Go Performance Starter

s.router.Use(mw.SecurityHeaders(isProd))
s.router.Use(mw.RequestID)
s.router.Use(mw.RealIP(s.cfg.TrustedProxyCIDRs, s.cfg.ClientIPHeader)) // before the limiter
s.router.Use(mw.RateLimiter(ctx, 50, 10)) // eviction stops with the server (#117)
s.router.Use(mw.Compress(5))
s.router.Use(mw.Metrics)
s.router.Use(mw.RequestLogger)
s.router.Use(mw.Recoverer)
s.router.Use(mw.Timeout(30 * time.Second))
s.router.Use(mw.CSRF(isProd))

r.Group(func(learn chi.Router) {
    learn.Use(mw.GuestSession(s.authClient, isProd)) // anonymous identity on first touch
    learn.Use(mw.OptionalAuth(s.authClient, isProd))
    learn.Use(mw.OptionalUserLoader(userRepo))
    learn.Use(mw.RateLimiter(ctx, 30.0/60.0, 20))    // stricter tier, anonymous-writable
    handler.QuizRoutes(learn, quizRepo)
})

func ProfileUpdate(w http.ResponseWriter, r *http.Request) {
    name := strings.TrimSpace(r.FormValue("name"))
    if name == "" { /* 422 with a field error, partial or page */ }

    repo := webutil.GetUserRepoFromContext(r.Context()) // repository interface, not *pgxpool.Pool
    if _, err := repo.UpdateName(r.Context(), user.ID, name); err != nil { /* 500 */ }

    if view.IsHTMXRequest(r) {
        view.SetHXTrigger(w, "Profile updated successfully!")
        view.Render(w, r, http.StatusOK, partials.ProfileForm(partials.ProfileFormProps{Name: name, Success: true}))
        return
    }
    http.Redirect(w, r, "/profile", http.StatusSeeOther)
}

-- name: ListFlashcardsByUser :many
SELECT id, user_id, question_id, front, back, is_known, created_at, updated_at
FROM flashcards
WHERE user_id = $1
ORDER BY created_at DESC;

-- migrations/000003_add_quiz_flashcards.up.sql
ALTER TABLE flashcards ENABLE ROW LEVEL SECURITY;
ALTER TABLE flashcards FORCE ROW LEVEL SECURITY;
CREATE POLICY flashcards_self_access ON flashcards
    USING      (EXISTS (SELECT 1 FROM users u WHERE u.id = flashcards.user_id AND u.auth_id = auth.uid()::text))
    WITH CHECK (EXISTS (SELECT 1 FROM users u WHERE u.id = flashcards.user_id AND u.auth_id = auth.uid()::text));

// A standalone fragment for HTMX swaps AND a plain form without JS:
// hx-post swaps the card in place, the form action posts the same payload full-page.
templ QuizQuestionCard(props QuizQuestionProps) {
    <form
        method="post"
        action={ templ.SafeURL(quizAnswerAction(props.Slug)) }
        hx-post={ quizAnswerAction(props.Slug) }
        hx-target="#quiz-card"
        hx-swap="innerHTML"
    >
        @components.CSRFField()
        for i, choice := range props.Choices {
            <label class="flex items-center gap-3 p-3 rounded-md border border-border hover:border-primary">
                <input type="radio" name="choice" value={ fmt.Sprintf("%d", i) } required/>
                <span>{ choice }</span>
            </label>
        }
        <button type="submit" class="btn btn-primary">Check answer</button>
    </form>
}

const (
    MaxP95ResponseTime = 100 * time.Millisecond
    MaxP99ResponseTime = 200 * time.Millisecond
    MaxBinarySize      = 20 * 1024 * 1024  // stripped linux build
    MaxMemoryUsage     = 128 * 1024 * 1024
    MaxStartupTime     = 500 * time.Millisecond
    MaxJavaScriptSize  = 50 * 1024         // gzipped
    MaxCSSSize         = 30 * 1024         // gzipped
)
// task ci → test:binary-size, test:asset-budgets, go test ./internal/performance/...