Merge branch 'develop' into stepsecurity_remediation_1722468463

.github/workflows/build.yml

@@ -24,7 +24,8 @@ jobs:
     - name: Set up Go
       uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2
       with:
-        go-version: '>=1.22.0'
+        go-version: '>=1.23.0'
+        cache: false
 
     - name: Build
       run: go build -v ./...

.github/workflows/release.yml

@@ -29,7 +29,8 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2
         with:
-          go-version: '>=1.22.0'
+          go-version: '>=1.23.0'
+          cache: false
       - name: Build release
         uses: goreleaser/goreleaser-action@5742e2a039330cbb23ebf35f046f814d4c6ff811 # v5.1.0
         with:

Dockerfile

@@ -1,4 +1,4 @@
-FROM --platform=$BUILDPLATFORM golang:1-bookworm@sha256:af9b40f2b1851be993763b85288f8434af87b5678af04355b1e33ff530b5765f as builder
+FROM --platform=$BUILDPLATFORM golang:1-bookworm@sha256:af9b40f2b1851be993763b85288f8434af87b5678af04355b1e33ff530b5765f AS builder
 ARG BUILDARCH TARGETOS TARGETARCH
 
 # Install GoReleaser

cmd/rwp/cmd/serve/api.go

@@ -9,6 +9,7 @@ import (
 	"os"
 	"path"
 	"path/filepath"
+	"slices"
 	"strconv"
 	"strings"
 	"syscall"
@@ -196,9 +197,15 @@ func (s *Server) getAsset(w http.ResponseWriter, r *http.Request) {
 		w.WriteHeader(http.StatusNotFound)
 		return
 	}
+	finalLink := *link
+
+	// Expand templated links to include URL query parameters
+	if finalLink.Templated {
+		finalLink = finalLink.ExpandTemplate(convertURLValuesToMap(r.URL.Query()))
+	}
 
 	// Get the asset from the publication
-	res := publication.Get(*link)
+	res := publication.Get(finalLink)
 	defer res.Close()
 
 	// Get asset length in bytes
@@ -214,6 +221,9 @@ func (s *Server) getAsset(w http.ResponseWriter, r *http.Request) {
 	if sub, ok := mimeSubstitutions[contentType]; ok {
 		contentType = sub
 	}
+	if slices.Contains(utfCharsetNeeded, contentType) {
+		contentType += "; charset=utf-8"
+	}
 	w.Header().Set("content-type", contentType)
 	w.Header().Set("cache-control", "private, max-age=86400, immutable")
 	w.Header().Set("content-length", strconv.FormatInt(l, 10))

cmd/rwp/cmd/serve/helpers.go

@@ -2,14 +2,24 @@ package serve
 
 import (
 	"net/http"
+	"net/url"
 	"strings"
 
 	"github.com/readium/go-toolkit/pkg/manifest"
+	"github.com/readium/go-toolkit/pkg/mediatype"
 )
 
 var mimeSubstitutions = map[string]string{
-	"application/vnd.ms-opentype":          "font/otf",                                            // Not just because it's sane, but because CF will compress it!
-	"application/vnd.readium.content+json": "application/vnd.readium.content+json; charset=utf-8", // Need utf-8 encoding
+	"application/vnd.ms-opentype": "font/otf", // Not just because it's sane, but because CF will compress it!
+}
+
+var utfCharsetNeeded = []string{
+	mediatype.ReadiumWebpubManifest.String(),
+	mediatype.ReadiumDivinaManifest.String(),
+	mediatype.ReadiumAudiobookManifest.String(),
+	mediatype.ReadiumPositionList.String(),
+	mediatype.ReadiumContentDocument.String(),
+	mediatype.ReadiumGuidedNavigationDocument.String(),
 }
 
 var compressableMimes = []string{
@@ -19,11 +29,11 @@ var compressableMimes = []string{
 	"text/css",
 	"text/html",
 	"application/xhtml+xml",
-	"application/webpub+json",
-	"application/divina+json",
-	"application/vnd.readium.position-list+json",
-	"application/vnd.readium.content+json",
-	"application/audiobook+json",
+	mediatype.ReadiumWebpubManifest.String(),
+	mediatype.ReadiumDivinaManifest.String(),
+	mediatype.ReadiumPositionList.String(),
+	mediatype.ReadiumContentDocument.String(),
+	mediatype.ReadiumAudiobookManifest.String(),
 	"font/ttf",
 	"application/ttf",
 	"application/x-ttf",
@@ -50,12 +60,12 @@ func makeRelative(link manifest.Link) manifest.Link {
 }
 
 func conformsToAsMimetype(conformsTo manifest.Profiles) string {
-	mime := "application/webpub+json"
+	mime := mediatype.ReadiumWebpubManifest.String()
 	for _, profile := range conformsTo {
 		if profile == manifest.ProfileDivina {
-			mime = "application/divina+json"
+			mime = mediatype.ReadiumDivinaManifest.String()
 		} else if profile == manifest.ProfileAudiobook {
-			mime = "application/audiobook+json"
+			mime = mediatype.ReadiumAudiobookManifest.String()
 		} else {
 			continue
 		}
@@ -88,3 +98,13 @@ func parseCoding(s string) (coding string) {
 	coding = strings.ToLower(strings.TrimSpace(s[:p]))
 	return
 }
+
+func convertURLValuesToMap(values url.Values) map[string]string {
+	result := make(map[string]string)
+	for key, val := range values {
+		if len(val) > 0 {
+			result[key] = val[0] // Take the first value for each key
+		}
+	}
+	return result
+}