marky

api.go (45525B)

---

 package internal
 
 import (
 	"bytes"
 	"context"
 	"encoding/json"
 	"encoding/xml"
 	"fmt"
 	"log"
 	"net/http"
 	"net/url"
 	"os"
 	"os/exec"
 	"path"
 	"strconv"
 	"strings"
 	"time"
 )
 
 // HandlerConfig controls optional features exposed by the HTTP handler.
 type HandlerConfig struct {
 	DisableSignup bool
 	BaseURL       string
 }
 
 // NewHandler constructs the HTTP API handler with default settings.
 func NewHandler(db *DB) (http.Handler, error) { return NewHandlerWithConfig(db, HandlerConfig{}) }
 
 // NewHandlerWithConfig constructs the HTTP API handler, including the embedded web UI.
 var baseURLOverride string
 
 func NewHandlerWithConfig(db *DB, cfg HandlerConfig) (http.Handler, error) {
 	if strings.TrimSpace(cfg.BaseURL) != "" {
 		baseURLOverride = strings.TrimRight(strings.TrimSpace(cfg.BaseURL), "/")
 	}
 	mux := http.NewServeMux()
 
 	// Auth endpoints
 	if !cfg.DisableSignup {
 		mux.HandleFunc("/signup", func(w http.ResponseWriter, r *http.Request) {
 			if r.Method != http.MethodPost {
 				http.Error(w, "method not allowed", http.StatusMethodNotAllowed)
 				return
 			}
 			var req struct{ Username, Password string }
 			if err := json.NewDecoder(r.Body).Decode(&req); err != nil || strings.TrimSpace(req.Username) == "" || strings.TrimSpace(req.Password) == "" {
 				http.Error(w, "invalid payload", http.StatusBadRequest)
 				return
 			}
 			if err := ValidateUsername(req.Username); err != nil {
 				http.Error(w, err.Error(), http.StatusBadRequest)
 				return
 			}
 			id, err := db.CreateUser(r.Context(), req.Username, req.Password)
 			if err != nil {
 				http.Error(w, "cannot create user", http.StatusConflict)
 				return
 			}
 			SetSession(w, id)
 			w.Header().Set("Content-Type", "application/json")
 			_ = json.NewEncoder(w).Encode(map[string]any{"username": req.Username})
 		})
 	}
 	mux.HandleFunc("/login", func(w http.ResponseWriter, r *http.Request) {
 		if r.Method != http.MethodPost {
 			http.Error(w, "method not allowed", http.StatusMethodNotAllowed)
 			return
 		}
 		var req struct{ Username, Password string }
 		if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
 			http.Error(w, "invalid payload", http.StatusBadRequest)
 			return
 		}
 		id, ok, err := db.VerifyUserPassword(r.Context(), req.Username, req.Password)
 		if err != nil || !ok {
 			http.Error(w, "invalid credentials", http.StatusUnauthorized)
 			return
 		}
 		SetSession(w, id)
 		w.Header().Set("Content-Type", "application/json")
 		_ = json.NewEncoder(w).Encode(map[string]any{"username": req.Username})
 	})
 	mux.HandleFunc("/logout", func(w http.ResponseWriter, r *http.Request) {
 		if r.Method != http.MethodPost {
 			http.Error(w, "method not allowed", http.StatusMethodNotAllowed)
 			return
 		}
 		ClearSession(w)
 		w.WriteHeader(http.StatusNoContent)
 	})
 
