index : cgit

/*
 * The output every cgit page has in common. A link from one page to another is
 * built here, as a path below the virtual root followed by the arguments the
 * target page needs, so that every page spells its urls the same way. The
 * headers, the document head, the header block, the footer, the error page and
 * the age column are here so that a page handler is left with only its own body
 * to produce.
 */

#define USE_THE_REPOSITORY_VARIABLE

#include "cache.h"
#include "cgit.h"
#include "html.h"
#include "shared.h"
#include "submodule-config.h"
#include "ui-shared.h"
#include "ui-snapshot.h"

#define DEFAULT_HTTP_PORT 80

#define SHORT_HASH_LEN 10

// A max-msg-len below this leaves too little of a commit subject to be worth
// truncating, and the ellipsis is paid for out of that same budget.
#define MIN_TRUNCATE_LEN 15
#define ELLIPSIS_LEN 3

// Bounds the breadcrumbs, so that one request cannot turn into an unbounded
// row of links.
#define MAX_CRUMB_LEVELS 15

// cgit_fmt exits the request rather than truncate, so a path is only worked
// into a tab title while it still leaves room to spare in that buffer.
#define MAX_TITLE_PATH_LEN 256

/*
 * Write one argument of a query string after delim, and return the delimiter
 * for the next one.
 */
static const char *url_arg(const char *delim, const char *name, const char *value)
{
	html(delim);
	html(name);
	html("=");
	html_url_arg(value);
	return "&";
}

static void site_url(const char *page, const char *search, const char *sort, int ofs, int always_root)
{
	const char *delim = "?";

	if (always_root || page)
		html_attr(ctx.cfg.virtual_root);
	else {
		char *currenturl = cgit_currenturl();
		html_attr(currenturl);
		free(currenturl);
	}

	if (page) {
		htmlf("?p=%s", page);
		delim = "&";
	}
	if (search)
		delim = url_arg(delim, "q", search);
	if (sort)
		delim = url_arg(delim, "s", sort);
	if (ofs)
		htmlf("%sofs=%d", delim, ofs);
}

/*
 * Open an anchor up to the start of its href, marking the link as the current
 * one for assistive technology when the class says it is the active tab or the
 * current page of a pager.
 */
static void open_link(const char *title, const char *class)
{
	html("<a");
	if (title) {
		html(" title='");
		html_attr(title);
		html("'");
	}
	if (class) {
		html(" class='");
		html_attr(class);
		html("'");
		if (!strcmp(class, "active") || !strcmp(class, "current"))
			html(" aria-current='page'");
	}
	html(" href='");
}

static void site_link(const char *page, const char *name, const char *title,
	const char *class, const char *search, const char *sort, int ofs, int always_root)
{
	open_link(title, class);
	site_url(page, search, sort, ofs, always_root);
	html("'>");
	html_txt(name);
	html("</a>");
}

/*
 * Write the url naming the repository, the page and the path.
 */
static void write_page_url(const char *page, const char *path)
{
	html_url_path(ctx.cfg.virtual_root);
	html_url_path(ctx.repo->url);
	if (ctx.repo->url[strlen(ctx.repo->url) - 1] != '/')
		html("/");
	if (page) {
		html_url_path(page);
		html("/");
		if (path)
			html_url_path(path);
	}
}

/*
 * Whether head needs naming in a url, which the default branch does not.
 */
static int head_is_named(const char *head)
{
	return head && ctx.repo->defbranch && strcmp(head, ctx.repo->defbranch);
}

/*
 * Open an anchor and write the part of its href naming the repository, the
 * page and the path, leaving the href quote open for the caller to add its own
 * arguments and close. The return is the delimiter to put before the first of
 * those, which is still a question mark unless a query string has been opened.
 */
static const char *repolink(const char *title, const char *class, const char *page,
	const char *head, const char *path)
{
	const char *delim = "?";

	open_link(title, class);
	write_page_url(page, path);
	if (head_is_named(head))
		delim = url_arg(delim, "h", head);
	return delim;
}

static const char *emit_rev_arg(const char *delim, const char *rev)
{
	if (rev && ctx.qry.head && strcmp(rev, ctx.qry.head))
		return url_arg(delim, "id", rev);
	return delim;
}

static void reporevlink(const char *page, const char *name, const char *title,
	const char *class, const char *head, const char *rev, const char *path)
{
	const char *delim;

	delim = repolink(title, class, page, head, path);
	emit_rev_arg(delim, rev);
	html("'>");
	html_txt(name);
	html("</a>");
}

static void emit_diff_args(const char *delim)
{
	if (ctx.qry.difftype) {
		htmlf("%sdt=%d", delim, (int)ctx.qry.difftype);
		delim = "&amp;";
	}
	if (ctx.qry.context > 0 && ctx.qry.context != DEFAULT_DIFF_CONTEXT) {
		htmlf("%scontext=%d", delim, ctx.qry.context);
		delim = "&amp;";
	}
	if (ctx.qry.ignorews) {
		html(delim);
		html("ignorews=1");
		delim = "&amp;";
	}
	if (ctx.qry.follow) {
		html(delim);
		html("follow=1");
	}
}

static struct string_list_item *lookup_path(struct string_list *list, const char *path)
{
	struct string_list_item *item;

	while (path && path[0]) {
		if ((item = string_list_lookup(list, path)))
			return item;
		if (!(path = strchr(path, '/')))
			break;
		path++;
	}
	return NULL;
}

