Derive the image's version from the .git in the build context (closes #366)

A plain docker build, as upaas runs it, passed no VERSION build arg and
had no .git, so every such image stamped "unknown". .dockerignore now
sends .git and every tracked file (an excluded one would read as
deleted and mark the version -dirty), and the VERSION build arg loses
its "unknown" default, so script/version derives the version inside the
build. A VERSION build arg still takes precedence.

The builder stage installs git and fails when its context carries .git
and the version still comes out "unknown".

Model: opus-5-5

.dockerignore

@@ -1,14 +1,15 @@
+# .git is deliberately NOT excluded: the build derives the version it stamps
+# into the binary from it (script/version). Nor is any tracked file: git in
+# the build would see it as deleted and mark the version -dirty. Only
+# untracked files belong here.
+#
 # .ci-fingerprint is deliberately NOT excluded: it is the CI cache barrier
 # that keeps the check stages from replaying a cached pass. See the lint
 # stage of the Dockerfile.
-.git/
 bin/
 # Extracted from 3p/ by `make assets` inside the build; a host copy is not
 # needed. The tarball in 3p/ must stay in the context.
 static/js/alpine.min.js
-*.md
-LICENSE
-.editorconfig
 .env
 .env.*
 *.db

.gitea/workflows/check.yml

@@ -28,12 +28,11 @@ jobs:
         run: script/ci-mark-superseded
 
       - name: Fingerprint the build context
-        # `.dockerignore` keeps docs out of the build context, so a docs-only
-        # commit legitimately replays the whole image from cache and stays
-        # cheap. Every other commit writes a new fingerprint into the context,
-        # which invalidates the `COPY . .` layer of both check stages: a
-        # commit that was never linted, formatted-checked, tested and built
-        # cannot report success from cache.
+        # Every commit that changes more than docs writes a new fingerprint
+        # into the context, which invalidates the `COPY . .` layer of both
+        # check stages: a commit that was never linted, formatted-checked,
+        # tested and built cannot report success from cache. Docs-only
+        # commits rebuild too, since the context also carries `.git`.
         run: |
           set -eu
           fp="$(git log -1 --format=%H -- . ':!*.md' ':!LICENSE' ':!.editorconfig')"

Dockerfile

@@ -38,8 +38,8 @@ FROM golang:1.26.1-bookworm@sha256:4465644228bc2857a954b092167e12aa59c006a349228
 COPY --from=lint /src/go.sum /dev/null
 
 # jq is a runtime dependency of script/ci-mark-superseded, which the test
-# suite executes.
-RUN apt-get update && apt-get install -y --no-install-recommends make curl ca-certificates jq && rm -rf /var/lib/apt/lists/*
+# suite executes. git is what script/version derives the version with.
+RUN apt-get update && apt-get install -y --no-install-recommends make curl ca-certificates jq git && rm -rf /var/lib/apt/lists/*
 
 WORKDIR /build
 
@@ -55,14 +55,22 @@ COPY . .
 # from its tarball in 3p/.
 RUN make test
 
-# Version stamped into the binary. .dockerignore excludes .git/, so
-# nothing in this stage can derive it: script/docker resolves it on the
-# host and passes it in. The default is what a bare `docker build .`
-# with no --build-arg gets, and it names no tag the tree may not be at.
+# Version stamped into the binary: the VERSION build arg when one is
+# given, otherwise what script/version derives from the .git the build
+# context carries, so any `docker build .` of a clone stamps its commit.
+# With neither, as from a source tarball, it is "unknown".
 #
 # Declared here, below the test step, so a changed version does not
 # invalidate its cached layer.
-ARG VERSION=unknown
+ARG VERSION
+
+# A context that carries .git must not stamp "unknown": that means git is
+# missing here or refused to read the checkout, and the image could not be
+# traced back to its commit.
+RUN if [ -d .git ] && [ "$(make version VERSION="$VERSION")" = unknown ]; then \
+        echo "version is unknown although the build context carries .git" >&2; \
+        exit 1; \
+    fi
 
 RUN make build VERSION="$VERSION"
 

Makefile

@@ -4,12 +4,12 @@
 .DEFAULT_GOAL := check
 
 # Version stamped into the binary. Derived from git by script/version;
-# override it (`make build VERSION=v1.2.3`) where git metadata is
-# unavailable, which is how the Dockerfile passes its build arg in.
+# override it (`make build VERSION=v1.2.3`) to stamp a given value, which is
+# how the Dockerfile passes its build arg in.
 VERSION ?= $(shell script/version)
 
-# An empty override (`make build VERSION=`, or a `--build-arg VERSION=`
-# landing on the Dockerfile's `make build VERSION="$VERSION"`) means unset,
+# An empty override (`make build VERSION=`, or the Dockerfile's `make build
+# VERSION="$VERSION"` when no VERSION build arg was given) means unset,
 # exactly as it does in script/version -- stamping "" would leave the binary
 # reporting no version and the footer back on its "dev" fallback. `override`
 # is required: a plain assignment loses to the command-line definition it

README.md

@@ -1123,13 +1123,21 @@ build itself.
 | Uncommitted changes | the above with a `-dirty` suffix |
 | No git metadata | `unknown` |
 
-`unknown` is what a source tarball or a `docker build .` with no
-`--build-arg VERSION=...` reports. `.dockerignore` excludes `.git/`, so
-the build context carries no git metadata and the image cannot derive
-the version itself: `script/docker` (and so `make docker`) resolves it
-on the host and passes it in as the `VERSION` build arg. A build that
-reports `unknown` is a build nobody told what it was; it is not a
-failure, but it cannot be traced back to a commit.
+The image derives it the same way, from the `.git` that the build
+context carries, so any `docker build .` of a clone stamps the commit it
+was built from; a shallow clone of one branch has no tags and stamps the
+short SHA. `.dockerignore` must therefore leave out neither `.git` nor
+any tracked file, which git in the build would see as deleted, marking
+the version `-dirty`. A `VERSION` build arg (`--build-arg VERSION=...`)
+takes precedence; `script/docker` (and so `make docker`) passes the one
+`script/version` resolves on the host. The image build fails if its
+context carries `.git` and the version still comes out `unknown`, which
+means git in the build could not read the checkout.
+
+`unknown` is what a source tarball, or a `docker build` with no `.git`
+in its context and no `VERSION` build arg, reports. A build that reports
+`unknown` is a build nobody told what it was; it is not a failure, but
+it cannot be traced back to a commit.
 
 `make version` prints what the current checkout would stamp, and
 `make build VERSION=v1.2.3` overrides it. An empty override — from
@@ -2692,16 +2700,12 @@ abuse limit later; they are tracked as future work.
 
 | Method | Path            | Description |
 | ------ | --------------- | ----------- |
-| `GET`  | `/pages/login`  | Login page (not rate limited). Its `next` parameter names the page to return to after login; anything but a path on this site is replaced with `/` |
-| `POST` | `/pages/login`  | Login form submission. On success, redirects to the form's `next` when it is a path on this site, otherwise to `/`. Credentials are verified before any limit is consulted, so a correct password is never throttled; 5 FAILED attempts per minute per bucket per submitted username, then `429`. `503` if no verification slot frees up within 5s, or immediately if 16 requests are already queued for one (see [Rate Limiting](#rate-limiting)) |
+| `GET`  | `/pages/login`  | Login page (not rate limited) |
+| `POST` | `/pages/login`  | Login form submission. Credentials are verified before any limit is consulted, so a correct password is never throttled; 5 FAILED attempts per minute per bucket per submitted username, then `429`. `503` if no verification slot frees up within 5s, or immediately if 16 requests are already queued for one (see [Rate Limiting](#rate-limiting)) |
 | `POST` | `/pages/logout` | Logout (destroys session) |
 
 #### Authenticated Endpoints
 
-A logged-out `GET` of any of these is redirected to `/pages/login` with
-its path and query as `next`, so logging in returns to the page that was
-asked for.
-
 | Method | Path                     | Description |
 | ------ | ------------------------ | ----------- |
 | `GET`  | `/user/{username}`       | User profile page |
@@ -3168,8 +3172,9 @@ version is fixed independently of the compiler's:
    rebuilds the binary with `CGO_ENABLED=1` and static linking so it
    runs on musl. Both builds go through `make build`, the relink adding
    its `-extldflags` via `GO_LDFLAGS`, so neither can drop the `-X` that
-   stamps the version. The version arrives as the `VERSION` build arg,
-   since the context has no `.git` (see
+   stamps the version. The version is the `VERSION` build arg if one is
+   given, otherwise derived from the `.git` in the context, and the
+   stage fails if a context with `.git` would stamp `unknown` (see
    [Version stamping](#version-stamping)).
 3. **Runtime stage** (`alpine:3.21`) — copies the static binary and
    `deploy/docker-entrypoint.sh`, creates the `/var/lib/webhooker`
@@ -3201,16 +3206,17 @@ A layer cache lets `docker build .` exit 0 in seconds with the lint and
 test stages replayed rather than executed, which would make a green
 check meaningless. The `check` workflow therefore writes
 `.ci-fingerprint` into the build context before building. Its value is
-the hash of the last commit that touched the build context, so:
+the hash of the last commit that touched anything other than `*.md`,
+`LICENSE` and `.editorconfig`, so:
 
 - Any commit that changes code (including a squash merge whose tree
   matches an already-built branch) gets a new fingerprint, invalidates
   the `COPY . .` layer of both check stages, and really runs
   `make fmt-check`, `golangci-lint`, `make test`, and `make build`. A
   run that reports success ran them.
-- A docs-only commit leaves the fingerprint unchanged — `.dockerignore`
-  excludes `*.md`, `LICENSE` and `.editorconfig` from the context
-  anyway — so the image replays from cache and costs seconds.
+- A docs-only commit leaves the fingerprint unchanged, but it still
+  rebuilds in full: the context also carries `.git`, which changes with
+  every commit (see [Version stamping](#version-stamping)).
 
 The module download layer sits above `COPY . .` and stays cached either
 way.

internal/handlers/auth.go

@@ -2,62 +2,19 @@ package handlers
 
 import (
 	"net/http"
-	"net/url"
 	"strconv"
-	"strings"
-	"unicode"
 
 	"sneak.berlin/go/webhooker/internal/database"
 	"sneak.berlin/go/webhooker/internal/logfield"
-	"sneak.berlin/go/webhooker/internal/middleware"
 )
 
-// maxNextBytes bounds the page to return to after login. The login
-// page writes it into its form, and every page is rendered into a
-// buffer first (see executeTemplate), so without a bound a request
-// would choose the size of that buffer.
-const maxNextBytes = 2048
-
-// loginDestination returns where a successful login sends the
-// browser: next when it is a path on this site, otherwise "/", which
-// leads to the webhook list.
-//
-// A browser reads "//host" as another site, reads "\" as "/", and
-// drops tabs and newlines before reading at all. So the value must
-// start with exactly one "/" and hold no "\" or control character
-// anywhere: http.Redirect cleans "/a/../\host" down to "/\host". It
-// is checked after percent-decoding, so an encoded form of any of
-// these is refused too.
-func loginDestination(next string) string {
-	if len(next) > maxNextBytes {
-		return "/"
-	}
-
-	decoded, err := url.PathUnescape(next)
-	if err != nil ||
-		!strings.HasPrefix(decoded, "/") ||
-		strings.HasPrefix(decoded, "//") ||
-		strings.Contains(decoded, `\`) ||
-		strings.ContainsFunc(decoded, unicode.IsControl) {
-		return "/"
-	}
-
-	return next
-}
-
 // HandleLoginPage returns a handler for the login page (GET)
 func (h *Handlers) HandleLoginPage() http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
-		next := loginDestination(
-			r.URL.Query().Get(middleware.NextParam),
-		)
-
 		// Check if already logged in
 		sess, err := h.session.Get(r)
 		if err == nil && h.session.IsAuthenticated(sess) {
-			http.Redirect( //nolint:gosec // checked by loginDestination
-				w, r, next, http.StatusSeeOther,
-			)
+			http.Redirect(w, r, "/", http.StatusSeeOther)
 
 			return
 		}
@@ -65,7 +22,6 @@ func (h *Handlers) HandleLoginPage() http.HandlerFunc {
 		// Render login page
 		data := map[string]any{
 			tmplKeyError: "",
-			tmplKeyNext:  next,
 		}
 
 		h.renderTemplate(w, r, "login.html", data)
@@ -121,13 +77,8 @@ func (h *Handlers) HandleLoginSubmit() http.HandlerFunc {
 			"user_id", user.ID,
 		)
 
