From 5325d4b10d39a8873b445ce956a059ad6c2811fb Mon Sep 17 00:00:00 2001
From: Rose Hogenson <rosehogenson@posteo.net>
Date: Sat, 15 Aug 2026 08:13:10 -0700
Subject: Properly use code unauthorized

---
 roseh.moe.go                  | 43 +++++++++++++++++++++++++------------------
 templates/login.html.template |  5 ++++-
 2 files changed, 29 insertions(+), 19 deletions(-)

diff --git a/roseh.moe.go b/roseh.moe.go
index 206679b..cf5627c 100644
--- a/roseh.moe.go
+++ b/roseh.moe.go
@@ -149,12 +149,12 @@ var (
 	outlineTemplate = template.Must(template.New("outline").Parse(outlineString))
 )
 
-func outlinedTemplate(s string) (*template.Template, error) {
+func outlinedTemplate(s string, funcMap template.FuncMap) (*template.Template, error) {
 	outline, err := outlineTemplate.Clone()
 	if err != nil {
 		return nil, err
 	}
-	t, err := outline.New("body").Parse(s)
+	t, err := outline.New("body").Funcs(funcMap).Parse(s)
 	if err != nil {
 		return nil, err
 	}
@@ -180,7 +180,7 @@ func notFound(w http.ResponseWriter, r *http.Request) {
 var (
 	//go:embed templates/index.html.template
 	indexString   string
-	indexTemplate = template.Must(outlinedTemplate(indexString))
+	indexTemplate = template.Must(outlinedTemplate(indexString, nil))
 )
 
 func index(w http.ResponseWriter, _ *http.Request) {
@@ -192,7 +192,7 @@ func index(w http.ResponseWriter, _ *http.Request) {
 var (
 	//go:embed templates/games/index.html.template
 	gamesIndexString   string
-	gamesIndexTemplate = template.Must(outlinedTemplate(gamesIndexString))
+	gamesIndexTemplate = template.Must(outlinedTemplate(gamesIndexString, nil))
 )
 
 func gamesIndex(w http.ResponseWriter, _ *http.Request) {
@@ -216,7 +216,7 @@ func pong(w http.ResponseWriter, _ *http.Request) {
 var (
 	//go:embed templates/games/rms.html.template
 	stallmanShooterString   string
-	stallmanShooterTemplate = template.Must(outlinedTemplate(stallmanShooterString))
+	stallmanShooterTemplate = template.Must(outlinedTemplate(stallmanShooterString, nil))
 )
 
 func stallmanShooter(w http.ResponseWriter, _ *http.Request) {
@@ -269,7 +269,7 @@ func qrHandler(w http.ResponseWriter, r *http.Request) {
 var (
 	//go:embed templates/wormhole.html.template
 	wormholeTemplateString string
-	wormholeTemplate       = template.Must(outlinedTemplate(wormholeTemplateString))
+	wormholeTemplate       = template.Must(outlinedTemplate(wormholeTemplateString, nil))
 )
 
 type wormholeTemplateArgs struct {
@@ -477,7 +477,7 @@ func uploadWormhole(reader *multipart.Reader) (string, error) {
 var (
 	//go:embed templates/wormhole-success.html.template
 	wormholeSuccessTemplateString string
-	wormholeSuccessTemplate       = template.Must(outlinedTemplate(wormholeSuccessTemplateString))
+	wormholeSuccessTemplate       = template.Must(outlinedTemplate(wormholeSuccessTemplateString, nil))
 )
 
 type wormholeSuccessTemplateArgs struct {
@@ -716,16 +716,23 @@ func checkPassword(password, auth string) bool {
 var (
 	//go:embed templates/login.html.template
 	loginTemplateString string
-	loginTemplate       = template.Must(outlinedTemplate(loginTemplateString))
+	loginTemplate       = template.Must(outlinedTemplate(loginTemplateString, template.FuncMap{
+		"selfURL": func() string { return *selfURL },
+	}))
 )
 
 type loginTemplateArgs struct {
-	Error bool
+	Redirect string
+	Error    bool
 }
 
