Skip to content

Print the GitHub button's URL instead of assembling it - #7

Merged
compscidr merged 2 commits into
mainfrom
fix/github-login-url-from-server
Sep 25, 2026
Merged

compscidr merged 2 commits into
mainfrom
fix/github-login-url-from-server

Conversation

@compscidr

Copy link
Copy Markdown
Contributor

Follow-up to goblogplatform/GoBlog#639.

Why

#631 moved GitHub's authorize URL into Go so the escaping was decided once. It left this theme assembling the URL that reaches it:

href="/login/github{{ if .next }}{{ if ne .next "/" }}?next={{ .next | urlquery }}{{ end }}{{ end }}"

A nested conditional building a URL, in markup, duplicated across four theme repositories.

goblog decides it now, so the template prints one value:

href="{{ .github_login_url }}"

The URL's shape becomes the server's business — if it ever needs another parameter, this theme does not change again.

Merge order

goblogplatform/GoBlog#639 first. Without it .github_login_url is unset and the button renders an empty href.

🤖 Generated with Claude Code

goblog builds it now (GithubLoginURL), so the nested template
conditional goes:

  href="/login/github{{ if .next }}{{ if ne .next "/" }}?next=...{{ end }}{{ end }}"
  ->
  href="{{ .github_login_url }}"

The URL's shape is the server's business; adding to it later touches no
theme.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Copilot AI lite review requested due to automatic review settings September 25, 2026 21:01

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot review overview

🟡 Changes recommended

As written, GitHub sign-in can silently break when .github_login_url is missing/empty (e.g., theme upgraded ahead of server), so a small template-level fallback is needed for safe rollout.

Get a fresh assessment by requesting another Copilot review.

Review effort: Lite
Findings: 1 Medium severity

Open (1)
What changed in this PR

Updates the login template to rely on a server-provided GitHub login URL (.github_login_url) rather than building the /login/github?... URL in the theme, keeping URL-shaping logic centralized in goblog.

Changes:

  • Replace inline conditional URL construction for the GitHub login button with {{ .github_login_url }}.
File Description
templates/​login.html Switch GitHub login button to print server-provided login URL instead of assembling query params in-template.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Comment thread templates/login.html
<p style="color: #7a937a; font-size: 14px; margin-bottom: 30px;">Log in to manage {{ .settings.site_title.Value }}</p>

<a id="github-button" href="/login/github{{ if .next }}{{ if ne .next "/" }}?next={{ .next | urlquery }}{{ end }}{{ end }}" style="display: inline-flex; align-items: center; gap: 10px; padding: 12px 28px; background: #2d5a27; color: #fff; border-radius: 8px; text-decoration: none; font-size: 14px; font-weight: 500;">
<a id="github-button" href="{{ .github_login_url }}" style="display: inline-flex; align-items: center; gap: 10px; padding: 12px 28px; background: #2d5a27; color: #fff; border-radius: 8px; text-decoration: none; font-size: 14px; font-weight: 500;">

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Real risk, and worth guarding — but with min_goblog_version rather than a template fallback. Bumped to 0.12.0 in 8e56594.

goblog already has a gate for exactly this. theme/installer checks the manifest before anything is written:

if !pinstaller.Compatible(i.Version, e.MinGoblogVersion) {
    return directory.Entry{}, fmt.Errorf("%w (%s; this is %s)", ErrIncompatible, e.MinGoblogVersion, i.Version)
}

and the listing shows "requires goblog 0.12.0 or newer" instead of an install button. That prevents the mismatch rather than degrading to a link that still works but has lost its next — and a fallback in the markup would put back the conditional this PR exists to remove.

Worth noting the dependency is not only .github_login_url: this theme's login page also stopped handling ?code= itself, because goblog completes the OAuth flow server-side against a state it minted (goblogplatform/GoBlog#638). On an older goblog that half is broken too, and no template fallback could paper over it. One version gate covers both.

0.12.0 is an assumption — it is the next goblog release, carrying #638 and #639, neither released yet (latest is v0.11.0). If that lands under a different number this needs to match.

Review asked for a template fallback in case this theme is installed
against a goblog that does not set .github_login_url. min_goblog_version
is the mechanism for that, and it prevents the broken state rather than
degrading to a link that has lost its next: the installer refuses an
incompatible theme (ErrIncompatible) and the directory listing says
"requires goblog 0.12.0 or newer".

A fallback in the template would also put back the conditional this
change exists to remove.

0.12.0 is the release carrying both that value and the server-side
OAuth callback, which this theme's login page already depends on.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
@compscidr
compscidr merged commit 3d5fbb1 into main Sep 25, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants