Changeset 0.27.0 (#166)

server/main.go

@@ -5,7 +5,9 @@ import (
 	"encoding/json"
 	"fmt"
 	"log"
+	"net/http"
 	"os"
+	"path/filepath"
 	"strings"
 	"time"
 
@@ -1049,6 +1051,25 @@ func main() {
 	// Server-rendered pages via Go templates. Runs alongside the SPA.
 	// The chat surface is a bridge: Go renders the shell, existing JS
 	// builds the DOM inside it — identical behavior to index.html.
+
+	// v0.27.0: Extension surface static assets (JS, CSS, images).
+	// Served without auth — same rationale as extension assets (script tags can't send headers).
+	// In split deployment, nginx serves these from /data/surfaces/ directly.
+	if cfg.StoragePath != "" {
+		surfacesStaticDir := cfg.StoragePath + "/surfaces"
+		base.GET("/surfaces/:id/*path", func(c *gin.Context) {
+			id := c.Param("id")
+			filePath := c.Param("path")
+			// Security: prevent path traversal
+			clean := filepath.Clean(filepath.Join(surfacesStaticDir, id, filePath))
+			if !strings.HasPrefix(clean, filepath.Clean(surfacesStaticDir)) {
+				c.Status(http.StatusForbidden)
+				return
+			}
+			c.File(clean)
+		})
+	}
+
 	pages.SetVersion(Version)
 	pageEngine := pages.New(cfg, stores)
 
@@ -1105,7 +1126,7 @@ func main() {
 	}
 	log.Printf("   EventBus: ready, WebSocket on %s/ws", cfg.BasePath)
 	log.Printf("   Health: provider tracking active (flush=%s, prune=%s)", health.FlushInterval, health.PruneAge)
-	log.Printf("   Pages: template engine active (surfaces: chat, editor, notes, settings, admin)")
+	log.Printf("   Pages: template engine active (%d surfaces registered)", len(pageEngine.Surfaces()))
 	if err := r.Run(":" + cfg.Port); err != nil {
 		log.Fatalf("Failed to start server: %v", err)
 	}