 	// Bookmarklet generator and popup form
 	mux.HandleFunc("/bookmarklet", func(w http.ResponseWriter, r *http.Request) {
 		if r.Method != http.MethodGet {
 			w.Header().Set("Allow", http.MethodGet)
 			http.Error(w, "method not allowed", http.StatusMethodNotAllowed)
 			return
 		}
 		uid, hasSession := CurrentUserID(r)
 		var user *User
 		var err error
 		if hasSession {
 			if user, err = db.GetUserByID(r.Context(), uid); err != nil {
 				user = nil
 				hasSession = false
 			}
 		}
 		// Resolve origin to use in links opened by the bookmarklet
 		origin := originFromRequest(r)
 		// Fetch API token (if present) for interpolation
 		var token string
 		var present bool
 		if hasSession {
 			token, present, err = db.GetAPIToken(r.Context(), uid)
 		}
 		if err != nil {
 			log.Printf("get api token error: %v", err)
 		}
 		// Determine mode: installer (no u param) or popup (with u)
 		q := r.URL.Query()
 		pageURL := strings.TrimSpace(q.Get("u"))
 		// Helpers for embedding JSON strings into HTML templates
 		enc := func(s string) string { b, _ := json.Marshal(s); return string(b) }
 		if pageURL == "" {
 			// No installer page anymore; redirect to settings (or root when unauth)
 			if !hasSession || user == nil {
 				http.Redirect(w, r, "/", http.StatusFound)
 			} else {
 				http.Redirect(w, r, "/settings", http.StatusFound)
 			}
 			return
 		}
 		// Popup form page
 		pageTitle := q.Get("t")
 		desc := q.Get("d")
 		refParam := q.Get("r")
 		pub := ""
 		if q.Get("p") != "" {
 			pub = q.Get("p")
 		}
 		// Escape text content for HTML attribute/text node usage.
 		htmlEscape := func(s string) string {
 			r := strings.NewReplacer(
 				"&", "&",
 				"<", "&lt;",
 				">", "&gt;",
 				`"`, "&quot;",
 				"'", "&#39;",
 			)
 			return r.Replace(s)
 		}
 		// Prefer token from query string for incognito usage
 		qTok := q.Get("tok")
 		qUser := q.Get("user")
 		jsToken := "null"
 		if strings.TrimSpace(qTok) != "" {
 			jsToken = enc(qTok)
 		} else if present {
 			jsToken = enc(token)
 		}
 		jsUser := "null"
 		if strings.TrimSpace(qUser) != "" {
 			jsUser = enc(qUser)
 		} else if user != nil {
 			jsUser = enc(user.Username)
 		}
 		w.Header().Set("Content-Type", "text/html; charset=utf-8")
 		fmt.Fprintf(w, `<!doctype html>
 		<html lang="en">
 		<meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1">
 		<title>Add Bookmark · Marky</title>
 		<style>
 		body{font:15px/1.4 -apple-system,BlinkMacSystemFont,Segoe UI,Roboto,Helvetica,Arial,sans-serif;margin:16px;color:#222}
 		label{display:block;margin:8px 0}
 		input[type=text], textarea{width:100%%;box-sizing:border-box;padding:8px;border:1px solid #ccc;border-radius:6px}
 		textarea{min-height:100px;resize:vertical}
 		.inline-row{display:flex;gap:8px;align-items:center}
 		.inline-row input{flex:1}
 		.actions{margin-top:12px;display:flex;gap:8px}
 		button{background:#222;color:#fff;border:0;border-radius:6px;padding:8px 12px;cursor:pointer}
 		button.secondary{background:#eee;color:#222}
 		button.inline{padding:8px 12px}
 		.small{color:#666;font-size:12px;margin-top:6px}
 		.success{color:green}
 		.error{color:#b00020}
 		</style>
 		<h2>Add Bookmark</h2>
 		<form id="f">
 			<label>URL
 				<input id="url" type="text" required value="%[1]s">
 			</label>
 			<label>Title
 				<input id="title" type="text" required value="%[2]s">
 			</label>
 			<label>Description
 				<textarea id="desc">%[3]s</textarea>
 			</label>
 			<label>Referrer
 				<span class="inline-row">
 					<input id="ref" type="text" value="%[8]s" placeholder="https://site-that-linked-here.example">
 					<button id="refClear" class="secondary inline" type="button">Clear</button>
 					<button id="refPaste" class="secondary inline" type="button">Paste</button>
 				</span>
 			</label>
 			<label><input id="pub" type="checkbox" %[4]s> Public</label>
 			<div class="actions">
 				<button id="saveBtn" type="submit">Save</button>
 				<button class="secondary" type="button" onclick="window.close()">Cancel</button>
 			</div>
 			<p class="small">Saves to %[5]s</p>
 			<p id="msg" class="small"></p>
 		</form>
 		<script>
 		(function(){
 		  const token = %[6]s;
 		  const uname = %[7]s;
 		  const form = document.getElementById('f');
 		  const msg = document.getElementById('msg');
 		  const saveBtn = document.getElementById('saveBtn');
 		  const refInput = document.getElementById('ref');
 		  const refClear = document.getElementById('refClear');
 		  const refPaste = document.getElementById('refPaste');
 		  refClear.addEventListener('click', function(){
 		    refInput.value = '';
 		    refInput.focus();
 		  });
 		  refPaste.addEventListener('click', async function(){
 		    try {
 		      const text = await navigator.clipboard.readText();
 		      refInput.value = (text || '').trim();
 		      refInput.focus();
 		    } catch (err) {
 		      alert('Paste failed');
 		    }
 		  });
 		  form.addEventListener('submit', async function(e){
 		    e.preventDefault();
 		    msg.textContent = '';
 		    if (saveBtn) {
 		      saveBtn.disabled = true;
 		      saveBtn.textContent = 'Saving ...';
 		    }
 		    const payload = {
 		      url: document.getElementById('url').value.trim(),
 		      title: document.getElementById('title').value.trim(),
           description: (function(){const v=document.getElementById('desc').value; return v.trim() ? v : null;})(),
           referrer: (function(){const v=document.getElementById('ref').value; return v.trim() ? v : null;})(),
           public: document.getElementById('pub').checked
         };
 		    try {
 		      const res = await fetch('%[5]s/bookmarks', {
 		        method: 'POST',
 		        headers: (function(){
 		          const h = {'Content-Type':'application/json'};
 		          if (token && uname) {
 		            const creds = btoa(uname + ':' + token);
 		            h['Authorization'] = 'Basic ' + creds;
 		          }
 		          return h;
 		        })(),
 		        body: JSON.stringify(payload)
 		      });
 		      if (!res.ok) {
 		        const text = await res.text();
 		        throw new Error(text || ('HTTP '+res.status));
 		      }
 		      msg.textContent = 'Saved! You can close this window.';
 		      msg.className = 'small success';
 		      setTimeout(function(){ window.close(); }, 800);
 		    } catch (err) {
 		      msg.textContent = 'Error: '+ err.message;
 		      msg.className = 'small error';
 		      if (saveBtn) {
 		        saveBtn.disabled = false;
 		        saveBtn.textContent = 'Save';
 		      }
 		    }
 		  });
 		})();
 		</script>
 		</html>`, htmlEscape(pageURL), htmlEscape(pageTitle), htmlEscape(desc), func() string {
 			if strings.EqualFold(pub, "1") || strings.EqualFold(pub, "true") {
 				return "checked"
 			}
 			return ""
 		}(), origin, jsToken, jsUser, htmlEscape(refParam))
 	})
 
 	// API token endpoint for logged-in user (regenerate only)
 	mux.HandleFunc("/api/token", func(w http.ResponseWriter, r *http.Request) {
 		uid, ok := CurrentUserID(r)
 		if !ok {
 			http.Error(w, "unauthorized", http.StatusUnauthorized)
 			return
 		}
 		switch r.Method {
 		case http.MethodPost:
 			tok, err := db.RegenerateAPIToken(r.Context(), uid)
 			if err != nil {
 				http.Error(w, "internal server error", http.StatusInternalServerError)
 				return
 			}
 			w.Header().Set("Content-Type", "application/json")
 			_ = json.NewEncoder(w).Encode(map[string]any{"api_token": tok})
 		default:
 			http.Error(w, "method not allowed", http.StatusMethodNotAllowed)
 		}
 	})
 
 	// Public listing endpoint removed; feeds normalized under /u:{username}(.format)
 
