path: root/internal/web/server.go

// This file wires the package's render helpers (RenderReadings, Themes,
// themeCSS, the embedded static/templates FS) into an HTTP server: the full
// page (GET /), the HTMX reading-pane partial (GET /readings), a theme
// stylesheet endpoint (GET /theme.css) and the embedded static assets (GET
// /static/...).
package web

import (
	"fmt"
	"html/template"
	"io"
	"io/fs"
	"net"
	"net/http"
	"os"
	"os/exec"
	"regexp"
	"runtime"
	"strconv"
	"strings"
	"sync"
	"time"

	"github.com/lukaszkasprzak/lectio/internal/bible"
	"github.com/lukaszkasprzak/lectio/internal/config"
	"github.com/lukaszkasprzak/lectio/internal/i18n"
	"github.com/lukaszkasprzak/lectio/internal/liturgy"
	"github.com/lukaszkasprzak/lectio/internal/readings"
	"github.com/lukaszkasprzak/lectio/internal/render"
)

// bibleVersions is the fixed, Themes-independent list of scripture versions
// the web UI's checkboxes offer -- independent of any one cfg.Versions, so
// every visitor sees the same five choices regardless of their config file.
var bibleVersions = []string{"bt", "wuj", "vul", "grb", "drb"}

// server holds the live, mutable config + book table so /settings can apply
// changes to the running process. All handlers read a snapshot via get()/table().
type server struct {
	mu  sync.RWMutex
	cfg config.Config
	tbl *bible.BookTable
}

func (s *server) get() config.Config      { s.mu.RLock(); defer s.mu.RUnlock(); return s.cfg }
func (s *server) table() *bible.BookTable { s.mu.RLock(); defer s.mu.RUnlock(); return s.tbl }
func (s *server) apply(cfg config.Config, tbl *bible.BookTable) {
	s.mu.Lock()
	defer s.mu.Unlock()
	s.cfg = cfg
	if tbl != nil {
		s.tbl = tbl
	}
}

// NewServer builds lectio-web's route tree. cfg supplies the defaults
// (lectionary, versions, theme, offline) that requests can override via
// query parameters; it is never mutated -- /settings applies changes to a
// live, mutable copy held by server, which every handler reads per request.
func NewServer(cfg config.Config) http.Handler {
	tbl, _ := bible.LoadBookTable(config.UserBooksTOML())
	s := &server{cfg: cfg, tbl: tbl}

	mux := http.NewServeMux()
	mux.HandleFunc("GET /{$}", func(w http.ResponseWriter, r *http.Request) { indexHandler(s.get())(w, r) })
	mux.HandleFunc("GET /readings", func(w http.ResponseWriter, r *http.Request) { readingsHandler(s.get())(w, r) })
	mux.HandleFunc("GET /reader", func(w http.ResponseWriter, r *http.Request) { readerHandler(s.get(), s.table())(w, r) })
	mux.HandleFunc("GET /theme.css", func(w http.ResponseWriter, r *http.Request) { themeCSSHandler(s.get())(w, r) })
	mux.HandleFunc("GET /settings", settingsGet(s))
	mux.HandleFunc("POST /settings", settingsPost(s))

	staticSub, err := fs.Sub(staticFS, "static")
	if err != nil {
		// Unreachable: "static" is embedded at build time by render.go.
		panic(err)
	}
	mux.Handle("GET /static/", http.StripPrefix("/static/", http.FileServer(http.FS(staticSub))))

	return noStore(mux)
}

// noStore stops the browser caching any lectio-web response, so a rebuilt or
// reinstalled server never has an old page, base.css or theme.css served from
// cache (which presents as "switching themes stopped working" after an update).
func noStore(h http.Handler) http.Handler {
	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		w.Header().Set("Cache-Control", "no-store")
		h.ServeHTTP(w, r)
	})
}

// today is lectio-web's "no ?date=" default, in the YYYY-MM-DD form every
// other package's Date fields expect.
func today() string {
	return time.Now().Format("2006-01-02")
}

