web.go

package main

import (
	"bytes"
	"crypto/sha256"
	"embed"
	"encoding/hex"
	"errors"
	"fmt"
	"io/fs"
	"net/http"
	"path"
	"strings"
	"sync"
	"time"
)

// webAssets embeds the app; the serving allowlist excludes source tests and directories.
//
//go:embed web
var webAssets embed.FS

var embeddedRelease = sync.OnceValues(func() (string, error) {
	assets, err := fs.Sub(webAssets, "web")
	if err != nil {
		return "", err
	}
	return assetRelease(assets)
})

const appCSP = "default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self'; connect-src 'self'; worker-src 'self'; manifest-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'; form-action 'self'"

// assetRelease hashes served asset names and bytes in lexical order. Length prefixes
// separate records; source tests and files outside the serving allowlist do not participate.
func assetRelease(assets fs.FS) (string, error) {
	digest := sha256.New()
	err := fs.WalkDir(assets, ".", func(name string, entry fs.DirEntry, err error) error {
		if err != nil {
			return err
		}
		if entry.IsDir() || assetType(name) == "" {
			return nil
		}
		data, err := fs.ReadFile(assets, name)
		if err != nil {
			return err
		}
		_, _ = fmt.Fprintf(digest, "%d:%s:%d:", len(name), name, len(data))
		_, _ = digest.Write(data)
		return nil
	})
	if err != nil {
		return "", err
	}
	return hex.EncodeToString(digest.Sum(nil)), nil
}

func assetType(name string) string {
	if !fs.ValidPath(name) || strings.Contains(name, ".test.") {
		return ""
	}
	if name == "index.html" {
		return "text/html; charset=utf-8"
	}
	if name == "styles.css" {
		return "text/css; charset=utf-8"
	}
	if name == "sw.js" {
		return "text/javascript; charset=utf-8"
	}
	if name == "manifest.webmanifest" {
		return "application/manifest+json"
	}
	if name == "icon.svg" || name == "icon-maskable.svg" {
		return "image/svg+xml"
	}
	if !strings.Contains(name, "/") && !strings.HasPrefix(name, ".") && strings.HasSuffix(name, ".mjs") {
		return "text/javascript; charset=utf-8"
	}
	if strings.HasPrefix(name, "icons/") {
		for _, part := range strings.Split(name, "/") {
			if strings.HasPrefix(part, ".") {
				return ""
			}
		}
		switch path.Ext(name) {
		case ".svg":
			return "image/svg+xml"
		case ".png":
			return "image/png"
		case ".ico":
			return "image/x-icon"
		}
	}
	return ""
}

func serveWeb(w http.ResponseWriter, r *http.Request) {
	name := strings.TrimPrefix(r.URL.Path, "/")
	if name == "" {
		name = "index.html"
	}
	contentType := assetType(name)
	if contentType == "" || (r.Method != http.MethodGet && r.Method != http.MethodHead) {
		writeError(w, r, http.StatusNotFound, errors.New("route not found"))
		return
	}
	assets, err := fs.Sub(webAssets, "web")
	if err != nil {
		writeError(w, r, http.StatusInternalServerError, errors.New("app assets unavailable"))
		return
	}
	data, err := fs.ReadFile(assets, name)
	if err != nil {
		writeError(w, r, http.StatusNotFound, errors.New("route not found"))
		return
	}
	if name == "sw.js" {
		release, err := embeddedRelease()
		if err != nil {
			writeError(w, r, http.StatusInternalServerError, errors.New("app release unavailable"))
			return
		}
		data = bytes.ReplaceAll(data, []byte("__GORACK_RELEASE__"), []byte(release))
	}
	w.Header().Set("Content-Type", contentType)
	w.Header().Set("X-Content-Type-Options", "nosniff")
	w.Header().Set("Content-Security-Policy", appCSP)
	w.Header().Set("Cache-Control", "no-cache")
	http.ServeContent(w, r, name, time.Time{}, bytes.NewReader(data))
}