From 75ce65c80e59447348915b8def0ad5086f02adfd Mon Sep 17 00:00:00 2001
From: Bryan Van Deusen <bryan.vandeusen@fabledsword.com>
Date: Wed, 22 Apr 2026 10:31:30 -0400
Subject: [PATCH] feat(server): serve embedded SPA at root with /api,/rest
 carve-out

- NotFound wrapper routes unknown /api/* and /rest/* to a JSON 404
- Everything else falls through to the embedded web handler, which
  resolves static assets or returns index.html for SPA deep links
---
 internal/server/server.go      | 14 +++++++
 internal/server/server_test.go | 77 ++++++++++++++++++++++++++++++++++
 2 files changed, 91 insertions(+)

diff --git a/internal/server/server.go b/internal/server/server.go
index 3c56987f..2515a019 100644
--- a/internal/server/server.go
+++ b/internal/server/server.go
@@ -5,6 +5,7 @@ import (
 	"encoding/json"
 	"log/slog"
 	"net/http"
+	"strings"
 
 	"github.com/go-chi/chi/v5"
 	"github.com/go-chi/chi/v5/middleware"
@@ -14,6 +15,7 @@ import (
 	"git.fabledsword.com/bvandeusen/minstrel/internal/auth"
 	"git.fabledsword.com/bvandeusen/minstrel/internal/library"
 	"git.fabledsword.com/bvandeusen/minstrel/internal/subsonic"
+	"git.fabledsword.com/bvandeusen/minstrel/web"
 )
 
 // ScanTrigger is the subset of the scanner the HTTP handler needs. Kept as an
@@ -50,6 +52,18 @@ func (s *Server) Router() http.Handler {
 		})
 		subsonic.Mount(r, s.Pool, s.Logger, s.SubsonicCfg)
 	}
+
+	spa := web.Handler()
+	r.NotFound(func(w http.ResponseWriter, req *http.Request) {
+		p := req.URL.Path
+		if strings.HasPrefix(p, "/api/") || strings.HasPrefix(p, "/rest/") {
+			w.Header().Set("Content-Type", "application/json")
+			w.WriteHeader(http.StatusNotFound)
+			_, _ = w.Write([]byte(`{"error":{"code":"not_found","message":"not found"}}`))
+			return
+		}
+		spa.ServeHTTP(w, req)
+	})
 	return r
 }
 
diff --git a/internal/server/server_test.go b/internal/server/server_test.go
index bb3ae017..9c207b0d 100644
--- a/internal/server/server_test.go
+++ b/internal/server/server_test.go
@@ -6,6 +6,7 @@ import (
 	"log/slog"
 	"net/http"
 	"net/http/httptest"
+	"strings"
 	"testing"
 
 	"git.fabledsword.com/bvandeusen/minstrel/internal/subsonic"
@@ -33,3 +34,79 @@ func TestHealthz(t *testing.T) {
 		t.Errorf("body = %v, want status=ok", body)
 	}
 }
+
+func TestRouter_ServesSPAAtRoot(t *testing.T) {
+	s := New(slog.New(slog.NewTextHandler(io.Discard, nil)), nil, nil, subsonic.Config{})
+	ts := httptest.NewServer(s.Router())
+	defer ts.Close()
+
+	resp, err := http.Get(ts.URL + "/")
+	if err != nil {
+		t.Fatalf("GET /: %v", err)
+	}
+	defer func() { _ = resp.Body.Close() }()
+
+	if resp.StatusCode != http.StatusOK {
+		t.Errorf("status = %d, want 200", resp.StatusCode)
+	}
+	if ct := resp.Header.Get("Content-Type"); !strings.Contains(ct, "text/html") {
+		t.Errorf("Content-Type = %q, want text/html*", ct)
+	}
+}
+
+func TestRouter_DeepLinkFallbackReturnsSPA(t *testing.T) {
+	s := New(slog.New(slog.NewTextHandler(io.Discard, nil)), nil, nil, subsonic.Config{})
+	ts := httptest.NewServer(s.Router())
+	defer ts.Close()
+
+	resp, err := http.Get(ts.URL + "/artists/00000000-0000-0000-0000-000000000001")
+	if err != nil {
+		t.Fatalf("GET deep link: %v", err)
+	}
+	defer func() { _ = resp.Body.Close() }()
+
+	if resp.StatusCode != http.StatusOK {
+		t.Errorf("status = %d, want 200", resp.StatusCode)
+	}
+	if ct := resp.Header.Get("Content-Type"); !strings.Contains(ct, "text/html") {
+		t.Errorf("Content-Type = %q, want text/html*", ct)
+	}
+}
+
+func TestRouter_APIPathNotSwallowedBySPA(t *testing.T) {
+	s := New(slog.New(slog.NewTextHandler(io.Discard, nil)), nil, nil, subsonic.Config{})
+	ts := httptest.NewServer(s.Router())
+	defer ts.Close()
+
+	resp, err := http.Get(ts.URL + "/api/does-not-exist")
+	if err != nil {
+		t.Fatalf("GET /api/does-not-exist: %v", err)
+	}
+	defer func() { _ = resp.Body.Close() }()
+
+	if resp.StatusCode != http.StatusNotFound {
+		t.Errorf("status = %d, want 404", resp.StatusCode)
+	}
+	if ct := resp.Header.Get("Content-Type"); strings.Contains(ct, "text/html") {
+		t.Errorf("Content-Type = %q; /api/* must never return text/html", ct)
+	}
+}
+
+func TestRouter_RestPathNotSwallowedBySPA(t *testing.T) {
+	s := New(slog.New(slog.NewTextHandler(io.Discard, nil)), nil, nil, subsonic.Config{})
+	ts := httptest.NewServer(s.Router())
+	defer ts.Close()
+
+	resp, err := http.Get(ts.URL + "/rest/does-not-exist")
+	if err != nil {
+		t.Fatalf("GET /rest/does-not-exist: %v", err)
+	}
+	defer func() { _ = resp.Body.Close() }()
+
+	if resp.StatusCode != http.StatusNotFound {
+		t.Errorf("status = %d, want 404", resp.StatusCode)
+	}
+	if ct := resp.Header.Get("Content-Type"); strings.Contains(ct, "text/html") {
+		t.Errorf("Content-Type = %q; /rest/* must never return text/html", ct)
+	}
+}