sulthan
ebc7a546c5
Adds a password-gated browser UI for the bookmark list, served by the same Go
binary and container as the userscript API.
## What
- `GET /` — list page, or the login page when there is no session (200, no redirect).
- `POST /login`, `POST /logout` — stateless HMAC session cookie, 60-day Max-Age.
- `GET /ui/list?tab=all|fav`, `POST /ui/bookmarks/{key}/favorite`,
`POST /ui/bookmarks/{key}/chapter`, `DELETE /ui/bookmarks/{key}` — htmx fragments.
- `GET /static/*` — embedded `style.css`, `htmx.min.js`, `filter.js`.
Mobile-first dark CSS, 2–3 column grid at ≥900px, "Continue reading" strip of the
five most recent series, NEW badge, client-side title search, no build step.
## Stack
Go `html/template` + htmx 2.0.4 (vendored, 50 KB) + plain CSS. No npm, no bundler.
Templates and assets are `go:embed`-ed, so `CGO_ENABLED=0` and the distroless
image still hold.
## Auth
`WEB_PASSWORD` gates the UI; unset means the web routes are never registered and
`/` returns 404. Session cookie is `HttpOnly`, `SameSite=Lax`, `Secure` when the
request is HTTPS. The signing key derives from `API_TOKEN` + `WEB_PASSWORD`, so
rotating either logs every browser out. Login is rate-limited to 10 failures per
20 minutes per client IP, keyed on the **rightmost** `X-Forwarded-For` entry
(Traefik appends the observed peer, so the leftmost is client-spoofable). CGNAT
lockout is a known, accepted limitation — the window self-heals.
## Invariants preserved
- A session cookie never authenticates `/bookmarks*`. That API stays JSON +
bearer token, unchanged, as does the userscript.
- `Store.Upsert` is byte-for-byte unmodified. Every UI write goes
read-modify-write through the new `Store.Get`, so the conditional-`updated_at`
rule (favouriting must not reorder the list, a chapter override must) lives in
exactly one function.
## Deployment
`docker-compose.prod.yml` gains a second Traefik router on `MANGA_WEB_HOST`
pointing at the same service — one container, one certificate resolver, no second
service. Both `MANGA_API_HOST` and `MANGA_WEB_HOST` are required (`:?`), with no
example fallback in `.env.example`: a placeholder there would make Traefik
silently publish the UI on a domain you do not own. Needs a DNS A/AAAA record for
`manga.<domain>`. See `DEPLOY.md` §1b.
## Docs
- Design: `docs/superpowers/specs/2026-07-25-web-ui-design.md`
- Plan: `plans/2026-07-25-web-ui-implementation-plan.md`
## Verification
`gofmt` clean, `go vet`, `go test -race ./...`, `CGO_ENABLED=0 go build`, a real
`docker build` + curl smoke test, and a Playwright pass covering login
reject/accept, favourite-without-reorder, chapter edit, delete-with-confirm,
search, tab switch + back button, 390px with no horizontal overflow, and zero JS
console errors.
Reviewed-on: #1
Co-authored-by: Sulthan Zaki <sultankiki05@gmail.com>
Co-committed-by: Sulthan Zaki <sultankiki05@gmail.com>
38 lines
1.7 KiB
HTML
38 lines
1.7 KiB
HTML
{{define "card"}}
|
|
<article class="card" id="card-{{.Key}}" data-title="{{.Title}}">
|
|
<a class="cover" href="{{.ContinueURL}}" target="_blank" rel="noopener noreferrer">
|
|
{{if .Cover}}<img src="{{.Cover}}" alt="" loading="lazy">{{end}}
|
|
</a>
|
|
<div class="body">
|
|
<h3 class="title">{{.Title}}</h3>
|
|
<p class="meta">
|
|
<span class="site site-{{.Site}}">{{.Site}}</span>
|
|
<span class="chapter">Ch {{.LastChapter}}</span>
|
|
{{if .HasNewChapter}}<span class="new">NEW {{.LatestChapter}}</span>{{end}}
|
|
</p>
|
|
<div class="actions">
|
|
<a class="primary" href="{{.ContinueURL}}" target="_blank" rel="noopener noreferrer">Continue</a>
|
|
<button class="icon {{if .Favorite}}on{{end}}"
|
|
title="Favourite" aria-label="Toggle favourite"
|
|
hx-post="/ui/bookmarks/{{.Key}}/favorite"
|
|
hx-target="[id='card-{{.Key}}']" hx-swap="outerHTML">
|
|
{{if .Favorite}}★{{else}}☆{{end}}
|
|
</button>
|
|
<button class="icon" title="Set chapter" aria-label="Set chapter"
|
|
onclick="toggleChapterForm('{{.Key}}')">✎</button>
|
|
<button class="icon danger" title="Remove" aria-label="Remove"
|
|
hx-delete="/ui/bookmarks/{{.Key}}"
|
|
hx-target="[id='card-{{.Key}}']" hx-swap="outerHTML"
|
|
hx-confirm="Remove {{.Title}} from the list?">🗑</button>
|
|
</div>
|
|
<form class="chapter-form" id="chapter-form-{{.Key}}" hidden
|
|
hx-post="/ui/bookmarks/{{.Key}}/chapter"
|
|
hx-target="[id='card-{{.Key}}']" hx-swap="outerHTML">
|
|
<input name="chapter" type="number" step="0.1" min="0"
|
|
value="{{.LastChapterNum}}" aria-label="Chapter number" required>
|
|
<button type="submit">Save</button>
|
|
</form>
|
|
</div>
|
|
</article>
|
|
{{end}}
|