Admin
a791232f18
Add the browser edge (contract rev 8.2/9): a Preact/Vite SPA under web/, an embedded placeholder bundle, the /web/* auth and action handlers, and the explicit browser-action allowlist. The SPA and the API share the one plaintext :8080 listener; there is no second port and no peer edge, so main.go also drops the mTLS listener and the identity mounts in the debug compose fall away. /_manifest announces the web block only while the SPA is mounted (honesty rule), always with the single service port. The DSNs move to the shared database's scram-sha-256 credentials, matching rev 9's removal of the PKI layer. Committed web/bun.lock because web/package.json and vite.config.ts are new in this commit. src/web/dist/index.html is a hand-written placeholder, not a generated bundle: it keeps bare `go build`/`go vet` working from a clean checkout, while /web/dist (the real build output) stays gitignored.
63 lines
1.9 KiB
Go
63 lines
1.9 KiB
Go
// Copyright (C) 2026 Dcntrlized
|
|
//
|
|
// This program is free software: you can redistribute it and/or modify
|
|
// it under the terms of the GNU Affero General Public License as published
|
|
// by the Free Software Foundation, either version 3 of the License, or
|
|
// (at your option) any later version.
|
|
//
|
|
// This program is distributed in the hope that it will be useful,
|
|
// but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
// GNU Affero General Public License for more details.
|
|
//
|
|
// You should have received a copy of the GNU Affero General Public License
|
|
// along with this program. If not, see <https://www.gnu.org/licenses/>.
|
|
|
|
package web
|
|
|
|
import (
|
|
"net/http"
|
|
"os"
|
|
"strconv"
|
|
)
|
|
|
|
const (
|
|
accessCookie = "dcntrlized_access"
|
|
refreshCookie = "dcntrlized_refresh"
|
|
cookiePath = "/web"
|
|
)
|
|
|
|
func cookieSecure() bool { return os.Getenv(EnvCookieSecure) == "true" }
|
|
|
|
func maxAge(env string, def int) int {
|
|
if v := os.Getenv(env); v != "" {
|
|
if n, err := strconv.Atoi(v); err == nil && n >= 0 {
|
|
return n
|
|
}
|
|
}
|
|
return def
|
|
}
|
|
|
|
func sessionCookie(name, value string, age int) *http.Cookie {
|
|
return &http.Cookie{
|
|
Name: name, Value: value, Path: cookiePath,
|
|
HttpOnly: true, SameSite: http.SameSiteLaxMode,
|
|
Secure: cookieSecure(), MaxAge: age,
|
|
}
|
|
}
|
|
|
|
func setSessionCookies(w http.ResponseWriter, access, refresh string) {
|
|
http.SetCookie(w, sessionCookie(accessCookie, access, maxAge(EnvAccessMaxAge, DefaultAccessMaxAge)))
|
|
http.SetCookie(w, sessionCookie(refreshCookie, refresh, maxAge(EnvRefreshMaxAge, DefaultRefreshMaxAge)))
|
|
}
|
|
|
|
func clearSessionCookies(w http.ResponseWriter) {
|
|
for _, name := range []string{accessCookie, refreshCookie} {
|
|
http.SetCookie(w, &http.Cookie{
|
|
Name: name, Value: "", Path: cookiePath,
|
|
HttpOnly: true, SameSite: http.SameSiteLaxMode,
|
|
Secure: cookieSecure(), MaxAge: -1,
|
|
})
|
|
}
|
|
}
|