`
	UserID     uint      `gorm:"not null;index"`
	User       User      `gorm:"foreignKey:UserID"`
	CategoryID uint      `gorm:"not null;index"`
	Category   Category  `gorm:"foreignKey:CategoryID"`
	CreatedAt  time.Time
	UpdatedAt  time.Time
}

return DB.AutoMigrate(&models.User{}, &models.Category{}, &models.Post{})

go build ./...
go run .

mysql -h 127.0.0.1 -P 3306 -u root belajar_fiber -e "SHOW TABLES; DESCRIBE posts;"

SHOW CREATE TABLE posts;

package helpers

import (
	"github.com/gofiber/fiber/v2"
	"github.com/gofiber/fiber/v2/middleware/session"

	"belajar-fiber/config"
)

func GetSession(c *fiber.Ctx) (*session.Session, error) {
	return config.Store.Get(c)
}

func SaveSession(sess *session.Session) {
	_ = sess.Save()
}

package helpers

import "github.com/gofiber/fiber/v2/middleware/session"

type Flash struct {
	Type    string
	Message string
}

func SetFlash(sess *session.Session, flashType, message string) {
	sess.Set("flash_type", flashType)
	sess.Set("flash_message", message)
}

func GetFlash(sess *session.Session) *Flash {
	flashType, _ := sess.Get("flash_type").(string)
	message, _ := sess.Get("flash_message").(string)
	if flashType == "" && message == "" {
		return nil
	}
	sess.Delete("flash_type")
	sess.Delete("flash_message")
	return &Flash{Type: flashType, Message: message}
}

package helpers

import (
	"crypto/rand"
	"crypto/subtle"
	"encoding/hex"

	"github.com/gofiber/fiber/v2/middleware/session"
)

const csrfSessionKey = "csrf_token"

func GetCSRFToken(sess *session.Session) string {
	if tok, ok := sess.Get(csrfSessionKey).(string); ok && tok != "" {
		return tok
	}
	return GenerateCSRFToken(sess)
}

func GenerateCSRFToken(sess *session.Session) string {
	b := make([]byte, 32)
	_, _ = rand.Read(b)
	tok := hex.EncodeToString(b)
	sess.Set(csrfSessionKey, tok)
	return tok
}

func ValidateCSRF(sess *session.Session, token string) bool {
	stored := GetCSRFToken(sess)
	if stored == "" || token == "" {
		return false
	}
	return subtle.ConstantTimeCompare([]byte(stored), []byte(token)) == 1
}

func RegenerateCSRF(sess *session.Session) {
	sess.Delete(csrfSessionKey)
	GenerateCSRFToken(sess)
}

package helpers

import (
	"regexp"
	"strings"
)

var nonSlugChars = regexp.MustCompile(`[^a-z0-9]+`)

func Slugify(s string) string {
	s = strings.ToLower(s)
	s = nonSlugChars.ReplaceAllString(s, "-")
	return strings.Trim(s, "-")
}

package helpers

import (
	"html/template"
	"time"

	"github.com/gofiber/fiber/v2"

	"belajar-fiber/config"
)

var funcMap = template.FuncMap{
	"formatDate": func(t time.Time) string {
		return t.Format("02 Jan 2006 15:04")
	},
	"truncate": func(s string, n int) string {
		r := []rune(s)
		if len(r) <= n {
			return s
		}
		return string(r[:n]) + "..."
	},
	"alertClass": func(flashType string) string {
		switch flashType {
		case "error":
			return "danger"
		case "success":
			return "success"
		case "warning":
			return "warning"
		case "info":
			return "info"
		default:
			return "primary"
		}
	},
}

var layouts = map[string]string{
	"app":  "views/layouts/app.html",
	"auth": "views/layouts/auth.html",
}

func Render(c *fiber.Ctx, layout, viewPath string, data fiber.Map) error {
	sess, err := GetSession(c)
	if err != nil {
		return err
	}
	if data == nil {
		data = fiber.Map{}
	}
	data["CSRFToken"] = GetCSRFToken(sess)
	data["AuthUser"] = c.Locals("authUser")
	data["Flash"] = GetFlash(sess)
	data["AppName"] = config.App.AppName