// dateRe validates a ?date= query param before it is ever handed to
// readings.Load/liturgy.Load, which build a filesystem cache path by string
// concatenation from it -- an unvalidated date is a path-traversal vector.
// Compiled once at package scope (not per request), the same shape as
// internal/cli's dateRe. See resolveQuery.
var dateRe = regexp.MustCompile(`^\d{4}-\d{2}-\d{2}$`)

// shiftDate adds days to date (YYYY-MM-DD); an unparsable date is returned
// unchanged, mirroring internal/tui's shiftDate.
func shiftDate(date string, days int) string {
	t, err := time.Parse("2006-01-02", date)
	if err != nil {
		return date
	}
	return t.AddDate(0, 0, days).Format("2006-01-02")
}

// requestVersions returns the versions requested via one or more repeated
// ?v= query params. The controls form always submits a hidden "vset" marker,
// so a request that carries "vset" but no "v" means the user unchecked EVERY
// version -- return none (the pane then shows nothing). A request with neither
// (a fresh visit or a bare link) falls back to cfg.WebVersions, else a single
// cfg.DefaultVersion, so a plain visit checks exactly one box.
func requestVersions(cfg config.Config, r *http.Request) []string {
	if vs, ok := r.URL.Query()["v"]; ok && len(vs) > 0 {
		return vs
	}
	if r.URL.Query().Has("vset") {
		return nil // form submitted with every box unchecked
	}
	if len(cfg.WebVersions) > 0 {
		return append([]string(nil), cfg.WebVersions...)
	}
	return []string{cfg.DefaultVersion}
}

// withoutVersion returns versions with every occurrence of drop removed.
func withoutVersion(versions []string, drop string) []string {
	kept := make([]string, 0, len(versions))
	for _, v := range versions {
		if v != drop {
			kept = append(kept, v)
		}
	}
	return kept
}

// queryBool reads a truthy/falsy query param ("1"/"true"/"on"/"yes" vs.
// "0"/"false"/"off"/"no"), falling back to def when the param is absent or
// unrecognized.
func queryBool(r *http.Request, name string, def bool) bool {
	if !r.URL.Query().Has(name) {
		return def
	}
	switch strings.ToLower(r.URL.Query().Get(name)) {
	case "1", "true", "on", "yes":
		return true
	case "0", "false", "off", "no":
		return false
	default:
		return def
	}
}

// requestLectionary returns the ?lectionary= override, falling back to
// cfg.Lectionary.
func requestLectionary(cfg config.Config, r *http.Request) string {
	if l := r.URL.Query().Get("lectionary"); l != "" {
		return l
	}
	return cfg.Lectionary
}

// requestDisplay returns the ?display= override (normalized the same way
// config.Load normalizes cfg.WebDisplay, so a bad/unknown value falls back
// to "horizontal" rather than reaching RenderReadings unchecked), falling
// back to cfg.WebDisplay when the param is absent.
func requestDisplay(cfg config.Config, r *http.Request) string {
	if d := r.URL.Query().Get("display"); d != "" {
		return config.NormalizeDisplay(d)
	}
	return cfg.WebDisplay
}

// resolveQuery resolves the date/lectionary/all/versions/display controls
// shared by indexHandler and readingsHandler from cfg (the defaults) and
// r's query params (the overrides) -- one place for both handlers so they
// can't drift.
func resolveQuery(cfg config.Config, r *http.Request) (date, lectionary string, all bool, versions []string, display string) {
	date = r.URL.Query().Get("date")
	if date == "" || !dateRe.MatchString(date) {
		date = today()
	}
	lectionary = requestLectionary(cfg, r)
	all = queryBool(r, "all", cfg.All)
	versions = requestVersions(cfg, r)
	// "bt" (the niedziela modern scrape) is invalid for the traditional
	// lectionary and is hidden in the form -- but a box hidden by CSS stays
	// checked, so switching modern->traditional carries a phantom v=bt that
	// EffectiveVersions would substitute to wuj, defeating "no version selected
	// -> nothing". On an explicit form submit (vset) drop that phantom bt; a
	// fresh visit (no vset) keeps bt so its bt->wuj default still shows.
	if lectionary == "traditional" && r.URL.Query().Has("vset") {
		versions = withoutVersion(versions, "bt")
	}
	display = requestDisplay(cfg, r)
	return date, lectionary, all, versions, display
}