-		// The form value is the client's to set, so it is checked
-		// again here rather than trusted from the rendered page.
-		http.Redirect( //nolint:gosec // checked by loginDestination
-			w, r,
-			loginDestination(r.PostFormValue(middleware.NextParam)),
-			http.StatusSeeOther,
-		)
+		// Redirect to home page
+		http.Redirect(w, r, "/", http.StatusSeeOther)
 	}
 }
 
@@ -140,9 +91,6 @@ func (h *Handlers) renderLoginError(
 ) {
 	data := map[string]any{
 		tmplKeyError: msg,
-		tmplKeyNext: loginDestination(
-			r.PostFormValue(middleware.NextParam),
-		),
 	}
 
 	w.WriteHeader(status)

internal/handlers/auth_test.go

@@ -454,151 +454,6 @@ func TestLogin_SuccessCreatesSession(t *testing.T) {
 	)
 }
 
-// TestLogin_ReturnsOnlyToAPathOnThisSite is the security half of
-// https://git.eeqj.de/sneak/webhooker/issues/384: the page a login
-// returns to is client-chosen, so anything that is not a path on this
-// site, plain or percent-encoded, must land on "/", the webhook list.
-func TestLogin_ReturnsOnlyToAPathOnThisSite(t *testing.T) {
-	t.Parallel()
-
-	var (
-		h  *handlers.Handlers
-		db *database.Database
-	)
-
-	app := newTestApp(t, &h, &db)
-	app.RequireStart()
-
-	t.Cleanup(app.RequireStop)
-
-	seedOperator(t, db)
-
-	cases := []struct{ next, want string }{
-		{"/source/abc/logs?page=2", "/source/abc/logs?page=2"},
-		{"", "/"},
-		{"https://evil.example/", "/"},
-		{"https%3A%2F%2Fevil.example%2F", "/"},
-		{"//evil.example/", "/"},
-		{"%2F%2Fevil.example/", "/"},
-		{"/%2Fevil.example/", "/"},
-		{`/\evil.example/`, "/"},
-		{"%2F%5Cevil.example/", "/"},
-		{"/%5Cevil.example/", "/"},
-		{`/a/../\evil.example/`, "/"},
-		{"/\t/evil.example/", "/"},
-		{"/%09/evil.example/", "/"},
-		{"/" + strings.Repeat("a", 4096), "/"},
-	}
-
-	for _, c := range cases {
-		form := url.Values{}
-		form.Set("username", operatorUser)
-		form.Set("password", operatorPassword)
-		form.Set("next", c.next)
-
-		req := httptest.NewRequestWithContext(
-			context.Background(),
-			http.MethodPost,
-			"/pages/login",
-			strings.NewReader(form.Encode()),
-		)
-		req.Header.Set(
-			"Content-Type", "application/x-www-form-urlencoded",
-		)
-		req.RemoteAddr = sharedProxyPeer
-
-		w := httptest.NewRecorder()
-		h.HandleLoginSubmit().ServeHTTP(w, req)
-
-		assert.Equal(t, http.StatusSeeOther, w.Code, "next %q", c.next)
-		assert.Equal(
-			t, c.want, w.Header().Get("Location"), "next %q", c.next,
-		)
-	}
-}
-
-// loginPageGet renders the login page as a GET with the given next
-// value and cookies.
-func loginPageGet(
-	h *handlers.Handlers, next string, cookies []*http.Cookie,
-) *httptest.ResponseRecorder {
-	req := httptest.NewRequestWithContext(
-		context.Background(), http.MethodGet,
-		"/pages/login?"+url.Values{"next": {next}}.Encode(), nil,
-	)
-
-	for _, c := range cookies {
-		req.AddCookie(c)
-	}
-
-	w := httptest.NewRecorder()
-	h.HandleLoginPage().ServeHTTP(w, req)
-
-	return w
-}
-
-// TestLoginPage_CarriesOnlyAPathOnThisSite covers the login page
-// itself: its form carries the requested page only when it is a path
-// on this site, and a browser already logged in goes straight there,
-// or to "/" when it is not.
-func TestLoginPage_CarriesOnlyAPathOnThisSite(t *testing.T) {
-	t.Parallel()
-
-	var (
-		h    *handlers.Handlers
-		sess *session.Session
-	)
-
-	app := newTestApp(t, &h, &sess)
-	app.RequireStart()
-
-	t.Cleanup(app.RequireStop)
-
-	assert.Contains(
-		t, loginPageGet(h, "/source/abc", nil).Body.String(),
-		`name="next" value="/source/abc"`,
-	)
-	assert.Contains(
-		t, loginPageGet(h, "//evil.example/", nil).Body.String(),
-		`name="next" value="/"`,
-	)
-
-	cookies := authenticatedCookies(t, sess, "test-user-id", "testuser")
-
-	cases := []struct{ next, want string }{
-		{"/source/abc", "/source/abc"},
-		{"//evil.example/", "/"},
-		{`/\evil.example/`, "/"},
-	}
-
-	for _, c := range cases {
-		w := loginPageGet(h, c.next, cookies)
-
-		assert.Equal(t, http.StatusSeeOther, w.Code, "next %q", c.next)
-		assert.Equal(
-			t, c.want, w.Header().Get("Location"), "next %q", c.next,
-		)
-	}
-}
-
-// TestLoginPage_HasNoLinkToItself: the navigation bar on the login
-// page offers no link to the login page.
-func TestLoginPage_HasNoLinkToItself(t *testing.T) {
-	t.Parallel()
-
-	var h *handlers.Handlers
-
-	app := newTestApp(t, &h)
-	app.RequireStart()
-
-	t.Cleanup(app.RequireStop)
-
-	w := loginPageGet(h, "", nil)
-
-	require.Equal(t, http.StatusOK, w.Code)
-	assert.NotContains(t, w.Body.String(), `href="/pages/login"`)
-}
-
 // TestLogin_UsernameAtLimitCanLogIn shows that a username of exactly
 // database.MaxUsernameBytes still fits in the session cookie. Past
 // what the cookie can carry, a correct login answers 500.