	SaveSession(sess)

	t, err := template.New(viewPath).Funcs(funcMap).ParseFiles(layouts[layout], viewPath)
	if err != nil {
		return err
	}
	c.Set(fiber.HeaderContentType, fiber.MIMETextHTMLCharsetUTF8)
	return t.ExecuteTemplate(c, layout, data)
}

go build ./...

{{define "app"}}
<!DOCTYPE html>
<html lang="id">
<head>
  <meta charset="UTF-8">
  <meta name="viewport" content="width=device-width, initial-scale=1">
  <title>{{if .Title}}{{.Title}} — {{end}}{{.AppName}}</title>
  <link href="https://cdn.jsdelivr.net/npm/bootstrap@5.3.3/dist/css/bootstrap.min.css" rel="stylesheet">
</head>
<body class="bg-light">
  <nav class="navbar navbar-expand-lg navbar-dark bg-primary mb-4">
    <div class="container">
      <a class="navbar-brand fw-bold" href="/dashboard">{{.AppName}}</a>
      <button class="navbar-toggler" type="button" data-bs-toggle="collapse" data-bs-target="#nav" aria-controls="nav" aria-expanded="false" aria-label="Toggle navigation">
        <span class="navbar-toggler-icon"></span>
      </button>
      <div class="collapse navbar-collapse" id="nav">
        <ul class="navbar-nav me-auto">
          <li class="nav-item"><a class="nav-link" href="/dashboard">Dashboard</a></li>
          <li class="nav-item"><a class="nav-link" href="/users">Users</a></li>
          <li class="nav-item"><a class="nav-link" href="/categories">Categories</a></li>
          <li class="nav-item"><a class="nav-link" href="/posts">Posts</a></li>
        </ul>
        <div class="d-flex align-items-center gap-3">
          <span class="navbar-text text-white">{{.AuthUser.Name}}</span>
          <form method="post" action="/logout">
            <input type="hidden" name="_token" value="{{.CSRFToken}}">
            <button type="submit" class="btn btn-outline-light btn-sm">Logout</button>
          </form>
        </div>
      </div>
    </div>
  </nav>
  <main class="container">
    {{if .Flash}}
    <div class="alert alert-{{alertClass .Flash.Type}} alert-dismissible fade show" role="alert">
      {{.Flash.Message}}
      <button type="button" class="btn-close" data-bs-dismiss="alert" aria-label="Close"></button>
    </div>
    {{end}}
    {{template "content" .}}
  </main>
  <script src="https://cdn.jsdelivr.net/npm/bootstrap@5.3.3/dist/js/bootstrap.bundle.min.js"></script>
</body>
</html>
{{end}}

{{define "auth"}}
<!DOCTYPE html>
<html lang="id">
<head>
  <meta charset="UTF-8">
  <meta name="viewport" content="width=device-width, initial-scale=1">
  <title>{{.Title}} — {{.AppName}}</title>
  <link href="https://cdn.jsdelivr.net/npm/bootstrap@5.3.3/dist/css/bootstrap.min.css" rel="stylesheet">
</head>
<body class="bg-light">
  <main class="container py-5">
    <div class="row justify-content-center">
      <div class="col-md-6 col-lg-5">
        <div class="text-center mb-4">
          <h1 class="fw-bold">{{.AppName}}</h1>
          <p class="text-muted mb-0">Blog MVC ala Laravel</p>
        </div>
        {{if .Flash}}
        <div class="alert alert-{{alertClass .Flash.Type}} alert-dismissible fade show" role="alert">
          {{.Flash.Message}}
          <button type="button" class="btn-close" data-bs-dismiss="alert" aria-label="Close"></button>
        </div>
        {{end}}
        <div class="card shadow-sm">
          <div class="card-body">
            {{template "content" .}}
          </div>
        </div>
      </div>
    </div>
  </main>
</body>
</html>
{{end}}

