John O'Keefe
4c43caa639
The "top search bar doesn't work" report had TWO stacked causes, found by reproducing with real keypress-by-keypress typing instead of Playwright's fill() (which fires a single input event and masked both): 1. htmx.min.js was included PER PAGE. The header's live search is htmx-driven on every page, but five pages rendering @Header — series, admin, admin hash-conflicts, admin processing-issues, browse-detail — never loaded it: the input's hx-* attributes were inert (htmx-internal-data absent), so typing produced no request at all. The include now lives in the header partial itself (classic script, before the module bundle); the sixteen per-page copies on @Header pages are removed (double-processing guard). Non-header pages (login/register/setup/reader/index) keep their own. 2. htmx's delay: modifier on a PROGRAMMATICALLY dispatched custom event (htmx.trigger) loses the request entirely under rapid successive triggers — every re-fire canceled the pending timer and the last never issued, so fast typing (the normal kind) never opened the dropdown while one-shot fill() worked. The debounce moved into the Alpine component (client-local state, where it belongs); htmx now executes the bare `search` event immediately. Also made bundle staleness structurally impossible: each bundle's script stamp is a content hash computed at startup (templates/ bundles.go), so a rebuild that changes bundle bytes changes its cache key with no manual ?v=N bump — the manual stamp was how the first dropdown fix stayed invisible for a deploy. The reader bundle (never stamped at all) is covered too. HTML pages additionally send Cache-Control: no-cache (they are dynamic), so a stale page can no longer reference a stale stamp; /api, /static and /uploads keep their native caching, pinned by a middleware test.
91 lines
3.1 KiB
Go
91 lines
3.1 KiB
Go
package middleware_test
|
|
|
|
import (
|
|
"context"
|
|
"crypto/sha256"
|
|
"encoding/base64"
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"regexp"
|
|
"strings"
|
|
"testing"
|
|
|
|
"bookhoard/internal/middleware"
|
|
"bookhoard/templates"
|
|
|
|
"github.com/labstack/echo/v5"
|
|
)
|
|
|
|
// TestThemeFlashGuardHashMatchesCSP pins the CSP script hash to the theme
|
|
// flash guard's rendered bytes: the guard is the app's ONLY inline script,
|
|
// and script-src allow-lists it by content hash. If the guard's script text
|
|
// is ever edited, this test fails and prints the replacement hash — copy it
|
|
// into middleware.ScriptHashThemeFlashGuard.
|
|
func TestThemeFlashGuardHashMatchesCSP(t *testing.T) {
|
|
var sb strings.Builder
|
|
if err := templates.ThemeFlashGuard().Render(context.Background(), &sb); err != nil {
|
|
t.Fatalf("render ThemeFlashGuard: %v", err)
|
|
}
|
|
rendered := sb.String()
|
|
|
|
m := regexp.MustCompile(`(?s)<script>(.*?)</script>`).FindStringSubmatch(rendered)
|
|
if m == nil {
|
|
t.Fatalf("rendered guard contains no <script> element:\n%s", rendered)
|
|
}
|
|
digest := sha256.Sum256([]byte(m[1]))
|
|
computed := "sha256-" + base64.StdEncoding.EncodeToString(digest[:])
|
|
if !strings.Contains(middleware.ScriptHashThemeFlashGuard, computed) {
|
|
t.Errorf(`
|
|
theme flash guard script hash drifted.
|
|
|
|
CSP constant contains: %s
|
|
rendered script hashes to: %s
|
|
|
|
Recompute: sha256 over the bytes between <script> and </script> of
|
|
templates/theme_flash_guard.templ, base64-encoded, then update
|
|
middleware.ScriptHashThemeFlashGuard and the CSP header string.`,
|
|
middleware.ScriptHashThemeFlashGuard, computed)
|
|
}
|
|
|
|
// The strict allow-list only holds the guard: no 'unsafe-inline' may
|
|
// sneak back into script-src (style-src keeps it for htmx/Alpine).
|
|
if strings.Contains(middleware.ScriptHashThemeFlashGuard, "unsafe-inline") {
|
|
t.Error("script-src must not re-introduce 'unsafe-inline' alongside the hash")
|
|
}
|
|
}
|
|
|
|
// HTML pages must always revalidate (Cache-Control: no-cache): a
|
|
// heuristically cached PAGE referenced a stale main.js stamp and kept
|
|
// the old bundle running long after a fix deployed (the 2026-10-27
|
|
// "search dropdown still broken" report). Static/API/media routes keep
|
|
// their native caching — stamped bundles are content-frozen by URL.
|
|
func TestHTMLPagesRevalidate(t *testing.T) {
|
|
mw := middleware.SecurityHeadersMiddleware()
|
|
|
|
render := func(path string) string {
|
|
e := echo.New()
|
|
req, _ := http.NewRequest("GET", path, nil)
|
|
rec := httptest.NewRecorder()
|
|
c := e.NewContext(req, rec)
|
|
handler := mw(func(c *echo.Context) error {
|
|
return c.HTML(http.StatusOK, "<html></html>")
|
|
})
|
|
if err := handler(c); err != nil {
|
|
t.Fatalf("handler error: %v", err)
|
|
}
|
|
return rec.Header().Get("Cache-Control")
|
|
}
|
|
|
|
if got := render("/bookshelf"); got != "no-cache" {
|
|
t.Errorf("/bookshelf: Cache-Control = %q, want no-cache", got)
|
|
}
|
|
if got := render("/series"); got != "no-cache" {
|
|
t.Errorf("/series: Cache-Control = %q, want no-cache", got)
|
|
}
|
|
for _, p := range []string{"/static/main.js", "/api/media-items", "/uploads/library-x/book.epub", "/health"} {
|
|
if got := render(p); got == "no-cache" {
|
|
t.Errorf("%s: must keep native caching, got no-cache", p)
|
|
}
|
|
}
|
|
}
|