增加调试前端页面

internal/handler/chat_page.go

@@ -0,0 +1,95 @@
+package handler
+
+import (
+	"embed"
+	"errors"
+	"fmt"
+	"html/template"
+	"io/fs"
+	"net/http"
+	"path"
+	"strconv"
+)
+
+//go:embed chatpage/*
+var chatPageAssets embed.FS
+
+// ChatPageOptions configures the optional browser-based compatibility client.
+// AppID is a public route identifier; callers must never pass an auth token here.
+type ChatPageOptions struct {
+	AppID string
+}
+
+// ChatPageHandler serves the self-contained browser client under /chat/.
+type ChatPageHandler struct {
+	appID  string
+	page   *template.Template
+	assets fs.FS
+}
+
+// NewChatPageHandler constructs the optional chat page. Whether it is mounted
+// is intentionally left to application configuration.
+func NewChatPageHandler(options ChatPageOptions) (*ChatPageHandler, error) {
+	if !validDashScopeAppID(options.AppID) {
+		return nil, errors.New("chat page app ID is invalid")
+	}
+	pageTemplate, err := template.ParseFS(chatPageAssets, "chatpage/index.html")
+	if err != nil {
+		return nil, fmt.Errorf("parse embedded chat page: %w", err)
+	}
+	assets, err := fs.Sub(chatPageAssets, "chatpage")
+	if err != nil {
+		return nil, fmt.Errorf("open embedded chat page assets: %w", err)
+	}
+	return &ChatPageHandler{appID: options.AppID, page: pageTemplate, assets: assets}, nil
+}
+
+func (h *ChatPageHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
+	h.setSecurityHeaders(w)
+	if r.Method != http.MethodGet && r.Method != http.MethodHead {
+		w.Header().Set("Allow", http.MethodGet+", "+http.MethodHead)
+		http.Error(w, "method not allowed", http.StatusMethodNotAllowed)
+		return
+	}
+
+	switch r.URL.Path {
+	case "/chat/":
+		w.Header().Set("Content-Type", "text/html; charset=utf-8")
+		if r.Method == http.MethodHead {
+			w.WriteHeader(http.StatusOK)
+			return
+		}
+		if err := h.page.ExecuteTemplate(w, "index.html", struct{ AppID string }{AppID: h.appID}); err != nil {
+			http.Error(w, "chat page unavailable", http.StatusInternalServerError)
+		}
+	case "/chat/app.css", "/chat/app.js":
+		name := path.Base(r.URL.Path)
+		if name == "app.css" {
+			w.Header().Set("Content-Type", "text/css; charset=utf-8")
+		} else {
+			w.Header().Set("Content-Type", "text/javascript; charset=utf-8")
+		}
+		content, err := fs.ReadFile(h.assets, name)
+		if err != nil {
+			http.NotFound(w, r)
+			return
+		}
+		w.Header().Set("Content-Length", strconv.Itoa(len(content)))
+		if r.Method == http.MethodGet {
+			_, _ = w.Write(content)
+		}
+	default:
+		http.NotFound(w, r)
+	}
+}
+
+func (h *ChatPageHandler) setSecurityHeaders(w http.ResponseWriter) {
+	w.Header().Set("Cache-Control", "no-store")
+	w.Header().Set("Content-Security-Policy", "default-src 'none'; script-src 'self'; style-src 'self'; connect-src 'self'; img-src 'self'; object-src 'none'; base-uri 'none'; form-action 'none'; frame-ancestors 'none'")
+	w.Header().Set("Cross-Origin-Opener-Policy", "same-origin")
+	w.Header().Set("Cross-Origin-Resource-Policy", "same-origin")
+	w.Header().Set("Permissions-Policy", "camera=(), microphone=(), geolocation=()")
+	w.Header().Set("Referrer-Policy", "no-referrer")
+	w.Header().Set("X-Content-Type-Options", "nosniff")
+	w.Header().Set("X-Frame-Options", "DENY")
+}