{{define "content"}}
<h2 class="h5 mb-4">Login</h2>
<form method="post" action="/login">
  <input type="hidden" name="_token" value="{{.CSRFToken}}">
  <div class="mb-3">
    <label for="email" class="form-label">Email</label>
    <input type="email" name="email" id="email" class="form-control" required autofocus>
  </div>
  <div class="mb-3">
    <label for="password" class="form-label">Password</label>
    <input type="password" name="password" id="password" class="form-control" required>
  </div>
  <button type="submit" class="btn btn-primary w-100">Login</button>
</form>
<p class="mt-3 mb-0 text-center">Belum punya akun? <a href="/register">Daftar sekarang</a></p>
{{end}}

{{define "content"}}
<h2 class="h5 mb-4">Registrasi</h2>
<form method="post" action="/register">
  <input type="hidden" name="_token" value="{{.CSRFToken}}">
  <div class="mb-3">
    <label for="name" class="form-label">Nama Lengkap</label>
    <input type="text" name="name" id="name" class="form-control" required autofocus>
  </div>
  <div class="mb-3">
    <label for="email" class="form-label">Email</label>
    <input type="email" name="email" id="email" class="form-control" required>
  </div>
  <div class="mb-3">
    <label for="password" class="form-label">Password</label>
    <input type="password" name="password" id="password" class="form-control" required>
  </div>
  <div class="mb-3">
    <label for="password_confirmation" class="form-label">Konfirmasi Password</label>
    <input type="password" name="password_confirmation" id="password_confirmation" class="form-control" required>
  </div>
  <button type="submit" class="btn btn-primary w-100">Daftar</button>
</form>
<p class="mt-3 mb-0 text-center">Sudah punya akun? <a href="/login">Login</a></p>
{{end}}

<!DOCTYPE html>
<html lang="id">
<head>
  <meta charset="UTF-8">
  <meta name="viewport" content="width=device-width, initial-scale=1">
  <title>419 Page Expired</title>
  <link href="https://cdn.jsdelivr.net/npm/bootstrap@5.3.3/dist/css/bootstrap.min.css" rel="stylesheet">
</head>
<body class="bg-light d-flex align-items-center" style="min-height:100vh;">
  <div class="container text-center">
    <h1 class="display-1 fw-bold text-muted">419</h1>
    <h2 class="h4">Page Expired</h2>
    <p class="text-muted">Token CSRF tidak valid atau sesi kedaluwarsa. Silakan kembali dan coba lagi.</p>
    <a href="/" class="btn btn-primary">Kembali ke Beranda</a>
  </div>
</body>
</html>

go build ./...

package middlewares

import "github.com/gofiber/fiber/v2"

func MethodOverride(c *fiber.Ctx) error {
	if c.Method() != fiber.MethodPost {
		return c.Next()
	}
	method := c.FormValue("_method")
	switch method {
	case fiber.MethodPut, fiber.MethodDelete, fiber.MethodPatch:
		c.Method(method)
	}
	return c.Next()
}

package middlewares

import (
	"html/template"

	"github.com/gofiber/fiber/v2"

	"belajar-fiber/helpers"
)

func CSRF(c *fiber.Ctx) error {
	if c.Method() == fiber.MethodGet ||
		c.Method() == fiber.MethodHead ||
		c.Method() == fiber.MethodOptions {
		return c.Next()
	}

	sess, err := helpers.GetSession(c)
	if err != nil {
		return err
	}
	token := c.FormValue("_token")
	if token == "" {
		token = c.Get("X-CSRF-TOKEN")
	}
	if !helpers.ValidateCSRF(sess, token) {
		c.Status(419)
		t, err := template.ParseFiles("views/errors/419.html")
		if err != nil {
			return err
		}
		return t.Execute(c, nil)
	}
	helpers.RegenerateCSRF(sess)
	helpers.SaveSession(sess)
	return c.Next()
}

package middlewares

import (
	"github.com/gofiber/fiber/v2"

