Claus Lohmar
dd865d4f27
- One base layout (layout.html) with the header, the nav from Registry.Nav()
(D-038), a content slot and the CSRF token; every page renders inside it and
a module supplies content only
- Embedded same-origin assets (app.css · app.js · webauthn.js · sw.js ·
manifest.webmanifest · icons) served by the reserved `static` workflow
- webauthn.js drives the three ceremonies from data-* attributes — no inline
script, so the CSP `script-src 'self'` holds (AC-3)
- manifest start_url "/" (D-011); the service worker never caches an
authenticated response or /{GUID} (A5)
34 lines
1.4 KiB
Go
34 lines
1.4 KiB
Go
// Package web is MyDay's shared web layer (SPEC-009): the core shell every
|
|
// screen renders inside, the template helpers, and the embedded static assets
|
|
// (stylesheet · WebAuthn client · shell bootstrap · service worker · PWA
|
|
// manifest · icons).
|
|
//
|
|
// It is deliberately SERVER-RENDERED and BUILDLESS: no framework, no npm, no
|
|
// bundler. The CSP is `script-src 'self'` (SPEC-003 §4), so every script is a
|
|
// same-origin file and there are NO INLINE SCRIPTS — the layout emits none, and
|
|
// the WebAuthn ceremonies are driven from data-* attributes by webauthn.js.
|
|
//
|
|
// The package is a leaf: it imports only the standard library, so any package
|
|
// (the door, the flows, a module) may render inside the shell without creating
|
|
// an import cycle. The nav comes from the module registry through the NavLister
|
|
// seam (SPEC-008 §7), installed once at startup by the entrypoint.
|
|
//
|
|
// Spec: docs/specs/spec-009-web-pwa.md.
|
|
package web
|
|
|
|
import "embed"
|
|
|
|
// AppName is the application's display name (the shell header, the manifest).
|
|
const AppName = "MyDay"
|
|
|
|
// StaticPath is the URL prefix of the reserved `static` workflow (D-004). The
|
|
// door serves the embedded assets under it.
|
|
const StaticPath = "/static/"
|
|
|
|
// StaticDir is the directory inside the embedded filesystem.
|
|
const StaticDir = "static"
|
|
|
|
// StaticFS holds the embedded assets (SPEC-009 §3).
|
|
//
|
|
//go:embed static
|
|
var StaticFS embed.FS
|