From c14860796c22e602d99e9ebad332d03228fc15d9 Mon Sep 17 00:00:00 2001
From: Michael Lynch <git@mtlynch.io>
Date: Tue, 14 Jul 2026 23:23:38 +0000
Subject: [PATCH 1/2] Apply htmx defaults in base template

---
 handlers/csp.go                      |  2 --
 handlers/static/js/htmx-settings.js  | 26 ----------------
 handlers/templates/layouts/base.html | 46 +++++++++++++++++++++++++++-
 3 files changed, 45 insertions(+), 29 deletions(-)
 delete mode 100644 handlers/static/js/htmx-settings.js

diff --git a/handlers/csp.go b/handlers/csp.go
index 6ef9be38..4c2fbde7 100644
--- a/handlers/csp.go
+++ b/handlers/csp.go
@@ -39,8 +39,6 @@ func enforceContentSecurityPolicy(next http.Handler) http.Handler {
 				values: []string{
 					"'self'",
 					"'nonce-" + nonce + "'",
-					// for htmx 2.0.4 inline style
-					"'sha256-bsV5JivYxvGywDAZ22EZJKBFip65Ng9xoJVLbBg7bdo='",
 				},
 			},
 			{
diff --git a/handlers/static/js/htmx-settings.js b/handlers/static/js/htmx-settings.js
deleted file mode 100644
index 2f3b1a42..00000000
--- a/handlers/static/js/htmx-settings.js
+++ /dev/null
@@ -1,26 +0,0 @@
-/* global htmx */
-
-// Tighten security.
-htmx.config.selfRequestsOnly = true;
-htmx.config.allowScriptTags = false;
-htmx.config.allowEval = false;
-
-// Don't let response-targets override isError.
-htmx.config.responseTargetUnsetsError = false;
-
-document.addEventListener("DOMContentLoaded", () => {
-  document.body.addEventListener("htmx:beforeSwap", function (evt) {
-    if (evt.detail.xhr.status === 204) {
-      evt.detail.shouldSwap = true;
-    }
-    if (evt.detail.xhr.status === 422) {
-      // allow 422 responses to swap as we are using this as a signal that
-      // a form was submitted with bad data and want to rerender with the
-      // errors
-      //
-      // set isError to false to avoid error logging in console
-      evt.detail.shouldSwap = true;
-      evt.detail.isError = false;
-    }
-  });
-});
diff --git a/handlers/templates/layouts/base.html b/handlers/templates/layouts/base.html
index 967f3fbf..b2d5cbf3 100644
--- a/handlers/templates/layouts/base.html
+++ b/handlers/templates/layouts/base.html
@@ -4,6 +4,51 @@
     <meta charset="utf-8" />
     <meta http-equiv="X-UA-Compatible" content="IE=edge" />
     <meta name="viewport" content="width=device-width,initial-scale=1.0" />
+    <!--
+      Keep htmx requests limited to this origin so hx-* attributes can't be
+      used to send data to another site.
+
+      Disable script tags and eval in swapped content because this app renders
+      htmx responses server-side and doesn't need response-provided script
+      execution.
+
+      Disable htmx's history cache because storing full pages in localStorage
+      can create stale-page bugs and leaks content into long-lived browser
+      storage.
+
+      Make history restores normal requests, not HX-Request requests, so any
+      future route that returns fragments for htmx can still return a complete
+      page during back-button restoration.
+
+      Disable htmx's injected indicator CSS because the app owns those styles
+      in screenjournal.css and CSP should not need to permit htmx inline styles.
+
+      Keep a default htmx timeout so stalled requests fail instead of leaving
+      controls disabled indefinitely.
+
+      Keep 204 responses swappable because delete endpoints rely on empty 204
+      responses to clear the target element. Keep 422 responses swappable and
+      non-error because forms use that status for validation feedback.
+    -->
+    <meta
+      name="htmx-config"
+      content='{
+        "selfRequestsOnly": true,
+        "allowScriptTags": false,
+        "allowEval": false,
+        "historyCacheSize": 0,
+        "historyRestoreAsHxRequest": false,
+        "includeIndicatorStyles": false,
+        "timeout": 5000,
+        "responseTargetUnsetsError": false,
+        "responseHandling": [
+          {"code": "204", "swap": true},
+          {"code": "422", "swap": true, "error": false},
+          {"code": "[23]..", "swap": true},
+          {"code": "[45]..", "swap": false, "error": true}
+        ]
+      }'
+    />
     <title>{{ block "title" . }}ScreenJournal{{ end }}</title>
     {{ block "style-tags" . }}{{ end }}
     <link
@@ -34,7 +79,6 @@
     <script src="/third-party/htmx@2.0.4/htmx.min.js"></script>
     <script src="/third-party/htmx-ext-response-targets@2.0.0/response-targets.js"></script>
     <script src="/js/htmx-ext/clear-before-send.js"></script>
-    <script src="/js/htmx-settings.js" type="module"></script>
   </head>
 