/*
 * A repository can supply the module-link template through a repo-local
 * cgitrc, so the %s placeholders are expanded here instead of the template
 * being handed to printf, where a surplus conversion would read past the
 * argument list.
 */
static void emit_module_link(const char *tmpl, const char **args, int nargs)
{
	struct strbuf sb = STRBUF_INIT;
	int used = 0;

	while (*tmpl) {
		if (*tmpl != '%') {
			strbuf_addch(&sb, *tmpl++);
			continue;
		}
		tmpl++;
		if (*tmpl == '%') {
			strbuf_addch(&sb, '%');
			tmpl++;
		} else if (*tmpl == 's' && used < nargs) {
			strbuf_addstr(&sb, args[used++]);
			tmpl++;
		} else {
			strbuf_addch(&sb, '%');
		}
	}
	html_attr(sb.buf);
	strbuf_release(&sb);
}

static struct date_mode configured_date_mode(void)
{
	struct date_mode mode = ctx.cfg.date_mode;

	if (ctx.cfg.local_time)
		mode.local = 1;
	return mode;
}

/*
 * Dates render as time elements, whose datetime attribute wants the strict
 * ISO 8601 form with the T separator rather than the space git prints by
 * default.
 */
static void print_abs_date(time_t t, int tz)
{
	html("<time datetime='");
	html_attr(show_date(t, tz, cgit_date_mode(DATE_ISO8601_STRICT)));
	html("' title='");
	html_attr(show_date(t, tz, cgit_date_mode(DATE_ISO8601)));
	html("'>");
	html_txt(show_date(t, tz, configured_date_mode()));
	html("</time>");
}

static void print_rel_date(time_t t, int tz, double count, const char *class, const char *suffix)
{
	htmlf("<time class='%s' datetime='", class);
	html_attr(show_date(t, tz, cgit_date_mode(DATE_ISO8601_STRICT)));
	htmlf("' data-ut='%" PRIu64 "' title='", (uint64_t)t);
	html_attr(show_date(t, tz, cgit_date_mode(DATE_ISO8601)));
	htmlf("'>%.0f %s</time>", count, suffix);
}

/*
 * Whether a clone url opens with a URI scheme. The scp form git@host:path
 * has none, and a link element's href must hold a URI, so that form stays
 * out of the document head.
 */
static int has_uri_scheme(const char *url)
{
	const char *p = url;

	if (!isalpha((unsigned char)*p))
		return 0;
	while (isalnum((unsigned char)*p) || *p == '+' || *p == '-' || *p == '.')
		p++;
	return *p == ':';
}

static void print_rel_vcs_link(const char *url)
{
	if (!has_uri_scheme(url))
		return;
	html("<link rel='vcs-git' href='");
	html_attr(url);
	html("' title='");
	html_attr(ctx.repo->name);
	html(" Git repository'>\n");
}

static void emit_css_link(const char *href)
{
	// An empty css entry is how a site turns the stylesheet off.
	if (!*href)
		return;

	html("<link rel='stylesheet' href='");
	html_attr(href);
	html("'>\n");
}

static void emit_js_link(const char *src)
{
	// An empty js entry is how a site turns the script off.
	if (!*src)
		return;

	html("<script src='");
	html_attr(src);
	html("' defer></script>\n");
}

static void add_clone_urls(void (*fn)(const char *), char *urls, char *suffix)
{
	struct strbuf **url_list = strbuf_split_str(urls, ' ', 0);
	int i;

	for (i = 0; url_list[i]; i++) {
		strbuf_rtrim(url_list[i]);
		if (url_list[i]->len == 0)
			continue;
		if (suffix && *suffix)
			strbuf_addf(url_list[i], "/%s", suffix);
		fn(url_list[i]->buf);
	}

	strbuf_list_free(url_list);
}

/*
 * The id parameter pins a page to one commit while the rest of the chrome
 * keeps naming the branch. Answer that commit, or null when the request
 * follows the branch or the pin lands on its tip anyway.
 */
static const struct object_id *pinned_oid(void)
{
	static struct object_id oid;
	static int resolved, pinned;
	struct object_id head_oid;
	struct commit *commit;

	// The chrome asks several times per page and the answer cannot change
	// within a request.
	if (resolved)
		return pinned ? &oid : NULL;
	resolved = 1;

	if (!ctx.repo || !ctx.qry.has_oid || !ctx.qry.oid || !ctx.qry.head)
		return NULL;
	// The chrome renders on an error page too, where the id was refused
	// before any command could look it up, so it is checked here as well.
	if (!cgit_valid_rev(ctx.qry.oid))
		return NULL;
	if (repo_get_oid(the_repository, ctx.qry.oid, &oid) ||
		repo_get_oid(the_repository, ctx.qry.head, &head_oid))
		return NULL;
	// A full hex id resolves without being looked up, so only peeling to a
	// commit proves the pin names history, and a tag pinned to the tip
	// compares equal only by its peeled commit.
	commit = lookup_commit_reference_gently(the_repository, &oid, 1);
	if (!commit)
		return NULL;
	oidcpy(&oid, &commit->object.oid);
	if (oideq(&oid, &head_oid))
		return NULL;
	pinned = 1;
	return &oid;
}

struct branch_option_data {
	int count;
	const char *selected;
};

