From afc096d1d106c494d442ea380f664d7b5da37535 Mon Sep 17 00:00:00 2001
From: Adriano Caloiaro <me@adriano.fyi>
Date: Fri, 28 Jul 2023 10:13:13 -0600
Subject: [PATCH] Fix up CORS stuff

---
 .gitignore                          |  3 ++-
 bin/fetch-deps.sh                   |  7 ++++++-
 content/users/login.md              | 20 ++++++++++----------
 layouts/partials/extended_head.html |  3 +--
 server.go                           | 16 ++++++++--------
 5 files changed, 27 insertions(+), 22 deletions(-)

diff --git a/.gitignore b/.gitignore
index a0ce617..cb30b01 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,3 +1,4 @@
+static/
 .env
 .hugo_build.lock
 build
@@ -7,4 +8,4 @@ themes/ananke
 bin/build
 bin/develop
 resources/_gen/
-static/htmx.js
+
diff --git a/bin/fetch-deps.sh b/bin/fetch-deps.sh
index c10bd5b..b3384a6 100755
--- a/bin/fetch-deps.sh
+++ b/bin/fetch-deps.sh
@@ -2,7 +2,12 @@
 
 HTMX_VERSION=1.9.2
 
+mkdir -p static/img
+
 curl -sL "https://unpkg.com/htmx.org@$HTMX_VERSION" > static/htmx.js
 curl -sL "https://unpkg.com/htmx.org/dist/ext/remove-me.js" > static/remove-me.js
-echo '<script type="text/javascript" src="/htmx.js"></script>' >> layouts/partials/extended_head.html
+curl -sL "https://htmx.org/img/bars.svg" > static/img/bars.svg
+
+echo '<script type="text/javascript" src="/htmx.js"></script>' > layouts/partials/extended_head.html
 echo '<script type="text/javascript" src="/remove-me.js"></script>' >> layouts/partials/extended_head.html
+echo "<meta name=\"htmx-config\" content='{\"withCredentials\": true}'>" >> layouts/partials/extended_head.html
diff --git a/content/users/login.md b/content/users/login.md
index 6e6aca3..eb6c036 100644
--- a/content/users/login.md
+++ b/content/users/login.md
@@ -1,21 +1,21 @@
 ---
 title: Log in
 ---
-
 {{< html.inline >}}
 <div class="auth-wrapper">
   <div class="auth-form">
     <form hx-post="{{ .Site.Params.apiBaseUrl }}/users/login">
-      <label for="username">Username</label>
-      <input id="username" type="text" name="username" placeholder="desired username"/>
-
-      <label for="password">Password</label>
-      <input id="password" type="password" name="password" placeholder="desired password">
-
-      <br>
-      <br>
-      <button class="btn btn-success">Log In</button>
+      <div hx-target="this" hx-swap="outerHTML">
+        <label for="username">Username</label>
+        <input id="username" type="text" name="username" placeholder="desired username" hx-post="{{ .Site.Params.apiBaseUrl }}/users/login">
+        <img id="ind" src="/img/bars.svg" class="htmx-indicator"/>
+        <label for="password">Password</label>
+        <input id="password" type="password" name="password" placeholder="desired password">
 
+        <br>
+        <br>
+        <button class="btn btn-success">Log In</button>
+      </div>
     </form>
   </div>
 </div>
diff --git a/layouts/partials/extended_head.html b/layouts/partials/extended_head.html
index e9fa910..ff7946b 100644
--- a/layouts/partials/extended_head.html
+++ b/layouts/partials/extended_head.html
@@ -1,4 +1,3 @@
-<meta name="htmx-config" content='{"withCredentials": true}'>
 <script type="text/javascript" src="/htmx.js"></script>
 <script type="text/javascript" src="/remove-me.js"></script>
-
+<meta name="htmx-config" content='{"withCredentials": true}'>
diff --git a/server.go b/server.go
index 81cf300..ee2b8ed 100644
--- a/server.go
+++ b/server.go
@@ -113,11 +113,11 @@ func init() {
 	sessionStore = pgxstore.New(db)
 
 	sessions.Cookie.Name = "session_id"
-	//sessions.Cookie.Domain = siteDomain()
-	//sessions.Cookie.HttpOnly = true
-	//sessions.Cookie.Persist = true
+	sessions.Cookie.Domain = siteDomain()
+	sessions.Cookie.HttpOnly = true
+	sessions.Cookie.Persist = true
 	sessions.Cookie.SameSite = http.SameSiteNoneMode
-	//sessions.Cookie.Secure = true
+	sessions.Cookie.Secure = true
 	sessions.Store = sessionStore
 
 	ctx := context.Background()
@@ -144,7 +144,7 @@ func main() {
 	defer NQ.Shutdown(context.Background())
 
 	r := chi.NewRouter()
-	//r.Use(sessions.LoadAndSave)
+	r.Use(sessions.LoadAndSave)
 	r.Use(middleware.Logger)
 	r.Use(middleware.RequestID)
 	r.Use(middleware.RealIP)
@@ -153,8 +153,8 @@ func main() {
 		AllowCredentials: true,
 		AllowedOrigins:   []string{"http://localhost:1313", fmt.Sprintf("https://%s", os.Getenv("SITE_DOMAIN"))},
 		AllowedMethods:   []string{"GET", "POST", "PUT", "DELETE", "OPTIONS"},
-		AllowedHeaders:   []string{"Accept", "Cookie", "Authorization", "Content-Type", "X-CSRF-Token", "hx-target", "hx-current-url", "hx-request"},
-		ExposedHeaders:   []string{"Link", "HX-Location"},
+		AllowedHeaders:   []string{"Accept", "Cookie", "Authorization", "Content-Type", "X-CSRF-Token", "hx-target", "hx-current-url", "hx-request", "hx-trigger", "hx-trigger-name"},
+		ExposedHeaders:   []string{"Link", "HX-Location", "Vary", "Access-Control-Allow-Origin"},
 		MaxAge:           300, // Maximum value not ignored by any of major browsers
 	}))
 
@@ -170,7 +170,7 @@ func main() {
 	})
 
 	fmt.Printf("Starting API server on port 1314\n")
-	if err := http.ListenAndServe("0.0.0.0:1314", sessions.LoadAndSave(r)); err != nil {
+	if err := http.ListenAndServe("0.0.0.0:1314", r); err != nil {
 		log.Fatal(err)
 	}
 }