Require login to create events when auth is enabled

Gate the home page and POST /events behind auth. Also add sqlite3 CLI
to the Docker image for DB inspection, and gitignore test.db files.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.gitignore

@@ -2,3 +2,6 @@ bbq
 bbq.db
 bbq.db-shm
 bbq.db-wal
+test.db
+test.db-shm
+test.db-wal

Dockerfile

@@ -6,7 +6,7 @@ COPY . .
 RUN CGO_ENABLED=1 go build -o /bbq .
 
 FROM debian:bookworm-slim
-RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates && rm -rf /var/lib/apt/lists/*
+RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates sqlite3 && rm -rf /var/lib/apt/lists/*
 COPY --from=build /bbq /usr/local/bin/bbq
 VOLUME /data
 ENV BBQ_DB=/data/bbq.db

auth.go

@@ -101,11 +101,15 @@ func (s *Server) handleLoginSubmit(w http.ResponseWriter, r *http.Request) {
 
 	code := generateCode()
 	expiresAt := time.Now().UTC().Add(10 * time.Minute)
-	s.q.CreateVerificationCode(r.Context(), db.CreateVerificationCodeParams{
+	if err := s.q.CreateVerificationCode(r.Context(), db.CreateVerificationCodeParams{
 		Identifier: identifier,
 		Code:       code,
 		ExpiresAt:  expiresAt,
-	})
+	}); err != nil {
+		log.Printf("failed to store verification code for %s: %v", identifier, err)
+		http.Error(w, "Internal error", 500)
+		return
+	}
 
 	if err := sendVerificationEmail(identifier, code); err != nil {
 		log.Printf("failed to send verification email to %s: %v", identifier, err)

handlers.go

@@ -49,6 +49,10 @@ func randomSlug() string {
 // --- Home / Create Event ---
 
 func (s *Server) handleHome(w http.ResponseWriter, r *http.Request) {
+	if s.features.Auth && s.currentUser(r) == nil {
+		http.Redirect(w, r, "/login", http.StatusSeeOther)
+		return
+	}
 	pageTmpl["home"].ExecuteTemplate(w, "layout", map[string]any{
 		"User":        s.currentUser(r),
 		"AuthEnabled": s.features.Auth,

main.go

@@ -174,7 +174,11 @@ func main() {
 
 	// Home / create event
 	r.Get("/", srv.handleHome)
+	if features.Auth {
+		r.With(srv.requireAuth).Post("/events", srv.handleCreateEvent)
+	} else {
 		r.Post("/events", srv.handleCreateEvent)
+	}
 
 	// Guest event view
 	r.Get("/e/{slug}", srv.handleEvent)

migrate.go

@@ -22,6 +22,12 @@ func runMigrations(database *sql.DB) {
 		`DELETE FROM rsvps WHERE id NOT IN (SELECT MIN(id) FROM rsvps GROUP BY event_id, name COLLATE NOCASE)`,
 		// Plus-one tracking for RSVPs.
 		`ALTER TABLE rsvps ADD COLUMN plus_one INTEGER NOT NULL DEFAULT 0`,
+		// Drop legacy phone/email columns from verification_codes. They were
+		// NOT NULL with no default, so inserts using only identifier failed.
+		`DROP INDEX IF EXISTS idx_verification_codes_phone`,
+		`DROP INDEX IF EXISTS idx_verification_codes_email`,
+		`ALTER TABLE verification_codes DROP COLUMN phone`,
+		`ALTER TABLE verification_codes DROP COLUMN email`,
 		// SMS consent logging for Twilio compliance.
 		`CREATE TABLE IF NOT EXISTS sms_consents (
 			id         INTEGER PRIMARY KEY AUTOINCREMENT,