// loadSections runs the readings router for one request: date/lectionary
// override cfg, all controls part filtering, and versions is swapped via
// render.OfflineVersions -- when cfg.Offline (any lectionary needs the
// network-free set), or when lectionary is "traditional" (pl is the
// niedziela.pl modern scrape, meaningless for missalemeum) -- before being
// handed back to the caller for rendering, so the caller's column labels
// always match what was actually loadable. dayInfo is the day's celebration
// identity (see liturgy.DayInfo), zero when the source carried none.
func loadSections(cfg config.Config, lectionary, date string, all bool, versions []string) (secs []liturgy.Section, dayInfo liturgy.DayInfo, effVersions []string, err error) {
	cfg.Lectionary = lectionary
	effVersions = render.EffectiveVersions(versions, lectionary, cfg.Offline)
	secs, dayInfo, err = readings.Load(cfg, readings.Options{
		Date:    date,
		Offline: cfg.Offline,
		All:     all,
	})
	return secs, dayInfo, effVersions, err
}

// indexData is what templates/index.html ranges/branches over.
type indexData struct {
	Date, PrevDate, NextDate string
	Lectionary               string
	VersionOpts              []versionOpt
	All                      bool
	ThemeOpts                []themeOpt
	Theme                    string
	Display                  string
	Mono                     bool
	Reading                  template.HTML
	// L holds the localised control labels (lectionary/layout/theme/...),
	// set from i18n.Get(cfg.UILanguage) -- index.html references its
	// fields (e.g. {{.L.Lectionary}}) instead of hardcoded Polish text.
	L i18n.UI
	// Lang is cfg.UILanguage, rendered into <html lang="...">.
	Lang string
}

type versionOpt struct {
	Code    string
	Checked bool
}

type themeOpt struct {
	Name     string
	Selected bool
}

// indexHandler serves the full page: controls reflecting the request's
// query (defaulting from cfg) plus the reading pane pre-rendered for that
// same query, so a plain (JS-less) GET / already shows today's gospel.
func indexHandler(cfg config.Config) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		date, lectionary, all, versions, display := resolveQuery(cfg, r)
		theme := r.URL.Query().Get("theme")
		if theme == "" {
			theme = cfg.WebTheme
		}

		// No version selected -> fetch nothing and show nothing (empty pane, no
		// day-info/headings); loadVersions stays nil so no box is checked.
		var reading template.HTML
		var loadVersions []string
		if len(versions) > 0 {
			secs, dayInfo, lv, err := loadSections(cfg, lectionary, date, all, versions)
			loadVersions = lv
			reading = renderOrError(secs, lv, lectionary, display, cfg.UILanguage, dayInfo, err)
		}

		// Check the boxes for the versions actually rendered (loadVersions),
		// not the raw request: traditional/offline substitute pl->wuj, so the
		// pl box must not show checked while Wujek is what's displayed.
		selected := map[string]bool{}
		for _, v := range loadVersions {
			selected[v] = true
		}
		versionOpts := make([]versionOpt, 0, len(bibleVersions))
		for _, v := range bibleVersions {
			versionOpts = append(versionOpts, versionOpt{Code: v, Checked: selected[v]})
		}

		themes := Themes()
		themeOpts := make([]themeOpt, 0, len(themes))
		for _, name := range themes {
			themeOpts = append(themeOpts, themeOpt{Name: name, Selected: name == theme})
		}

		data := indexData{
			Date:        date,
			PrevDate:    shiftDate(date, -1),
			NextDate:    shiftDate(date, 1),
			Lectionary:  lectionary,
			VersionOpts: versionOpts,
			All:         all,
			ThemeOpts:   themeOpts,
			Theme:       theme,
			Display:     display,
			Mono:        queryBool(r, "mono", cfg.WebMono),
			Reading:     reading,
			L:           i18n.Get(cfg.UILanguage),
			Lang:        cfg.UILanguage,
		}

		w.Header().Set("Content-Type", "text/html; charset=utf-8")
		if err := tmpl.ExecuteTemplate(w, "index.html", data); err != nil {
			http.Error(w, err.Error(), http.StatusInternalServerError)
		}
	}
}

// readingsHandler serves the HTMX reading-pane partial: a fragment only,
// produced entirely by RenderReadings (never re-implemented here).
func readingsHandler(cfg config.Config) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		date, lectionary, all, versions, display := resolveQuery(cfg, r)

		var reading template.HTML
		if len(versions) > 0 {
			secs, dayInfo, loadVersions, err := loadSections(cfg, lectionary, date, all, versions)
			reading = renderOrError(secs, loadVersions, lectionary, display, cfg.UILanguage, dayInfo, err)
		}

		w.Header().Set("Content-Type", "text/html; charset=utf-8")
		io.WriteString(w, string(reading))
	}
}

// renderOrError returns RenderReadings' fragment, or (on a readings.Load
// error, or no sections at all for the date) a small escaped error
// paragraph, localised via lang -- readings.Load errors are expected in
// normal operation (an unpublished date, no network while online, ...) so
// the pane should show them, not 500.
func renderOrError(secs []liturgy.Section, versions []string, lectionary, display, lang string, dayInfo liturgy.DayInfo, err error) template.HTML {
	if err != nil {
		return template.HTML(`<p class="error">` + template.HTMLEscapeString(err.Error()) + `</p>`)
	}
	if len(secs) == 0 {
		return template.HTML(`<p class="error">` + template.HTMLEscapeString(i18n.Get(lang).NoReadingsDay) + `</p>`)
	}
	return RenderReadings(secs, versions, lectionary, display, lang, dayInfo)
}

// requestReaderVersions returns the corpus versions the reader request asks for
// (repeated ?v=), dropping "bt" (no corpus) and anything invalid; falling back
// to the configured default (or "wuj" when that is bt/invalid) so a plain visit
// shows exactly one column.
func requestReaderVersions(cfg config.Config, r *http.Request) []string {
	var out []string
	for _, v := range r.URL.Query()["v"] {
		if v != "bt" && config.ValidVersion(v) {
			out = append(out, v)
		}
	}
	if len(out) == 0 {
		d := cfg.DefaultVersion
		if d == "bt" || !config.ValidVersion(d) {
			d = "wuj"
		}
		out = []string{d}
	}
	return out
}

// findBook returns the BookInfo whose Canonical matches, and whether found.
func findBook(books []bible.BookInfo, canonical string) (bible.BookInfo, bool) {
	for _, b := range books {
		if b.Canonical == canonical {
			return b, true
		}
	}
	return bible.BookInfo{}, false
}

// clampChap keeps chap within the book's available chapters (contiguous in
// practice); 0 when the book has none in any corpus version.
func clampChap(chap int, chaps []int) int {
	if len(chaps) == 0 {
		return 0
	}
	if chap < chaps[0] {
		return chaps[0]
	}
	last := chaps[len(chaps)-1]
	if chap > last {
		return last
	}
	return chap
}

// atoiDefault parses s as an int, returning def when it is empty/unparsable.
func atoiDefault(s string, def int) int {
	if n, err := strconv.Atoi(strings.TrimSpace(s)); err == nil {
		return n
	}
	return def
}

type readerData struct {
	BookOpts           []bookOpt
	Chap               int
	PrevChap, NextChap int
	ChapOpts           []chapOpt
	VersionOpts        []versionOpt
	Display            string
	ThemeOpts          []themeOpt
	Theme              string
	Mono               bool
	Reading            template.HTML
	L                  i18n.UI
	Lang               string
}

type bookOpt struct {
	Value    string // canonical name (corpus/query value)
	Label    string // dialect display name
	Selected bool
}