internal/handlers/handlers.go

@@ -36,9 +36,6 @@ const (
 	tmplKeyError = "Error"
 	// tmplKeyWebhook is the template data key for a webhook.
 	tmplKeyWebhook = "Webhook"
-	// tmplKeyNext is the template data key for the page to return
-	// to after login.
-	tmplKeyNext = "Next"
 )
 
 // errInvalidPassword is returned when a password does not match.

internal/handlers/profile_test.go

@@ -88,8 +88,6 @@ func TestHandleProfile_OwnProfile_OK(t *testing.T) {
 	h.HandleProfile().ServeHTTP(w, req)
 
 	assert.Equal(t, http.StatusOK, w.Code)
-	assert.Contains(t, w.Body.String(), "Account Information")
-	assert.NotContains(t, w.Body.String(), "Account Type")
 }
 
 func TestHandleProfile_OtherProfile_Forbidden(t *testing.T) {
@@ -160,10 +158,7 @@ func TestUserRoute_Unauthenticated_RedirectedByMiddleware(t *testing.T) {
 		"handler must not be reached for unauthenticated request",
 	)
 	assert.Equal(t, http.StatusSeeOther, w.Code)
-	assert.Equal(
-		t, "/pages/login?next=%2Fuser%2Ftestuser",
-		w.Header().Get("Location"),
-	)
+	assert.Equal(t, "/pages/login", w.Header().Get("Location"))
 }
 
 // passwordChangeRequest builds a POST request to the password-change

internal/middleware/middleware.go

@@ -6,7 +6,6 @@ import (
 	"log/slog"
 	"net"
 	"net/http"
-	"net/url"
 	"sync"
 	"time"
 
@@ -367,24 +366,6 @@ func (s *Middleware) CORS() func(http.Handler) http.Handler {
 	}
 }
 
