diff options
| author | Lukasz Kasprzak <lukas@labunix.xyz> | 2026-07-23 14:39:31 +0200 |
|---|---|---|
| committer | Lukasz Kasprzak <lukas@labunix.xyz> | 2026-07-23 14:39:31 +0200 |
| commit | 4de7f7dca7485c9a6c94f6f86a53d01a974fce54 (patch) | |
| tree | bcdc1ea366a068310e460804c4a5f04df3ae20f4 /docs/superpowers | |
| parent | b72b81c410c161797eb525a6231b0517b4def993 (diff) | |
| download | lectio-4de7f7dca7485c9a6c94f6f86a53d01a974fce54.tar.gz lectio-4de7f7dca7485c9a6c94f6f86a53d01a974fce54.zip | |
web: HTMX server + lectio-web binary
NewServer wires B1's RenderReadings/Themes/themeCSS/embedded static+
templates FS into an http.ServeMux: GET / (full page), GET /readings
(HTMX reading-pane fragment), GET /lookup (bible.Lookup passage search
fragment), GET /theme.css (theme stylesheet, falling back through
cfg.WebTheme to the built-in default on an unknown name), GET /static/.
Run listens on cfg.WebPort (0 = OS-picked free port), prints the URL,
best-effort opens a browser, then serves. cmd/lectio-web is the binary
entry point (config.Load -> web.Run).
Fold-in from the B1 review: hardened themeCSS's name guard to an
explicit ^[A-Za-z0-9_-]+$ allowlist (the old filepath.Base/ContainsAny
check let ".." through), plus guard-rejection and HTML-escaping
regression tests -- B2 is what makes /theme.css?name=<raw> reachable
from the network, so it owns closing this out.
Diffstat (limited to 'docs/superpowers')
0 files changed, 0 insertions, 0 deletions