	"belajar-fiber/config"
	"belajar-fiber/helpers"
	"belajar-fiber/models"
)

func Auth(c *fiber.Ctx) error {
	sess, err := helpers.GetSession(c)
	if err != nil {
		return err
	}
	uid, ok := sess.Get("user_id").(uint)
	if !ok {
		helpers.SetFlash(sess, "error", "Silakan login terlebih dahulu.")
		helpers.SaveSession(sess)
		return c.Redirect("/login")
	}
	var user models.User
	if err := config.DB.First(&user, uid).Error; err != nil {
		sess.Delete("user_id")
		helpers.SetFlash(sess, "error", "Sesi tidak valid, silakan login ulang.")
		helpers.SaveSession(sess)
		return c.Redirect("/login")
	}
	c.Locals("authUser", &user)
	c.Locals("userID", uid)
	return c.Next()
}

go build ./...

package controllers

import (
	"regexp"

	"github.com/gofiber/fiber/v2"
	"golang.org/x/crypto/bcrypt"

	"belajar-fiber/config"
	"belajar-fiber/helpers"
	"belajar-fiber/models"
)

var emailPattern = regexp.MustCompile(`^[^@\s]+@[^@\s]+\.[^@\s]+$`)

func Home(c *fiber.Ctx) error {
	return c.Redirect("/dashboard")
}

func ShowLogin(c *fiber.Ctx) error {
	return helpers.Render(c, "auth", "views/auth/login.html", fiber.Map{"Title": "Login"})
}

func Login(c *fiber.Ctx) error {
	email := c.FormValue("email")
	password := c.FormValue("password")

	sess, err := helpers.GetSession(c)
	if err != nil {
		return err
	}
	if email == "" || password == "" {
		helpers.SetFlash(sess, "error", "Email dan password wajib diisi.")
		helpers.SaveSession(sess)
		return c.Redirect("/login")
	}

	var user models.User
	if err := config.DB.Where("email = ?", email).First(&user).Error; err != nil {
		helpers.SetFlash(sess, "error", "Kredensial tidak cocok.")
		helpers.SaveSession(sess)
		return c.Redirect("/login")
	}
	if bcrypt.CompareHashAndPassword([]byte(user.Password), []byte(password)) != nil {
		helpers.SetFlash(sess, "error", "Kredensial tidak cocok.")
		helpers.SaveSession(sess)
		return c.Redirect("/login")
	}

	helpers.RegenerateCSRF(sess)
	sess.Set("user_id", user.ID)
	helpers.SetFlash(sess, "success", "Berhasil login. Selamat datang, "+user.Name+"!")
	helpers.SaveSession(sess)
	return c.Redirect("/dashboard")
}
func ShowRegister(c *fiber.Ctx) error {
	return helpers.Render(c, "auth", "views/auth/register.html", fiber.Map{"Title": "Registrasi"})
}

func Register(c *fiber.Ctx) error {
	name := c.FormValue("name")
	email := c.FormValue("email")
	password := c.FormValue("password")
	confirm := c.FormValue("password_confirmation")

	sess, err := helpers.GetSession(c)
	if err != nil {
		return err
	}
	if name == "" || email == "" || password == "" {
		helpers.SetFlash(sess, "error", "Semua field wajib diisi.")
		helpers.SaveSession(sess)
		return c.Redirect("/register")
	}
	if !emailPattern.MatchString(email) {
		helpers.SetFlash(sess, "error", "Format email tidak valid.")
		helpers.SaveSession(sess)
		return c.Redirect("/register")
	}
	if len(password) < 6 {
		helpers.SetFlash(sess, "error", "Password minimal 6 karakter.")
		helpers.SaveSession(sess)
		return c.Redirect("/register")
	}
	if password != confirm {
		helpers.SetFlash(sess, "error", "Konfirmasi password tidak cocok.")
		helpers.SaveSession(sess)
		return c.Redirect("/register")
	}