-// NextParam is the query parameter on the login redirect, and the
-// login form field, that holds the page to return to after login.
-const NextParam = "next"
-
-// loginURL is the login page RequireAuth redirects to. A GET carries
-// its own path and query in NextParam so that logging in returns to
-// it; HandleLoginSubmit decides whether that value is safe to follow.
-// Other methods carry nothing, since a redirect cannot repeat them.
-func loginURL(r *http.Request) string {
-	if r.Method != http.MethodGet {
-		return "/pages/login"
-	}
-
-	return "/pages/login?" + url.Values{
-		NextParam: {r.URL.RequestURI()},
-	}.Encode()
-}
-
 // RequireAuth returns middleware that checks for a valid session.
 // Unauthenticated users are redirected to the login page.
 func (s *Middleware) RequireAuth() func(http.Handler) http.Handler {
@@ -400,7 +381,7 @@ func (s *Middleware) RequireAuth() func(http.Handler) http.Handler {
 					"error", err,
 				)
 				http.Redirect(
-					w, r, loginURL(r), http.StatusSeeOther,
+					w, r, "/pages/login", http.StatusSeeOther,
 				)
 
 				return
@@ -428,7 +409,7 @@ func (s *Middleware) RequireAuth() func(http.Handler) http.Handler {
 					),
 				)
 				http.Redirect(
-					w, r, loginURL(r), http.StatusSeeOther,
+					w, r, "/pages/login", http.StatusSeeOther,
 				)
 
 				return

internal/middleware/middleware_test.go

@@ -338,42 +338,6 @@ func TestRequireAuth_NoSession_RedirectsToLogin(t *testing.T) {
 			"unauthenticated request",
 	)
 	assert.Equal(t, http.StatusSeeOther, w.Code)
-	assert.Equal(
-		t, "/pages/login?next=%2Fdashboard", w.Header().Get("Location"),
-	)
-}
-
-// TestRequireAuth_LoginRedirectCarriesOnlyAGet pins what the login
-// redirect carries: a GET's path and query, so logging in can return
-// there, and nothing for a POST, which a redirect cannot repeat.
-func TestRequireAuth_LoginRedirectCarriesOnlyAGet(t *testing.T) {
-	t.Parallel()
-
-	m, _ := testMiddleware(t, config.EnvironmentDev)
-
-	handler := m.RequireAuth()(http.HandlerFunc(
-		func(_ http.ResponseWriter, _ *http.Request) {},
-	))
-
-	get := httptest.NewRequestWithContext(
-		context.Background(),
-		http.MethodGet, "/source/abc/logs?page=2", nil,
-	)
-	w := httptest.NewRecorder()
-	handler.ServeHTTP(w, get)
-
-	assert.Equal(
-		t, "/pages/login?next=%2Fsource%2Fabc%2Flogs%3Fpage%3D2",
-		w.Header().Get("Location"),
-	)
-
-	post := httptest.NewRequestWithContext(
-		context.Background(),
-		http.MethodPost, "/source/abc/delete", nil,
-	)
-	w = httptest.NewRecorder()
-	handler.ServeHTTP(w, post)
-
 	assert.Equal(t, "/pages/login", w.Header().Get("Location"))
 }
 
@@ -479,9 +443,7 @@ func TestRequireAuth_UnauthenticatedSession_RedirectsToLogin(
 			"unauthenticated session",
 	)
 	assert.Equal(t, http.StatusSeeOther, w.Code)
-	assert.Equal(
-		t, "/pages/login?next=%2Fdashboard", w.Header().Get("Location"),
-	)
+	assert.Equal(t, "/pages/login", w.Header().Get("Location"))
 }
 
 // --- RequireAuth Session Expiry Tests ---
@@ -579,9 +541,7 @@ func TestRequireAuth_IdleExpiredSession_RedirectsToLogin(
 		"handler should not run for an idle-expired session",
 	)
 	assert.Equal(t, http.StatusSeeOther, w.Code)
-	assert.Equal(
-		t, "/pages/login?next=%2Fdashboard", w.Header().Get("Location"),
-	)
+	assert.Equal(t, "/pages/login", w.Header().Get("Location"))
 	assert.Empty(
 		t, sessionCookies(w),
 		"an expired session must not be refreshed",

internal/server/routes_test.go

@@ -680,44 +680,6 @@ func TestPagesLogin_CookiesFromAnEarlierDatabase(t *testing.T) {
 	)
 }
 
