feat: publish the Sandwich Hime tutorial starter

internal/server/handler.go

@@ -0,0 +1,113 @@
+// SPDX-License-Identifier: 0BSD
+
+// Package server owns the example application's HTTP policy and request data.
+package server
+
+import (
+	"bytes"
+	"fmt"
+	"net/http"
+	"strconv"
+	"strings"
+	"sync/atomic"
+	"time"
+	"unicode/utf8"
+
+	"gamertan.com/sandwich-hime/sando"
+	"gitea.speelman.ca/gamertan/sandwich-hime-tutorial/internal/views"
+)
+
+const maxVisitorRunes = 80
+
+// New returns the complete example application using the system clock.
+func New() http.Handler {
+	return NewWithClock(time.Now)
+}
+
+// NewWithClock returns the application with an injectable request clock.
+// It is exported from this internal package so tests can make time exact.
+func NewWithClock(now func() time.Time) http.Handler {
+	if now == nil {
+		now = time.Now
+	}
+
+	application := &application{now: now}
+	mux := http.NewServeMux()
+	mux.HandleFunc("GET /{$}", application.home)
+	return mux
+}
+
+type application struct {
+	now      func() time.Time
+	requests atomic.Uint64
+}
+
+func (a *application) home(w http.ResponseWriter, r *http.Request) {
+	renderedAt := a.now().UTC()
+	requestNumber := a.requests.Add(1)
+
+	body := views.Home(views.HomeView{
+		Visitor: normalizeVisitor(r.URL.Query().Get("name")),
+		Trails:  trailsForRequest(),
+	})
+	page := views.Layout(views.LayoutView{
+		Title:         "A small Sandwich Hime site",
+		Body:          body,
+		RenderedAtUTC: renderedAt.Format(time.RFC3339Nano),
+		RequestNumber: requestNumber,
+	})
+
+	var output bytes.Buffer
+	renderStarted := time.Now()
+	if err := sando.Render(r.Context(), &output, page); err != nil {
+		w.Header().Set("Cache-Control", "no-store")
+		http.Error(w, "could not render page", http.StatusInternalServerError)
+		return
+	}
+	renderDuration := time.Since(renderStarted)
+
+	w.Header().Set("Content-Type", "text/html; charset=utf-8")
+	w.Header().Set("Cache-Control", "no-store")
+	w.Header().Set("Content-Length", strconv.Itoa(output.Len()))
+	w.Header().Set("Content-Security-Policy", "default-src 'none'; style-src 'unsafe-inline'; base-uri 'none'; form-action 'self'; frame-ancestors 'none'")
+	w.Header().Set("Referrer-Policy", "no-referrer")
+	w.Header().Set("X-Content-Type-Options", "nosniff")
+	w.Header().Set("Server-Timing", fmt.Sprintf(`sando;dur=%.3f;desc="buffered component render"`, float64(renderDuration)/float64(time.Millisecond)))
+	w.WriteHeader(http.StatusOK)
+	if r.Method == http.MethodHead {
+		return
+	}
+	_, _ = w.Write(output.Bytes())
+}
+
+func trailsForRequest() []views.Trail {
+	return []views.Trail{
+		{
+			Label:       "Read the official tutorial",
+			Description: "Walk through the source one typed component at a time.",
+			URL:         "https://sandwichhime.com/docs/tutorial/",
+		},
+		{
+			Label:       "Study the language and safety boundary",
+			Description: "See where contextual escaping succeeds and where compilation deliberately stops.",
+			URL:         "https://sandwichhime.com/docs/",
+		},
+		{
+			Label:       "Render another visitor",
+			Description: "This local link sends different untrusted request data through the same compiled templates.",
+			URL:         "/?name=friend",
+		},
+	}
+}
+
+func normalizeVisitor(value string) string {
+	value = strings.TrimSpace(value)
+	if value == "" {
+		return "traveler"
+	}
+	if utf8.RuneCountInString(value) <= maxVisitorRunes {
+		return value
+	}
+	runes := []rune(value)
+	return string(runes[:maxVisitorRunes])
+}