MSCore Demo

func main() {
	config.Init()
	sqlite.InitDB()
	app, core := InitApp()
	initEmailSystem()
	core.Scheduler.Start(context.Background())
	srv.ListenAndServe()
}

func (h *Handler) metricsPanel(ctx *xun.Context) error {
	if h.core.MetricsCollector == nil {
		return ctx.View(map[string]any{"MetricsDisabled": true})
	}
	sample, ok := h.core.MetricsCollector.Latest()
	return ctx.View(map[string]any{
		"Sample":    sample,
		"HasSample": ok,
		"Sparkline": h.core.MetricsCollector.Snapshot(),
	})
}

func (h *Handler) streamHeartbeat(ctx *xun.Context) error {
	sub := h.core.EventBus.Hub.Subscribe(HeartbeatRoom)
	defer h.core.EventBus.Hub.Unsubscribe(HeartbeatRoom, sub.ID)
	for {
		select {
		case msg := <-sub.Ch:
			fmt.Fprintf(ctx.Response, "event: %s\ndata: %s\n\n",
				msg.Type, msg.Payload)
		case <-ctx.Request.Context().Done():
			return xun.ErrCancelled
		}
	}
}

func (h *Handler) streamActivity(ctx *xun.Context) error {
	sub := h.core.EventBus.Hub.Subscribe(ActivityRoom)
	defer h.core.EventBus.Hub.Unsubscribe(ActivityRoom, sub.ID)
	// hijack TCP for true streaming; chunked fallback if hijack unavailable
	if hj, ok := ctx.Response.(http.Hijacker); ok {
		conn, bufrw, _ := hj.Hijack()
		defer conn.Close()
		return activityLoop(ctx, bufrw, sub.Ch)
	}
	return activityChunked(ctx, sub.Ch)
}

func (h *Handler) content(ctx *xun.Context) error {
	posts, _, err := h.core.ContentSvc.ListPosts(
		ctx.Request.Context(), "blog", "", 6, true)
	if err != nil {
		ctx.WriteStatus(http.StatusInternalServerError)
		return err
	}
	sessions, _, err := h.core.ContentSvc.ListSessions(
		ctx.Request.Context(), "", "", 6, true)
	if err != nil {
		ctx.WriteStatus(http.StatusInternalServerError)
		return err
	}
	return ctx.View(map[string]any{
		"Posts": posts, "Sessions": sessions,
	})
}

func (h *Handler) contentPosts(ctx *xun.Context) error {
	cursor := ctx.Request.URL.Query().Get("cursor")
	posts, next, err := h.core.ContentSvc.ListPosts(
		ctx.Request.Context(), "blog", cursor, 4, true)
	if err != nil {
		ctx.WriteStatus(http.StatusInternalServerError)
		return err
	}
	return ctx.View(map[string]any{
		"Posts": posts, "NextCursor": next,
	})
}

func (p BlogPost) IsScheduled() bool {
	return !p.Published && p.PublishAt > 0
}

func (h *Handler) documentPanel(ctx *xun.Context) error {
	const key = "demo:doc"
	var content []byte
	if v := ctx.Request.URL.Query().Get("version"); v != "" {
		if ver, err := strconv.ParseUint(v, 10, 64); err == nil {
			content, _ = h.core.NoteStore.ReadVersion(key, ver)
		}
	}
	if len(content) == 0 {
		content, _ = h.core.NoteStore.Read(key)
	}
	versions, _ := h.core.NoteStore.ListVersions(key)
	return ctx.View(map[string]any{
		"Content": string(content), "Versions": versions,
	})
}

// pkg/auth/handler.go — role-based redirect after login
result, err := h.AuthService.Login(ctx.Request.Context(), bind.Data,
	resolvedAgent.ID, ip, ctx.Request.UserAgent())
if err != nil {
	return hhttp.WriteHTMXError(ctx, h.SysLog, err, bind)
}
sessionAge := sessionCookieAge(result.Account.Settings.AutoLogout)
cookies.SetSignedCookie(ctx, "session", result.Token.JWT, sessionAge)

ret := "/dash"
if result.Account.HasPermission("admin.read") { ret = "/admin" }
if referer, err := url.Parse(ctx.RequestReferer()); err == nil {
	if q := referer.Query().Get("return"); q != "" { ret = q }
}
ctx.Redirect(ret)

// requestctx.CtxAccount.HasPermission — pkg/shared/requestctx/requestctx.go
func (c *CtxAccount) HasPermission(p string) bool {
	return slices.Contains(c.Permissions, p)
}