	var count int64
	config.DB.Model(&models.User{}).Where("email = ?", email).Count(&count)
	if count > 0 {
		helpers.SetFlash(sess, "error", "Email sudah terdaftar.")
		helpers.SaveSession(sess)
		return c.Redirect("/register")
	}

	hash, err := bcrypt.GenerateFromPassword([]byte(password), bcrypt.DefaultCost)
	if err != nil {
		helpers.SetFlash(sess, "error", "Gagal memproses password.")
		helpers.SaveSession(sess)
		return c.Redirect("/register")
	}
	user := models.User{Name: name, Email: email, Password: string(hash)}
	if err := config.DB.Create(&user).Error; err != nil {
		helpers.SetFlash(sess, "error", "Gagal mendaftar: "+err.Error())
		helpers.SaveSession(sess)
		return c.Redirect("/register")
	}

	helpers.RegenerateCSRF(sess)
	sess.Set("user_id", user.ID)
	helpers.SetFlash(sess, "success", "Registrasi berhasil. Selamat datang, "+name+"!")
	helpers.SaveSession(sess)
	return c.Redirect("/dashboard")
}

func Logout(c *fiber.Ctx) error {
	sess, err := helpers.GetSession(c)
	if err != nil {
		return err
	}
	sess.Delete("user_id")
	helpers.RegenerateCSRF(sess)
	helpers.SetFlash(sess, "success", "Anda berhasil logout.")
	helpers.SaveSession(sess)
	return c.Redirect("/login")
}

func Dashboard(c *fiber.Ctx) error {
	var userCount, categoryCount, postCount int64
	config.DB.Model(&models.User{}).Count(&userCount)
	config.DB.Model(&models.Category{}).Count(&categoryCount)
	config.DB.Model(&models.Post{}).Count(&postCount)

	var recentPosts []models.Post
	config.DB.Preload("User").Preload("Category").Order("created_at desc").Limit(5).Find(&recentPosts)

	return helpers.Render(c, "app", "views/dashboard.html", fiber.Map{
		"Title":         "Dashboard",
		"UserCount":     userCount,
		"CategoryCount": categoryCount,
		"PostCount":     postCount,
		"RecentPosts":   recentPosts,
	})
}

if len(password) < 6 {
	helpers.SetFlash(sess, "error", "Password minimal 6 karakter.")
	helpers.SaveSession(sess)
	return c.Redirect("/register")
}

hash, err := bcrypt.GenerateFromPassword([]byte(password), bcrypt.DefaultCost)

helpers.RegenerateCSRF(sess)
sess.Set("user_id", user.ID)
helpers.SetFlash(sess, "success", "Berhasil login. Selamat datang, "+user.Name+"!")
helpers.SaveSession(sess)

{{define "content"}}
<h1 class="h3 mb-4">Dashboard</h1>
<div class="row g-3">
  <div class="col-md-4">
    <div class="card shadow-sm text-center">
      <div class="card-body">
        <h2 class="card-title display-6">{{.UserCount}}</h2>
        <p class="text-muted mb-0">Total User</p>
      </div>
    </div>
  </div>
  <div class="col-md-4">
    <div class="card shadow-sm text-center">
      <div class="card-body">
        <h2 class="card-title display-6">{{.CategoryCount}}</h2>
        <p class="text-muted mb-0">Total Kategori</p>
      </div>
    </div>
  </div>
  <div class="col-md-4">
    <div class="card shadow-sm text-center">
      <div class="card-body">
        <h2 class="card-title display-6">{{.PostCount}}</h2>
        <p class="text-muted mb-0">Total Post</p>
      </div>
    </div>
  </div>
</div>

