7ae492a4
web: draw assets, pages, csrf and the middleware from ecore
Deletes this package's copies of five things the instance now shares. assets replaces hashedCSSRe, hashedBundleRe, resolveCSSHref, resolveBundleHref and the bare StripPrefix(FileServer) route. That route was a fix and not only a dedupe: an http.FileServer answers a directory with a listing, so /static/ published the whole inventory of the binary — every vendored artefact and the hashed names that fingerprint the build — as a public, hour-cacheable page. It also wrote the cache directives onto the header map before delegating, where a panic later would have carried public, max-age=3600 onto a viewer's error page, and left the Vary the private-cache policy sets, which is enough to stop any shared cache from ever reusing an asset whose name was hashed for that purpose. assets.Handler refuses the listing, stamps the policy on the bytes rather than on the map, and drops the Vary per asset. pages replaces pageNames, the package-level template map, render and errorData. Pages are discovered from the embedded tree instead of listed by hand, so templates/x.html is now the whole registration of a page, and a page that defines no content block is refused at startup rather than served as chrome around a hole with a 200 — neither of which this service checked before. Render answers the response itself; the error it returns is a log line and never reaches fail. The local error.html goes with them: ecore ships the page and the srht-error partial. renderError stays here, because building this service's view struct is this service's business, and it now passes for every status but 400 so a repository the viewer may not see and one that never existed produce the same sentence. csrf.Require and the middleware group are new rather than replacements: compare has no POST today, so the guard covers the day somebody adds one, and PrivateCache states the policy every per-viewer page here was serving without. BundleHref leaves viewData for chrome.Service.Assets, keyed bundle.js and read through an emptiness guard, next to StyleHref where the other hashed artefact already lived. The date helper goes to chrome's reltime and abstime: listings show 3 days ago and hover to the exact stamp.
bigbes <bigbes@gmail.com> — 2026-08-08 19:44:55 UTC
Commit 7ae492a421bbb74f1aab54870956ecfdf2dec57c —
view raw patch
Parent(s):
1a83202b
| File | Status | + | − |
|---|---|---|---|
web/handlers.go
|
M | +14 | -2 |
web/router.go
|
M | +44 | -28 |
web/server.go
|
M | +64 | -69 |
web/templates.go
|
M | +43 | -59 |
web/templates/commit.html
|
M | +6 | -2 |
web/templates/compare.html
|
M | +3 | -2 |
web/templates/layout.html
|
M | +7 | -3 |
web/templates/repo.html
|
M | +1 | -1 |
web/web_test.go
|
M | +141 | -39 |