type chapOpt struct {
	N        int
	Selected bool
}

// readerHandler serves GET /reader: a book picker (dialect names), chapter
// navigation and corpus-version compare, rendering the same reading-pane
// templates/themes as the daily view. The controls form re-fetches /reader and
// hx-selects #reader-root, so book/chapter/version selects stay in sync.
func readerHandler(cfg config.Config, tbl *bible.BookTable) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		books := tbl.Books(cfg.SiglaLang())
		if len(books) == 0 { // defensive: embedded table always has books
			http.Error(w, "web: no books", http.StatusInternalServerError)
			return
		}

		info, ok := findBook(books, r.URL.Query().Get("book"))
		if !ok {
			info = books[0]
		}
		versions := requestReaderVersions(cfg, r)
		chaps := UnionChapters(info.Canonical)
		first := 1
		if len(chaps) > 0 {
			first = chaps[0]
		}
		chap := clampChap(atoiDefault(r.URL.Query().Get("chap"), first), chaps)
		display := requestDisplay(cfg, r)
		theme := r.URL.Query().Get("theme")
		if theme == "" {
			theme = cfg.WebTheme
		}

		reading := RenderPassage(info.Canonical, info.Name, chap, versions, display, cfg.UILanguage)

		bookOpts := make([]bookOpt, 0, len(books))
		for _, b := range books {
			bookOpts = append(bookOpts, bookOpt{Value: b.Canonical, Label: b.Name, Selected: b.Canonical == info.Canonical})
		}
		chapOpts := make([]chapOpt, 0, len(chaps))
		for _, c := range chaps {
			chapOpts = append(chapOpts, chapOpt{N: c, Selected: c == chap})
		}
		selected := map[string]bool{}
		for _, v := range versions {
			selected[v] = true
		}
		versionOpts := make([]versionOpt, 0, len(readerCorpusVersions))
		for _, v := range readerCorpusVersions {
			versionOpts = append(versionOpts, versionOpt{Code: v, Checked: selected[v]})
		}
		themes := Themes()
		themeOpts := make([]themeOpt, 0, len(themes))
		for _, name := range themes {
			themeOpts = append(themeOpts, themeOpt{Name: name, Selected: name == theme})
		}

		prev, next := chap-1, chap+1
		if len(chaps) > 0 {
			prev = clampChap(chap-1, chaps)
			next = clampChap(chap+1, chaps)
		}

		data := readerData{
			BookOpts:    bookOpts,
			Chap:        chap,
			PrevChap:    prev,
			NextChap:    next,
			ChapOpts:    chapOpts,
			VersionOpts: versionOpts,
			Display:     display,
			ThemeOpts:   themeOpts,
			Theme:       theme,
			Mono:        queryBool(r, "mono", cfg.WebMono),
			Reading:     reading,
			L:           i18n.Get(cfg.UILanguage),
			Lang:        cfg.UILanguage,
		}

		w.Header().Set("Content-Type", "text/html; charset=utf-8")
		if err := tmpl.ExecuteTemplate(w, "reader.html", data); err != nil {
			http.Error(w, err.Error(), http.StatusInternalServerError)
		}
	}
}

// themeCSSHandler serves one theme's stylesheet: the requested name, or
// (unknown/invalid) cfg.WebTheme, or (that also unknown) the built-in
// default -- so an unrecognized ?name= degrades to a working theme instead
// of a broken page.
func themeCSSHandler(cfg config.Config) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		name := r.URL.Query().Get("name")
		css, err := themeCSS(name)
		if err != nil {
			css, err = themeCSS(cfg.WebTheme)
		}
		if err != nil {
			css, err = themeCSS(config.Default().WebTheme)
		}
		if err != nil {
			http.Error(w, "web: no theme available", http.StatusInternalServerError)
			return
		}
		w.Header().Set("Content-Type", "text/css; charset=utf-8")
		w.Write(css)
	}
}

