#!/usr/bin/env bash
# Build Tailwind CSS from the HTML templates into static/css/app.css.
#
# The production build does NOT use cdn.tailwindcss.com (the dev runtime):
# it is a JS script executed in the browser, which browsers cannot pin with
# SRI and which would keep a third-party origin in our CSP
# (SECURITY_TODO #9). This script produces a static stylesheet instead.
#
# Running it requires Node >= 18 with npx available. The generated
# static/css/app.css MUST be committed so deployments need no toolchain
# (static assets are go:embed'd into the binary).
#
# Usage: ./scripts/build_tailwind.sh [version]
set -euo pipefail

VERSION="${1:-3.4.17}"
HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
ROOT="$(dirname "${HERE}")"

echo "==> Building Tailwind CSS ${VERSION} (offline static build)"
cd "${ROOT}"
# Content sources: templates for static markup, Go sources for class strings
# assembled in handlers (e.g. status/role badges), plus the embedding main.
npx --yes "tailwindcss@${VERSION}" \
  -i ./static/css/input.css \
  -o ./static/css/app.css \
  --content "./templates/**/*.html" "./handlers/**/*.go" "./middleware/**/*.go" "./main.go"
echo "==> Done: static/css/app.css"
echo "    (commit this file; it is embedded into the binary via go:embed)"