From 27dbaf2b2d5895a091d04aa1c852abb91a619e2d Mon Sep 17 00:00:00 2001 From: Paul Buetow Date: Fri, 1 May 2026 12:40:30 +0300 Subject: Minimalist UI: hide all elements until activated; add help modal and keyboard shortcuts - Redesign UI to be invisible by default: only header + '?' button shown - Press m to show sidebar, t for toolbar, / for search, ? for help - Add help modal with all keyboard shortcuts - Fix scanner to skip corrupt/unprobeable files instead of aborting - Fix scanner to skip thumbnail errors instead of aborting - Fix rescan to use background context so it completes after HTTP response - Rename project from KISS Media Player to Player --- internal/api/middleware.go | 15 +++++++++++++++ 1 file changed, 15 insertions(+) (limited to 'internal/api/middleware.go') diff --git a/internal/api/middleware.go b/internal/api/middleware.go index ee1d6c9..fd779b5 100644 --- a/internal/api/middleware.go +++ b/internal/api/middleware.go @@ -29,15 +29,24 @@ func NewMiddleware(store repository.Store, sm *auth.SessionManager) *Middleware } // RequireSession validates the session cookie and injects the session into request context. +// For HTML page requests (Accept: text/html), redirects to /login.html instead of returning 401. func (mw *Middleware) RequireSession(next http.Handler) http.Handler { return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { cookie, err := r.Cookie("session") if err != nil { + if wantsHTML(r) { + http.Redirect(w, r, "/login.html", http.StatusTemporaryRedirect) + return + } http.Error(w, "unauthorized", http.StatusUnauthorized) return } sess, err := mw.sm.ValidateSession(r.Context(), cookie.Value) if err != nil || sess == nil { + if wantsHTML(r) { + http.Redirect(w, r, "/login.html", http.StatusTemporaryRedirect) + return + } http.Error(w, "unauthorized", http.StatusUnauthorized) return } @@ -46,6 +55,12 @@ func (mw *Middleware) RequireSession(next http.Handler) http.Handler { }) } +// wantsHTML returns true if the request appears to be from a browser expecting an HTML page. +func wantsHTML(r *http.Request) bool { + accept := r.Header.Get("Accept") + return strings.Contains(accept, "text/html") +} + // RequireAdmin ensures the authenticated user is an admin. func (mw *Middleware) RequireAdmin(next http.Handler) http.Handler { return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { -- cgit v1.2.3