 	// Static web UI and page routes
 	static, err := StaticHandlerWithConfig(cfg)
 	if err != nil {
 		return nil, err
 	}
 	mux.HandleFunc("/", func(w http.ResponseWriter, r *http.Request) {
 		p := strings.TrimPrefix(r.URL.Path, "/")
 		// Root
 		if p == "" {
 			if uid, ok := userIDFromRequest(r, db); ok && uid > 0 {
 				if u, err := db.GetUserByID(r.Context(), uid); err == nil && u != nil {
 					http.Redirect(w, r, "/u:"+u.Username, http.StatusFound)
 					return
 				}
 			}
 			if html, err := RenderPage("login.html", cfg); err == nil {
 				html = applyCacheBust(html)
 				w.Header().Set("Content-Type", "text/html; charset=utf-8")
 				_, _ = w.Write(html)
 				return
 			}
 		}
 		// Only GET/HEAD beyond this point
 		if r.Method != http.MethodGet && r.Method != http.MethodHead {
 			http.NotFound(w, r)
 			return
 		}
 		// Settings page
 		if p == "settings" {
 			uid, ok := userIDFromRequest(r, db)
 			if !ok || uid == 0 {
 				http.Redirect(w, r, "/", http.StatusFound)
 				return
 			}
 			if html, err := RenderPage("settings.html", cfg); err == nil {
 				if tok, _, err := db.GetAPIToken(r.Context(), uid); err == nil {
 					inject := []byte("<script>window.MARKY_TOKEN=" + strconv.Quote(tok) + "</script>\n")
 					marker := []byte("<script src=\"/app.js\"></script>")
 					if i := bytes.Index(html, marker); i >= 0 {
 						out := make([]byte, 0, len(html)+len(inject))
 						out = append(out, html[:i]...)
 						out = append(out, inject...)
 						out = append(out, html[i:]...)
 						html = out
 					}
 				}
 				if u, err := db.GetUserByID(r.Context(), uid); err == nil && u != nil {
 					inject := []byte("<script>window.MARKY_ME=" + strconv.Quote(u.Username) + "</script>\n")
 					marker := []byte("<script src=\"/app.js\"></script>")
 					if i := bytes.Index(html, marker); i >= 0 {
 						out := make([]byte, 0, len(html)+len(inject))
 						out = append(out, html[:i]...)
 						out = append(out, inject...)
 						out = append(out, html[i:]...)
 						html = out
 					}
 				}
 				html = applyCacheBust(html)
 				w.Header().Set("Content-Type", "text/html; charset=utf-8")
 				_, _ = w.Write(html)
 				return
 			}
 		}
 		// Single-segment with trailing dot is invalid
 		if !strings.Contains(p, "/") && strings.HasSuffix(p, ".") {
 			http.NotFound(w, r)
 			return
 		}
 		// User page and feeds: /u:{username}[.rss|.json]
 		if strings.HasPrefix(p, "u:") {
 			rest := strings.TrimPrefix(p, "u:")
 			if rest == "" || strings.Contains(rest, "/") {
 				http.NotFound(w, r)
 				return
 			}
 			format := ""
 			uname := rest
 			if strings.HasSuffix(rest, ".rss") {
 				format = "rss"
 				uname = strings.TrimSuffix(uname, ".rss")
 			}
 			if strings.HasSuffix(rest, ".json") {
 				format = "json"
 				uname = strings.TrimSuffix(uname, ".json")
 			}
 			u, err := db.GetUserByUsername(r.Context(), uname)
 			if err != nil || u == nil {
 				http.NotFound(w, r)
 				return
 			}
 			if format != "" {
 				var items []Bookmark
 				if isOwnerAuthorized(r, u, db) {
 					items, err = db.ListBookmarks(r.Context(), u.ID, 50, 0)
 				} else {
 					items, err = db.ListPublicBookmarks(r.Context(), u.ID, 50, 0)
 				}
 				if err != nil {
 					http.Error(w, "internal server error", http.StatusInternalServerError)
 					return
 				}
 				resp := make([]bookmarkResponse, 0, len(items))
 				for i := range items {
 					resp = append(resp, toRespWithArchive(r.Context(), db, &items[i]))
 				}
 				if format == "json" {
 					w.Header().Set("Content-Type", "application/json")
 					_ = json.NewEncoder(w).Encode(resp)
 				} else {
 					w.Header().Set("Content-Type", "application/rss+xml; charset=utf-8")
 					_ = writeRSS(w, r, resp, fmt.Sprintf("%s's Bookmarks", u.Username))
 				}
 				return
 			}
 			// HTML user page
 			if html, err := RenderPage("user.html", cfg); err == nil {
 				// Embed MARKY_ME if session
 				if uid, ok := userIDFromRequest(r, db); ok && uid > 0 {
 					if cu, err := db.GetUserByID(r.Context(), uid); err == nil && cu != nil {
 						meInject := []byte("<script>window.MARKY_ME=" + strconv.Quote(cu.Username) + "</script>\n")
 						marker := []byte("<script src=\"/app.js\"></script>")
 						if i := bytes.Index(html, marker); i >= 0 {
 							out := make([]byte, 0, len(html)+len(meInject))
 							out = append(out, html[:i]...)
 							out = append(out, meInject...)
 							out = append(out, html[i:]...)
 							html = out
 						}
 					}
 				}
 				// Title
 				if ti := bytes.Index(html, []byte("<title>")); ti >= 0 {
 					if tj := bytes.Index(html[ti:], []byte("</title>")); tj > 0 {
 						start := ti + len("<title>")
 						end := ti + tj
 						nt := []byte(u.Username + " | Marky")
 						nb := make([]byte, 0, len(html)-(end-start)+len(nt))
 						nb = append(nb, html[:start]...)
 						nb = append(nb, nt...)
 						nb = append(nb, html[end:]...)
 						html = nb
 					}
 				}
 				// Pagination + search params
 				uq := r.URL.Query()
 				page := 1
 				if pstr := strings.TrimSpace(uq.Get("page")); pstr != "" {
 					if pv, e := strconv.Atoi(pstr); e == nil && pv > 0 {
 						page = pv
 					}
 				}
 				size := 20
 				if sstr := strings.TrimSpace(uq.Get("size")); sstr != "" {
 					if sv, e := strconv.Atoi(sstr); e == nil && (sv == 20 || sv == 50 || sv == 100) {
 						size = sv
 					}
 				}
 				offset := (page - 1) * size
 				query := strings.TrimSpace(uq.Get("q"))
 				vis := strings.TrimSpace(uq.Get("vis"))
 				if vis == "" {
 					vis = "all"
 				}
 
