marky

static.go (3342B)

---

 package internal
 
 import (
 	"bytes"
 	"crypto/sha256"
 	"embed"
 	"fmt"
 	"io/fs"
 	"net/http"
 	"path"
 	"strings"
 )
 
 //go:embed web/*
 var webAssets embed.FS
 
 // StaticHandler returns an http.Handler serving the embedded web UI files only.
 // Unknown paths return 404 (no SPA fallback).
 func StaticHandler() (http.Handler, error) { return StaticHandlerWithConfig(HandlerConfig{}) }
 
 // StaticHandlerWithConfig serves the embedded UI, injecting runtime config.
 func StaticHandlerWithConfig(cfg HandlerConfig) (http.Handler, error) {
 	sub, err := fs.Sub(webAssets, "web")
 	if err != nil {
 		return nil, err
 	}
 	fsys := http.FS(sub)
 	fileServer := http.FileServer(fsys)
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		p := strings.TrimPrefix(r.URL.Path, "/")
 		// Root should serve the login page (index)
 		if p == "" {
 			if html, err := RenderPage("login.html", cfg); err == nil {
 				html = applyCacheBust(html)
 				w.Header().Set("Content-Type", "text/html; charset=utf-8")
 				_, _ = w.Write(html)
 				return
 			}
 		}
 		// Try to stat the requested file
 		if f, err := fs.Stat(sub, path.Clean(p)); err == nil && !f.IsDir() {
 			fileServer.ServeHTTP(w, r)
 			return
 		}
 		// Unknown file: 404
 		http.NotFound(w, r)
 	}), nil
 }
 
 // RenderPage reads an embedded HTML page under internal/web and injects the
 // shared header and optional runtime config.
 func RenderPage(name string, cfg HandlerConfig) ([]byte, error) {
 	sub, err := fs.Sub(webAssets, "web")
 	if err != nil {
 		return nil, err
 	}
 	pageBytes, err := fs.ReadFile(sub, name)
 	if err != nil {
 		return nil, err
 	}
 	if hb, err := fs.ReadFile(sub, "header.html"); err == nil {
 		if bytes.Contains(pageBytes, []byte("{{HEADER}}")) {
 			pageBytes = bytes.ReplaceAll(pageBytes, []byte("{{HEADER}}"), hb)
 		}
 	}
 	if cfg.DisableSignup {
 		marker := []byte("<script src=\"/app.js\"></script>")
 		if i := bytes.Index(pageBytes, marker); i >= 0 {
 			inject := []byte("<script>window.MARKY_CFG={disableSignup:true}</script>\n")
 			nb := make([]byte, 0, len(pageBytes)+len(inject))
 			nb = append(nb, pageBytes[:i]...)
 			nb = append(nb, inject...)
 			nb = append(nb, pageBytes[i:]...)
 			pageBytes = nb
 		}
 	}
 	return pageBytes, nil
 }
 
 // applyCacheBust appends a short content hash to known asset URLs in HTML,
 // e.g., /app.js?v=abcd1234. This helps CDNs like Cloudflare pick up changes
 // without manual purges.
 func applyCacheBust(html []byte) []byte {
 	sub, err := fs.Sub(webAssets, "web")
 	if err != nil {
 		return html
 	}
 	// Build fingerprint map for assets we serve locally
 	assets := []string{
 		"app.js",
 		"styles.css",
 		"favicon.svg",
 		"apple-touch-icon.png",
 		"favicon-32x32.png",
 		"favicon-16x16.png",
 		"vendor/vue.global.prod.js",
 		"vendor/marked.min.js",
 		"vendor/purify.min.js",
 	}
 	bust := map[string]string{}
 	for _, p := range assets {
 		if b, err := fs.ReadFile(sub, p); err == nil {
 			sum := sha256.Sum256(b)
 			bust[p] = fmt.Sprintf("%x", sum)[:10]
 		}
 	}
 	// Replace src/href occurrences
 	out := html
 	for p, v := range bust {
 		// src="/path"
 		from := []byte("src=\"/" + p + "\"")
 		to := []byte("src=\"/" + p + "?v=" + v + "\"")
 		out = bytes.ReplaceAll(out, from, to)
 		// href="/path"
 		fromH := []byte("href=\"/" + p + "\"")
 		toH := []byte("href=\"/" + p + "?v=" + v + "\"")
 		out = bytes.ReplaceAll(out, fromH, toH)
 	}
 	return out
 }