nidus/internal/web/server.go

// Package web implements the nidus web UI: a small server-rendered
// dashboard (templ + Tailwind, htmx for partial updates) that lets users
// log in and manage sharing of their calendars and address books. It is
// intentionally separate from the DAV Basic Auth (internal/auth) — the
// web UI uses cookie-based sessions stored in internal/db.
package web

import (
	"log/slog"
	"net/http"
	"strings"

	"github.com/yourusername/caldav-server/internal/config"
	"github.com/yourusername/caldav-server/internal/db"
	"github.com/yourusername/caldav-server/internal/store"
)

// Server holds the dependencies needed by the web UI handlers.
type Server struct {
	cfg    *config.Config
	store  *store.Store
	dbase  *db.DB
	logger *slog.Logger
}

// NewServer constructs a web UI Server.
func NewServer(cfg *config.Config, st *store.Store, dbase *db.DB, logger *slog.Logger) *Server {
	return &Server{cfg: cfg, store: st, dbase: dbase, logger: logger}
}

// Handler returns the http.Handler serving the web UI, mounted at "/web/"
// by the caller (cmd/server). staticFS serves the compiled Tailwind CSS
// and any other static assets. Since it's mounted with a path prefix,
// the caller must wrap this handler in http.StripPrefix("/web", ...).
func (s *Server) Handler(staticFS http.FileSystem) http.Handler {
	mux := http.NewServeMux()

	mux.Handle("/static/", http.StripPrefix("/static/", http.FileServer(staticFS)))

	mux.HandleFunc("/login", s.handleLogin)
	mux.HandleFunc("/logout", s.handleLogout)
	mux.HandleFunc("/", s.requireLogin(s.handleDashboard))
	mux.HandleFunc("/shares/calendar", s.requireLogin(s.handleCalendarShare))
	mux.HandleFunc("/shares/addressbook", s.requireLogin(s.handleAddressBookShare))
	mux.HandleFunc("/resources/calendar", s.requireLogin(s.handleCalendarResource))
	mux.HandleFunc("/resources/calendar/color", s.requireLogin(s.handleCalendarColor))
	mux.HandleFunc("/resources/birthdays/color", s.requireLogin(s.handleBirthdayColor))
	mux.HandleFunc("/resources/addressbook", s.requireLogin(s.handleAddressBookResource))
	mux.HandleFunc("/files/{path...}", s.requireLogin(s.handleFiles))
	mux.HandleFunc("/contacts", s.requireLogin(s.handleContactsHome))
	mux.HandleFunc("/contacts/{book}", s.requireLogin(s.handleContactsList))
	mux.HandleFunc("/contacts/{book}/new", s.requireLogin(s.handleContactNew))
	mux.HandleFunc("/contacts/{book}/import", s.requireLogin(s.handleContactImport))
	mux.HandleFunc("/contacts/{book}/export", s.requireLogin(s.handleContactExportAll))
	mux.HandleFunc("/contacts/{book}/{id}/edit", s.requireLogin(s.handleContactEdit))
	mux.HandleFunc("/contacts/{book}/{id}/delete", s.requireLogin(s.handleContactDelete))
	mux.HandleFunc("/contacts/{book}/{id}/export", s.requireLogin(s.handleContactExportOne))
	mux.HandleFunc("/calendar", s.requireLogin(s.handleCalendarMonth))
	mux.HandleFunc("/calendar/new", s.requireLogin(s.handleEventNew))
	mux.HandleFunc("/calendar/{ref}/import", s.requireLogin(s.handleCalendarImport))
	mux.HandleFunc("/calendar/{ref}/export", s.requireLogin(s.handleCalendarExportAll))
	mux.HandleFunc("/calendar/{ref}/{id}/edit", s.requireLogin(s.handleEventEdit))
	mux.HandleFunc("/calendar/{ref}/{id}/delete", s.requireLogin(s.handleEventDelete))
	mux.HandleFunc("/calendar/{ref}/{id}/export", s.requireLogin(s.handleEventExportOne))

	return mux
}

// authenticate validates username/password against the database, mirroring
// internal/auth's Basic Auth check.
func (s *Server) authenticate(username, password string) bool {
	return s.dbase.VerifyPassword(username, password)
}

func (s *Server) handleLogin(w http.ResponseWriter, r *http.Request) {
	if r.Method == http.MethodGet {
		renderLogin(w, "")
		return
	}
	if r.Method != http.MethodPost {
		w.Header().Set("Allow", "GET, POST")
		http.Error(w, "method not allowed", http.StatusMethodNotAllowed)
		return
	}

	if err := r.ParseForm(); err != nil {
		renderLogin(w, "invalid form submission")
		return
	}
	username := strings.TrimSpace(r.PostForm.Get("username"))
	password := r.PostForm.Get("password")

	if !s.authenticate(username, password) {
		s.logger.Warn("web login failed", "username", username, "remote_addr", r.RemoteAddr)
		renderLogin(w, "invalid username or password")
		return
	}

	token, err := s.dbase.CreateSession(username)
	if err != nil {
		s.logger.Error("creating web session", "error", err)
		http.Error(w, "internal error", http.StatusInternalServerError)
		return
	}
	s.setSessionCookie(w, token)
	http.Redirect(w, r, "/web/", http.StatusSeeOther)
}

func (s *Server) handleLogout(w http.ResponseWriter, r *http.Request) {
	if cookie, err := r.Cookie(sessionCookieName); err == nil {
		_ = s.dbase.DeleteSession(cookie.Value)
	}
	s.clearSessionCookie(w)
	http.Redirect(w, r, "/web/login", http.StatusSeeOther)
}