 				// Embed initial results for the current page (search-aware)
 				if query != "" {
 					var resp []bookmarkResponse
 					var listErr error
 					if isOwnerAuthorized(r, u, db) {
 						if strings.ToLower(vis) == "public" {
 							if hits, e := db.SearchPublicBookmarksWithExcerpt(r.Context(), u.ID, query, size, offset); e == nil {
 								resp = make([]bookmarkResponse, 0, len(hits))
 								for i := range hits {
 									h := hits[i]
 									br := toRespWithArchive(r.Context(), db, &h.Bookmark)
 									if h.Excerpt.Valid {
 										ex := h.Excerpt.String
 										br.Excerpt = &ex
 									}
 									resp = append(resp, br)
 								}
 							} else {
 								listErr = e
 							}
 						} else if strings.ToLower(vis) == "private" {
 							if hits, e := db.SearchPrivateBookmarksWithExcerpt(r.Context(), u.ID, query, size, offset); e == nil {
 								resp = make([]bookmarkResponse, 0, len(hits))
 								for i := range hits {
 									h := hits[i]
 									br := toRespWithArchive(r.Context(), db, &h.Bookmark)
 									if h.Excerpt.Valid {
 										ex := h.Excerpt.String
 										br.Excerpt = &ex
 									}
 									resp = append(resp, br)
 								}
 							} else {
 								listErr = e
 							}
 						} else {
 							if hits, e := db.SearchBookmarksWithExcerpt(r.Context(), u.ID, query, size, offset); e == nil {
 								resp = make([]bookmarkResponse, 0, len(hits))
 								for i := range hits {
 									h := hits[i]
 									br := toRespWithArchive(r.Context(), db, &h.Bookmark)
 									if h.Excerpt.Valid {
 										ex := h.Excerpt.String
 										br.Excerpt = &ex
 									}
 									resp = append(resp, br)
 								}
 							} else {
 								listErr = e
 							}
 						}
 					} else {
 						if hits, e := db.SearchPublicBookmarksWithExcerpt(r.Context(), u.ID, query, size, offset); e == nil {
 							resp = make([]bookmarkResponse, 0, len(hits))
 							for i := range hits {
 								h := hits[i]
 								br := toRespWithArchive(r.Context(), db, &h.Bookmark)
 								if h.Excerpt.Valid {
 									ex := h.Excerpt.String
 									br.Excerpt = &ex
 								}
 								resp = append(resp, br)
 							}
 						} else {
 							listErr = e
 						}
 					}
 					if listErr == nil {
 						if b, err := json.Marshal(resp); err == nil {
 							view := "public"
 							if isOwnerAuthorized(r, u, db) {
 								view = "self"
 							}
 							inject := []byte("<script>window.MARKY_INITIAL={view:'" + view + "',user:" + strconv.Quote(u.Username) + ",results:" + string(b) + "}</script>\n")
 							marker := []byte("<script src=\"/app.js\"></script>")
 							if i := bytes.Index(html, marker); i >= 0 {
 								out := make([]byte, 0, len(html)+len(inject))
 								out = append(out, html[:i]...)
 								out = append(out, inject...)
 								out = append(out, html[i:]...)
 								html = out
 							}
 						}
 					}
 				} else {
 					var items []Bookmark
 					if isOwnerAuthorized(r, u, db) {
 						switch strings.ToLower(vis) {
 						case "public":
 							items, err = db.ListPublicBookmarks(r.Context(), u.ID, size, offset)
 						case "private":
 							items, err = db.ListPrivateBookmarks(r.Context(), u.ID, size, offset)
 						default:
 							items, err = db.ListBookmarks(r.Context(), u.ID, size, offset)
 						}
 					} else {
 						items, err = db.ListPublicBookmarks(r.Context(), u.ID, size, offset)
 					}
 					if err == nil {
 						resp := make([]bookmarkResponse, 0, len(items))
 						for i := range items {
 							resp = append(resp, toRespWithArchive(r.Context(), db, &items[i]))
 						}
 						if b, err := json.Marshal(resp); err == nil {
 							view := "public"
 							if isOwnerAuthorized(r, u, db) {
 								view = "self"
 							}
 							inject := []byte("<script>window.MARKY_INITIAL={view:'" + view + "',user:" + strconv.Quote(u.Username) + ",results:" + string(b) + "}</script>\n")
 							marker := []byte("<script src=\"/app.js\"></script>")
 							if i := bytes.Index(html, marker); i >= 0 {
 								out := make([]byte, 0, len(html)+len(inject))
 								out = append(out, html[:i]...)
 								out = append(out, inject...)
 								out = append(out, html[i:]...)
 								html = out
 							}
 						}
 					}
 				}
 				// Embed pagination meta (search-aware)
 				total := 0
 				if query != "" {
 					if isOwnerAuthorized(r, u, db) {
 						switch strings.ToLower(vis) {
 						case "public":
 							if n, e := db.CountSearchPublicBookmarks(r.Context(), u.ID, query); e == nil {
 								total = n
 							}
 						case "private":
 							if n, e := db.CountSearchPrivateBookmarks(r.Context(), u.ID, query); e == nil {
 								total = n
 							}
 						default:
 							if n, e := db.CountSearchBookmarks(r.Context(), u.ID, query); e == nil {
 								total = n
 							}
 						}
 					} else {
 						if n, e := db.CountSearchPublicBookmarks(r.Context(), u.ID, query); e == nil {
 							total = n
 						}
 					}
 				} else {
 					if isOwnerAuthorized(r, u, db) {
 						switch strings.ToLower(vis) {
 						case "public":
 							if n, e := db.CountPublicBookmarks(r.Context(), u.ID); e == nil {
 								total = n
 							}
 						case "private":
 							if n, e := db.CountPrivateBookmarks(r.Context(), u.ID); e == nil {
 								total = n
 							}
 						default:
 							if n, e := db.CountBookmarks(r.Context(), u.ID); e == nil {
 								total = n
 							}
 						}
 					} else {
 						if n, e := db.CountPublicBookmarks(r.Context(), u.ID); e == nil {
 							total = n
 						}
 					}
 				}
 				totalPages := 1
 				if size > 0 {
 					totalPages = (total + size - 1) / size
 				}
 				if totalPages < 1 {
 					totalPages = 1
 				}
 				pageObj := map[string]any{"page": page, "size": size, "total": totalPages, "count": total, "username": u.Username, "owner": isOwnerAuthorized(r, u, db)}
 				if query != "" {
 					pageObj["query"] = query
 					pageObj["queryEncoded"] = url.QueryEscape(query)
 				}
 				if isOwnerAuthorized(r, u, db) {
 					pageObj["vis"] = vis
 				}
 				if pb, e := json.Marshal(pageObj); e == nil {
 					pinject := []byte("<script>window.MARKY_PAGINATION=" + string(pb) + "</script>\n")
 					marker := []byte("<script src=\"/app.js\"></script>")
 					if i := bytes.Index(html, marker); i >= 0 {
 						out := make([]byte, 0, len(html)+len(pinject))
 						out = append(out, html[:i]...)
 						out = append(out, pinject...)
 						out = append(out, html[i:]...)
 						html = out
 					}
 				}
 
 				html = applyCacheBust(html)
 				w.Header().Set("Content-Type", "text/html; charset=utf-8")
 				_, _ = w.Write(html)
 				return
 			}
 			http.NotFound(w, r)
 			return
 		}
 		// Legacy feeds like /{username}.json or /{username}.rss → 404
 		if !strings.Contains(p, "/") && (strings.HasSuffix(p, ".json") || strings.HasSuffix(p, ".rss")) {
 			http.NotFound(w, r)
 			return
 		}
 		// Unknown single segment that isn't a file → 404
 		if !strings.Contains(p, "/") && !strings.Contains(p, ".") {
 			http.NotFound(w, r)
 			return
 		}
 		// Fallback to static server
 		static.ServeHTTP(w, r)
 	})
 