// settingsData drives templates/settings.html.
type settingsData struct {
	Cfg            config.Config
	Books          string       // current books.toml text (user override, else the embedded default)
	ThemeOpts      []themeOpt   // for the web_theme <select>
	VersionOpts    []versionOpt // all five, Checked if in Cfg.Versions
	WebVersionOpts []versionOpt // all five, Checked if in Cfg.WebVersions
	Saved          bool         // show a "saved" note (post-redirect)
	Error          string       // validation error to show (empty = none)
	L              i18n.UI
	Lang           string
}

func newSettingsData(cfg config.Config, books, errMsg string, saved bool) settingsData {
	themes := Themes()
	opts := make([]themeOpt, 0, len(themes))
	for _, name := range themes {
		opts = append(opts, themeOpt{Name: name, Selected: name == cfg.WebTheme})
	}

	versionsSet := map[string]bool{}
	for _, v := range cfg.Versions {
		versionsSet[v] = true
	}
	versionOpts := make([]versionOpt, 0, len(bibleVersions))
	for _, v := range bibleVersions {
		versionOpts = append(versionOpts, versionOpt{Code: v, Checked: versionsSet[v]})
	}

	webVersionsSet := map[string]bool{}
	for _, v := range cfg.WebVersions {
		webVersionsSet[v] = true
	}
	webVersionOpts := make([]versionOpt, 0, len(bibleVersions))
	for _, v := range bibleVersions {
		webVersionOpts = append(webVersionOpts, versionOpt{Code: v, Checked: webVersionsSet[v]})
	}

	return settingsData{
		Cfg:            cfg,
		Books:          books,
		ThemeOpts:      opts,
		VersionOpts:    versionOpts,
		WebVersionOpts: webVersionOpts,
		Saved:          saved,
		Error:          errMsg,
		L:              i18n.Get(cfg.UILanguage),
		Lang:           cfg.UILanguage,
	}
}

func currentBooksText() string {
	if b := config.UserBooksTOML(); len(b) > 0 {
		return string(b)
	}
	return string(bible.DefaultBooksTOML())
}

// settingsGet renders the settings form for the live config.
func settingsGet(s *server) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		data := newSettingsData(s.get(), currentBooksText(), "", r.URL.Query().Get("saved") == "1")
		w.Header().Set("Content-Type", "text/html; charset=utf-8")
		if err := tmpl.ExecuteTemplate(w, "settings.html", data); err != nil {
			http.Error(w, err.Error(), http.StatusInternalServerError)
		}
	}
}

// settingsPost validates and persists the submitted settings + books.toml, then
// applies them to the running server and redirects (PRG). On a validation error
// it re-renders the form with the message and the user's edits, HTTP 200.
func settingsPost(s *server) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		if err := r.ParseForm(); err != nil {
			http.Error(w, err.Error(), http.StatusBadRequest)
			return
		}

		cfg := s.get() // start from live cfg so Parts/SchemaVersion are preserved
		cfg.Lectionary = normLect(r.PostForm.Get("lectionary"), cfg.Lectionary)
		cfg.TraditionalLang = pickLang(r.PostForm.Get("traditional_lang"), cfg.TraditionalLang)
		cfg.UILanguage = config.NormalizeUILanguage(r.PostForm.Get("ui_language"))
		cfg.SiglaStyle = config.NormalizeSiglaStyle(r.PostForm.Get("sigla_style"))
		cfg.WebDisplay = config.NormalizeDisplay(r.PostForm.Get("web_display"))
		cfg.WebTheme = r.PostForm.Get("web_theme")
		cfg.DefaultVersion = r.PostForm.Get("default_version")
		cfg.Versions = r.PostForm["versions"]
		cfg.WebVersions = r.PostForm["web_versions"]
		cfg.All = r.PostForm.Get("all") != ""
		cfg.Offline = r.PostForm.Get("offline") != ""
		cfg.WebMono = r.PostForm.Get("web_mono") != ""
		cfg.Width = atoiOr(r.PostForm.Get("width"), cfg.Width)
		cfg.WebPort = atoiOr(r.PostForm.Get("web_port"), cfg.WebPort)
		cfg.Pager = r.PostForm.Get("pager")

		booksText := r.PostForm.Get("books")

