- web/ts/login.ts: small vanilla TS module toggling the password input's
type between 'password'/'text' via a 'Show/Hide' button, so users can
rule out typos before submitting. Compiled to web/static/login.js
(ES module) via tsc (web/tsconfig.json, new 'make web-ts'/'web-assets'
Makefile targets) and loaded via <script type="module">. Compiled JS
is committed/embedded the same way as the compiled CSS — no Node.js
needed at runtime.
- Verified end-to-end against the live proxied server
(https://local.unqr.dev/web/login): POST /web/login correctly returns
303 + Set-Cookie, and the session then authorizes GET /web/ — the
server-side login flow is confirmed working correctly.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
New internal/web package mounted at /ui/, separate from DAV Basic Auth:
- Cookie-based sessions (opaque random tokens in a new web_sessions
SQLite table, internal/db/sessions.go), checked against the same
cfg.Users/bcrypt credentials as DAV Basic Auth.
- Dashboard listing the logged-in user's own calendars/address books,
who they're shared with, and what's shared with them.
- Share/unshare directly from the dashboard, updated in place via htmx
partial swaps (POST to create/update, DELETE to revoke). Always
verifies the resource actually belongs to the logged-in user before
granting a share.
- Templates written in templ (internal/web/templates/*.templ, generated
*_templ.go committed), styled with Tailwind CSS v4 (web/input.css,
compiled to web/static/app.css), with htmx vendored as a static file
for the dynamic bits. Both are embedded into the binary at build time
(web/staticassets.go) so the compiled server has no Node.js/web/
runtime dependency.
- Wired into cmd/server/main.go at /ui/ alongside the existing /cal/,
/card/, /files/ routes; welcome page links to it.
- Tests: internal/web/server_test.go covers login success/failure, the
login-required redirect, dashboard rendering, share/unshare including
the htmx-v2-sends-DELETE-params-as-query-string quirk, and rejecting
shares of resources the user doesn't own.
- Docs: README (new 'Web UI' section, updated sharing section, project
layout, dependencies) and copilot-instructions updated accordingly.
Makefile: new templ-generate/web-deps/web-css targets.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
- tools/nidusctl: subcommands `calendar {share,unshare,shares}` and
`addressbook {share,unshare,shares}`, thin wrapper around internal/db.
Warns (non-fatal) if owner/user isn't in config.yaml.
- internal/db: add SharesOfAddressBook (owner-perspective query, mirrors
SharesOfCalendar) needed by the CLI.
- internal/db: db.Open now creates the parent data directory itself, so
the CLI works standalone without requiring the server to have run first.
- Update Makefile (build bin/nidusctl, new 'nidusctl' target), README and
copilot-instructions with usage docs.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
arnef