 	// Shared handler for JSON and RSS
 	bookmarksHandler := func(w http.ResponseWriter, r *http.Request) {
 		switch r.Method {
 		case http.MethodPost:
 			uid, ok := userIDFromRequest(r, db)
 			if !ok {
 				http.Error(w, "unauthorized", http.StatusUnauthorized)
 				return
 			}
 			if r.Header.Get("Content-Type") != "" {
 				ct := r.Header.Get("Content-Type")
 				if ct != "application/json" && ct != "application/json; charset=utf-8" && ct != "application/json;charset=utf-8" {
 					if ct != "" && len(ct) >= 16 && ct[:16] != "application/json" {
 						http.Error(w, "unsupported media type", http.StatusUnsupportedMediaType)
 						return
 					}
 				}
 			}
 			decoder := json.NewDecoder(r.Body)
 			decoder.DisallowUnknownFields()
 			var req createBookmarkRequest
 			if err := decoder.Decode(&req); err != nil {
 				http.Error(w, "invalid JSON payload", http.StatusBadRequest)
 				return
 			}
 			if req.URL == "" {
 				http.Error(w, "url is required", http.StatusBadRequest)
 				return
 			}
 
 			if _, err := url.ParseRequestURI(req.URL); err != nil {
 				http.Error(w, "invalid url", http.StatusBadRequest)
 				return
 			}
 			// Strip common tracking params (utm*, gclid, fbclid, etc.) from the URL before processing
 			sanitizedURL := stripTrackingParams(req.URL)
 			req.URL = sanitizedURL
 			ctx, cancel := context.WithTimeout(r.Context(), 45*time.Second)
 			defer cancel()
 			isHTML := IsHTMLURL(ctx, req.URL)
 			var fetchedTitle, txt string
 			var err error
 			if isHTML {
 				fetchedTitle, txt, err = TitleAndText(ctx, req.URL)
 				if err != nil {
 					// Fallback: if HTML fetch fails, try w3m directly to get plaintext
 					if path, err2 := exec.LookPath("w3m"); err2 == nil && path != "" {
 						if out, err3 := w3mDump(ctx, req.URL); err3 == nil && strings.TrimSpace(out) != "" {
 							txt = strings.TrimSpace(out)
 							fetchedTitle = ""
 							err = nil
 						}
 					}
 				}
 				if err != nil {
 					http.Error(w, "failed to archive URL", http.StatusUnprocessableEntity)
 					return
 				}
 			}
 			title := req.Title
 			if strings.TrimSpace(title) == "" {
 				if strings.TrimSpace(fetchedTitle) != "" {
 					title = fetchedTitle
 				} else if fn := fileNameFromURL(req.URL); fn != "" {
 					title = fn
 				} else {
 					title = req.URL
 				}
 			}
 			pub := false
 			if req.Public != nil {
 				pub = *req.Public
 			}
 			ref := ""
 			if req.Referrer != nil {
 				ref = *req.Referrer
 			}
 
 			if existing, err := db.GetBookmarkByURL(r.Context(), uid, req.URL); err != nil {
 				log.Printf("lookup by url error: %v", err)
 				http.Error(w, "internal server error", http.StatusInternalServerError)
 				return
 			} else if existing != nil {
 				// Merge metadata updates per request: title (if non-blank),
 				// description (if provided and non-blank; otherwise preserve),
 				// and public (if provided; otherwise preserve).
 				newTitle := existing.Title
 				if strings.TrimSpace(req.Title) != "" {
 					newTitle = req.Title
 				}
 				var newDesc *string
 				if req.Description == nil || strings.TrimSpace(*req.Description) == "" {
 					if existing.Description.Valid {
 						d := existing.Description.String
 						newDesc = &d
 					} else {
 						newDesc = nil
 					}
 				} else {
 					newDesc = req.Description
 				}
 				newPub := existing.Public
 				if req.Public != nil {
 					newPub = *req.Public
 				}
 
 				// Apply metadata update first so archive reindex uses latest fields.
 				// Include referrer when provided; otherwise preserve existing.
 				newRef := existing.Referrer.String
 				if req.Referrer != nil {
 					newRef = *req.Referrer
 				}
 				updated, err := db.UpdateBookmarkWithReferrer(r.Context(), existing.ID, existing.URL, newTitle, newDesc, newPub, newRef)
 				if err != nil || updated == nil {
 					if err != nil {
 						log.Printf("update existing bookmark error: %v", err)
 					}
 					http.Error(w, "internal server error", http.StatusInternalServerError)
 					return
 				}
 				if isHTML {
 					if err := db.SaveArchive(r.Context(), existing.ID, txt); err != nil {
 						log.Printf("save archive error: %v", err)
 						http.Error(w, "internal server error", http.StatusInternalServerError)
 						return
 					}
 				}
 				w.Header().Set("Content-Type", "application/json")
 				_ = json.NewEncoder(w).Encode(toRespWithArchive(r.Context(), db, updated))
 				return
 			} else {
 				var created *Bookmark
 				if isHTML {
 					created, err = db.CreateBookmarkWithArchive(r.Context(), uid, req.URL, title, req.Description, pub, txt)
 				} else {
 					created, err = db.CreateBookmarkNoArchive(r.Context(), uid, req.URL, title, req.Description, pub)
 				}
 				if err != nil {
 					log.Printf("create bookmark with archive error: %v", err)
 					http.Error(w, "internal server error", http.StatusInternalServerError)
 					return
 				}
 				if strings.TrimSpace(ref) != "" {
 					// Persist referrer via a focused update to avoid changing other fields
 					_, _ = db.sql.ExecContext(r.Context(), `UPDATE bookmarks SET referrer = ? WHERE id = ?`, ref, created.ID)
 					// Reload to include referrer in response
 					if b2, _ := db.GetBookmark(r.Context(), created.ID); b2 != nil {
 						created = b2
 					}
 				}
 				w.Header().Set("Content-Type", "application/json")
 				w.WriteHeader(http.StatusCreated)
 				_ = json.NewEncoder(w).Encode(toRespWithArchive(r.Context(), db, created))
 			}
 
 		case http.MethodGet:
 			uid, _ := userIDFromRequest(r, db)
 			if uid == 0 {
 				http.Error(w, "unauthorized", http.StatusUnauthorized)
 				return
 			}
 			q := r.URL.Query()
 			limit := 50
 			offset := 0
 			query := strings.TrimSpace(q.Get("q"))
 			if s := q.Get("limit"); s != "" {
 				if v, err := strconv.Atoi(s); err == nil && v > 0 {
 					if v > 200 {
 						v = 200
 					}
 					limit = v
 				} else if s != "" {
 					http.Error(w, "invalid limit", http.StatusBadRequest)
 					return
 				}
 			}
 			if s := q.Get("offset"); s != "" {
 				if v, err := strconv.Atoi(s); err == nil && v >= 0 {
 					offset = v
 				} else {
 					http.Error(w, "invalid offset", http.StatusBadRequest)
 					return
 				}
 			}
 
 			var resp []bookmarkResponse
 			if query != "" {
 				hits, err := db.SearchBookmarksWithExcerpt(r.Context(), uid, query, limit, offset)
 				if err != nil {
 					log.Printf("list bookmarks error: %v", err)
 					http.Error(w, "internal server error", http.StatusInternalServerError)
 					return
 				}
 				resp = make([]bookmarkResponse, 0, len(hits))
 				for i := range hits {
 					h := hits[i]
 					br := toRespWithArchive(r.Context(), db, &h.Bookmark)
 					if h.Excerpt.Valid {
 						ex := h.Excerpt.String
 						br.Excerpt = &ex
 					}
 					resp = append(resp, br)
 				}
 			} else {
 				items, err := db.ListBookmarks(r.Context(), uid, limit, offset)
 				if err != nil {
 					log.Printf("list bookmarks error: %v", err)
 					http.Error(w, "internal server error", http.StatusInternalServerError)
 					return
 				}
 				resp = make([]bookmarkResponse, 0, len(items))
 				for i := range items {
 					b := items[i]
 					resp = append(resp, toRespWithArchive(r.Context(), db, &b))
 				}
 			}
 
