init

2026-05-14 13:38:41 +02:00
parent 5d1ced594d
commit be7bd79fc7
16 changed files with 1434 additions and 1 deletions
@@ -0,0 +1,318 @@
+package web
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"html/template"
+	"log/slog"
+	"net/http"
+	"strconv"
+	"strings"
+	"time"
+
+	"go-htmx-chat/internal/chat"
+	"go-htmx-chat/internal/store"
+)
+
+type Server struct {
+	store     *store.Store
+	hub       *chat.Hub
+	templates *template.Template
+	logger    *slog.Logger
+	auth      AuthConfig
+	oidc      oidcDiscovery
+}
+
+func NewServer(st *store.Store, hub *chat.Hub, logger *slog.Logger, auth AuthConfig) (*Server, error) {
+	funcs := template.FuncMap{
+		"formatTime": func(t time.Time) string { return t.Format("15:04") },
+		"initial": func(s string) string {
+			s = strings.TrimSpace(s)
+			if s == "" {
+				return "?"
+			}
+			for _, r := range s {
+				return strings.ToUpper(string(r))
+			}
+			return "?"
+		},
+	}
+	tmpl, err := template.New("base").Funcs(funcs).ParseGlob("templates/**/*.html")
+	if err != nil {
+		return nil, err
+	}
+	tmpl, err = tmpl.ParseGlob("templates/*.html")
+	if err != nil {
+		return nil, err
+	}
+
+	srv := &Server{store: st, hub: hub, templates: tmpl, logger: logger, auth: auth}
+	if err := srv.discoverOIDC(); err != nil {
+		return nil, err
+	}
+	return srv, nil
+}
+
+func (s *Server) Routes() http.Handler {
+	mux := http.NewServeMux()
+	mux.Handle("GET /static/", http.StripPrefix("/static/", http.FileServer(http.Dir("static"))))
+	mux.HandleFunc("GET /", s.handleHome)
+	mux.HandleFunc("POST /login", s.handleLogin)
+	mux.HandleFunc("GET /auth/login", s.handleOIDCLogin)
+	mux.HandleFunc("GET /auth/callback", s.handleOIDCCallback)
+	mux.HandleFunc("POST /logout", s.handleLogout)
+	mux.HandleFunc("GET /rooms", s.handleRooms)
+	mux.HandleFunc("POST /rooms", s.handleCreateRoom)
+	mux.HandleFunc("GET /rooms/{id}", s.handleRoom)
+	mux.HandleFunc("POST /rooms/{id}/messages", s.handlePostMessage)
+	mux.HandleFunc("GET /rooms/{id}/events", s.handleEvents)
+	return s.recover(nextSecurityHeaders(mux))
+}
+
+func nextSecurityHeaders(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("X-Content-Type-Options", "nosniff")
+		w.Header().Set("Referrer-Policy", "same-origin")
+		next.ServeHTTP(w, r)
+	})
+}
+
+func (s *Server) recover(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		defer func() {
+			if rec := recover(); rec != nil {
+				s.logger.Error("panic", "error", rec)
+				http.Error(w, "internal server error", http.StatusInternalServerError)
+			}
+		}()
+		next.ServeHTTP(w, r)
+	})
+}
+
+func (s *Server) handleHome(w http.ResponseWriter, r *http.Request) {
+	username := s.currentUser(r)
+	if username == "" {
+		s.render(w, r, "login.html", map[string]any{"Title": "Login", "AuthMode": s.auth.Mode})
+		return
+	}
+	http.Redirect(w, r, "/rooms", http.StatusSeeOther)
+}
+
+func (s *Server) handleLogin(w http.ResponseWriter, r *http.Request) {
+	if s.auth.Mode == AuthModeOIDC {
+		http.Redirect(w, r, "/auth/login", http.StatusSeeOther)
+		return
+	}
+	username := strings.TrimSpace(r.FormValue("username"))
+	if len(username) < 2 || len(username) > 24 {
+		s.renderStatus(w, r, http.StatusBadRequest, "login.html", map[string]any{"Title": "Login", "AuthMode": s.auth.Mode, "Error": "Bitte nutze einen Namen mit 2 bis 24 Zeichen."})
+		return
+	}
+	cookie := &http.Cookie{
+		Name:     "chat_user",
+		Value:    username,
+		Path:     "/",
+		MaxAge:   60 * 60 * 24 * 30,
+		HttpOnly: true,
+		SameSite: http.SameSiteLaxMode,
+	}
+	http.SetCookie(w, cookie)
+	w.Header().Set("HX-Redirect", "/rooms")
+	http.Redirect(w, r, "/rooms", http.StatusSeeOther)
+}
+
+func (s *Server) handleLogout(w http.ResponseWriter, r *http.Request) {
+	http.SetCookie(w, &http.Cookie{Name: "chat_user", Value: "", Path: "/", MaxAge: -1, HttpOnly: true, SameSite: http.SameSiteLaxMode})
+	clearCookie(w, "chat_session", "/")
+	http.Redirect(w, r, "/", http.StatusSeeOther)
+}
+
+func (s *Server) handleRooms(w http.ResponseWriter, r *http.Request) {
+	username := s.requireUser(w, r)
+	if username == "" {
+		return
+	}
+	rooms, err := s.store.Rooms()
+	if err != nil {
+		http.Error(w, err.Error(), 500)
+		return
+	}
+	s.render(w, r, "rooms.html", map[string]any{"Title": "Räume", "Username": username, "Rooms": rooms})
+}
+
+func (s *Server) handleCreateRoom(w http.ResponseWriter, r *http.Request) {
+	username := s.requireUser(w, r)
+	if username == "" {
+		return
+	}
+	name := strings.TrimSpace(r.FormValue("name"))