// Gate any handler with a one-liner:
func getAdminUsers(ctx *xun.Context) error {
	account, ok := requestctx.GetAccount(ctx)
	if !ok || !account.HasPermission("admin.read") {
		return ctx.WriteStatus(http.StatusForbidden)
	}
	// … serve the response
}

// pkg/files/handler.go — policy gate on every file request
func (h *Handler) enforcePolicy(ctx *xun.Context,
	cfg BucketConfig, key string) bool {
	acc, _ := requestctx.GetAccount(ctx)
	if acc == nil {
		if cfg.Policy.RequireAuth {
			ctx.WriteStatus(http.StatusUnauthorized); return false
		}
		return true // public bucket — no check
	}
	if cfg.Policy.RequirePermission != "" &&
		!acc.HasPermission(cfg.Policy.RequirePermission) {
		ctx.WriteStatus(http.StatusForbidden); return false
	}
	ok, _ := h.Access.CanAccess(ctx.Request.Context(), acc.ID, cfg.Name, key)
	if !ok { ctx.WriteStatus(http.StatusForbidden) }
	return ok
}

func sessionCookieAge(autoLogout string) int64 {
	switch autoLogout {
	case "0":
		return 10 * 365 * 24 * 60 * 60
	case "15":
		return 15 * 60
	case "30":
		return 30 * 60
	case "60":
		return 60 * 60
	case "120":
		return 120 * 60
	default:
		return config.CookieExipiration / 1000
	}
}

func (s *AuthService) RequestPasswordReset(ctx context.Context, emailAddr string) error {
	acc, err := s.User.GetByEmail(ctx, emailAddr)
	if err != nil {
		return nil // always nil — no account enumeration
	}
	code, err := s.issueOTP(ctx, acc.ID, OTPPasswordReset)
	if err != nil {
		return nil
	}
	if err := s.Mailer.SendTemplate(s.SysLog, acc.Email, "Reset your password",
		"password_otp", map[string]string{"name": acc.Name.Firstname, "otp": code}); err != nil {
		s.SysLog.WithError(err).Error("auth: failed to send password reset email")
	}
	return nil
}

func (h *Handler) notifPrefsPanel(ctx *xun.Context) error {
	acc, err := h.core.UserSvc.GetByEmail(ctx.Request.Context(), DemoEmail)
	if err != nil {
		return ctx.View(map[string]any{"PrefsUnavailable": true})
	}
	prefs, err := h.core.UserSvc.GetNotifPrefs(ctx.Request.Context(), acc.ID)
	if err != nil {
		return ctx.View(map[string]any{"PrefsUnavailable": true})
	}
	return ctx.View(map[string]any{"Prefs": prefs})
}

// pkg/auth/mobile_handler.go — identity + roles in a single call
func (h *MobileHandler) getMe(ctx *xun.Context) error {
	ctxAcc, ok := requestctx.GetAccount(ctx)
	if !ok {
		return hhttp.WriteJSONAppError(ctx, h.SysLog, apperr.Unauthorized(""))
	}
	acc, err := h.UserService.GetByID(ctx.Request.Context(), ctxAcc.ID)
	if err != nil { return hhttp.WriteJSONAppError(ctx, h.SysLog, err) }

	if roles, err := h.UserService.GetRolesByID(ctx.Request.Context(), acc.ID); err == nil {
		acc.Roles = roles // full permissions union attached here
	}
	return hhttp.WriteJSON(ctx, http.StatusOK, MeResponse{
		Account: h.UserService.ToAccountResponse(acc),
	})
}

// Server stores raw int64 unix ms — no formatting, no timezone.
// epochs.js converts every [data-epoch] in the browser automatically.
func (h *Handler) getPost(ctx *xun.Context) error {
	post, err := h.core.ContentSvc.GetPost(ctx.Request.Context(), id)
	if err != nil { return err }
	return ctx.View(map[string]any{
		"CreatedDate": post.CreatedDate, // int64 unix ms
		"PublishAt":   post.PublishAt,   // int64 unix ms
	})
}

func (h *Handler) schedulerStatus(ctx *xun.Context) error {
	return ctx.View(map[string]any{
		"Tasks": h.core.Scheduler.Status(),
	})
}

func (h *Handler) maintenancePanel(ctx *xun.Context) error {
	active, msg := h.core.MaintenanceSvc.IsActiveFromCache()
	upcoming, _ := h.core.MaintenanceSvc.Upcoming(ctx.Request.Context())
	return ctx.View(map[string]any{
		"Active":   active,
		"Message":  msg,
		"Upcoming": upcoming,
		"NowMs":    time.Now().UnixMilli(),
	})
}

// Color mode is pure client-side — no Go handler needed.