 			wantsRSS := r.URL.Path == "/bookmarks.xml" || strings.EqualFold(r.URL.Query().Get("format"), "rss") || strings.Contains(r.Header.Get("Accept"), "application/rss+xml")
 			if wantsRSS {
 				w.Header().Set("Content-Type", "application/rss+xml; charset=utf-8")
 				feedTitle := "Bookmarks"
 				if uid > 0 {
 					if u, err := db.GetUserByID(r.Context(), uid); err == nil && u != nil {
 						feedTitle = fmt.Sprintf("%s's Bookmarks", u.Username)
 					}
 				}
 				if err := writeRSS(w, r, resp, feedTitle); err != nil {
 					log.Printf("write rss error: %v", err)
 					http.Error(w, "internal server error", http.StatusInternalServerError)
 				}
 				return
 			}
 			w.Header().Set("Content-Type", "application/json")
 			_ = json.NewEncoder(w).Encode(resp)
 
 		default:
 			w.Header().Set("Allow", http.MethodGet+", "+http.MethodPost)
 			http.Error(w, "method not allowed", http.StatusMethodNotAllowed)
 		}
 	}
 	mux.HandleFunc("/bookmarks", bookmarksHandler)
 	mux.HandleFunc("/bookmarks.xml", bookmarksHandler)
 
 	// Archive, PUT, DELETE under /bookmarks/{id}
 	mux.HandleFunc("/bookmarks/", func(w http.ResponseWriter, r *http.Request) {
 		path := r.URL.Path
 		rest := strings.TrimPrefix(path, "/bookmarks/")
 		if rest == "" || strings.HasPrefix(rest, "/") {
 			http.NotFound(w, r)
 			return
 		}
 		if strings.HasSuffix(rest, "/archive") {
 			idPart := strings.TrimSuffix(rest, "/archive")
 			idPart = strings.TrimSuffix(idPart, "/")
 			id64, err := strconv.ParseInt(idPart, 10, 64)
 			if err != nil || id64 <= 0 {
 				http.Error(w, "invalid id", http.StatusBadRequest)
 				return
 			}
 			switch r.Method {
 			case http.MethodGet:
 				// Enforce public/private visibility
 				b, err := db.GetBookmark(r.Context(), id64)
 				if err != nil {
 					log.Printf("lookup bookmark error: %v", err)
 					http.Error(w, "internal server error", http.StatusInternalServerError)
 					return
 				}
 				if b == nil {
 					http.NotFound(w, r)
 					return
 				}
 				uid, _ := userIDFromRequest(r, db)
 				isOwner := (uid > 0 && uid == b.UserID)
 				if !b.Public && !isOwner {
 					http.NotFound(w, r)
 					return
 				}
 
 				content, _, ok, err := db.GetArchive(r.Context(), id64)
 				if err != nil {
 					log.Printf("get archive error: %v", err)
 					http.Error(w, "internal server error", http.StatusInternalServerError)
 					return
 				}
 				if !ok {
 					// Only the owner may fetch on-demand
 					if isOwner && (r.URL.Query().Get("fetch") == "1" || r.URL.Query().Get("fetch") == "true") {
 						ctx, cancel := context.WithTimeout(r.Context(), 30*time.Second)
 						defer cancel()
 						if !IsHTMLURL(ctx, b.URL) {
 							http.NotFound(w, r)
 							return
 						}
 						txt, err := ArchiveToText(ctx, b.URL)
 						if err != nil {
 							http.Error(w, "failed to fetch archive", http.StatusUnprocessableEntity)
 							return
 						}
 						if err := db.SaveArchive(ctx, id64, txt); err != nil {
 							log.Printf("save archive error: %v", err)
 							http.Error(w, "internal server error", http.StatusInternalServerError)
 							return
 						}
 						content = txt
 						ok = true
 					}
 				}
 				if !ok {
 					http.NotFound(w, r)
 					return
 				}
 				w.Header().Set("Content-Type", "text/plain; charset=utf-8")
 				_, _ = w.Write([]byte(content))
 			default:
 				w.Header().Set("Allow", http.MethodGet)
 				http.Error(w, "method not allowed", http.StatusMethodNotAllowed)
 			}
 			return
 		}
 
 		idPart := strings.TrimSuffix(rest, "/")
 		if strings.Contains(idPart, "/") {
 			http.NotFound(w, r)
 			return
 		}
 		id64, err := strconv.ParseInt(idPart, 10, 64)
 		if err != nil || id64 <= 0 {
 			http.Error(w, "invalid id", http.StatusBadRequest)
 			return
 		}
 		switch r.Method {
 		case http.MethodPut:
 			if _, ok := userIDFromRequest(r, db); !ok {
 				http.Error(w, "unauthorized", http.StatusUnauthorized)
 				return
 			}
 			decoder := json.NewDecoder(r.Body)
 			decoder.DisallowUnknownFields()
 			var req createBookmarkRequest
 			if err := decoder.Decode(&req); err != nil {
 				http.Error(w, "invalid JSON payload", http.StatusBadRequest)
 				return
 			}
 			if strings.TrimSpace(req.URL) == "" || strings.TrimSpace(req.Title) == "" {
 				http.Error(w, "url and title are required", http.StatusBadRequest)
 				return
 			}
 			// Load existing to compare URL and preserve fields.
 			existing, err := db.GetBookmark(r.Context(), id64)
 			if err != nil {
 				log.Printf("get bookmark error: %v", err)
 				http.Error(w, "internal server error", http.StatusInternalServerError)
 				return
 			}
 			if existing == nil {
 				http.NotFound(w, r)
 				return
 			}
 			desc := req.Description
 			var pub bool
 			if desc == nil && existing.Description.Valid {
 				d := existing.Description.String
 				desc = &d
 			}
 			if req.Public == nil {
 				pub = existing.Public
 			}
 			if req.Public != nil {
 				pub = *req.Public
 			}
 
 			// If URL changed, try to refetch archive for the new URL before updating.
 			urlChanged := strings.TrimSpace(req.URL) != existing.URL
 			var newArchive string
 			var shouldArchive bool
 			if urlChanged {
 				ctx, cancel := context.WithTimeout(r.Context(), 45*time.Second)
 				defer cancel()
 				if IsHTMLURL(ctx, req.URL) {
 					shouldArchive = true
 					_, txt, err := TitleAndText(ctx, req.URL)
 					if err != nil {
 						http.Error(w, "failed to archive URL", http.StatusUnprocessableEntity)
 						return
 					}
 					newArchive = txt
 				} else {
 					shouldArchive = false
 				}
 			}
 
