Dmitry VerkhoturovandGitHub
fb7b6c2cdd
* Serve the build-independent web assets from the backend `privacy.html`, `markdown-help.html` and the `400x400.jpeg` it embeds carry no template variable, link no script or stylesheet, and are imported by nothing in the widget. They now live in `backend/app/webassets/assets`, embedded there, and are served under `/web` alongside the frontend build. `/web` reads the frontend build first and falls back to them, which is what lets an operator replace one by dropping a file into `--web-root`. That is what `privacy.html` needs: it describes remark42.com, while the authorization guide tells operators to hand its URL to Google and Facebook as their own application's privacy policy. Only a missing file falls through. An unreadable file in the web root keeps reporting as unreadable rather than being silently replaced by the embedded copy, and a name the filesystem rejects reports as missing rather than as a server error, both matching what `http.Dir` did. The dev server serves the same directory, so the Markdown help link in the comment form resolves on the dev port as well as in production. The two pages are served as they are written. `markdown-help.html` was minified before, and its formatted inline stylesheet is most of its 8.5 kB; that is 2.4 kB more over the wire, behind the hour-long cache header the file server already sets. Drops `copy-webpack-plugin`, which had no other pattern, and the stylelint entries that only ever matched these files. * Make pnpm dev:app start again The dev server has been failing to start on two counts, so the flow the contributing guide documents does not run at all. `webpack-cli` 4 drives `webpack-dev-server` 5 through the argument order of an older major, handing it the compiler where it expects the options object. It rejects that against its schema and exits, complaining about an unknown `_assetEmittingPreviousFiles` property, which is a field of the compiler. `webpack-cli` 7 is the release that declares `webpack-dev-server` 5 as a peer. Past that, `http-proxy-middleware` resolves to 4.1.1, which no longer accepts the two-argument call `webpack-dev-server` makes, so the `/api` and `/auth` proxies throw on startup. It is pulled in by the security override for CVE-2025-32996, the only override in the file with no upper bound: `>=2.0.10` matches every later major. Bounding it to the 2.x line keeps the fix and the API `webpack-dev-server` calls. With both in place `pnpm dev:app` serves the widget and the pages under `/web` on port 9000.
79 lines
2.3 KiB
Go
79 lines
2.3 KiB
Go
package webassets
|
|
|
|
import (
|
|
"io/fs"
|
|
"regexp"
|
|
"strings"
|
|
"testing"
|
|
|
|
"github.com/stretchr/testify/assert"
|
|
"github.com/stretchr/testify/require"
|
|
)
|
|
|
|
func TestFS_Contents(t *testing.T) {
|
|
entries, err := fs.ReadDir(FS, ".")
|
|
require.NoError(t, err)
|
|
|
|
names := make([]string, 0, len(entries))
|
|
for _, e := range entries {
|
|
assert.False(t, e.IsDir(), "the assets are served flat under /web, %s is a directory", e.Name())
|
|
info, err := e.Info()
|
|
require.NoError(t, err)
|
|
assert.NotZero(t, info.Size(), "%s is empty", e.Name())
|
|
names = append(names, e.Name())
|
|
}
|
|
assert.Equal(t, []string{"400x400.jpeg", "markdown-help.html", "privacy.html"}, names)
|
|
}
|
|
|
|
// TestFS_ContentShape catches an asset that has been truncated or replaced by something of the
|
|
// wrong kind, which a size check alone lets through.
|
|
func TestFS_ContentShape(t *testing.T) {
|
|
tbl := []struct {
|
|
name string
|
|
prefix []byte
|
|
want string
|
|
}{
|
|
{name: "400x400.jpeg", prefix: []byte{0xff, 0xd8, 0xff}},
|
|
{name: "markdown-help.html", want: "<!DOCTYPE html>"},
|
|
{name: "privacy.html", want: "<!DOCTYPE html>"},
|
|
}
|
|
|
|
for _, tt := range tbl {
|
|
t.Run(tt.name, func(t *testing.T) {
|
|
b, err := fs.ReadFile(FS, tt.name)
|
|
require.NoError(t, err)
|
|
|
|
if tt.prefix != nil {
|
|
require.GreaterOrEqual(t, len(b), len(tt.prefix))
|
|
assert.Equal(t, tt.prefix, b[:len(tt.prefix)], "not a JPEG")
|
|
return
|
|
}
|
|
assert.True(t, strings.HasPrefix(strings.TrimSpace(string(b)), tt.want), "not an HTML document")
|
|
assert.Contains(t, string(b), "</html>", "the document is truncated")
|
|
})
|
|
}
|
|
}
|
|
|
|
// TestFS_RelativeReferencesResolve keeps the pages self-contained: every relative src and href
|
|
// they use has to name a sibling that ships alongside them, since nothing else supplies one.
|
|
func TestFS_RelativeReferencesResolve(t *testing.T) {
|
|
ref := regexp.MustCompile(`(?:src|href)="([^"]+)"`)
|
|
external := regexp.MustCompile(`^(?:[a-z]+:|//|#|mailto:)`)
|
|
|
|
for _, page := range []string{"markdown-help.html", "privacy.html"} {
|
|
t.Run(page, func(t *testing.T) {
|
|
b, err := fs.ReadFile(FS, page)
|
|
require.NoError(t, err)
|
|
|
|
for _, m := range ref.FindAllStringSubmatch(string(b), -1) {
|
|
target := m[1]
|
|
if external.MatchString(target) {
|
|
continue
|
|
}
|
|
_, err := fs.Stat(FS, target)
|
|
assert.NoError(t, err, "%s references %q, which ships nowhere", page, target)
|
|
}
|
|
})
|
|
}
|
|
}
|