Documentation
¶
Overview ¶
Package webapp contains deliberately small building blocks shared by the runnable web applications in cmd/. It keeps the examples dependency-free while making their database and HTTP behaviour consistent.
Index ¶
- func Apply(ctx context.Context, db *sql.DB, statements ...string) error
- func ContextWithTimeout(parent context.Context) (context.Context, context.CancelFunc)
- func Error(w http.ResponseWriter, r *http.Request, status int, message string)
- func JSON(w http.ResponseWriter, status int, value any)
- func MountShared(mux *http.ServeMux)
- func NextID(ctx context.Context, q interface{ ... }, table string) (int64, error)
- func Open(ctx context.Context, dsn string) (*sql.DB, error)
- func SecurityHeaders(next http.Handler) http.Handler
- type CheckPageOptions
- type PageProblem
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func Apply ¶
Apply executes schema statements one by one so error messages name the failing statement. The schemas in these examples are intentionally simple and use only TinySQL's public SQL surface.
func ContextWithTimeout ¶
ContextWithTimeout returns a modest request timeout used by command apps.
func Error ¶
Error writes a JSON error when a request targets /api/, otherwise a plain text HTTP error. It avoids leaking implementation details from handlers.
func JSON ¶
func JSON(w http.ResponseWriter, status int, value any)
JSON writes a JSON response. It is suitable for the compact browser APIs in the examples and intentionally does not expose internal errors itself.
func MountShared ¶ added in v0.50.0
MountShared registers the assets that every demo shares under /static/. Call it before the app's own "GET /static/" file server: ServeMux prefers the more specific pattern, so the app keeps full control of every other path below /static/.
func NextID ¶
func NextID(ctx context.Context, q interface { QueryRowContext(context.Context, string, ...any) *sql.Row }, table string) (int64, error)
NextID returns the next positive integral key for a fixed, trusted table name. Table names are supplied by application code, never HTTP input.
Types ¶
type CheckPageOptions ¶ added in v0.50.0
type CheckPageOptions struct {
// AllowExternalAssets lists hosts the page is permitted to load from, for
// example "cdn.jsdelivr.net". Any other absolute URL is reported. A page
// that loads nothing remotely — the goal for a local-first application —
// leaves this empty.
AllowExternalAssets []string
}
CheckPageOptions tunes CheckPage for a specific application.
type PageProblem ¶ added in v0.50.0
type PageProblem struct {
Kind string // "missing-asset", "blocked-inline", "external-asset"
Detail string
}
PageProblem describes one defect found by CheckPage.
func CheckPage ¶ added in v0.50.0
func CheckPage(handler http.Handler, path string, opts CheckPageOptions) ([]PageProblem, error)
CheckPage fetches path from handler and reports the defects that a plain status-code test cannot see.
It exists because two applications in this repository shipped a Content-Security-Policy without 'unsafe-inline' while keeping their entire stylesheet — and, in one case, every interactive handler — in inline <style> and <script> blocks. The browser dropped all of it, so the page rendered unstyled and its buttons did nothing, while every Go test still saw a healthy 200. The checks below are exactly the ones that would have caught that on the first day:
- every same-origin stylesheet and script the page references is actually served,
- no inline style/script content or on*= handler survives a CSP that forbids it, and
- no asset is loaded from an unexpected host.
func (PageProblem) String ¶ added in v0.50.0
func (p PageProblem) String() string
Source Files