<h2 class="h5 mt-5 mb-3">Post Terbaru</h2>
{{if .RecentPosts}}
<ul class="list-group shadow-sm">
  {{range .RecentPosts}}
  <li class="list-group-item d-flex justify-content-between align-items-center">
    <a href="/posts/{{.ID}}" class="text-decoration-none">{{.Title}}</a>
    <span class="text-muted small">{{.User.Name}} • {{.Category.Name}} • {{formatDate .CreatedAt}}</span>
  </li>
  {{end}}
</ul>
{{else}}
<div class="alert alert-info">Belum ada post. <a href="/posts/create">Buat post pertama</a>.</div>
{{end}}
{{end}}

app.Get("/register", controllers.ShowRegister)
app.Post("/register", controllers.Register)
app.Get("/login", controllers.ShowLogin)
app.Post("/login", controllers.Login)

go run .

mysql -h 127.0.0.1 -P 3306 -u root belajar_fiber -e "SELECT id, name, email, LEFT(password, 7) AS hash FROM users;"

package controllers

import (
	"strconv"

	"github.com/gofiber/fiber/v2"
	"golang.org/x/crypto/bcrypt"

	"belajar-fiber/config"
	"belajar-fiber/helpers"
	"belajar-fiber/models"
)

func UserIndex(c *fiber.Ctx) error {
	var users []models.User
	config.DB.Order("created_at desc").Find(&users)
	return helpers.Render(c, "app", "views/users/index.html", fiber.Map{
		"Title": "Daftar User",
		"Users": users,
	})
}

func UserCreate(c *fiber.Ctx) error {
	return helpers.Render(c, "app", "views/users/create.html", fiber.Map{"Title": "Tambah User"})
}

func UserStore(c *fiber.Ctx) error {
	name := c.FormValue("name")
	email := c.FormValue("email")
	password := c.FormValue("password")

	sess, err := helpers.GetSession(c)
	if err != nil {
		return err
	}
	if name == "" || email == "" || password == "" {
		helpers.SetFlash(sess, "error", "Semua field wajib diisi.")
		helpers.SaveSession(sess)
		return c.Redirect("/users/create")
	}
	if !emailPattern.MatchString(email) {
		helpers.SetFlash(sess, "error", "Format email tidak valid.")
		helpers.SaveSession(sess)
		return c.Redirect("/users/create")
	}
	if len(password) < 6 {
		helpers.SetFlash(sess, "error", "Password minimal 6 karakter.")
		helpers.SaveSession(sess)
		return c.Redirect("/users/create")
	}

	var count int64
	config.DB.Model(&models.User{}).Where("email = ?", email).Count(&count)
	if count > 0 {
		helpers.SetFlash(sess, "error", "Email sudah terdaftar.")
		helpers.SaveSession(sess)
		return c.Redirect("/users/create")
	}

	hash, err := bcrypt.GenerateFromPassword([]byte(password), bcrypt.DefaultCost)
	if err != nil {
		helpers.SetFlash(sess, "error", "Gagal memproses password.")
		helpers.SaveSession(sess)
		return c.Redirect("/users/create")
	}
	user := models.User{Name: name, Email: email, Password: string(hash)}
	if err := config.DB.Create(&user).Error; err != nil {
		helpers.SetFlash(sess, "error", "Gagal menyimpan user: "+err.Error())
		helpers.SaveSession(sess)
		return c.Redirect("/users/create")
	}

	helpers.SetFlash(sess, "success", "User berhasil dibuat.")
	helpers.SaveSession(sess)
	return c.Redirect("/users")
}

func UserEdit(c *fiber.Ctx) error {
	id, err := strconv.ParseUint(c.Params("id"), 10, 64)
	if err != nil {
		return c.Redirect("/users")
	}
	var user models.User
	if err := config.DB.First(&user, id).Error; err != nil {
		sess, _ := helpers.GetSession(c)
		helpers.SetFlash(sess, "error", "User tidak ditemukan.")
		helpers.SaveSession(sess)
		return c.Redirect("/users")
	}
	return helpers.Render(c, "app", "views/users/edit.html", fiber.Map{
		"Title": "Edit User",
		"User":  user,
	})
}

