feat: restore configurable root page and api docs

chfs-ng/internal/api/root_handler_test.go

@@ -0,0 +1,35 @@
+package api
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	"chfs-ng/internal/auth"
+	"chfs-ng/internal/storage"
+)
+
+func TestRootAndAPIDoc(t *testing.T) {
+	s := &Server{Store: storage.Local{Root: t.TempDir()}, Auth: &auth.Manager{Guest: &auth.Account{Mask: auth.Read}}, HTMLTitle: "My Files", HTMLNotice: "`<strong>Hello</strong>`"}
+	h := s.Handler()
+	r := httptest.NewRecorder()
+	h.ServeHTTP(r, httptest.NewRequest(http.MethodGet, "/", nil))
+	if r.Code != 200 || !strings.Contains(r.Body.String(), "<title>My Files</title>") || !strings.Contains(r.Body.String(), "<strong>Hello</strong>") {
+		t.Fatalf("root: %d %s", r.Code, r.Body.String())
+	}
+	r = httptest.NewRecorder()
+	h.ServeHTTP(r, httptest.NewRequest(http.MethodGet, "/asset/api.html", nil))
+	if r.Code != 200 || !strings.Contains(r.Body.String(), "/chfs/files") {
+		t.Fatalf("api doc: %d %s", r.Code, r.Body.String())
+	}
+}
+
+func TestRootEscapesPlainNotice(t *testing.T) {
+	s := &Server{Store: storage.Local{Root: t.TempDir()}, Auth: &auth.Manager{Guest: &auth.Account{Mask: auth.Read}}, HTMLNotice: `<script>alert(1)</script>`}
+	r := httptest.NewRecorder()
+	s.Handler().ServeHTTP(r, httptest.NewRequest(http.MethodGet, "/", nil))
+	if strings.Contains(r.Body.String(), `<script>alert(1)</script>`) {
+		t.Fatal("plain notice was not escaped")
+	}
+}