Re-arrange how api endpoints are defined

srv/src/api/api.go

@@ -152,17 +152,29 @@ func (a *api) handler() http.Handler {
 		staticHandler = httputil.NewSingleHostReverseProxy(a.params.StaticProxy)
 	}
 
-	staticHandler = setCSRFMiddleware(staticHandler)
-
 	// sugar
+
 	requirePow := func(h http.Handler) http.Handler {
 		return a.requirePowMiddleware(h)
 	}
 
+	postFormMiddleware := func(h http.Handler) http.Handler {
+		h = checkCSRFMiddleware(h)
+		h = postOnlyMiddleware(h)
+		h = logReqMiddleware(h)
+		h = addResponseHeaders(map[string]string{
+			"Cache-Control": "no-store, max-age=0",
+			"Pragma":        "no-cache",
+			"Expires":       "0",
+		}, h)
+		return h
+	}
+
 	mux := http.NewServeMux()
 
 	mux.Handle("/", staticHandler)
 
+	{
 		apiMux := http.NewServeMux()
 		apiMux.Handle("/pow/challenge", a.newPowChallengeHandler())
 		apiMux.Handle("/pow/check",
@@ -181,28 +193,22 @@ func (a *api) handler() http.Handler {
 			a.requirePowMiddleware,
 		)))
 
-	var apiHandler http.Handler = apiMux
-	apiHandler = checkCSRFMiddleware(apiHandler)
-	apiHandler = postOnlyMiddleware(apiHandler)
-	apiHandler = logReqMiddleware(apiHandler)
-	apiHandler = addResponseHeaders(map[string]string{
-		"Cache-Control": "no-store, max-age=0",
-		"Pragma":        "no-cache",
-		"Expires":       "0",
-	}, apiHandler)
+		mux.Handle("/api/", http.StripPrefix("/api", postFormMiddleware(apiMux)))
+	}
 
-	mux.Handle("/api/", http.StripPrefix("/api", apiHandler))
+	{
+		v2Mux := http.NewServeMux()
+		v2Mux.Handle("/follow.html", a.renderDumbHandler("follow.html"))
+		v2Mux.Handle("/posts/", a.renderPostHandler())
+		v2Mux.Handle("/assets", a.renderPostAssetsIndexHandler())
+		v2Mux.Handle("/assets/", a.servePostAssetHandler())
+		v2Mux.Handle("/", a.renderIndexHandler())
 
-	// TODO need to setCSRFMiddleware on all these rendering endpoints
-	mux.Handle("/v2/follow.html", a.renderDumbHandler("follow.html"))
-	mux.Handle("/v2/posts/", a.renderPostHandler())
-	mux.Handle("/v2/", a.renderIndexHandler())
-
-	mux.Handle("/v2/assets/", a.servePostAssetHandler())
-
-	mux.Handle("/v2/admin/assets.html", a.renderAdminAssets())
+		mux.Handle("/v2/", http.StripPrefix("/v2", v2Mux))
+	}
 
 	var globalHandler http.Handler = mux
+	globalHandler = setCSRFMiddleware(globalHandler)
 	globalHandler = setLoggerMiddleware(a.params.Logger, globalHandler)
 
 	return globalHandler

srv/src/api/render.go

@@ -197,9 +197,9 @@ func (a *api) renderDumbHandler(tplName string) http.Handler {
 	})
 }
 
-func (a *api) renderAdminAssets() http.Handler {
+func (a *api) renderPostAssetsIndexHandler() http.Handler {
 
-	tpl := a.mustParseTpl("admin/assets.html")
+	tpl := a.mustParseTpl("admin-assets.html")
 
 	return http.HandlerFunc(func(rw http.ResponseWriter, r *http.Request) {