jochen
d14ef647d6
Review round 2 F3 (ADR 0517 §3, 1858/AC5): acted=1 stayed in the address, so a reload, a restored tab or a bookmark of it recorded no page opened or opened. An act's 303 (and a mode chosen) now sets mail_acted for 10 seconds, HttpOnly and SameSite=Strict, Secure but on 127.0.0.1; the next list or pane it reaches records nothing and clears it; the address carries no marker. The local run keeps the browser's other cookies.
46 lines
1.6 KiB
Go
46 lines
1.6 KiB
Go
package web
|
|
|
|
// The mail page's one script and one stylesheet (novox/hq ADR 0515 §6, issue 1859), built into the binary and
|
|
// served from the page's own origin at /static/app.js and /static/app.css, with their types and nosniff;
|
|
// nothing else is served from /static/. Neither carries anything of a mail.
|
|
|
|
import (
|
|
"embed"
|
|
"net/http"
|
|
)
|
|
|
|
//go:embed static/app.js static/app.css
|
|
var staticFiles embed.FS
|
|
|
|
// staticTypes are the two files and their types.
|
|
var staticTypes = map[string]string{
|
|
"/static/app.js": "text/javascript; charset=utf-8",
|
|
"/static/app.css": "text/css; charset=utf-8",
|
|
}
|
|
|
|
// staticPage answers /static/app.js and /static/app.css; anything else under /static/ is 404.
|
|
func staticPage(w http.ResponseWriter, r *http.Request) {
|
|
typ, ok := staticTypes[r.URL.Path]
|
|
if !ok || (r.Method != http.MethodGet && r.Method != http.MethodHead) {
|
|
http.NotFound(w, r)
|
|
return
|
|
}
|
|
body, err := staticFiles.ReadFile(r.URL.Path[1:])
|
|
if err != nil {
|
|
http.NotFound(w, r)
|
|
return
|
|
}
|
|
w.Header().Set("Content-Type", typ)
|
|
w.Header().Set("X-Content-Type-Options", "nosniff")
|
|
w.Header().Set("Cache-Control", "no-cache")
|
|
_, _ = w.Write(body)
|
|
}
|
|
|
|
// RefreshHeader marks the script's own refresh of the page after an act (review round 1 F1): the page it
|
|
// answers records nothing, since the act already wrote its one line.
|
|
const RefreshHeader = "X-Mail-Refresh"
|
|
|
|
// ActedCookie is set by an act's own 303 (review round 2 F3): the one next GET of the list or the pane sees it,
|
|
// records nothing, and clears it — never a marker in the address, which a reload or a bookmark would keep.
|
|
const ActedCookie = "mail_acted"
|