func UserUpdate(c *fiber.Ctx) error {
	id, err := strconv.ParseUint(c.Params("id"), 10, 64)
	if err != nil {
		return c.Redirect("/users")
	}
	sess, err := helpers.GetSession(c)
	if err != nil {
		return err
	}

	var user models.User
	if err := config.DB.First(&user, id).Error; err != nil {
		helpers.SetFlash(sess, "error", "User tidak ditemukan.")
		helpers.SaveSession(sess)
		return c.Redirect("/users")
	}

	name := c.FormValue("name")
	email := c.FormValue("email")
	password := c.FormValue("password")

	if name == "" || email == "" {
		helpers.SetFlash(sess, "error", "Nama dan email wajib diisi.")
		helpers.SaveSession(sess)
		return c.Redirect("/users/" + c.Params("id") + "/edit")
	}
	if !emailPattern.MatchString(email) {
		helpers.SetFlash(sess, "error", "Format email tidak valid.")
		helpers.SaveSession(sess)
		return c.Redirect("/users/" + c.Params("id") + "/edit")
	}

	var count int64
	config.DB.Model(&models.User{}).Where("email = ? AND id <> ?", email, id).Count(&count)
	if count > 0 {
		helpers.SetFlash(sess, "error", "Email sudah dipakai user lain.")
		helpers.SaveSession(sess)
		return c.Redirect("/users/" + c.Params("id") + "/edit")
	}

	user.Name = name
	user.Email = email
	if password != "" {
		if len(password) < 6 {
			helpers.SetFlash(sess, "error", "Password minimal 6 karakter.")
			helpers.SaveSession(sess)
			return c.Redirect("/users/" + c.Params("id") + "/edit")
		}
		hash, err := bcrypt.GenerateFromPassword([]byte(password), bcrypt.DefaultCost)
		if err != nil {
			helpers.SetFlash(sess, "error", "Gagal memproses password.")
			helpers.SaveSession(sess)
			return c.Redirect("/users/" + c.Params("id") + "/edit")
		}
		user.Password = string(hash)
	}
	if err := config.DB.Save(&user).Error; err != nil {
		helpers.SetFlash(sess, "error", "Gagal memperbarui user: "+err.Error())
		helpers.SaveSession(sess)
		return c.Redirect("/users/" + c.Params("id") + "/edit")
	}

	helpers.SetFlash(sess, "success", "User berhasil diperbarui.")
	helpers.SaveSession(sess)
	return c.Redirect("/users")
}

func UserDelete(c *fiber.Ctx) error {
	id, err := strconv.ParseUint(c.Params("id"), 10, 64)
	if err != nil {
		return c.Redirect("/users")
	}
	sess, err := helpers.GetSession(c)
	if err != nil {
		return err
	}

	if uid, ok := sess.Get("user_id").(uint); ok && uint(id) == uid {
		helpers.SetFlash(sess, "error", "Tidak dapat menghapus akun sendiri.")
		helpers.SaveSession(sess)
		return c.Redirect("/users")
	}

	var postCount int64
	config.DB.Model(&models.Post{}).Where("user_id = ?", id).Count(&postCount)
	if postCount > 0 {
		helpers.SetFlash(sess, "error", "User masih memiliki post, hapus post-nya dulu.")
		helpers.SaveSession(sess)
		return c.Redirect("/users")
	}

	if err := config.DB.Delete(&models.User{}, id).Error; err != nil {
		helpers.SetFlash(sess, "error", "Gagal menghapus user: "+err.Error())
		helpers.SaveSession(sess)
		return c.Redirect("/users")
	}

	helpers.SetFlash(sess, "success", "User berhasil dihapus.")
	helpers.SaveSession(sess)
	return c.Redirect("/users")
}