readd .env

.dockerignore

@@ -1,3 +1,4 @@
+.env
 .git
 .gitignore
 README.md

main.go

@@ -50,7 +50,12 @@ func main() {
 		MaxAge:   60 * 80 * 24 * 7, // 7 days
 		HttpOnly: true,
 		Secure:   os.Getenv("ENV") == "production",
-		SameSite: http.SameSiteLaxMode,
+		SameSite: func() http.SameSite {
+			if os.Getenv("CORS_ORIGINS") != "" {
+				return http.SameSiteNoneMode
+			}
+			return http.SameSiteLaxMode
+		}(),
 	})
 	r.Use(sessions.Sessions("rideaware-session", store))
 

services/user_service.go

@@ -19,6 +19,8 @@ func NewUserService(db *gorm.DB) *UserService {
 }
 
 func (s *UserService) CreateUser(username, email, password string) (*models.User, error) {
+	username = strings.TrimSpace(username)
+	email = strings.ToLower(strings.TrimSpace(email))
 	if username == "" || email == "" || password == "" {
 		return nil, errors.New("username, email, and password are required")
 	}
@@ -36,12 +38,15 @@ func (s *UserService) CreateUser(username, email, password string) (*models.User
 	var existingUser models.User
 	if err := s.db.Where("username = ? OR email = ?", username, email).First(&existingUser).Error; err == nil {
 		return nil, errors.New("user with this username or email already exists")
+	} else if !errors.Is(err, gorm.ErrRecordNotFound) {
+		log.Printf("Error checking existing users: %v", err)
+		return nil, errors.New("could not create user")
 	}
 
 	// Create new user
 	user := models.User{
 		Username: username,
-		Email:    email,
+		Email:    strings.ToLower(email),
 	}
 	if err := user.SetPassword(password); err != nil {
 		log.Printf("Error hashing password: %v", err)
@@ -59,7 +64,8 @@ func (s *UserService) CreateUser(username, email, password string) (*models.User
 func (s *UserService) VerifyUser(username, password string) (*models.User, error) {
 	var user models.User
 	identifier := strings.TrimSpace(username)
-	if err := s.db.Where("username = ? OR email = ?", identifier, strings.ToLower(identifier)).First(&user).Error; err != nil {
+	lid := strings.ToLower(identifier)
+	if err := s.db.Where("username = ? OR LOWER(email) = ?", identifier, lid).First(&user).Error; err != nil {
 		if errors.Is(err, gorm.ErrRecordNotFound) {
 			return nil, errors.New("invalid username or password")
 		}