You've submitted too many contact forms. Please wait an hour before trying again.
You've submitted too many contact forms. Please wait an hour before trying again.
{{.UserInput}}
``` **Validation Sanitization:** ```go Message string `validate:"required,trim,max=5000,sanitize"` // Result: HTML-escaped, newlines removed ``` ## Error Responses ### Standard Error Format ```json { "success": false, "error": "Error message", "errors": [ { "field": "email", "tag": "email", "message": "Invalid email address format" } ] } ``` ### HTTP Status Codes | Code | Meaning | Usage | |------|---------|-------| | 200 | OK | Successful request | | 302 | Found | PDF shortcut redirect | | 400 | Bad Request | Validation error | | 403 | Forbidden | BrowserOnly or OriginChecker failed | | 404 | Not Found | Route not found | | 429 | Too Many Requests | Rate limit exceeded | | 500 | Internal Server Error | Server error, template error | | 503 | Service Unavailable | Health check failed | ## Configuration ### Environment Variables ```bash # Application environment GO_ENV=production # or "development" # Allowed origins for PDF export ALLOWED_ORIGINS="juan.andres.morenorub.io,www.juan.andres.morenorub.io" # Template hot reload (development) TEMPLATE_HOT_RELOAD=true # Server configuration PORT=8080 HOST=0.0.0.0 ``` ### Route Priority Routes are registered in order of specificity to avoid conflicts: ```go // 1. Specific patterns first mux.HandleFunc("/cv-jamr-", cvHandler.DefaultCVShortcut) mux.HandleFunc("/api/cmd-k", cvHandler.CmdKData) // 2. Protected endpoints mux.Handle("/api/contact", protectedContactHandler) mux.Handle("/export/pdf", protectedPDFHandler) // 3. General routes mux.HandleFunc("/", cvHandler.Home) mux.HandleFunc("/cv", cvHandler.CVContent) // 4. Static files (catch-all) mux.Handle("/static/", middleware.CacheControl(staticHandler)) ``` ## Performance Considerations ### 1. Middleware Order Optimization ```go // Fast-fail first (Recovery catches panics immediately) Recovery → Logger → SecurityHeaders → DynamicCache → Preferences → Mux ``` ### 2. Rate Limiter Efficiency ```go // RWMutex for concurrent reads type RateLimiter struct { mu sync.RWMutex // Read-heavy workload clients map[string]*rateLimitEntry } ``` **Performance:** - Allow check: ~100-200 ns - Memory per IP: ~48 bytes - Cleanup overhead: Negligible (1/min) ### 3. Template Caching Production mode (HotReload=false): - Templates loaded once at startup - Zero reload overhead - Thread-safe concurrent rendering ### 4. Static File Serving ```go // Native Go file server with proper cache headers http.FileServer(http.Dir("static")) ``` **Benefits:** - Efficient sendfile() syscall - Range request support - ETag generation - Gzip compression (if configured) ## Monitoring and Observability ### Request Logging ``` 2025-12-06 10:30:15 | 200 | 15.234ms | 192.168.1.100 | GET /cv 2025-12-06 10:30:16 | 429 | 0.523ms | 192.168.1.101 | POST /api/contact 2025-12-06 10:30:17 | 200 | 125.678ms| 192.168.1.102 | GET /export/pdf ``` **Logged Fields:** - Timestamp - Status code - Response time - Client IP - Method + Path ### Health Check Endpoint ```bash curl https://juan.andres.morenorub.io/health ``` **Response:** ```json { "status": "healthy", "timestamp": "2025-12-06T10:30:00Z", "version": "1.0.0" } ``` **Use Cases:** - Load balancer health checks - Uptime monitoring - Deployment verification ### Rate Limiter Statistics ```go // Available for monitoring dashboards func (rl *RateLimiter) GetStats() map[string]interface{} { return map[string]interface{}{ "total_clients": len(rl.clients), "limit": rl.limit, "window": rl.window.String(), } } ``` ## Testing Routes ### Manual Testing ```bash # Home page curl https://juan.andres.morenorub.io/ # Plain text CV curl https://juan.andres.morenorub.io/text # Health check curl https://juan.andres.morenorub.io/health # PDF export (will be blocked - needs browser) curl https://juan.andres.morenorub.io/export/pdf # Contact form (will be blocked - needs browser) curl -X POST https://juan.andres.morenorub.io/api/contact \ -H "Content-Type: application/json" \ -d '{"name":"Test","email":"test@example.com",...}' ``` ### Automated Testing ```go // Test route handlers func TestHomeHandler(t *testing.T) { req := httptest.NewRequest("GET", "/", nil) w := httptest.NewRecorder() handler.ServeHTTP(w, req) if w.Code != http.StatusOK { t.Errorf("Expected 200, got %d", w.Code) } } // Test middleware func TestBrowserOnly(t *testing.T) { req := httptest.NewRequest("POST", "/api/contact", nil) req.Header.Set("User-Agent", "curl/7.68.0") w := httptest.NewRecorder() middleware.BrowserOnly(mockHandler).ServeHTTP(w, req) if w.Code != http.StatusForbidden { t.Errorf("Expected 403, got %d", w.Code) } } ``` ## Quick Reference ### Route Overview ``` Public: / → Home page /cv → CV content partial /text → Plain text CV /health → Health check HTMX: /switch-language → Toggle EN/ES /toggle/length → Toggle short/full /toggle/icons → Toggle icons /toggle/theme → Toggle light/dark API: /api/cmd-k → Command palette data /api/contact → Contact form (protected) Protected: /export/pdf → PDF generation (rate limited) /cv-jamr-* → PDF shortcuts Static: /static/* → CSS, JS, images, fonts ``` ### Middleware Chains ``` Global (all routes): Recovery → Logger → SecurityHeaders → DynamicCache → Preferences Contact Form: + BrowserOnly → RateLimiter(5/hour) PDF Export: + OriginChecker → RateLimiter(3/min) Static Files: + CacheControl ``` ### Security Headers ``` X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Referrer-Policy: strict-origin-when-cross-origin Content-Security-Policy: (comprehensive policy) Strict-Transport-Security: max-age=31536000 (production only) ``` ## Related Files - `internal/routes/routes.go` - Route setup and middleware chain - `internal/middleware/security.go` - Security middleware - `internal/middleware/browser_only.go` - BrowserOnly middleware - `internal/middleware/contact_rate_limit.go` - Contact rate limiting - `internal/middleware/logger.go` - Request logging - `internal/middleware/recovery.go` - Panic recovery - `internal/middleware/preferences.go` - User preferences - `internal/handlers/cv.go` - CV handlers - `internal/handlers/health.go` - Health check handler - `internal/handlers/cv_contact.go` - Contact form handler - `internal/handlers/cv_pdf.go` - PDF export handler ## See Also - [Validation System Documentation](go-validation-system.md) - [Template System Documentation](go-template-system.md) - [Go net/http Package](https://pkg.go.dev/net/http)