arnefandCopilot
ab3c7f44d5
New internal/web package mounted at /ui/, separate from DAV Basic Auth: - Cookie-based sessions (opaque random tokens in a new web_sessions SQLite table, internal/db/sessions.go), checked against the same cfg.Users/bcrypt credentials as DAV Basic Auth. - Dashboard listing the logged-in user's own calendars/address books, who they're shared with, and what's shared with them. - Share/unshare directly from the dashboard, updated in place via htmx partial swaps (POST to create/update, DELETE to revoke). Always verifies the resource actually belongs to the logged-in user before granting a share. - Templates written in templ (internal/web/templates/*.templ, generated *_templ.go committed), styled with Tailwind CSS v4 (web/input.css, compiled to web/static/app.css), with htmx vendored as a static file for the dynamic bits. Both are embedded into the binary at build time (web/staticassets.go) so the compiled server has no Node.js/web/ runtime dependency. - Wired into cmd/server/main.go at /ui/ alongside the existing /cal/, /card/, /files/ routes; welcome page links to it. - Tests: internal/web/server_test.go covers login success/failure, the login-required redirect, dashboard rendering, share/unshare including the htmx-v2-sends-DELETE-params-as-query-string quirk, and rejecting shares of resources the user doesn't own. - Docs: README (new 'Web UI' section, updated sharing section, project layout, dependencies) and copilot-instructions updated accordingly. Makefile: new templ-generate/web-deps/web-css targets. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
66 lines
1.6 KiB
Go
66 lines
1.6 KiB
Go
package web
|
|
|
|
import (
|
|
"context"
|
|
"net/http"
|
|
"time"
|
|
)
|
|
|
|
const sessionCookieName = "nidus_session"
|
|
|
|
type ctxKey string
|
|
|
|
const userCtxKey ctxKey = "web_username"
|
|
|
|
// userFromContext returns the logged-in username for the current request,
|
|
// or "" if unauthenticated.
|
|
func userFromContext(ctx context.Context) string {
|
|
u, _ := ctx.Value(userCtxKey).(string)
|
|
return u
|
|
}
|
|
|
|
// requireLogin wraps a handler so that it redirects to /login when no
|
|
// valid session cookie is present, otherwise it stores the username in
|
|
// the request context for downstream handlers to use.
|
|
func (s *Server) requireLogin(next http.HandlerFunc) http.HandlerFunc {
|
|
return func(w http.ResponseWriter, r *http.Request) {
|
|
cookie, err := r.Cookie(sessionCookieName)
|
|
if err != nil {
|
|
http.Redirect(w, r, "/ui/login", http.StatusSeeOther)
|
|
return
|
|
}
|
|
username, err := s.dbase.SessionUser(cookie.Value)
|
|
if err != nil {
|
|
s.clearSessionCookie(w)
|
|
http.Redirect(w, r, "/ui/login", http.StatusSeeOther)
|
|
return
|
|
}
|
|
ctx := context.WithValue(r.Context(), userCtxKey, username)
|
|
next(w, r.WithContext(ctx))
|
|
}
|
|
}
|
|
|
|
func (s *Server) setSessionCookie(w http.ResponseWriter, token string) {
|
|
http.SetCookie(w, &http.Cookie{
|
|
Name: sessionCookieName,
|
|
Value: token,
|
|
Path: "/",
|
|
HttpOnly: true,
|
|
Secure: s.cfg.TLS.Enabled,
|
|
SameSite: http.SameSiteLaxMode,
|
|
Expires: time.Now().Add(7 * 24 * time.Hour),
|
|
})
|
|
}
|
|
|
|
func (s *Server) clearSessionCookie(w http.ResponseWriter) {
|
|
http.SetCookie(w, &http.Cookie{
|
|
Name: sessionCookieName,
|
|
Value: "",
|
|
Path: "/",
|
|
HttpOnly: true,
|
|
Secure: s.cfg.TLS.Enabled,
|
|
SameSite: http.SameSiteLaxMode,
|
|
MaxAge: -1,
|
|
})
|
|
}
|