first commit

internal/webui/flash.go

@@ -0,0 +1,49 @@
+package webui
+
+import (
+	"encoding/base64"
+	"encoding/json"
+	"net/http"
+)
+
+// Flash mirrors one Flask flash() message: (message, category).
+type Flash struct {
+	Category string `json:"c"`
+	Message  string `json:"m"`
+}
+
+const flashCookieName = "flash"
+
+// setFlash mirrors flask.flash(): appends one message to the flash cookie so it
+// survives the redirect that (almost) always follows a form POST in this app.
+// No signing: these are cosmetic toast notifications, not a trust boundary.
+func setFlash(w http.ResponseWriter, category, message string) {
+	flashes := []Flash{{Category: category, Message: message}}
+	encoded, _ := json.Marshal(flashes)
+	http.SetCookie(w, &http.Cookie{
+		Name:     flashCookieName,
+		Value:    base64.URLEncoding.EncodeToString(encoded),
+		Path:     "/",
+		HttpOnly: true,
+		SameSite: http.SameSiteLaxMode,
+	})
+}
+
+// popFlashes mirrors get_flashed_messages(with_categories=true): reads and clears the
+// flash cookie so each message is shown exactly once, on the very next render.
+func popFlashes(w http.ResponseWriter, r *http.Request) []Flash {
+	c, err := r.Cookie(flashCookieName)
+	if err != nil || c.Value == "" {
+		return nil
+	}
+	http.SetCookie(w, &http.Cookie{Name: flashCookieName, Value: "", Path: "/", MaxAge: -1})
+	raw, err := base64.URLEncoding.DecodeString(c.Value)
+	if err != nil {
+		return nil
+	}
+	var flashes []Flash
+	if err := json.Unmarshal(raw, &flashes); err != nil {
+		return nil
+	}
+	return flashes
+}