-// TestPagesLogin_ReturnsToTheRequestedPage is
-// https://git.eeqj.de/sneak/webhooker/issues/384: a page opened while
-// logged out leads to the login page, and logging in from there lands
-// on that page, query included.
-func TestPagesLogin_ReturnsToTheRequestedPage(t *testing.T) {
-	t.Parallel()
-
-	const (
-		username = "operator"
-		password = "correct-horse-battery-staple"
-	)
-
-	env := newTestEnv(t)
-	userID, _ := env.seedUser(t, username, password)
-	asked := "/source/" + env.seedWebhook(t, userID).ID + "/logs?page=2"
-
-	bounced := env.get(asked, nil)
-	require.Equal(t, http.StatusSeeOther, bounced.Code)
-
-	loginPage := bounced.Header().Get("Location")
-
-	match := regexp.MustCompile(`name="next" value="([^"]*)"`).
-		FindStringSubmatch(env.get(loginPage, nil).Body.String())
-	require.Len(t, match, 2, "the login form must carry the page")
-
-	token, cookies := env.csrfFrom(t, loginPage, nil)
-
-	form := url.Values{}
-	form.Set("csrf_token", token)
-	form.Set("username", username)
-	form.Set("password", password)
-	form.Set("next", html.UnescapeString(match[1]))
-
-	w := env.post("/pages/login", form, cookies)
-	require.Equal(t, http.StatusSeeOther, w.Code)
-	assert.Equal(t, asked, w.Header().Get("Location"))
-}
-
 // --- /user/{username} group ---
 
 // TestPasswordChange_OversizeBody_RejectedAndPasswordUnchanged
@@ -868,10 +830,7 @@ func TestSourceLogsBody_OtherUser404s(t *testing.T) {
 
 	anon := env.get(path, nil)
 	assert.Equal(t, http.StatusSeeOther, anon.Code)
-	assert.Equal(
-		t, "/pages/login?next="+url.QueryEscape(path),
-		anon.Header().Get("Location"),
-	)
+	assert.Equal(t, "/pages/login", anon.Header().Get("Location"))
 }
 
 // TestDeliveryReplay_PostOnlyAndCSRFProtected walks the replay action

internal/versionscript/version_script_test.go

@@ -115,8 +115,8 @@ func TestVersion_EnclosingRepositoryIsNotUsed(t *testing.T) {
 	require.Equal(t, unknown, runScript(t, inner, nil))
 }
 
-// The Docker build has no git metadata, so the version arrives as an
-// environment override. It wins over anything derivable.
+// An explicit VERSION, such as the Dockerfile's build arg, wins over
+// anything derivable.
 func TestVersion_EnvironmentOverrideWins(t *testing.T) {
 	t.Parallel()
 
@@ -128,8 +128,8 @@ func TestVersion_EnvironmentOverrideWins(t *testing.T) {
 }
 
 // An empty VERSION is treated as unset rather than stamping an empty
-// string: the Dockerfile's build arg has a non-empty default, but a
-// caller exporting VERSION= must not produce a binary reporting "".
+// string: a caller exporting VERSION= must not produce a binary
+// reporting "".
 func TestVersion_EmptyOverrideFallsBackToGit(t *testing.T) {
 	t.Parallel()
 
@@ -168,8 +168,8 @@ func TestMakefile_BuildComposesVersionAndExtraFlags(t *testing.T) {
 }
 
 // A caller can define VERSION as the empty string -- `make build
-// VERSION=`, or a `--build-arg VERSION=` reaching the Dockerfile's `make
-// build VERSION="$VERSION"`. script/version's own guard does not cover
+// VERSION=`, or the Dockerfile's `make build VERSION="$VERSION"` when no
+// VERSION build arg was given. script/version's own guard does not cover
 // that: the value never passes through the script. Stamping "" would
 // leave the binary reporting no version and the footer on "dev", which
 // is the defect this package exists for.
@@ -231,7 +231,7 @@ func TestDockerfile_BuildsThroughTheMakeTarget(t *testing.T) {
 
