fix: serve real home page instead of redirecting, add templated pages by CKodidela · Pull Request #409 · cameri/nostream

CKodidela · 2026-04-09T03:07:20Z

Previously, visiting the relay's home page resulted in a 301 permanent redirect to /invoices when payments were
enabled, or a bare text response when payments were disabled. Neither gave relay operators a real home page, and the
301 caused browsers to cache the redirect permanently making it impossible to change home page behaviour later
without users clearing cache.

Changes:

/ now always serves index.html, a proper home page that works with and without payments. When admission fees are
enabled, a payment card and link to /invoices is shown; otherwise an "open relay" card is shown. Template variables:
{{name}}, {{description}}, {{relay_url}}, {{amount}}, {{payments_section_class}}, {{no_payments_section_class}},
{{nonce}}.
The old index.html (admission fee form) is renamed to get-invoice.html, served by GET /invoices. The ToS link now
points to /terms instead of an embedded modal.
The old invoices.html (payment result page) is renamed to post-invoice.html, served after POST /invoices. The rename
reflects what the page actually is.
privacy.html template added and served at GET /privacy.
Old index.html and invoices.html remain in resources/ for reference.

Description

Replaces the broken home page behaviour with a proper templated home page. All five templates (index.html,
get-invoice.html, post-invoice.html, terms.html, privacy.html) are user-modifiable files in resources/. The
home page conditionally shows or hides the admission fee section using CSS class template variables, so it works
correctly whether payments are enabled or not.

Related Issue

Closes #269

Motivation and Context

The 301 redirect was a bug browsers cache it permanently, so any future change to the home page would be invisible
to returning visitors until they manually cleared their cache. Beyond the redirect fix, relay operators (especially
those running private/whitelist-only relays with no payments) had no home page at all, and there was no privacy policy
page despite many jurisdictions requiring one.

How Has This Been Tested?

Manually verified both payment-enabled and payment-disabled paths render the correct home page content. Verified GET /invoices serves get-invoice.html, POST /invoices serves post-invoice.html, GET /terms and GET /privacy
both render correctly. Confirmed application/nostr+json requests to / still return the relay information document
unchanged.

Types of changes

Bug fix (non-breaking change which fixes an issue)
New feature (non-breaking change which adds functionality)

Checklist

My code follows the code style of this project.
I have read the CONTRIBUTING document.
I have added tests to cover my code changes.
All new and existing tests passed.

Previously, visiting the relay's home page resulted in a 301 permanent redirect to /invoices when payments were enabled, or a bare text response when payments were disabled. Neither gave relay operators a real home page, and the 301 caused browsers to cache the redirect permanently — making it impossible to change home page behaviour later without users clearing cache. Changes: - / now always serves index.html, a proper home page that works with and without payments. When admission fees are enabled, a payment card and link to /invoices is shown; otherwise an "open relay" card is shown. Template variables: {{name}}, {{description}}, {{relay_url}}, {{amount}}, {{payments_section_class}}, {{no_payments_section_class}}, {{nonce}}. - The old index.html (admission fee form) is renamed to get-invoice.html, served by GET /invoices. The ToS link now points to /terms instead of an embedded modal. - The old invoices.html (payment result page) is renamed to post-invoice.html, served after POST /invoices. The rename reflects what the page actually is. - privacy.html template added and served at GET /privacy. - Old index.html and invoices.html remain in resources/ for reference.

CKodidela · 2026-04-09T13:50:07Z

@cameri this PR up for review

Copilot

Pull request overview

This PR replaces the relay’s previous root-path behavior (301 redirect to /invoices or plain text) with a real, user-modifiable, templated home page, and adds additional user-modifiable legal/payment templates served from resources/.

Changes:

Serve a templated resources/index.html at GET /, with conditional sections for payments-enabled vs open-relay mode.
Rename/split invoice templates into get-invoice.html (GET /invoices) and post-invoice.html (after POST /invoices), updating controllers accordingly.
Add resources/privacy.html and serve it at GET /privacy.

Reviewed changes

Copilot reviewed 9 out of 9 changed files in this pull request and generated 8 comments.

Show a summary per file

File	Description
src/routes/index.ts	Adds `GET /privacy` route wiring.
src/handlers/request-handlers/root-request-handler.ts	Stops redirect/text behavior; renders templated home page.
src/handlers/request-handlers/get-privacy-request-handler.ts	New handler that renders `privacy.html`.
src/controllers/invoices/get-invoice-controller.ts	Serves `get-invoice.html` instead of `index.html`.
src/controllers/invoices/post-invoice-controller.ts	Serves `post-invoice.html` instead of `invoices.html`.
resources/index.html	New home page template with conditional payments/open-relay sections.
resources/get-invoice.html	New “get invoice” page template (formerly home page admission form).
resources/post-invoice.html	New “post invoice” page template (formerly `invoices.html`).
resources/privacy.html	New privacy policy template.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

src/handlers/request-handlers/root-request-handler.ts

src/handlers/request-handlers/get-privacy-request-handler.ts

resources/post-invoice.html

resources/index.html

resources/get-invoice.html

cameri · 2026-04-10T02:24:43Z

@CKodidela Please address reviews by Copilot.

Copilot

Pull request overview

Copilot reviewed 11 out of 11 changed files in this pull request and generated 4 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

src/handlers/request-handlers/root-request-handler.ts

resources/post-invoice.html

…ndling

Copilot

Pull request overview

Copilot reviewed 13 out of 13 changed files in this pull request and generated 3 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

src/controllers/invoices/post-invoice-controller.ts

src/utils/template-cache.ts

src/controllers/invoices/get-invoice-controller.ts

…ache

CKodidela · 2026-04-10T03:57:18Z

@cameri @phoenix-server I’ve addressed the issues raised by Copilot, please take a look when you get a chance.

