96 lines
3.0 KiB
Go
96 lines
3.0 KiB
Go
package handler
|
|
|
|
import (
|
|
"embed"
|
|
"errors"
|
|
"fmt"
|
|
"html/template"
|
|
"io/fs"
|
|
"net/http"
|
|
"path"
|
|
"strconv"
|
|
)
|
|
|
|
//go:embed chatpage/*
|
|
var chatPageAssets embed.FS
|
|
|
|
// ChatPageOptions configures the optional browser-based compatibility client.
|
|
// AppID is a public route identifier; callers must never pass an auth token here.
|
|
type ChatPageOptions struct {
|
|
AppID string
|
|
}
|
|
|
|
// ChatPageHandler serves the self-contained browser client under /chat/.
|
|
type ChatPageHandler struct {
|
|
appID string
|
|
page *template.Template
|
|
assets fs.FS
|
|
}
|
|
|
|
// NewChatPageHandler constructs the optional chat page. Whether it is mounted
|
|
// is intentionally left to application configuration.
|
|
func NewChatPageHandler(options ChatPageOptions) (*ChatPageHandler, error) {
|
|
if !validDashScopeAppID(options.AppID) {
|
|
return nil, errors.New("chat page app ID is invalid")
|
|
}
|
|
pageTemplate, err := template.ParseFS(chatPageAssets, "chatpage/index.html")
|
|
if err != nil {
|
|
return nil, fmt.Errorf("parse embedded chat page: %w", err)
|
|
}
|
|
assets, err := fs.Sub(chatPageAssets, "chatpage")
|
|
if err != nil {
|
|
return nil, fmt.Errorf("open embedded chat page assets: %w", err)
|
|
}
|
|
return &ChatPageHandler{appID: options.AppID, page: pageTemplate, assets: assets}, nil
|
|
}
|
|
|
|
func (h *ChatPageHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
|
|
h.setSecurityHeaders(w)
|
|
if r.Method != http.MethodGet && r.Method != http.MethodHead {
|
|
w.Header().Set("Allow", http.MethodGet+", "+http.MethodHead)
|
|
http.Error(w, "method not allowed", http.StatusMethodNotAllowed)
|
|
return
|
|
}
|
|
|
|
switch r.URL.Path {
|
|
case "/chat/":
|
|
w.Header().Set("Content-Type", "text/html; charset=utf-8")
|
|
if r.Method == http.MethodHead {
|
|
w.WriteHeader(http.StatusOK)
|
|
return
|
|
}
|
|
if err := h.page.ExecuteTemplate(w, "index.html", struct{ AppID string }{AppID: h.appID}); err != nil {
|
|
http.Error(w, "chat page unavailable", http.StatusInternalServerError)
|
|
}
|
|
case "/chat/app.css", "/chat/app.js":
|
|
name := path.Base(r.URL.Path)
|
|
if name == "app.css" {
|
|
w.Header().Set("Content-Type", "text/css; charset=utf-8")
|
|
} else {
|
|
w.Header().Set("Content-Type", "text/javascript; charset=utf-8")
|
|
}
|
|
content, err := fs.ReadFile(h.assets, name)
|
|
if err != nil {
|
|
http.NotFound(w, r)
|
|
return
|
|
}
|
|
w.Header().Set("Content-Length", strconv.Itoa(len(content)))
|
|
if r.Method == http.MethodGet {
|
|
_, _ = w.Write(content)
|
|
}
|
|
default:
|
|
http.NotFound(w, r)
|
|
}
|
|
}
|
|
|
|
func (h *ChatPageHandler) setSecurityHeaders(w http.ResponseWriter) {
|
|
w.Header().Set("Cache-Control", "no-store")
|
|
w.Header().Set("Content-Security-Policy", "default-src 'none'; script-src 'self'; style-src 'self'; connect-src 'self'; img-src 'self'; object-src 'none'; base-uri 'none'; form-action 'none'; frame-ancestors 'none'")
|
|
w.Header().Set("Cross-Origin-Opener-Policy", "same-origin")
|
|
w.Header().Set("Cross-Origin-Resource-Policy", "same-origin")
|
|
w.Header().Set("Permissions-Policy", "camera=(), microphone=(), geolocation=()")
|
|
w.Header().Set("Referrer-Policy", "no-referrer")
|
|
w.Header().Set("X-Content-Type-Options", "nosniff")
|
|
w.Header().Set("X-Frame-Options", "DENY")
|
|
}
|