fixing style

internal/web/handlers.go

@@ -1,6 +1,7 @@
 package web
 
 import (
+	"bytes"
 	"context"
 	"encoding/json"
 	"fmt"
@@ -25,6 +26,18 @@ type Handler struct {
 	sso     security.ITokenVerifier
 	browser *golooseauth.Auth
 	demo    *service.DemoAuth
+	// themeOrigin is the go-bananas origin supplying the shared styling contract.
+	// Empty means the shell keeps its own fallbacks, which is the default.
+	themeOrigin string
+}
+
+// WithThemeOrigin sets the origin the shared styling contract is served from.
+//
+// A setter rather than a constructor argument, so that adding this does not change
+// the signature every existing caller and test passes through.
+func (h *Handler) WithThemeOrigin(origin string) *Handler {
+	h.themeOrigin = origin
+	return h
 }
 
 func NewHandler(content service.IContentService, assets fs.FS, sso security.ITokenVerifier, browser *golooseauth.Auth, demo ...*service.DemoAuth) *Handler {
@@ -47,11 +60,13 @@ func (h *Handler) Routes(origins string) http.Handler {
 	mux.HandleFunc("/api/auth/sudo", h.sudo)
 	mux.HandleFunc("/api/auth/users", h.users)
 	mux.HandleFunc("/api/protected", h.protected)
-	mux.HandleFunc("/api/test/protected", h.protected)
-	mux.HandleFunc("/api/content", h.contentList)
+	mux.HandleFunc("/api/content", h.contentCollection)
+	mux.HandleFunc("/api/dev/null", h.contentCollection)
 	mux.HandleFunc("/api/content/categories", h.contentCategories)
 	mux.HandleFunc("/api/content/badges", h.contentBadges)
+	mux.HandleFunc("/api/content/clear", h.adminReset)
 	mux.HandleFunc("/api/content/", h.contentDetail)
+	mux.HandleFunc("/api/dev/null/", h.contentDetail)
 	mux.HandleFunc("/api/admin/reset", h.adminReset)
 	mux.HandleFunc("/", h.singlePageApp)
 	return cors(mux, origins, h.sso.HeaderName())
@@ -67,6 +82,18 @@ func (h *Handler) session(w http.ResponseWriter, r *http.Request) {
 		response["email"] = user.Email
 		response["displayName"] = user.DisplayName
 	}
+	if h.demo != nil {
+		response["demo"] = true
+		if authenticated {
+			for _, user := range h.demo.Users() {
+				if user.Username == username {
+					response["displayName"] = user.Name
+					response["email"] = user.Username
+					break
+				}
+			}
+		}
+	}
 	if h.browser != nil {
 		response["loginUrl"] = golooseauth.LoginPath
 		response["logoutUrl"] = golooseauth.LogoutPath
@@ -141,6 +168,17 @@ func (h *Handler) sudo(w http.ResponseWriter, r *http.Request) {
 	jsonWrite(w, http.StatusOK, map[string]any{"token": token, "user": user})
 }
 
+func (h *Handler) contentCollection(w http.ResponseWriter, r *http.Request) {
+	switch r.Method {
+	case http.MethodGet:
+		h.contentList(w, r)
+	case http.MethodPost:
+		h.contentCreate(w, r)
+	default:
+		jsonWrite(w, http.StatusMethodNotAllowed, nil)
+	}
+}
+
 func (h *Handler) contentList(w http.ResponseWriter, r *http.Request) {
 	if r.Method != http.MethodGet {
 		jsonWrite(w, http.StatusMethodNotAllowed, nil)
@@ -170,7 +208,7 @@ func (h *Handler) contentCreate(w http.ResponseWriter, r *http.Request) {
 		jsonWrite(w, http.StatusMethodNotAllowed, nil)
 		return
 	}
-	_, authenticated := h.identity(r)
+	username, authenticated := h.identity(r)
 	if !authenticated {
 		jsonWrite(w, http.StatusUnauthorized, map[string]string{"error": "authentication required"})
 		return
@@ -180,6 +218,9 @@ func (h *Handler) contentCreate(w http.ResponseWriter, r *http.Request) {
 		jsonWrite(w, http.StatusBadRequest, map[string]string{"error": "invalid JSON"})
 		return
 	}
+	if strings.TrimSpace(item.Author) == "" {
+		item.Author = username
+	}
 	created, err := h.content.Create(r.Context(), item)
 	if err != nil {
 		jsonWrite(w, http.StatusBadRequest, map[string]string{"error": err.Error()})
@@ -216,6 +257,7 @@ func (h *Handler) contentBadges(w http.ResponseWriter, r *http.Request) {
 