 			// Sanitize URL and include referrer when provided; otherwise preserve existing value
 			req.URL = stripTrackingParams(req.URL)
 			newRef := existing.Referrer.String
 			if req.Referrer != nil {
 				newRef = *req.Referrer
 			}
 			updated, err := db.UpdateBookmarkWithReferrer(r.Context(), id64, req.URL, req.Title, desc, pub, newRef)
 			if err != nil {
 				log.Printf("update bookmark error: %v", err)
 				http.Error(w, "internal server error", http.StatusInternalServerError)
 				return
 			}
 			if updated == nil {
 				http.NotFound(w, r)
 				return
 			}
 			// Apply archive changes if URL changed
 			if urlChanged {
 				if shouldArchive {
 					if err := db.SaveArchive(r.Context(), id64, newArchive); err != nil {
 						log.Printf("save archive after URL change error: %v", err)
 						http.Error(w, "internal server error", http.StatusInternalServerError)
 						return
 					}
 				} else {
 					if err := db.DeleteArchive(r.Context(), id64); err != nil {
 						log.Printf("delete archive after URL change error: %v", err)
 						http.Error(w, "internal server error", http.StatusInternalServerError)
 						return
 					}
 				}
 			}
 			w.Header().Set("Content-Type", "application/json")
 			_ = json.NewEncoder(w).Encode(toRespWithArchive(r.Context(), db, updated))
 		case http.MethodDelete:
 			if _, ok := userIDFromRequest(r, db); !ok {
 				http.Error(w, "unauthorized", http.StatusUnauthorized)
 				return
 			}
 			ok, err := db.DeleteBookmark(r.Context(), id64)
 			if err != nil {
 				log.Printf("delete bookmark error: %v", err)
 				http.Error(w, "internal server error", http.StatusInternalServerError)
 				return
 			}
 			if !ok {
 				http.NotFound(w, r)
 				return
 			}
 			w.WriteHeader(http.StatusNoContent)
 		default:
 			w.Header().Set("Allow", http.MethodPut+", "+http.MethodDelete+", "+http.MethodGet)
 			http.Error(w, "method not allowed", http.StatusMethodNotAllowed)
 		}
 	})
 
 	return mux, nil
 }
 
 // originFromRequest determines the request origin (scheme://host), honoring
 // standard reverse-proxy headers when present. This supports deployments
 // behind TLS-terminating proxies like Cloudflare or nginx.
 func originFromRequest(r *http.Request) string {
 	// CLI-configured override takes highest precedence
 	if baseURLOverride != "" {
 		return baseURLOverride
 	}
 	// Explicit override via environment, e.g. MARKY_BASE_URL=https://example.com
 	if base := strings.TrimSpace(os.Getenv("MARKY_BASE_URL")); base != "" {
 		return strings.TrimRight(base, "/")
 	}
 	// Default scheme based on connection
 	scheme := "http"
 	if r.TLS != nil {
 		scheme = "https"
 	}
 
 	// Prefer standard proxy headers when present
 	if xfp := r.Header.Get("X-Forwarded-Proto"); xfp != "" {
 		// May be a comma-separated list; take the first value
 		first := strings.ToLower(strings.TrimSpace(strings.Split(xfp, ",")[0]))
 		if first == "https" || first == "http" {
 			scheme = first
 		}
 	} else if cfv := r.Header.Get("Cf-Visitor"); cfv != "" { // Cloudflare
 		l := strings.ToLower(cfv)
 		if strings.Contains(l, "\"https\"") || strings.Contains(l, "https") { // {"scheme":"https"}
 			scheme = "https"
 		} else if strings.Contains(l, "http") {
 			scheme = "http"
 		}
 	} else if xs := r.Header.Get("X-Forwarded-Scheme"); xs != "" { // some proxies
 		first := strings.ToLower(strings.TrimSpace(strings.Split(xs, ",")[0]))
 		if first == "https" || first == "http" {
 			scheme = first
 		}
 	} else if xfssl := r.Header.Get("X-Forwarded-Ssl"); xfssl != "" { // nginx/common: on/off
 		if strings.EqualFold(strings.TrimSpace(strings.Split(xfssl, ",")[0]), "on") {
 			scheme = "https"
 		}
 	} else if fwd := r.Header.Get("Forwarded"); fwd != "" {
 		// Parse Forwarded header (RFC 7239), look for proto=
 		// Example: Forwarded: for=1.2.3.4; proto=https; host=example.com
 		// The header may contain multiple entries separated by commas; use the first
 		first := strings.Split(fwd, ",")[0]
 		for _, part := range strings.Split(first, ";") {
 			kv := strings.SplitN(strings.TrimSpace(part), "=", 2)
 			if len(kv) == 2 && strings.ToLower(strings.TrimSpace(kv[0])) == "proto" {
 				v := strings.Trim(kv[1], "\"')")
 				v = strings.ToLower(strings.TrimSpace(v))
 				if v == "https" || v == "http" {
 					scheme = v
 				}
 				break
 			}
 		}
 	}
 
 	host := r.Host
 	if xfh := r.Header.Get("X-Forwarded-Host"); xfh != "" {
 		host = strings.TrimSpace(strings.Split(xfh, ",")[0])
 	} else if fwd := r.Header.Get("Forwarded"); fwd != "" {
 		// Parse host= from Forwarded header
 		first := strings.Split(fwd, ",")[0]
 		for _, part := range strings.Split(first, ";") {
 			kv := strings.SplitN(strings.TrimSpace(part), "=", 2)
 			if len(kv) == 2 && strings.ToLower(strings.TrimSpace(kv[0])) == "host" {
 				v := strings.Trim(kv[1], "\"')")
 				if v != "" {
 					host = v
 				}
 				break
 			}
 		}
 	}
 	return scheme + "://" + host
 }
 
 // userIDFromRequest resolves the user ID using either a signed session cookie
 // or HTTP Basic auth where the username is the account username and the
 // password is the API token.
 func userIDFromRequest(r *http.Request, db *DB) (int64, bool) {
 	if uid, ok := CurrentUserID(r); ok {
 		return uid, true
 	}
 	if u, p, ok := r.BasicAuth(); ok {
 		if u == "" || p == "" {
 			return 0, false
 		}
 		usr, err := db.GetUserByUsername(r.Context(), u)
 		if err != nil || usr == nil {
 			return 0, false
 		}
 		if usr.APIToken != nil && *usr.APIToken == p {
 			return usr.ID, true
 		}
 	}
 	return 0, false
 }
 
