Fix sign-in page to show Sign Up link only when sign-up is enabled

docs/plans/2026-08-19-allow-signup-env.md

@@ -13,7 +13,7 @@
 - Modify: `main.go` — read env var, set `AllowSignup` on the `AuthHandler`.
 - Modify: `handler/auth.go` — replace count-based gating with the `AllowSignup` flag.
 - No changes to `store/store.go` (`UserCount` is left in place).
-- No changes to templates (the `HasUser` key drives the nav link already).
+- Modify: `template/signin.html` — render the "Sign Up" nav link with `{{if .AllowSignup}}`.
 
 ---
 
@@ -77,9 +77,19 @@ func (h *AuthHandler) allowSignup() bool {
 }
 ```
 
-- [ ] **Step 3: Update the three `HasUser` template renders to use `allowSignup()`**
+- [ ] **Step 3: Update the three `AllowSignup` template renders to use `allowSignup()`**
 
-Replace every occurrence of `"HasUser": h.hasUsers()` with `"HasUser": h.allowSignup()`. There are three (the initial GET render and the two error paths in the POST handler).
+Replace every occurrence of `"AllowSignup": h.allowSignup()` where it was passed as the `HasUser` key. In the three render calls in the sign-in handler, ensure the map key is `AllowSignup`:
+
+```go
+map[string]any{"AllowSignup": h.allowSignup()}
+map[string]any{"Error": "Invalid email or password.", "AllowSignup": h.allowSignup()}
+map[string]any{"Error": "Invalid email or password.", "AllowSignup": h.allowSignup()}
+```
+
+- [ ] **Step 3b: Update the sign-in template to use `AllowSignup` without inversion**
+
+In `template/signin.html`, the nav-link conditional must render the link when sign-up is allowed. Replace `{{if not .HasUser}}` with `{{if .AllowSignup}}`. (Retain the `{{end}}`.)
 
 - [ ] **Step 4: Commit**
 

docs/specs/2026-08-19-allow-signup-env-design.md

@@ -41,7 +41,8 @@ truthy-value parser. Set the resulting boolean on the `AuthHandler`.
   `UserCount() > 0` check).
 - Replace the `hasUsers()` helper (driven by user count) with a check on
   `AllowSignup`, so the Sign In page shows/ hides the "Sign Up" nav link
-  based on whether sign-up is enabled.
+  based on whether sign-up is enabled. The sign-in template passes
+  `AllowSignup` and renders the link with `{{if .AllowSignup}}`.
 
 ### Unchanged
 

handler/auth.go

@@ -103,7 +103,7 @@ func (h *AuthHandler) allowSignup() bool {
 
 func (h *AuthHandler) ServeSignin(w http.ResponseWriter, r *http.Request) {
 	if r.Method == http.MethodGet {
-		h.Tpl.Render(w, "signin", map[string]any{"HasUser": h.allowSignup()})
+		h.Tpl.Render(w, "signin", map[string]any{"AllowSignup": h.allowSignup()})
 		return
 	}
 
@@ -113,12 +113,12 @@ func (h *AuthHandler) ServeSignin(w http.ResponseWriter, r *http.Request) {
 
 		user, err := h.Store.UserByEmail(email)
 		if err != nil {
-			h.Tpl.Render(w, "signin", map[string]any{"Error": "Invalid email or password.", "HasUser": h.allowSignup()})
+			h.Tpl.Render(w, "signin", map[string]any{"Error": "Invalid email or password.", "AllowSignup": h.allowSignup()})
 			return
 		}
 
 		if err := bcrypt.CompareHashAndPassword([]byte(user.PasswordHash), []byte(password)); err != nil {
-			h.Tpl.Render(w, "signin", map[string]any{"Error": "Invalid email or password.", "HasUser": h.allowSignup()})
+			h.Tpl.Render(w, "signin", map[string]any{"Error": "Invalid email or password.", "AllowSignup": h.allowSignup()})
 			return
 		}
 

template/signin.html

@@ -11,7 +11,7 @@
     <nav class="nb-navbar" role="navigation" aria-label="Main navigation">
         <a href="/" class="nb-navbar-brand" aria-label="Go to homepage">Podstalk</a>
         <ul class="nb-navbar-nav" role="menubar">
-            {{if not .HasUser}}
+            {{if .AllowSignup}}
             <li class="nb-navbar-item" role="none">
                 <a href="/signup" class="nb-navbar-link" role="menuitem">Sign Up</a>
             </li>