Dmitry VerkhoturovandGitHub
fb7b6c2cdd
* Serve the build-independent web assets from the backend `privacy.html`, `markdown-help.html` and the `400x400.jpeg` it embeds carry no template variable, link no script or stylesheet, and are imported by nothing in the widget. They now live in `backend/app/webassets/assets`, embedded there, and are served under `/web` alongside the frontend build. `/web` reads the frontend build first and falls back to them, which is what lets an operator replace one by dropping a file into `--web-root`. That is what `privacy.html` needs: it describes remark42.com, while the authorization guide tells operators to hand its URL to Google and Facebook as their own application's privacy policy. Only a missing file falls through. An unreadable file in the web root keeps reporting as unreadable rather than being silently replaced by the embedded copy, and a name the filesystem rejects reports as missing rather than as a server error, both matching what `http.Dir` did. The dev server serves the same directory, so the Markdown help link in the comment form resolves on the dev port as well as in production. The two pages are served as they are written. `markdown-help.html` was minified before, and its formatted inline stylesheet is most of its 8.5 kB; that is 2.4 kB more over the wire, behind the hour-long cache header the file server already sets. Drops `copy-webpack-plugin`, which had no other pattern, and the stylelint entries that only ever matched these files. * Make pnpm dev:app start again The dev server has been failing to start on two counts, so the flow the contributing guide documents does not run at all. `webpack-cli` 4 drives `webpack-dev-server` 5 through the argument order of an older major, handing it the compiler where it expects the options object. It rejects that against its schema and exits, complaining about an unknown `_assetEmittingPreviousFiles` property, which is a field of the compiler. `webpack-cli` 7 is the release that declares `webpack-dev-server` 5 as a peer. Past that, `http-proxy-middleware` resolves to 4.1.1, which no longer accepts the two-argument call `webpack-dev-server` makes, so the `/api` and `/auth` proxies throw on startup. It is pulled in by the security override for CVE-2025-32996, the only override in the file with no upper bound: `>=2.0.10` matches every later major. Bounding it to the 2.x line keeps the fix and the API `webpack-dev-server` calls. With both in place `pnpm dev:app` serves the widget and the pages under `/web` on port 9000.
47 lines
1.6 KiB
Go
47 lines
1.6 KiB
Go
package api
|
|
|
|
import (
|
|
"errors"
|
|
"io/fs"
|
|
"path/filepath"
|
|
)
|
|
|
|
// webFiles serves /web from two sources: a name present in the frontend build is served from there,
|
|
// and any other name from the assets embedded in the binary.
|
|
type webFiles struct {
|
|
frontend fs.FS
|
|
embedded fs.FS
|
|
}
|
|
|
|
// Open looks the name up in the frontend build first. Only a missing file falls through to the
|
|
// embedded assets; every other error is returned so an unreadable file keeps reporting as one
|
|
// rather than being replaced by the embedded copy or reported as missing.
|
|
func (w webFiles) Open(name string) (fs.File, error) {
|
|
// fs.ValidPath alone is not enough: it accepts names the operating system rejects, NUL among
|
|
// them, and os.DirFS turns those into fs.ErrInvalid, which renders as 500 rather than 404
|
|
if _, err := filepath.Localize(name); err != nil || !fs.ValidPath(name) {
|
|
return nil, &fs.PathError{Op: "open", Path: name, Err: fs.ErrNotExist}
|
|
}
|
|
f, err := w.frontend.Open(name)
|
|
if err == nil {
|
|
return f, nil
|
|
}
|
|
if !errors.Is(err, fs.ErrNotExist) {
|
|
return nil, err
|
|
}
|
|
if name == "." {
|
|
// the embedded set is a flat list of files; only the frontend build answers for the
|
|
// directory itself, so a missing web root reports as missing rather than listing them
|
|
return nil, err
|
|
}
|
|
return w.embedded.Open(name)
|
|
}
|
|
|
|
// emptyFS stands in for a frontend source that could not be opened, so a misconfigured one serves
|
|
// nothing instead of panicking or serving the build at paths it does not belong at
|
|
type emptyFS struct{}
|
|
|
|
func (emptyFS) Open(name string) (fs.File, error) {
|
|
return nil, &fs.PathError{Op: "open", Path: name, Err: fs.ErrNotExist}
|
|
}
|