 // isOwnerAuthorized checks if the request authenticates as the given user via
 // (1) session cookie, (2) HTTP Basic (username + API token), (3) X-API-Token
 // header, or (4) token query parameter.
 func isOwnerAuthorized(r *http.Request, u *User, db *DB) bool {
 	if uid, ok := CurrentUserID(r); ok && uid == u.ID {
 		return true
 	}
 	if user, pass, ok := r.BasicAuth(); ok {
 		if user == u.Username && u.APIToken != nil && *u.APIToken == pass {
 			return true
 		}
 	}
 	if tok := r.Header.Get("X-API-Token"); tok != "" && u.APIToken != nil && *u.APIToken == tok {
 		return true
 	}
 	if tok := r.URL.Query().Get("token"); tok != "" && u.APIToken != nil && *u.APIToken == tok {
 		return true
 	}
 	return false
 }
 
 type createBookmarkRequest struct {
 	URL         string  `json:"url"`
 	Title       string  `json:"title"`
 	Description *string `json:"description,omitempty"`
 	Public      *bool   `json:"public,omitempty"`
 	Referrer    *string `json:"referrer,omitempty"`
 }
 
 type bookmarkResponse struct {
 	ID          int64     `json:"id"`
 	URL         string    `json:"url"`
 	Title       string    `json:"title"`
 	Description *string   `json:"description,omitempty"`
 	CreatedAt   time.Time `json:"created_at"`
 	UpdatedAt   time.Time `json:"updated_at"`
 	Excerpt     *string   `json:"excerpt,omitempty"`
 	Public      bool      `json:"public"`
 	HasArchive  bool      `json:"has_archive"`
 	Referrer    *string   `json:"referrer,omitempty"`
 }
 
 func toResp(b *Bookmark) bookmarkResponse {
 	var desc *string
 	if b.Description.Valid {
 		desc = &b.Description.String
 	}
 	var ref *string
 	if b.Referrer.Valid && strings.TrimSpace(b.Referrer.String) != "" {
 		s := b.Referrer.String
 		ref = &s
 	}
 	return bookmarkResponse{
 		ID:          b.ID,
 		URL:         b.URL,
 		Title:       b.Title,
 		Description: desc,
 		CreatedAt:   b.CreatedAt,
 		UpdatedAt:   b.UpdatedAt,
 		Public:      b.Public,
 		Referrer:    ref,
 	}
 }
 
 func toRespWithArchive(ctx context.Context, db *DB, b *Bookmark) bookmarkResponse {
 	br := toResp(b)
 	if ok, err := db.HasArchive(ctx, b.ID); err == nil {
 		br.HasArchive = ok
 	}
 	return br
 }
 
 // stripTrackingParams removes common tracking parameters from a URL's query string.
 // It strips keys that start with "utm" (case-insensitive) and a denylist of known trackers
 // such as gclid, fbclid, ueid, mc_cid, mc_eid, mkt_tok, _hsmi, _hsenc, igshid, etc.
 func stripTrackingParams(raw string) string {
 	u, err := url.Parse(raw)
 	if err != nil {
 		return raw
 	}
 	if u.RawQuery == "" {
 		return raw
 	}
 	q := u.Query()
 	changed := false
 	deny := map[string]struct{}{
 		// Google / Facebook / Mailchimp / HubSpot / others
 		"gclid": {}, "fbclid": {}, "ueid": {},
 		"mc_cid": {}, "mc_eid": {},
 		"mkt_tok": {}, "_hsmi": {}, "_hsenc": {},
 		"igshid": {},
 		// common generic trackers
 		"utm": {}, // handled by prefix match, keep for clarity
 	}
 	for key := range q {
 		lk := strings.ToLower(key)
 		if strings.HasPrefix(lk, "utm") {
 			q.Del(key)
 			changed = true
 			continue
 		}
 		if _, ok := deny[lk]; ok {
 			q.Del(key)
 			changed = true
 			continue
 		}
 	}
 	if !changed {
 		return raw
 	}
 	u.RawQuery = q.Encode()
 	// If nothing left, ensure the URL doesn't end with a bare '?'
 	return u.String()
 }
 
 // RSS structures and writer
 type rssFeed struct {
 	XMLName xml.Name   `xml:"rss"`
 	Version string     `xml:"version,attr"`
 	Channel rssChannel `xml:"channel"`
 }
 type rssChannel struct {
 	Title       string    `xml:"title"`
 	Link        string    `xml:"link"`
 	Description string    `xml:"description"`
 	Items       []rssItem `xml:"item"`
 }
 type rssItem struct {
 	Title       string `xml:"title"`
 	Link        string `xml:"link"`
 	GUID        string `xml:"guid"`
 	Description string `xml:"description,omitempty"`
 	PubDate     string `xml:"pubDate"`
 }
 
 func writeRSS(w http.ResponseWriter, r *http.Request, items []bookmarkResponse, title string) error {
 	chanTitle := strings.TrimSpace(title)
 	if chanTitle == "" {
 		chanTitle = "Bookmarks"
 	}
 	chanLink := ""
 	if r != nil && r.Host != "" {
 		chanLink = strings.TrimRight(originFromRequest(r), "/") + "/bookmarks"
 	}
 	chanDesc := chanTitle
 	out := rssFeed{Version: "2.0", Channel: rssChannel{Title: chanTitle, Link: chanLink, Description: chanDesc}}
 	out.Channel.Items = make([]rssItem, 0, len(items))
 	for _, b := range items {
 		desc := ""
 		if b.Excerpt != nil && *b.Excerpt != "" {
 			desc = *b.Excerpt
 		} else if b.Description != nil {
 			desc = *b.Description
 		}
 		guid := fmt.Sprintf("marky:%d", b.ID)
 		if chanLink != "" {
 			guid = fmt.Sprintf("%s/%d", strings.TrimRight(chanLink, "/"), b.ID)
 		}
 		out.Channel.Items = append(out.Channel.Items, rssItem{
 			Title:       b.Title,
 			Link:        b.URL,
 			GUID:        guid,
 			Description: desc,
 			PubDate:     b.UpdatedAt.Format(time.RFC1123Z),
 		})
 	}
 	enc := xml.NewEncoder(w)
 	enc.Indent("", "  ")
 	return enc.Encode(out)
 }
 
 // fileNameFromURL extracts a human-friendly filename from a URL path.
 // It returns an empty string when no filename can be determined.
 func fileNameFromURL(raw string) string {
 	u, err := url.Parse(raw)
 	if err != nil || u == nil {
 		return ""
 	}
 	p := strings.TrimSuffix(u.Path, "/")
 	base := path.Base(p)
 	if base == "." || base == "/" || base == "" {
 		return ""
 	}
 	if un, err := url.PathUnescape(base); err == nil && un != "" {
 		base = un
 	}
 	return base
 }