		// Validate config.
		if err := config.Validate(cfg); err != nil {
			renderSettingsError(w, cfg, booksText, err.Error())
			return
		}
		// Validate books.toml (parse via the same loader the app uses).
		var newTbl *bible.BookTable
		if strings.TrimSpace(booksText) != "" {
			t, berr := bible.LoadBookTable([]byte(booksText))
			if berr != nil {
				renderSettingsError(w, cfg, booksText, "books.toml: "+berr.Error())
				return
			}
			newTbl = t
		}

		// Persist.
		if err := config.Save(cfg); err != nil {
			renderSettingsError(w, cfg, booksText, "saving config: "+err.Error())
			return
		}
		// Only write books.toml when the editor actually carried content, so a
		// submit with an empty/absent books field never clobbers an existing
		// override (the form always pre-fills the textarea).
		if strings.TrimSpace(booksText) != "" {
			if p, err := config.BooksPath(); err == nil {
				_ = os.WriteFile(p, []byte(booksText), 0o644)
			}
		}

		s.apply(cfg, newTbl)
		http.Redirect(w, r, "/settings?saved=1", http.StatusSeeOther)
	}
}

func renderSettingsError(w http.ResponseWriter, cfg config.Config, books, msg string) {
	w.Header().Set("Content-Type", "text/html; charset=utf-8")
	w.WriteHeader(http.StatusOK)
	_ = tmpl.ExecuteTemplate(w, "settings.html", newSettingsData(cfg, books, msg, false))
}

// normLect normalizes a lectionary form value, falling back to def on anything invalid.
func normLect(v, def string) string {
	if n, ok := config.NormalizeLectionary(v); ok {
		return n
	}
	return def
}

// pickLang returns v if it is "pl"/"en", else def.
func pickLang(v, def string) string {
	if v == "pl" || v == "en" {
		return v
	}
	return def
}

func atoiOr(s string, def int) int {
	if n, err := strconv.Atoi(strings.TrimSpace(s)); err == nil {
		return n
	}
	return def
}

// defaultWebPort is the port chooseListener prefers when cfg.WebPort is 0.
const defaultWebPort = 1099

// chooseListener binds the port to serve on, on loopback only (127.0.0.1) --
// lectio-web is documented as a personal tool and Run prints an
// http://localhost/... URL, so it must not be reachable from the LAN. port==0
// means "prefer defaultWebPort (1099), else let the OS pick a free port"; a
// non-zero port is bound exactly (and its bind error surfaced if the port is
// in use).
func chooseListener(port int) (net.Listener, error) {
	if port != 0 {
		return net.Listen("tcp", fmt.Sprintf("127.0.0.1:%d", port))
	}
	if ln, err := net.Listen("tcp", fmt.Sprintf("127.0.0.1:%d", defaultWebPort)); err == nil {
		return ln, nil
	}
	return net.Listen("tcp", "127.0.0.1:0") // 1099 taken -> any free port
}

// Run starts lectio-web: listens on cfg.WebPort via chooseListener (0
// prefers 1099, falling back to a free OS port), prints the URL, best-effort
// opens it in a browser, and serves until the listener errors.
func Run(cfg config.Config) error {
	ln, err := chooseListener(cfg.WebPort)
	if err != nil {
		return err
	}
	port := ln.Addr().(*net.TCPAddr).Port
	url := fmt.Sprintf("http://localhost:%d", port)
	fmt.Println("lectio-web on " + url)

	openBrowser(url) // best-effort; ignore failure (no browser, headless, ...)

	return http.Serve(ln, NewServer(cfg))
}

// openBrowser best-effort launches the platform's "open a URL" command;
// any failure (missing command, no display, ...) is silently ignored, as
// lectio-web is fully usable by just visiting the printed URL manually.
func openBrowser(url string) {
	var cmd *exec.Cmd
	switch runtime.GOOS {
	case "darwin":
		cmd = exec.Command("open", url)
	case "windows":
		cmd = exec.Command("cmd", "/c", "start", "", url)
	default:
		cmd = exec.Command("xdg-open", url)
	}
	_ = cmd.Start()
}