-func redirectLogin(w http.ResponseWriter, r *http.Request, redirect string) {
+func unauthenticated(w http.ResponseWriter, r *http.Request) {
+	w.WriteHeader(http.StatusUnauthorized)
+	redirect := r.URL.String()
 	redirect += base64.RawURLEncoding.EncodeToString(mac([]byte(redirect), "redirect"))
-	http.Redirect(w, r, *selfURL+"/login?redirect="+url.QueryEscape(redirect), http.StatusFound)
+	if err := loginTemplate.Execute(w, loginTemplateArgs{Redirect: redirect}); err != nil {
+		log.Printf("Warning: login: %s", err)
+	}
 }
 
 func serveLogin(w http.ResponseWriter, r *http.Request) {
@@ -752,7 +759,7 @@ func verifyRedirect(redirect string) (string, bool) {
 
 func login(w http.ResponseWriter, r *http.Request) {
 	if !checkPassword(r.FormValue("password"), r.FormValue("auth")) {
-		if err := loginTemplate.Execute(w, loginTemplateArgs{Error: true}); err != nil {
+		if err := loginTemplate.Execute(w, loginTemplateArgs{Redirect: r.FormValue("redirect"), Error: true}); err != nil {
 			log.Printf("Warning: login: %s", err)
 		}
 		return
@@ -768,7 +775,7 @@ func login(w http.ResponseWriter, r *http.Request) {
 var (
 	//go:embed templates/note.html.template
 	notepadString   string
-	notepadTemplate = template.Must(outlinedTemplate(notepadString))
+	notepadTemplate = template.Must(outlinedTemplate(notepadString, nil))
 
 	notepadContentsMu sync.Mutex
 	notepadContents   string
@@ -780,7 +787,7 @@ type notepadTemplateArgs struct {
 
 func notepad(w http.ResponseWriter, r *http.Request) {
 	if !cookieAuth(w, r) {
-		redirectLogin(w, r, "/notepad")
+		unauthenticated(w, r)
 		return
 	}
 	notepadContentsMu.Lock()
@@ -833,7 +840,7 @@ func cmd(w http.ResponseWriter, r *http.Request) {
 var (
 	//go:embed templates/pkg-index.html.template
 	pkgIndexString   string
-	pkgIndexTemplate = template.Must(outlinedTemplate(pkgIndexString))
+	pkgIndexTemplate = template.Must(outlinedTemplate(pkgIndexString, nil))
 )
 
 type pkgIndexTemplateArgs struct {
@@ -855,7 +862,7 @@ func pkgIndex(w http.ResponseWriter, r *http.Request) {
 var (
 	//go:embed templates/cmd-index.html.template
 	cmdIndexString   string
-	cmdIndexTemplate = template.Must(outlinedTemplate(cmdIndexString))
+	cmdIndexTemplate = template.Must(outlinedTemplate(cmdIndexString, nil))
 )
 
 type cmdIndexTemplateArgs struct {
@@ -899,7 +906,7 @@ type nezukoHandler struct {
 
 func (h *nezukoHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 	if !cookieAuth(w, r) {
-		redirectLogin(w, r, r.URL.Path)
+		unauthenticated(w, r)
 		return
 	}
 	h.srv.ServeHTTP(w, r)
@@ -911,7 +918,7 @@ type jellyfinReverseProxy struct {
 
 func (p *jellyfinReverseProxy) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 	if !cookieAuth(w, r) {
-		redirectLogin(w, r, "https://cinema.roseh.moe")
+		unauthenticated(w, r)
 		return
 	}
 	p.proxy.ServeHTTP(w, r)
diff --git a/templates/login.html.template b/templates/login.html.template
index 1aef0f2..2f17947 100644
--- a/templates/login.html.template
+++ b/templates/login.html.template
@@ -4,8 +4,11 @@
 	{{if .Error}}
 		<p class="login-error"><img class="inline" src="/static/angry.webp">Incorrect password</p>
 	{{end}}
-	<form class="password-form" method="post">
+	<form class="password-form" method="post" action="{{selfURL}}/login">
 		<table>
+		{{if .Redirect}}
+			<input type="hidden" name="redirect" value="{{.Redirect}}">
+		{{end}}
 		<tr class="password-form-row">
 			<td><label class="password-label" for="password">Enter password</label></td>
 			<td><input id="password" class="password" type="password" name="password" autofocus></td>
-- 
cgit v1.3.1