6521b77 fix: simplify onboarding redirect link handling · gordon

M internal/adapters/in/http/middleware/cidr.go +2 -2


@@ -79,8 +79,8 @@ func HTTPSAuthority(host string, httpPort, tlsPort int) string {
79	79		return host
80	80		}
81	81
82		-	port, _ := strconv.Atoi(portStr) // Ignore parse errors so invalid explicit ports fall through to the preserve-as-is branch.
83		-	if port == httpPort {
	82	+	port, err := strconv.Atoi(portStr)
	83	+	if err == nil && port == httpPort {
84	84		return net.JoinHostPort(hostname, strconv.Itoa(tlsPort))
85	85		}
86	86


@@ -79,8 +79,8 @@ func HTTPSAuthority(host string, httpPort, tlsPort int) string {
79		return host	79		return host
80		}	80		}
81			81
82	-	port, _ := strconv.Atoi(portStr) // Ignore parse errors so invalid explicit ports fall through to the preserve-as-is branch.	82	+	port, err := strconv.Atoi(portStr)
83	-	if port == httpPort {	83	+	if err == nil && port == httpPort {
84		return net.JoinHostPort(hostname, strconv.Itoa(tlsPort))	84		return net.JoinHostPort(hostname, strconv.Itoa(tlsPort))
85		}	85		}
86			86

M internal/adapters/in/http/middleware/cidr_test.go +19 -0


@@ -167,6 +167,25 @@ func TestHTTPSRedirect_UnknownExplicitPort_IsPreserved(t *testing.T) {
167	167		assert.Equal(t, "https://o2.bnema.dev:9999/", rr.Header().Get("Location"))
168	168		}
169	169
	170	+	func TestHTTPSRedirect_InvalidExplicitPort_IsPreserved(t *testing.T) {
	171	+	log := testLogger()
	172	+	ok := http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
	173	+	w.WriteHeader(http.StatusOK)
	174	+	})
	175	+
	176	+	handler := HTTPSRedirect(nil, 8088, 8443, true, log)(ok)
	177	+
	178	+	req := httptest.NewRequest(http.MethodGet, "http://example.com/", nil)
	179	+	req.Host = "o2.bnema.dev:abcd"
	180	+	req.RemoteAddr = "203.0.113.10:12345"
	181	+	rr := httptest.NewRecorder()
	182	+
	183	+	handler.ServeHTTP(rr, req)
	184	+
	185	+	assert.Equal(t, http.StatusPermanentRedirect, rr.Code)
	186	+	assert.Equal(t, "https://o2.bnema.dev:abcd/", rr.Header().Get("Location"))
	187	+	}
	188	+
170	189		func TestProxyCIDRAllowlist(t *testing.T) {
171	190		log := testLogger()
172	191		redirect := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {


@@ -167,6 +167,25 @@ func TestHTTPSRedirect_UnknownExplicitPort_IsPreserved(t *testing.T) {
167	assert.Equal(t, "https://o2.bnema.dev:9999/", rr.Header().Get("Location"))	167		assert.Equal(t, "https://o2.bnema.dev:9999/", rr.Header().Get("Location"))
168	}	168		}
169		169
		170	+	func TestHTTPSRedirect_InvalidExplicitPort_IsPreserved(t *testing.T) {
		171	+	log := testLogger()
		172	+	ok := http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
		173	+	w.WriteHeader(http.StatusOK)
		174	+	})
		175	+
		176	+	handler := HTTPSRedirect(nil, 8088, 8443, true, log)(ok)
		177	+
		178	+	req := httptest.NewRequest(http.MethodGet, "http://example.com/", nil)
		179	+	req.Host = "o2.bnema.dev:abcd"
		180	+	req.RemoteAddr = "203.0.113.10:12345"
		181	+	rr := httptest.NewRecorder()
		182	+
		183	+	handler.ServeHTTP(rr, req)
		184	+
		185	+	assert.Equal(t, http.StatusPermanentRedirect, rr.Code)
		186	+	assert.Equal(t, "https://o2.bnema.dev:abcd/", rr.Header().Get("Location"))
		187	+	}
		188	+
170	func TestProxyCIDRAllowlist(t *testing.T) {	189		func TestProxyCIDRAllowlist(t *testing.T) {
171	log := testLogger()	190		log := testLogger()
172	redirect := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {	191		redirect := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {

