feat(backend): serve userscript at token-protected path

Reads the file per request from USERSCRIPT_PATH and rewrites its @version
to an mtime-derived value, so Violentmonkey always sees a higher version
after an edit regardless of what the file body claims. Also guards against
ServeMux's own path-cleaning redirect turning an empty {token} segment into
a 307 instead of the required 404.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

backend/userscript_test.go

@@ -0,0 +1,132 @@
+package main
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+)
+
+// sampleScript is a stand-in for the real userscript: a metadata block with a
+// @version line, plus a body that must survive the rewrite untouched.
+const sampleScript = `// ==UserScript==
+// @name         Manga Bookmark Sync
+// @version      1.5.0
+// @match        https://asurascans.com/*
+// ==/UserScript==
+(function () { "use strict"; })();
+`
+
+// writeScript drops a userscript in a temp dir with a known mtime and returns
+// its path plus the version string the handler is expected to stamp.
+func writeScript(t *testing.T, body string) (path, wantVersion string) {
+	t.Helper()
+	path = filepath.Join(t.TempDir(), "manga-bookmark.user.js")
+	if err := os.WriteFile(path, []byte(body), 0o644); err != nil {
+		t.Fatalf("write script: %v", err)
+	}
+	mod := time.Date(2026, 7, 28, 16, 42, 0, 0, time.UTC)
+	if err := os.Chtimes(path, mod, mod); err != nil {
+		t.Fatalf("chtimes: %v", err)
+	}
+	return path, "2026.07.28.1642"
+}
+
+func newUserscriptServer(t *testing.T, path string) http.Handler {
+	t.Helper()
+	store, err := OpenStore(filepath.Join(t.TempDir(), "test.db"))
+	if err != nil {
+		t.Fatalf("OpenStore: %v", err)
+	}
+	t.Cleanup(func() { store.Close() })
+	cfg := testConfig()
+	cfg.UserscriptPath = path
+	return newRouter(store, cfg)
+}
+
+func getScript(t *testing.T, srv http.Handler, token string) *httptest.ResponseRecorder {
+	t.Helper()
+	rr := httptest.NewRecorder()
+	srv.ServeHTTP(rr, httptest.NewRequest(http.MethodGet, "/u/"+token+"/manga-bookmark.user.js", nil))
+	return rr
+}
+
+func TestUserscriptServedWithStampedVersion(t *testing.T) {
+	path, wantVersion := writeScript(t, sampleScript)
+	rr := getScript(t, newUserscriptServer(t, path), testToken)
+
+	if rr.Code != http.StatusOK {
+		t.Fatalf("status = %d, want 200", rr.Code)
+	}
+	if ct := rr.Header().Get("Content-Type"); !strings.HasPrefix(ct, "text/javascript") {
+		t.Errorf("Content-Type = %q, want text/javascript", ct)
+	}
+	if cc := rr.Header().Get("Cache-Control"); cc != "no-cache" {
+		t.Errorf("Cache-Control = %q, want no-cache", cc)
+	}
+	body := rr.Body.String()
+	if !strings.Contains(body, "// @version      "+wantVersion) {
+		t.Errorf("body has no stamped version %q:\n%s", wantVersion, body)
+	}
+	if strings.Contains(body, "1.5.0") {
+		t.Errorf("body still carries the file's own version:\n%s", body)
+	}
+	// Everything outside the @version line is served verbatim.
+	if !strings.Contains(body, `(function () { "use strict"; })();`) {
+		t.Errorf("body was altered beyond the version line:\n%s", body)
+	}
+	if !strings.Contains(body, "// @name         Manga Bookmark Sync") {
+		t.Errorf("metadata block was altered:\n%s", body)
+	}
+}
+
+func TestUserscriptWrongTokenIs404(t *testing.T) {
+	path, _ := writeScript(t, sampleScript)
+	srv := newUserscriptServer(t, path)
+	for _, tok := range []string{"wrong", "", testToken + "x", testToken[:3]} {
+		if got := getScript(t, srv, tok).Code; got != http.StatusNotFound {
+			t.Errorf("token %q: status = %d, want 404", tok, got)
+		}
+	}
+}
+
+func TestUserscriptMissingFileIs404(t *testing.T) {
+	srv := newUserscriptServer(t, filepath.Join(t.TempDir(), "absent.user.js"))
+	if got := getScript(t, srv, testToken).Code; got != http.StatusNotFound {
+		t.Fatalf("status = %d, want 404", got)
+	}
+}
+
+func TestUserscriptWithoutVersionLineServedUnmodified(t *testing.T) {
+	const noVersion = "// ==UserScript==\n// @name x\n// ==/UserScript==\nconsole.log(1);\n"
+	path, _ := writeScript(t, noVersion)
+	rr := getScript(t, newUserscriptServer(t, path), testToken)
+
+	if rr.Code != http.StatusOK {
+		t.Fatalf("status = %d, want 200", rr.Code)
+	}
+	if rr.Body.String() != noVersion {
+		t.Fatalf("body = %q, want it unmodified", rr.Body.String())
+	}
+}
+
+// The endpoint must work on a deployment that never set WEB_PASSWORD, since
+// the web routes are not registered at all in that case.
+func TestUserscriptServedWithWebUIDisabled(t *testing.T) {
+	path, _ := writeScript(t, sampleScript)
+	store, err := OpenStore(filepath.Join(t.TempDir(), "nopass.db"))
+	if err != nil {
+		t.Fatalf("OpenStore: %v", err)
+	}
+	t.Cleanup(func() { store.Close() })
+	cfg := testConfig()
+	cfg.WebPassword = ""
+	cfg.UserscriptPath = path
+
+	if got := getScript(t, newRouter(store, cfg), testToken).Code; got != http.StatusOK {
+		t.Fatalf("status = %d, want 200", got)
+	}
+}