 func (h *Handler) contentDetail(w http.ResponseWriter, r *http.Request) {
 	slug := strings.TrimPrefix(r.URL.Path, "/api/content/")
+	slug = strings.TrimPrefix(slug, "/api/dev/null/")
 	switch r.Method {
 	case http.MethodGet:
 		item, err := h.content.Get(r.Context(), slug)
@@ -342,9 +384,52 @@ func (h *Handler) singlePageApp(w http.ResponseWriter, r *http.Request) {
 		http.NotFound(w, r)
 		return
 	}
+	body := applyThemeOrigin(index, h.themeOrigin)
 	w.Header().Set("Content-Type", "text/html; charset=utf-8")
 	w.Header().Set("Cache-Control", "no-cache")
-	_, _ = w.Write(index)
+	_, _ = w.Write(body)
+}
+
+// applyThemeOrigin adds the shared styling contract to the shell when an origin is
+// configured, and adds nothing when one is not.
+//
+// Appending rather than substituting, which is the opposite of the obvious approach
+// and the reason it is worth a comment. A placeholder in index.html has to survive
+// two things that both fail quietly:
+//
+//   - The bundler resolves a <script src> at build time. A placeholder is not a
+//     resolvable module, so the build fails with an error that points at the HTML
+//     rather than at the cause.
+//   - An unset or whitespace-only environment variable substitutes an empty or blank
+//     origin, producing a relative URL. The browser then requests this application's
+//     own origin, where neither path exists, and every page load logs a 404 that
+//     reads as a styling bug in the wrong service.
+//
+// Adding nothing in the unset case is correct rather than degraded: the stylesheet's
+// every colour is written as var(--bn-role, <the colour it used to be>), so the
+// application renders exactly as it always did.
+func applyThemeOrigin(index []byte, base string) []byte {
+	origin := strings.TrimRight(strings.TrimSpace(base), "/")
+	if origin == "" {
+		return index
+	}
+
+	// Injected just before </head> so the stylesheet is parsed before the body
+	// renders: a contract that arrives late produces a flash of the fallback palette.
+	tag := "\n    " +
+		`<link rel="stylesheet" href="` + origin + `/rt/v1/contract.css" data-theme-contract>` + "\n    " +
+		`<script type="module" src="` + origin + `/rt/v1/components.js"></script>` + "\n"
+
+	head := []byte("</head>")
+	at := bytes.Index(index, head)
+	if at < 0 {
+		return index
+	}
+	out := make([]byte, 0, len(index)+len(tag))
+	out = append(out, index[:at]...)
+	out = append(out, tag...)
+	out = append(out, index[at:]...)
+	return out
 }
 
 func decode(r *http.Request, v any) bool { return json.NewDecoder(r.Body).Decode(v) == nil }
@@ -366,7 +451,7 @@ func cors(next http.Handler, origin, ssoHeader string) http.Handler {
 		w.Header().Set("Access-Control-Allow-Origin", origin)
 		w.Header().Set("Vary", "Origin")
 		w.Header().Set("Access-Control-Allow-Headers", allowed)
-		w.Header().Set("Access-Control-Allow-Methods", "GET, POST, PUT, OPTIONS")
+		w.Header().Set("Access-Control-Allow-Methods", "GET, POST, PUT, DELETE, OPTIONS")
 		if r.Method == http.MethodOptions {
 			w.WriteHeader(http.StatusNoContent)
 			return