+	description := strings.TrimSpace(r.FormValue("description"))
+	if len(name) < 2 || len(name) > 40 {
+		http.Error(w, "Raumname muss 2 bis 40 Zeichen haben.", http.StatusBadRequest)
+		return
+	}
+	room, err := s.store.CreateRoom(name, description)
+	if err != nil {
+		http.Error(w, "Raum konnte nicht erstellt werden. Existiert er schon?", http.StatusBadRequest)
+		return
+	}
+	w.Header().Set("HX-Redirect", fmt.Sprintf("/rooms/%d", room.ID))
+	http.Redirect(w, r, fmt.Sprintf("/rooms/%d", room.ID), http.StatusSeeOther)
+}
+
+func (s *Server) handleRoom(w http.ResponseWriter, r *http.Request) {
+	username := s.requireUser(w, r)
+	if username == "" {
+		return
+	}
+	roomID, ok := parseID(w, r)
+	if !ok {
+		return
+	}
+	room, err := s.store.Room(roomID)
+	if errors.Is(err, store.ErrNotFound) {
+		http.NotFound(w, r)
+		return
+	}
+	if err != nil {
+		http.Error(w, err.Error(), 500)
+		return
+	}
+	messages, err := s.store.RecentMessages(roomID, 100)
+	if err != nil {
+		http.Error(w, err.Error(), 500)
+		return
+	}
+	s.render(w, r, "room.html", map[string]any{"Title": room.Name, "Username": username, "Room": room, "Messages": messages})
+}
+
+func (s *Server) handlePostMessage(w http.ResponseWriter, r *http.Request) {
+	username := s.requireUser(w, r)
+	if username == "" {
+		return
+	}
+	roomID, ok := parseID(w, r)
+	if !ok {
+		return
+	}
+	body := strings.TrimSpace(r.FormValue("body"))
+	if body == "" {
+		w.WriteHeader(http.StatusNoContent)
+		return
+	}
+	if len(body) > 2000 {
+		http.Error(w, "Nachricht ist zu lang.", http.StatusBadRequest)
+		return
+	}
+	msg, err := s.store.AddMessage(roomID, username, body)
+	if err != nil {
+		http.Error(w, err.Error(), 500)
+		return
+	}
+	s.hub.Publish(msg)
+
+	// Clear the form without duplicating the message; the SSE stream appends it.
+	w.Header().Set("HX-Trigger", "message-sent")
+	w.WriteHeader(http.StatusNoContent)
+}
+
+func (s *Server) handleEvents(w http.ResponseWriter, r *http.Request) {
+	username := s.requireUser(w, r)
+	if username == "" {
+		return
+	}
+	roomID, ok := parseID(w, r)
+	if !ok {
+		return
+	}
+
+	flusher, ok := w.(http.Flusher)
+	if !ok {
+		http.Error(w, "streaming unsupported", http.StatusInternalServerError)
+		return
+	}
+	w.Header().Set("Content-Type", "text/event-stream")
+	w.Header().Set("Cache-Control", "no-cache")
+	w.Header().Set("Connection", "keep-alive")
+
+	sub := s.hub.Subscribe(roomID)
+	defer s.hub.Unsubscribe(roomID, sub)
+
+	fmt.Fprint(w, ": connected\n\n")
+	flusher.Flush()
+
+	heartbeat := time.NewTicker(25 * time.Second)
+	defer heartbeat.Stop()
+	for {
+		select {
+		case <-r.Context().Done():
+			return
+		case <-heartbeat.C:
+			fmt.Fprint(w, ": heartbeat\n\n")
+			flusher.Flush()
+		case msg := <-sub:
+			html, err := s.renderPartial(r.Context(), "partials/message.html", msg)
+			if err != nil {
+				s.logger.Error("render partial", "error", err)
+				continue
+			}
+			payload := map[string]string{"html": html}
+			b, _ := json.Marshal(payload)
+			fmt.Fprintf(w, "event: message\ndata: %s\n\n", b)
+			flusher.Flush()
+		}
+	}
+}
+
+func parseID(w http.ResponseWriter, r *http.Request) (int64, bool) {
+	id, err := strconv.ParseInt(r.PathValue("id"), 10, 64)
+	if err != nil || id <= 0 {
+		http.NotFound(w, r)
+		return 0, false
+	}
+	return id, true
+}
+
+func (s *Server) currentUser(r *http.Request) string {
+	if sess, ok := s.readSession(r); ok {
+		return strings.TrimSpace(sess.Username)
+	}
+	if s.auth.Mode == AuthModeLocal {
+		c, err := r.Cookie("chat_user")
+		if err != nil {
+			return ""
+		}
+		return strings.TrimSpace(c.Value)
+	}
+	return ""
+}
+
+func (s *Server) requireUser(w http.ResponseWriter, r *http.Request) string {
+	username := s.currentUser(r)
+	if username == "" {
+		http.Redirect(w, r, "/", http.StatusSeeOther)
+		return ""
+	}
+	return username
+}
+
+func (s *Server) render(w http.ResponseWriter, r *http.Request, name string, data map[string]any) {
+	s.renderStatus(w, r, http.StatusOK, name, data)
+}
+
+func (s *Server) renderStatus(w http.ResponseWriter, r *http.Request, status int, name string, data map[string]any) {
+	w.Header().Set("Content-Type", "text/html; charset=utf-8")
+	w.WriteHeader(status)
+	if err := s.templates.ExecuteTemplate(w, name, data); err != nil {
+		s.logger.Error("template", "name", name, "error", err)
+	}
+}
+
+func (s *Server) renderPartial(_ context.Context, name string, data any) (string, error) {
+	var buf bytes.Buffer
+	err := s.templates.ExecuteTemplate(&buf, name, data)
+	return buf.String(), err
+}