Copilot

Pull request overview

Copilot reviewed 13 out of 13 changed files in this pull request and generated 4 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

src/utils/html.ts

Copilot · 2026-04-10T04:04:46Z

src/utils/html.ts

+const HTML_ESCAPES: Record<string, string> = {
+  '&': '&amp;',
+  '<': '&lt;',
+  '>': '&gt;',
+  '"': '&quot;',
+  "'": '&#39;',
+}
+
+/**
+ * Escape a string for safe interpolation into HTML text or attribute values.
+ */
+export const escapeHtml = (value: string): string =>
+  value.replace(/[&<>"']/g, (ch) => HTML_ESCAPES[ch])
+
+/**
+ * Serialize a value for safe embedding inside an inline <script> block.
+ *
+ * JSON.stringify alone is NOT sufficient: it leaves `<` unescaped, so a value
+ * containing `</script>` would terminate the script block and allow injection.
+ * After serializing, replace every `<` with the Unicode escape `\u003C`, which
+ * is valid JSON and prevents the browser from treating the character as markup.
+ */
+export const safeJsonForScript = (value: unknown): string =>
+  JSON.stringify(value).replace(/</g, '\\u003C')


New escaping utilities (escapeHtml / safeJsonForScript) are security-critical and currently have no unit tests. Adding tests for common and edge cases (quotes/ampersands, '<' in JSON, undefined handling, etc.) would help prevent regressions.

@CKodidela We should add unit tests

Copilot · 2026-04-10T04:04:47Z

src/utils/template-cache.ts

+import { readFileSync } from 'fs'
+
+const cache = new Map<string, string>()
+const isProd = process.env.NODE_ENV === 'production'
+
+/**
+ * Return the raw content of a template file.
+ *
+ * In production (NODE_ENV=production) the file is read from disk once and
+ * cached for the lifetime of the process — no per-request I/O. Operators who
+ * edit files under resources/ must restart the process for changes to take
+ * effect.
+ *
+ * Outside of production the cache is bypassed so template edits are reflected
+ * immediately without a restart.
+ */
+export const getTemplate = (path: string): string => {
+  if (isProd) {
+    let template = cache.get(path)
+    if (template === undefined) {
+      template = readFileSync(path, 'utf8')
+      cache.set(path, template)
+    }
+    return template
+  }
+
+  return readFileSync(path, 'utf8')
+}


getTemplate introduces environment-dependent caching behavior but currently has no unit tests. Adding tests for production vs non-production behavior (cache hit/miss, bypass in dev) would help ensure templates render consistently and avoid regressions.

Agreed with Copilot here: let's add unit tests.

resources/post-invoice.html

CKodidela · 2026-04-10T04:11:06Z

@cameri should i add test coverage?

cameri · 2026-04-10T11:40:49Z

@CKodidela Yes please, unit tests are key against regressions, code correctness, and overall quality.
I don't think we need integration tests for this PR though.

cache, request handlers, and invoice controller

…rs, post-invoice controller

CKodidela · 2026-04-10T14:13:57Z

I'm still working on some issues will tag when its ready

CKodidela · 2026-04-11T07:31:48Z

Up for review @cameri @phoenix-server

cameri requested a review from Copilot April 10, 2026 02:18

Copilot started reviewing on behalf of cameri April 10, 2026 02:18 View session

Copilot AI reviewed Apr 10, 2026

View reviewed changes

fix: security and reliability fixes for home page and invoice handlers

51121f9

CKodidela requested a review from Copilot April 10, 2026 03:17

Copilot started reviewing on behalf of CKodidela April 10, 2026 03:17 View session

Copilot AI reviewed Apr 10, 2026

View reviewed changes

fix: HTML-escape template values, cache templates, fix fetch error ha…

6823039

…ndling

CKodidela requested a review from Copilot April 10, 2026 03:47

Copilot started reviewing on behalf of CKodidela April 10, 2026 03:47 View session

Copilot AI reviewed Apr 10, 2026

View reviewed changes

src/controllers/invoices/post-invoice-controller.ts Outdated Show resolved Hide resolved

src/utils/template-cache.ts Show resolved Hide resolved

src/controllers/invoices/get-invoice-controller.ts Show resolved Hide resolved

fix: safe JSON serialization for inline scripts, env-aware template c…

1581346

…ache

CKodidela requested a review from Copilot April 10, 2026 04:00

Copilot started reviewing on behalf of CKodidela April 10, 2026 04:01 View session

Copilot AI reviewed Apr 10, 2026

View reviewed changes

CKodidela added 2 commits April 10, 2026 18:52

test: add unit tests for html utils, template

c1c9c7e

cache, request handlers, and invoice controller

test: add missing unit tests for html, template-cache, request handle…

bdf710f

…rs, post-invoice controller

fix: resolve lint rule violations and unit test errors

838de91

Conversation

CKodidela commented Apr 9, 2026

Description

Related Issue

Motivation and Context

How Has This Been Tested?

Types of changes

Checklist

Uh oh!

CKodidela commented Apr 9, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

cameri commented Apr 10, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

CKodidela commented Apr 10, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Copilot AI Apr 10, 2026

Choose a reason for hiding this comment

Uh oh!

cameri Apr 10, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 10, 2026

Choose a reason for hiding this comment

Uh oh!

cameri Apr 10, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

CKodidela commented Apr 10, 2026

Uh oh!

cameri commented Apr 10, 2026

Uh oh!

CKodidela commented Apr 10, 2026

Uh oh!

CKodidela commented Apr 11, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants