New internal/web package mounted at /ui/, separate from DAV Basic Auth:
- Cookie-based sessions (opaque random tokens in a new web_sessions
SQLite table, internal/db/sessions.go), checked against the same
cfg.Users/bcrypt credentials as DAV Basic Auth.
- Dashboard listing the logged-in user's own calendars/address books,
who they're shared with, and what's shared with them.
- Share/unshare directly from the dashboard, updated in place via htmx
partial swaps (POST to create/update, DELETE to revoke). Always
verifies the resource actually belongs to the logged-in user before
granting a share.
- Templates written in templ (internal/web/templates/*.templ, generated
*_templ.go committed), styled with Tailwind CSS v4 (web/input.css,
compiled to web/static/app.css), with htmx vendored as a static file
for the dynamic bits. Both are embedded into the binary at build time
(web/staticassets.go) so the compiled server has no Node.js/web/
runtime dependency.
- Wired into cmd/server/main.go at /ui/ alongside the existing /cal/,
/card/, /files/ routes; welcome page links to it.
- Tests: internal/web/server_test.go covers login success/failure, the
login-required redirect, dashboard rendering, share/unshare including
the htmx-v2-sends-DELETE-params-as-query-string quirk, and rejecting
shares of resources the user doesn't own.
- Docs: README (new 'Web UI' section, updated sharing section, project
layout, dependencies) and copilot-instructions updated accordingly.
Makefile: new templ-generate/web-deps/web-css targets.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
config.yaml is meant to hold real, deployment-specific secrets (bcrypt
password hashes) and the public base_url, so it shouldn't be committed.
Add it to .gitignore, remove it from version control (kept locally on
disk), and check in config.example.yaml as the template to copy from.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
arnefandCopilot