   <body>

From 4aefe8b5dfa325350404b928f91298f522be5b55 Mon Sep 17 00:00:00 2001
From: Michael Lynch <git@mtlynch.io>
Date: Wed, 15 Jul 2026 11:26:33 +0000
Subject: [PATCH 2/2] Keep htmx settings in JavaScript

---
 handlers/static/js/htmx-settings.js  | 16 ++++++++++
 handlers/templates/layouts/base.html | 46 +---------------------------
 2 files changed, 17 insertions(+), 45 deletions(-)
 create mode 100644 handlers/static/js/htmx-settings.js

diff --git a/handlers/static/js/htmx-settings.js b/handlers/static/js/htmx-settings.js
new file mode 100644
index 00000000..b59ceb99
--- /dev/null
+++ b/handlers/static/js/htmx-settings.js
@@ -0,0 +1,16 @@
+/* global htmx */
+
+htmx.config.selfRequestsOnly = true; // Prevent hx-* from calling other origins.
+htmx.config.allowScriptTags = false; // Server-rendered swaps don't need scripts.
+htmx.config.allowEval = false; // Keep htmx from evaluating dynamic JS strings.
+htmx.config.historyCacheSize = 0; // Avoid localStorage page-cache staleness/leaks.
+htmx.config.historyRestoreAsHxRequest = false; // Restore history with full pages.
+htmx.config.includeIndicatorStyles = false; // Indicator CSS lives in screenjournal.css.
+htmx.config.timeout = 5000; // Fail stalled requests instead of disabling UI forever.
+htmx.config.responseTargetUnsetsError = false; // Keep response-targets error state.
+htmx.config.responseHandling = [
+  { code: "204", swap: true }, // Empty 204 deletes clear the target element.
+  { code: "422", swap: true, error: false }, // Validation errors swap normally.
+  { code: "[23]..", swap: true }, // Successful non-empty responses swap normally.
+  { code: "[45]..", swap: false, error: true }, // Error targets handle failures.
+];
diff --git a/handlers/templates/layouts/base.html b/handlers/templates/layouts/base.html
index b2d5cbf3..967f3fbf 100644
--- a/handlers/templates/layouts/base.html
+++ b/handlers/templates/layouts/base.html
@@ -4,51 +4,6 @@
     <meta charset="utf-8" />
     <meta http-equiv="X-UA-Compatible" content="IE=edge" />
     <meta name="viewport" content="width=device-width,initial-scale=1.0" />
-    <!--
-      Keep htmx requests limited to this origin so hx-* attributes can't be
-      used to send data to another site.
-
-      Disable script tags and eval in swapped content because this app renders
-      htmx responses server-side and doesn't need response-provided script
-      execution.
-
-      Disable htmx's history cache because storing full pages in localStorage
-      can create stale-page bugs and leaks content into long-lived browser
-      storage.
-
-      Make history restores normal requests, not HX-Request requests, so any
-      future route that returns fragments for htmx can still return a complete
-      page during back-button restoration.
-
-      Disable htmx's injected indicator CSS because the app owns those styles
-      in screenjournal.css and CSP should not need to permit htmx inline styles.
-
-      Keep a default htmx timeout so stalled requests fail instead of leaving
-      controls disabled indefinitely.
-
-      Keep 204 responses swappable because delete endpoints rely on empty 204
-      responses to clear the target element. Keep 422 responses swappable and
-      non-error because forms use that status for validation feedback.
-    -->
-    <meta
-      name="htmx-config"
-      content='{
-        "selfRequestsOnly": true,
-        "allowScriptTags": false,
-        "allowEval": false,
-        "historyCacheSize": 0,
-        "historyRestoreAsHxRequest": false,
-        "includeIndicatorStyles": false,
-        "timeout": 5000,
-        "responseTargetUnsetsError": false,
-        "responseHandling": [
-          {"code": "204", "swap": true},
-          {"code": "422", "swap": true, "error": false},
-          {"code": "[23]..", "swap": true},
-          {"code": "[45]..", "swap": false, "error": true}
-        ]
-      }'
-    />
     <title>{{ block "title" . }}ScreenJournal{{ end }}</title>
     {{ block "style-tags" . }}{{ end }}
     <link
@@ -79,6 +34,7 @@
     <script src="/third-party/htmx@2.0.4/htmx.min.js"></script>
     <script src="/third-party/htmx-ext-response-targets@2.0.0/response-targets.js"></script>
     <script src="/js/htmx-ext/clear-before-send.js"></script>
+    <script src="/js/htmx-settings.js" type="module"></script>
   </head>
 
   <body>