From 6e7df4ca7924871709af195eba621770c5412a7a Mon Sep 17 00:00:00 2001
From: jordi fita mas <jordi@tandem.blog>
Date: Wed, 18 Oct 2023 20:58:52 +0200
Subject: [PATCH] =?UTF-8?q?Do=20not=20accept=20=E2=80=9Csubdirectories?=
 =?UTF-8?q?=E2=80=9D=20for=20public=20campsite=20types=20URL?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

For now, it ends with the UUID or 404.
---
 pkg/campsite/types/public.go | 38 ++++++++++++++++++++++--------------
 1 file changed, 23 insertions(+), 15 deletions(-)

diff --git a/pkg/campsite/types/public.go b/pkg/campsite/types/public.go
index 92c5ccd..0017f87 100644
--- a/pkg/campsite/types/public.go
+++ b/pkg/campsite/types/public.go
@@ -28,25 +28,33 @@ type PublicHandler struct {
 
 func (h *PublicHandler) Handler(user *auth.User, company *auth.Company, conn *database.Conn) http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		var typeUuid string
+		typeUuid, r.URL.Path = httplib.ShiftPath(r.URL.Path)
+
+		if !uuid.Valid(typeUuid) {
+			http.NotFound(w, r)
+			return
+		}
+
 		var head string
 		head, r.URL.Path = httplib.ShiftPath(r.URL.Path)
-
-		switch r.Method {
-		case http.MethodGet:
-			if !uuid.Valid(head) {
-				http.NotFound(w, r)
-				return
+		switch head {
+		case "":
+			switch r.Method {
+			case http.MethodGet:
+				page, err := newPublicPage(r.Context(), company, conn, user.Locale, typeUuid)
+				if database.ErrorIsNotFound(err) {
+					http.NotFound(w, r)
+					return
+				} else if err != nil {
+					panic(err)
+				}
+				page.MustRender(w, r, user, company, conn)
+			default:
+				httplib.MethodNotAllowed(w, r, http.MethodGet)
 			}
-			page, err := newPublicPage(r.Context(), company, conn, user.Locale, head)
-			if database.ErrorIsNotFound(err) {
-				http.NotFound(w, r)
-				return
-			} else if err != nil {
-				panic(err)
-			}
-			page.MustRender(w, r, user, company, conn)
 		default:
-			httplib.MethodNotAllowed(w, r, http.MethodGet)
+			http.NotFound(w, r)
 		}
 	})
 }