6 files changed, 50 insertions, 4 deletions
diff --git a/app/controllers/dashboard/controller.go b/app/controllers/dashboard/controller.go
index 220871f..0f165ad 100644
--- a/app/controllers/dashboard/controller.go
+++ b/app/controllers/dashboard/controller.go
@@ -20,6 +20,7 @@ func (c *Controller) MountTo(mux *http.ServeMux) {
 	requireUser := middleware.RequireUser()
 
 	mux.Handle("GET /dashboard", requireUser(http.HandlerFunc(c.Show)))
+	mux.Handle("GET /dashboard/nav", http.HandlerFunc(c.Navigation))
 }
 
 func (c *Controller) Show(w http.ResponseWriter, r *http.Request) {
@@ -35,3 +36,20 @@ func (c *Controller) Show(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 }
+
+func (c *Controller) Navigation(w http.ResponseWriter, r *http.Request) {
+	currentUser := cfg.CurrentUser.From(r.Context())
+
+	w.WriteHeader(http.StatusOK)
+	w.Header().Add("Content-Type", "text/html")
+
+	dto := &NavigationDTO{
+		CurrentUser: currentUser,
+		IsLoggedIn:  currentUser != nil,
+	}
+	if err := views.Render(w, "dashboard/nav", dto); err != nil {
+		log.WithFields(r.Context(), log.Fields{"error": err})
+		w.WriteHeader(http.StatusInternalServerError)
+		return
+	}
+}
diff --git a/app/controllers/dashboard/controller_test.go b/app/controllers/dashboard/controller_test.go
index 629a03a..f6b2f43 100644
--- a/app/controllers/dashboard/controller_test.go
+++ b/app/controllers/dashboard/controller_test.go
@@ -5,6 +5,7 @@ import (
 	"testing"
 
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 	"gitlab.com/gitlab-org/software-supply-chain-security/authorization/sparkled/app/cfg"
 	"gitlab.com/gitlab-org/software-supply-chain-security/authorization/sparkled/app/domain"
 	"gitlab.com/gitlab-org/software-supply-chain-security/authorization/sparkled/pkg/test"
@@ -22,7 +23,8 @@ func TestController(t *testing.T) {
 
 				mux.ServeHTTP(w, r)
 
-				assert.Equal(t, http.StatusNotFound, w.Code)
+				require.Equal(t, http.StatusFound, w.Code)
+				assert.Equal(t, "/", w.Header().Get("Location"))
 			})
 		})
 
diff --git a/app/controllers/dashboard/dto.go b/app/controllers/dashboard/dto.go
index 6ffe027..0a7f39d 100644
--- a/app/controllers/dashboard/dto.go
+++ b/app/controllers/dashboard/dto.go
@@ -5,3 +5,8 @@ import "gitlab.com/gitlab-org/software-supply-chain-security/authorization/spark
 type ViewDashboardDTO struct {
 	CurrentUser *domain.User
 }
+
+type NavigationDTO struct {
+	IsLoggedIn  bool
+	CurrentUser *domain.User
+}
diff --git a/app/controllers/sessions/controller.go b/app/controllers/sessions/controller.go
index 9a65ae3..08002a2 100644
--- a/app/controllers/sessions/controller.go
+++ b/app/controllers/sessions/controller.go
@@ -136,5 +136,5 @@ func (c *Controller) Create(w http.ResponseWriter, r *http.Request) {
 	}
 
 	http.SetCookie(w, cookie.New("session", encoded, tokens.Expiry))
-	http.Redirect(w, r, "/", http.StatusFound)
+	http.Redirect(w, r, "/dashboard", http.StatusFound)
 }
diff --git a/app/controllers/sparkles/controller.go b/app/controllers/sparkles/controller.go
index e0da8c4..35f2076 100644
--- a/app/controllers/sparkles/controller.go
+++ b/app/controllers/sparkles/controller.go
@@ -22,14 +22,28 @@ func New(db domain.Repository[*domain.Sparkle]) *Controller {
 }
 
 func (c *Controller) MountTo(mux *http.ServeMux) {
-	requireUser := middleware.RequireUser(http.StatusFound, "/")
+	requireUser := middleware.RequireUser()
 
 	mux.HandleFunc("GET /sparkles", c.Index)
+	mux.Handle("GET /sparkles/new", requireUser(http.HandlerFunc(c.NewForm)))
 	mux.Handle("POST /sparkles", requireUser(http.HandlerFunc(c.Create)))
 }
 
 func (c *Controller) Index(w http.ResponseWriter, r *http.Request) {
-	serde.ToHTTP(w, r, c.db.All())
+	if err := serde.ToHTTP(w, r, c.db.All()); err != nil {
+		log.WithFields(r.Context(), log.Fields{"error": err})
+		w.WriteHeader(http.StatusInternalServerError)
+	}
+}
+
+func (c *Controller) NewForm(w http.ResponseWriter, r *http.Request) {
+	w.WriteHeader(http.StatusOK)
+	w.Header().Add("Content-Type", "text/html")
+
+	dto := &NewSparkleDTO{CurrentUser: cfg.CurrentUser.From(r.Context())}
+	if err := views.Render(w, "sparkles/new", dto); err != nil {
+		log.WithFields(r.Context(), log.Fields{"error": err})
+	}
 }
 
 func (c *Controller) Create(w http.ResponseWriter, r *http.Request) {
diff --git a/app/controllers/sparkles/dto.go b/app/controllers/sparkles/dto.go
new file mode 100644
index 0000000..5e53dab
--- /dev/null
+++ b/app/controllers/sparkles/dto.go
@@ -0,0 +1,7 @@
+package sparkles
+
+import "gitlab.com/gitlab-org/software-supply-chain-security/authorization/sparkled/app/domain"
+
+type NewSparkleDTO struct {
+	CurrentUser *domain.User
+}