Phase 1.2: session login + empty HTMX dashboard
- Session login for the single user Sam: server-side session store with an HMAC-signed session cookie, POST /login, POST /logout, and double-submit CSRF on every form post. Unauthenticated requests to / and /partials/* redirect to /login?next=... - Empty dashboard shell in the Family Home Lab design system: left nav (category and folder placeholders), centre list, right detail pane. - Copy tokens.css and the self-hosted Inter fonts from the family-home-lab design system into web/static; vendor htmx 2.0.4. No cross-project imports at runtime. - Dark mode via prefers-color-scheme plus a persisted toggle; phone-first layout with 44px touch targets, hairline borders, 8px grid, pill CTAs. - Config: EMAIL_AGENT_PASSWORD for the login password, falling back to EMAIL_AGENT_SESSION_SECRET so one configured secret is enough. Co-Authored-By: Paperclip <noreply@paperclip.ing>
This commit is contained in:
@@ -1,45 +1,66 @@
|
||||
// Package server wires the HTTP surface of the Email Agent.
|
||||
//
|
||||
// Phase 1 exposes liveness/readiness endpoints and a placeholder dashboard.
|
||||
// Login and the real HTMX screens arrive in Phase 1.2.
|
||||
// Phase 1.2 exposes a session login and an empty HTMX dashboard shell in the
|
||||
// Family Home Lab design system. Mail fetch arrives in Phase 2.
|
||||
package server
|
||||
|
||||
import (
|
||||
"context"
|
||||
"crypto/rand"
|
||||
"encoding/json"
|
||||
"errors"
|
||||
"fmt"
|
||||
"html/template"
|
||||
"io/fs"
|
||||
"log/slog"
|
||||
"mime"
|
||||
"net/http"
|
||||
"time"
|
||||
|
||||
"gitea.lab.audasmedia.com.au/sam/email_agent/internal/config"
|
||||
"gitea.lab.audasmedia.com.au/sam/email_agent/internal/session"
|
||||
"gitea.lab.audasmedia.com.au/sam/email_agent/internal/store"
|
||||
"gitea.lab.audasmedia.com.au/sam/email_agent/internal/version"
|
||||
"gitea.lab.audasmedia.com.au/sam/email_agent/web"
|
||||
)
|
||||
|
||||
func init() {
|
||||
// Go's mime table has no woff2 entry; the self-hosted Inter fonts need it.
|
||||
_ = mime.AddExtensionType(".woff2", "font/woff2")
|
||||
}
|
||||
|
||||
// Server holds the HTTP dependencies.
|
||||
type Server struct {
|
||||
cfg *config.Config
|
||||
store *store.Store
|
||||
logger *slog.Logger
|
||||
http *http.Server
|
||||
index *template.Template
|
||||
cfg *config.Config
|
||||
store *store.Store
|
||||
logger *slog.Logger
|
||||
http *http.Server
|
||||
tmpl *template.Template
|
||||
sessions *session.Manager
|
||||
}
|
||||
|
||||
// New builds a Server. It does not start listening.
|
||||
func New(cfg *config.Config, st *store.Store, logger *slog.Logger) (*Server, error) {
|
||||
index, err := template.New("index").Parse(indexHTML)
|
||||
tmpl, err := template.ParseFS(web.TemplateFS, "templates/*.html")
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("parse index template: %w", err)
|
||||
return nil, fmt.Errorf("parse templates: %w", err)
|
||||
}
|
||||
|
||||
key, err := sessionKey(cfg, logger)
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("session key: %w", err)
|
||||
}
|
||||
sessions, err := session.NewManager(key, session.DefaultTTL)
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("session manager: %w", err)
|
||||
}
|
||||
|
||||
s := &Server{
|
||||
cfg: cfg,
|
||||
store: st,
|
||||
logger: logger,
|
||||
index: index,
|
||||
cfg: cfg,
|
||||
store: st,
|
||||
logger: logger,
|
||||
tmpl: tmpl,
|
||||
sessions: sessions,
|
||||
}
|
||||
s.http = &http.Server{
|
||||
Addr: cfg.Addr,
|
||||
@@ -52,12 +73,43 @@ func New(cfg *config.Config, st *store.Store, logger *slog.Logger) (*Server, err
|
||||
return s, nil
|
||||
}
|
||||
|
||||
// sessionKey returns the cookie signing key. In production it comes from
|
||||
// EMAIL_AGENT_SESSION_SECRET; with no secret configured the service still
|
||||
// starts with an ephemeral key so it is usable, but sessions do not survive a
|
||||
// restart and the operator sees a warning.