M internal/adapters/in/http/onboarding/handler.go +2 -9


@@ -69,18 +69,11 @@ func (h Handler) ServeOnboardingPage(w http.ResponseWriter, r http.Request) {
69	69		redirectURL := h.publicHTTPSURL(r)
70	70		showSiteLink := !isRawIP(r.Host)
71	71
72		-	// On HTTP (r.TLS == nil), omit Secure from the cookie so browsers persist it.
73		-	// On HTTPS, do not set the cookie at all — it is an HTTP-bootstrap-only UX hint.
74		-	cookieJS := ""
75		-	if r.TLS == nil {
76		-	cookieJS = `onclick="document.cookie='gordon-ca-installed=1;path=/;max-age=315360000;SameSite=Lax'"`
77		-	}
78		-
79	72		siteLink := ""
80	73		if showSiteLink {
81	74		siteLink = fmt.Sprintf(
82		-	`<div class="skip"><p>Already installed? <a href="%s" %s>Go to site →</a></p></div>`,
83		-	redirectURL, cookieJS,
	75	+	`<div class="skip"><p>Already installed? <a href="%s">Go to site →</a></p></div>`,
	76	+	redirectURL,
84	77		)
85	78		}
86	79

 	redirectURL := h.publicHTTPSURL(r)
 	showSiteLink := !isRawIP(r.Host)
-	// On HTTP (r.TLS == nil), omit Secure from the cookie so browsers persist it.
-	// On HTTPS, do not set the cookie at all — it is an HTTP-bootstrap-only UX hint.
-	cookieJS := ""
-	if r.TLS == nil {
-		cookieJS = `onclick="document.cookie='gordon-ca-installed=1;path=/;max-age=315360000;SameSite=Lax'"`
-	}
 	siteLink := ""
 	if showSiteLink {
 		siteLink = fmt.Sprintf(
-			`<div class="skip"><p>Already installed? <a href="%s" %s>Go to site &#x2192;</a></p></div>`,
+			`<div class="skip"><p>Already installed? <a href="%s">Go to site &#x2192;</a></p></div>`,
-			redirectURL, cookieJS,
+			redirectURL,
 		)
 	}

M internal/adapters/in/http/onboarding/handler_test.go +4 -4


@@ -151,14 +151,14 @@ func TestHandler_OnboardingPage_IncludesFingerprintAndClientImportCopy(t *testin
151	151		assert.NotContains(t, body, "sudo gordon ca install")
152	152		}
153	153
154		-	func TestHandler_OnboardingPage_HTTPVariantDoesNotUseSecureCookieHint(t *testing.T) {
	154	+	func TestHandler_OnboardingPage_GoToSiteLinkIsPlainLink(t *testing.T) {
155	155		srv, _, _ := newTestServer(t)
156	156
157		-	// Default httptest server is HTTP, so request is non-TLS.
158	157		body := getOnboardingBody(t, srv, "o2.bnema.dev")
159	158
160		-	// The cookie JS must NOT include "Secure" on the HTTP variant.
161		-	assert.NotContains(t, body, ";Secure")
	159	+	assert.Contains(t, body, `<a href="https://o2.bnema.dev/">Go to site →</a>`)
	160	+	assert.NotContains(t, body, "onclick=")
	161	+	assert.NotContains(t, body, "document.cookie")
162	162		}
163	163
164	164		func TestHandler_OnboardingPage_HEAD(t *testing.T) {

 	assert.NotContains(t, body, "sudo gordon ca install")
 }
-func TestHandler_OnboardingPage_HTTPVariantDoesNotUseSecureCookieHint(t *testing.T) {
+func TestHandler_OnboardingPage_GoToSiteLinkIsPlainLink(t *testing.T) {
 	srv, _, _ := newTestServer(t)
-	// Default httptest server is HTTP, so request is non-TLS.
 	body := getOnboardingBody(t, srv, "o2.bnema.dev")
-	// The cookie JS must NOT include "Secure" on the HTTP variant.
+	assert.Contains(t, body, `<a href="https://o2.bnema.dev/">Go to site &#x2192;</a>`)
-	assert.NotContains(t, body, ";Secure")
+	assert.NotContains(t, body, "onclick=")
+	assert.NotContains(t, body, "document.cookie")
 }
 func TestHandler_OnboardingPage_HEAD(t *testing.T) {