18881598057

Committed 28 Oct 2025 04:16PM UTC coverage: 84.838% (+0.07%) from 84.764%

Build # 18881598057

Build Type

push

github

Committed by

dunglas

Commit Message

feat: add support for wildcard in publish origins

Run Details

40 of 40 new or added lines in 5 files covered. (100.0%)

20 existing lines in 4 files now uncovered.

1701 of 2005 relevant lines covered (84.84%)

68.0 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

91.94

/handler.go

package mercure

import (
        "io/fs"
        "net/http"

        "github.com/gorilla/mux"
        "github.com/rs/cors"
        "github.com/unrolled/secure"
        "go.uber.org/zap"
)

const (
        defaultHubURL  = "/.well-known/mercure"
        defaultUIURL   = defaultHubURL + "/ui/"
        defaultDemoURL = defaultUIURL + "demo/"
)

func (h *Hub) initHandler() {
        router := mux.NewRouter()
        router.UseEncodedPath()
        router.SkipClean(true)

        csp := "default-src 'self'"

        if h.demo {
                router.PathPrefix(defaultDemoURL).HandlerFunc(h.Demo).Methods(http.MethodGet, http.MethodHead)
        }

        if h.ui {
                public, err := fs.Sub(uiContent, "public")
                if err != nil {
                        panic(err)
                }

                router.PathPrefix(defaultUIURL).Handler(http.StripPrefix(defaultUIURL, http.FileServer(http.FS(public))))

                csp += " mercure.rocks cdn.jsdelivr.net"
        }

        h.registerSubscriptionHandlers(router)

        router.HandleFunc(defaultHubURL, h.SubscribeHandler).Methods(http.MethodGet, http.MethodHead)
        router.HandleFunc(defaultHubURL, h.PublishHandler).Methods(http.MethodPost)

        secureMiddleware := secure.New(secure.Options{
                IsDevelopment:         h.debug,
                AllowedHosts:          h.allowedHosts,
                FrameDeny:             true,
                ContentTypeNosniff:    true,
                BrowserXssFilter:      true,
                ContentSecurityPolicy: csp,
        })

        if len(h.corsOrigins) == 0 {
                h.handler = secureMiddleware.Handler(router)

                return
        }

        h.handler = secureMiddleware.Handler(
                cors.New(cors.Options{
                        AllowedOrigins:   h.corsOrigins,
                        AllowCredentials: true,
                        AllowedHeaders:   []string{"authorization", "cache-control", "last-event-id"},
                        Debug:            h.debug,
                }).Handler(router),
        )
}

func (h *Hub) ServeHTTP(w http.ResponseWriter, r *http.Request) {
        h.handler.ServeHTTP(w, r)
}

func (h *Hub) registerSubscriptionHandlers(r *mux.Router) {
        if !h.subscriptions {
                return
        }

        if _, ok := h.transport.(TransportSubscribers); !ok {
                if c := h.logger.Check(zap.ErrorLevel, "The current transport doesn't support subscriptions. Subscription API disabled."); c != nil {
                        c.Write()
                }

                return
        }

        r.UseEncodedPath()
        r.SkipClean(true)

        r.HandleFunc(subscriptionURL, h.SubscriptionHandler).Methods(http.MethodGet)
        r.HandleFunc(subscriptionsForTopicURL, h.SubscriptionsHandler).Methods(http.MethodGet)
        r.HandleFunc(subscriptionsURL, h.SubscriptionsHandler).Methods(http.MethodGet)
}

1	package mercure
2
3	import (
4	"io/fs"
5	"net/http"
6
7	"github.com/gorilla/mux"
8	"github.com/rs/cors"
9	"github.com/unrolled/secure"
10	"go.uber.org/zap"
11	)
12
13	const (
14	defaultHubURL = "/.well-known/mercure"
15	defaultUIURL = defaultHubURL + "/ui/"
16	defaultDemoURL = defaultUIURL + "demo/"
17	)
18
19	func (h *Hub) initHandler() {	165✔
20	router := mux.NewRouter()	165✔
21	router.UseEncodedPath()	165✔
22	router.SkipClean(true)	165✔
23		165✔
24	csp := "default-src 'self'"	165✔
25		165✔
26	if h.demo {	167✔
27	router.PathPrefix(defaultDemoURL).HandlerFunc(h.Demo).Methods(http.MethodGet, http.MethodHead)	2✔
28	}	2✔
29
30	if h.ui {	167✔
31	public, err := fs.Sub(uiContent, "public")	2✔
32	if err != nil {	2✔
33	panic(err)	×
34	}
35
36	router.PathPrefix(defaultUIURL).Handler(http.StripPrefix(defaultUIURL, http.FileServer(http.FS(public))))	2✔
37		2✔
38	csp += " mercure.rocks cdn.jsdelivr.net"	2✔
39	}
40
41	h.registerSubscriptionHandlers(router)	165✔
42		165✔
43	router.HandleFunc(defaultHubURL, h.SubscribeHandler).Methods(http.MethodGet, http.MethodHead)	165✔
44	router.HandleFunc(defaultHubURL, h.PublishHandler).Methods(http.MethodPost)	165✔
45		165✔
46	secureMiddleware := secure.New(secure.Options{	165✔
47	IsDevelopment: h.debug,	165✔
48	AllowedHosts: h.allowedHosts,	165✔
49	FrameDeny: true,	165✔
50	ContentTypeNosniff: true,	165✔
51	BrowserXssFilter: true,	165✔
52	ContentSecurityPolicy: csp,	165✔
53	})	165✔
54		165✔
55	if len(h.corsOrigins) == 0 {	327✔
56	h.handler = secureMiddleware.Handler(router)	162✔
57		162✔
58	return	162✔
59	}	162✔
60
61	h.handler = secureMiddleware.Handler(	3✔
62	cors.New(cors.Options{	3✔
63	AllowedOrigins: h.corsOrigins,	3✔
64	AllowCredentials: true,	3✔
65	AllowedHeaders: []string{"authorization", "cache-control", "last-event-id"},	3✔
66	Debug: h.debug,	3✔
67	}).Handler(router),	3✔
68	)	3✔
69	}
70
71	func (h Hub) ServeHTTP(w http.ResponseWriter, r http.Request) {	12✔
72	h.handler.ServeHTTP(w, r)	12✔
73	}	12✔
74
75	func (h Hub) registerSubscriptionHandlers(r mux.Router) {	174✔
76	if !h.subscriptions {	341✔
77	return	167✔
78	}	167✔
79
80	if _, ok := h.transport.(TransportSubscribers); !ok {	7✔
81	if c := h.logger.Check(zap.ErrorLevel, "The current transport doesn't support subscriptions. Subscription API disabled."); c != nil {	×
82	c.Write()	×
UNCOV 83	}	×
84
UNCOV 85	return	×
86	}
87
88	r.UseEncodedPath()	7✔
89	r.SkipClean(true)	7✔
90		7✔
91	r.HandleFunc(subscriptionURL, h.SubscriptionHandler).Methods(http.MethodGet)	7✔
92	r.HandleFunc(subscriptionsForTopicURL, h.SubscriptionsHandler).Methods(http.MethodGet)	7✔
93	r.HandleFunc(subscriptionsURL, h.SubscriptionsHandler).Methods(http.MethodGet)	7✔
94	}

dunglas / mercure / 18881598057

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous