Add in-browser EPUB reader (no JavaScript)

- internal/library/reader.go: new Chapter type and Service.ReadChapter/ ChapterAsset. Parses the EPUB spine, extracts and sanitizes each chapter's <body> HTML using golang.org/x/net/html: - strips <script>, <style>, <link>, <iframe>, <object>, <embed>, <form>, <meta>, <base>, <audio>, <video>, <noscript> and any on*-event-handler attributes - rewrites relative <img>/xlink:href asset references to /read/{id}/asset/{path} - rewrites internal chapter links to /read/{id}/{spineIndex}, neutralizes javascript: hrefs, leaves external links untouched - refactored CoverBytes to share the new findEPUBPath helper - internal/web/handlers.go: GET /read/{id}/{idx} renders a chapter page with prev/next navigation; GET /read/{id}/asset/{path...} serves embedded chapter assets (images) with a size cap, mirroring the existing cover-image guard - views/pages.templ: new ReaderPage component (renders sanitized HTML via templ.Raw); BookPage gets an "Im Browser lesen" button next to the existing download button; templ regenerated - static/styles.css: reader typography/layout, prev/next nav styling - go.mod/go.sum: golang.org/x/net/html promoted to a direct dependency - README: documents the new in-browser reader feature Verified end-to-end with a hand-built test EPUB (spine ordering, metadata, script/style stripping, event-handler stripping, chapter link rewriting, image asset rewriting, javascript: neutralization, external link passthrough, out-of-range chapter handling, and path-traversal guard on chapter assets); test file removed afterwards per repo convention (no test suite checked in yet). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
2026-08-15 16:17:16 +02:00
parent be3dfaeb47
commit 2399d8a5a6
9 changed files with 727 additions and 48 deletions
@@ -10,6 +10,7 @@ import (
 	"net/http"
 	"os"
 	"path/filepath"
+	"strconv"
 	"strings"

 	"github.com/a-h/templ"
@@ -41,6 +42,8 @@ func (h *Handler) RegisterRoutes(mux *http.ServeMux) {
 	mux.HandleFunc("GET /book/{id}", h.requireAuth(h.bookDetails))
 	mux.HandleFunc("GET /download/{id}", h.requireAuth(h.downloadBook))
 	mux.HandleFunc("GET /cover/{id}", h.requireAuth(h.bookCover))
+	mux.HandleFunc("GET /read/{id}/asset/{path...}", h.requireAuth(h.readAsset))
+	mux.HandleFunc("GET /read/{id}/{idx}", h.requireAuth(h.readChapter))

 	// Uploader and above
 	mux.HandleFunc("GET /upload", h.requireRole(users.RoleUploader, h.uploadPage))
@@ -131,6 +134,69 @@ func (h *Handler) bookCover(w http.ResponseWriter, r *http.Request) {
 	_, _ = w.Write(data)
 }

+func (h *Handler) readChapter(w http.ResponseWriter, r *http.Request) {
+	id := r.PathValue("id")
+	if id == "" {
+		http.NotFound(w, r)
+		return
+	}
+	idx, err := strconv.Atoi(r.PathValue("idx"))
+	if err != nil || idx < 0 {
+		http.NotFound(w, r)
+		return
+	}
+
+	book, err := h.lib.FindBook(id)
+	if err != nil {
+		http.Error(w, "failed to load book", http.StatusInternalServerError)
+		return
+	}
+	if book == nil {
+		http.NotFound(w, r)
+		return
+	}
+
+	chapter, err := h.lib.ReadChapter(id, idx)
+	if err != nil {
+		if errors.Is(err, library.ErrChapterNotFound) {
+			http.NotFound(w, r)
+			return
+		}
+		log.Printf("read chapter: %v", err)
+		http.Error(w, "Kapitel konnte nicht geladen werden", http.StatusInternalServerError)
+		return
+	}
+
+	render(w, r.Context(), views.ReaderPage(*book, *chapter))
+}
+
+func (h *Handler) readAsset(w http.ResponseWriter, r *http.Request) {
+	id := r.PathValue("id")
+	assetPath := r.PathValue("path")
+	if id == "" || assetPath == "" {
+		http.NotFound(w, r)
+		return
+	}
+
+	data, contentType, err := h.lib.ChapterAsset(id, assetPath)
+	if err != nil {
+		log.Printf("read asset: %v", err)
+		http.Error(w, "Datei konnte nicht geladen werden", http.StatusInternalServerError)
+		return
+	}
+	if len(data) == 0 {
+		http.NotFound(w, r)
+		return
+	}
+	if contentType == "" {
+		contentType = "application/octet-stream"
+	}
+
+	w.Header().Set("Content-Type", contentType)
+	w.Header().Set("Cache-Control", "public, max-age=3600")
+	_, _ = w.Write(data)
+}
+
 func render(w http.ResponseWriter, ctx context.Context, c templ.Component) {
 	w.Header().Set("Content-Type", "text/html; charset=utf-8")
 	if err := c.Render(ctx, w); err != nil && !errors.Is(err, context.Canceled) {