|
||||
func sessionKey(cfg *config.Config, logger *slog.Logger) ([]byte, error) {
|
||||
if cfg.SessionSecret != "" {
|
||||
return []byte(cfg.SessionSecret), nil
|
||||
}
|
||||
key := make([]byte, 32)
|
||||
if _, err := rand.Read(key); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
logger.Warn("EMAIL_AGENT_SESSION_SECRET is not set; using an ephemeral session key (sessions reset on restart)")
|
||||
return key, nil
|
||||
}
|
||||
|
||||
// Handler returns the root HTTP handler with middleware applied.
|
||||
func (s *Server) Handler() http.Handler {
|
||||
staticFS, err := fs.Sub(web.StaticFS, "static")
|
||||
if err != nil {
|
||||
// web.StaticFS is a compile-time constant; this cannot fail at runtime.
|
||||
panic(fmt.Sprintf("static assets: %v", err))
|
||||
}
|
||||
static := http.StripPrefix("/static/", http.FileServer(http.FS(staticFS)))
|
||||
|
||||
mux := http.NewServeMux()
|
||||
mux.HandleFunc("GET /health", s.handleHealth)
|
||||
mux.HandleFunc("GET /readyz", s.handleReady)
|
||||
mux.HandleFunc("GET /{$}", s.handleIndex)
|
||||
mux.Handle("GET /static/", static)
|
||||
|
||||
mux.HandleFunc("GET /login", s.handleLoginGet)
|
||||
mux.HandleFunc("POST /login", s.handleLoginPost)
|
||||
mux.HandleFunc("POST /logout", s.handleLogout)
|
||||
|
||||
mux.HandleFunc("GET /{$}", s.requireAuth(s.handleDashboard))
|
||||
mux.HandleFunc("GET /partials/inbox", s.requireAuth(s.handleInboxPartial))
|
||||
|
||||
return s.recoverPanic(s.logRequests(mux))
|
||||
}
|
||||
|
||||
@@ -138,19 +190,6 @@ func (s *Server) handleReady(w http.ResponseWriter, r *http.Request) {
|
||||
writeJSON(w, http.StatusOK, map[string]string{"status": "ready"})
|
||||
}
|
||||
|
||||
// handleIndex renders a placeholder dashboard. The real login + inbox screens
|
||||
// are Phase 1.2.
|
||||
func (s *Server) handleIndex(w http.ResponseWriter, r *http.Request) {
|
||||
w.Header().Set("Content-Type", "text/html; charset=utf-8")
|
||||
data := struct {
|
||||
Version string
|
||||
Env string
|
||||
}{Version: version.Version, Env: s.cfg.Env}
|
||||
if err := s.index.Execute(w, data); err != nil {
|
||||
s.logger.Error("render index", "error", err)
|
||||
}
|
||||
}
|
||||
|
||||
func writeJSON(w http.ResponseWriter, code int, v any) {
|
||||
w.Header().Set("Content-Type", "application/json; charset=utf-8")
|
||||
w.WriteHeader(code)
|
||||
@@ -195,34 +234,3 @@ func (r *statusRecorder) WriteHeader(code int) {
|
||||
r.status = code
|
||||
r.ResponseWriter.WriteHeader(code)
|
||||
}
|
||||
|
||||
const indexHTML = `<!doctype html>
|
||||
<html lang="en" data-theme="light">
|
||||
<head>
|
||||
<meta charset="utf-8">
|
||||
<meta name="viewport" content="width=device-width, initial-scale=1">
|
||||
<title>Email Agent</title>
|
||||
<style>
|
||||
:root { color-scheme: light dark; }
|
||||
body { font-family: Inter, -apple-system, system-ui, "Segoe UI", Helvetica, Arial, sans-serif;
|
||||
background: #f6f5f4; color: #31302e; margin: 0; }
|
||||
@media (prefers-color-scheme: dark) { body { background: #141518; color: #dcdee2; } }
|
||||
main { max-width: 640px; margin: 12vh auto; padding: 0 24px; }
|
||||
.band { background: #213183; color: #fff; border-radius: 12px; padding: 24px; }
|
||||
h1 { font-size: 32px; line-height: 1.1; margin: 0 0 8px; }
|
||||
p { font-size: 15px; line-height: 1.5; }
|
||||
code { background: rgba(127,127,127,.15); padding: 2px 6px; border-radius: 4px; }
|
||||
</style>
|
||||
</head>
|
||||
<body>
|
||||
<main>
|
||||
<div class="band">
|
||||
<h1>Email Agent</h1>
|
||||
<p>Phase 1 skeleton is running. Version <code>{{.Version}}</code> ({{.Env}}).</p>
|
||||
</div>
|
||||
<p>Login and the inbox arrive in Phase 1.2. Liveness is at
|
||||
<a href="/health">/health</a>.</p>
|
||||
</main>
|
||||
</body>
|
||||
</html>
|
||||
`
|
||||
|
||||
Reference in New Issue
Block a user