 	require.NotContains(t, dockerfile, "go build",
 		"a raw go build bypasses the Makefile's -X flag")
-	require.Contains(t, dockerfile, "ARG VERSION=")
+	require.Contains(t, dockerfile, "ARG VERSION")
 	require.Contains(t, dockerfile,
 		`make build VERSION="$VERSION" GO_LDFLAGS='-extldflags "-static"'`)
 }

script/docker

@@ -2,9 +2,9 @@
 # script/docker: build the Docker image tagged with the project name.
 # The tag comes from script/projectname.
 #
-# .dockerignore excludes .git/, so the builder stage cannot derive the
-# version itself. It is resolved here, where the checkout is, and passed
-# in as a build arg; without it the image would stamp itself "unknown".
+# The version script/version resolves here goes in as the VERSION build
+# arg, which takes precedence over what the build would derive from the
+# .git in its context.
 set -eu
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"

script/version

@@ -7,18 +7,16 @@
 #
 # Order of precedence:
 #
-#   1. $VERSION, if set and non-empty. This is how the value reaches a
-#      build that cannot derive it: .dockerignore excludes .git/, so the
-#      builder stage has no git metadata and the Dockerfile takes the
-#      value as a build arg instead.
+#   1. $VERSION, if set and non-empty: an explicit value, such as the
+#      Dockerfile's VERSION build arg.
 #   2. `git describe --tags --always --dirty` against this checkout. At
 #      a clean tagged commit that is exactly the tag; otherwise it
 #      carries the short SHA, the commit distance when a tag is
 #      reachable, and a -dirty suffix for uncommitted changes.
 #   3. "unknown", for a tree with no git metadata and no $VERSION -- a
-#      source tarball, or `docker build .` with no --build-arg. That
-#      case must not fail the build and must not name a tag the tree may
-#      not be at, so it names nothing.
+#      source tarball, or a `docker build` with no .git in its context
+#      and no VERSION build arg. That case must not fail the build and
+#      must not name a tag the tree may not be at, so it names nothing.
 #
 # The git step insists the enclosing repository is this checkout, not
 # merely some repository above it: an unpacked tarball sitting inside an

templates/login.html

@@ -24,7 +24,6 @@
 
             <form method="POST" action="/pages/login" class="space-y-6">
                 <input type="hidden" name="csrf_token" value="{{.CSRFToken}}">
-                <input type="hidden" name="next" value="{{.Next}}">
                 <div class="form-group">
                     <label for="username" class="label">Username</label>
                     <input

templates/navbar.html

@@ -6,14 +6,12 @@
         </div>
 
         <!-- Mobile menu button -->
-        {{if .User}}
         <button @click="open = !open" class="md:hidden p-2 rounded-md text-gray-500 hover:bg-gray-100">
             <svg class="w-6 h-6" fill="none" stroke="currentColor" viewBox="0 0 24 24">
                 <path x-show="!open" stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M4 6h16M4 12h16M4 18h16"/>
                 <path x-show="open" x-cloak stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M6 18L18 6M6 6l12 12"/>
             </svg>
         </button>
-        {{end}}
 
         <!-- Desktop navigation -->
         <div class="hidden md:flex items-center gap-4">
@@ -30,6 +28,8 @@
                 <input type="hidden" name="csrf_token" value="{{.CSRFToken}}">
                 <button type="submit" class="btn-text">Logout</button>
             </form>
+            {{else}}
+            <a href="/pages/login" class="btn-primary">Login</a>
             {{end}}
         </div>
     </div>
@@ -44,6 +44,8 @@
                 <input type="hidden" name="csrf_token" value="{{.CSRFToken}}">
                 <button type="submit" class="btn-text w-full text-left">Logout</button>
             </form>
+            {{else}}
+            <a href="/pages/login" class="btn-primary w-full">Login</a>
             {{end}}
         </div>
     </div>

templates/profile.html

@@ -41,6 +41,10 @@
                     <dt class="w-32 text-sm font-medium text-gray-500">Username</dt>
                     <dd class="text-sm text-gray-900">{{.User.Username}}</dd>
                 </div>
+                <div class="flex">
+                    <dt class="w-32 text-sm font-medium text-gray-500">Account Type</dt>
+                    <dd class="text-sm text-gray-900">Standard User</dd>
+                </div>
             </dl>
         </div>
     </div>