1 files changed, 75 insertions, 0 deletions

diff --git a/echo/tplfuncs/embed_csp.go b/echo/tplfuncs/embed_csp.go
new file mode 100644
index 0000000..44930c4
--- /dev/null
+++ b/echo/tplfuncs/embed_csp.go
@@ -0,0 +1,75 @@
+package tplfuncs
+
+import (
+        "fmt"
+        "html/template"
+        "io"
+        "io/fs"
+        "path"
+
+        "code.crute.us/mcrute/golib/echo/middleware"
+
+        "github.com/labstack/echo/v4"
+)
+
+type TemplateEmbeder struct {
+        templateStore fs.FS
+}
+
+func (t *TemplateEmbeder) ConfigureTemplateStore(store fs.FS) {
+        t.templateStore = store
+}
+
+func (t *TemplateEmbeder) Embed(filename string) ([]byte, error) {
+        if t.templateStore == nil {
+                return nil, fmt.Errorf("EmbedWithCSP: has not been setup with template store")
+        }
+
+        fd, err := t.templateStore.Open(filename)
+        if err != nil {
+                return nil, err
+        }
+        defer fd.Close()
+
+        fc, err := io.ReadAll(fd)
+        if err != nil {
+                return nil, err
+        }
+
+        return fc, nil
+}
+
+func (t *TemplateEmbeder) EmbedHTML(filename string) (any, error) {
+        d, err := t.Embed(filename)
+        return template.HTML(d), err
+}
+
+func (t *TemplateEmbeder) embedWithCSP(filename string, c echo.Context) ([]byte, error) {
+        fc, err := t.Embed(filename)
+        if err != nil {
+                return nil, err
+        }
+
+        csp := &middleware.ContentSecurityPolicyConfig{}
+        switch path.Ext(filename) {
+        case ".js", ".json":
+                csp.ScriptSrc = []middleware.CSPDirective{
+                        middleware.CSPSha256FromBytes(fc),
+                }
+        case ".css":
+                csp.StyleSrc = []middleware.CSPDirective{
+                        middleware.CSPSha256FromBytes(fc),
+                }
+        default:
+                return nil, fmt.Errorf("EmbedWithCSP: file %s can not be embedded", filename)
+        }
+
+        middleware.ExtendCSP(c, csp)
+
+        return fc, nil
+}
+
+func (t *TemplateEmbeder) EmbedJSWithCSP(filename string, c echo.Context) (any, error) {
+        d, err := t.embedWithCSP(filename, c)
+        return template.JS(d), err
+}