/*
 * Whether the head the request follows is one of the branches the switcher
 * lists, remote ones included when those are shown. A head that is not, a
 * raw commit id or a tag, would otherwise leave the select resting on the
 * first branch, and submitting the form would quietly move the visitor there.
 */
static int head_is_listed_branch(void)
{
	struct ref_store *refs = get_main_ref_store(the_repository);
	struct strbuf ref = STRBUF_INIT;
	int found;

	strbuf_addf(&ref, "refs/heads/%s", ctx.qry.head);
	found = refs_ref_exists(refs, ref.buf);
	if (!found && ctx.repo->enable_remote_branches) {
		strbuf_reset(&ref);
		strbuf_addf(&ref, "refs/remotes/%s", ctx.qry.head);
		found = refs_ref_exists(refs, ref.buf);
	}
	strbuf_release(&ref);
	return found;
}

static void print_detached_head_option(void)
{
	const char *head = ctx.qry.head;
	struct object_id oid;
	struct strbuf label = STRBUF_INIT;

	// A head that is a full id reads better cut to the length the pinned
	// entry uses.
	if (strlen(head) == the_hash_algo->hexsz && !get_oid_hex(head, &oid))
		strbuf_addf(&label, "%.*s (detached)", SHORT_HASH_LEN, head);
	else
		strbuf_addf(&label, "%s (detached)", head);
	html_option(head, label.buf, head);
	strbuf_release(&label);
}

static int print_branch_option(const struct reference *ref, void *data)
{
	struct branch_option_data *opt = data;
	const char *name = ref->name;

	// The switcher runs on every page, so it is bounded like the refs list.
	if (ctx.cfg.max_ref_count > 0 && opt->count >= ctx.cfg.max_ref_count)
		return -1;
	// A name spelled like an option is refused as a head, so offering it
	// would only lead to an error page.
	if (name[0] == '-')
		return 0;
	opt->count++;
	html_option(name, name, opt->selected);
	return 0;
}

static void print_header(void)
{
	const char *logo = NULL, *logo_link = NULL;

	if (ctx.repo && ctx.repo->logo && *ctx.repo->logo)
		logo = ctx.repo->logo;
	else
		logo = ctx.cfg.logo;
	if (ctx.repo && ctx.repo->logo_link && *ctx.repo->logo_link)
		logo_link = ctx.repo->logo_link;
	else
		logo_link = ctx.cfg.logo_link;

	html("<header id='header'>\n");
	if (logo && *logo) {
		html("<a class='logo' href='");
		if (logo_link && *logo_link)
			html_attr(logo_link);
		else
			html_attr(ctx.cfg.virtual_root);
		html("'><img src='");
		html_attr(logo);
		html("' alt='cgit logo'></a>\n");
	}

	html("<h1 class='main'>");
	if (ctx.repo) {
		cgit_index_link("index", NULL, NULL, NULL, NULL, 0, 1);
		html(" : ");
		cgit_summary_link(ctx.repo->name, NULL, NULL, NULL);
	} else {
		html_txt(ctx.cfg.root_title);
	}
	html("</h1>\n");

	// A repository with no commits has no branches to list, so the
	// switcher would be an empty select next to a switch button, and an
	// error raised before the head was resolved has nothing to select.
	if (ctx.repo && ctx.env.authenticated && !ctx.empty_repo && ctx.qry.head) {
		const struct object_id *pinned = pinned_oid();
		// Only one option may carry selected, and a pinned commit
		// outranks the branch it was reached from.
		struct branch_option_data opt = {
			.selected = pinned ? NULL : ctx.qry.head,
		};
		char *oid = ctx.qry.oid, *oid2 = ctx.qry.oid2;

		html("<form class='branch-switch' method='get'>\n");
		// Switching branch means leaving the pinned commit behind, so
		// the id fields stay out of the form.
		ctx.qry.oid = ctx.qry.oid2 = NULL;
		cgit_add_hidden_formfields(0, 1, ctx.qry.page);
		ctx.qry.oid = oid;
		ctx.qry.oid2 = oid2;
		html("<select name='h' aria-label='Branch'>\n");
		if (pinned) {
			const char *hex = oid_to_hex(pinned);

			html_option(hex, cgit_fmt("%.*s (detached)", SHORT_HASH_LEN, hex), hex);
		} else if (!head_is_listed_branch()) {
			print_detached_head_option();
		}
		refs_for_each_branch_ref(get_main_ref_store(the_repository), print_branch_option, &opt);
		if (ctx.repo->enable_remote_branches)
			refs_for_each_remote_ref(get_main_ref_store(the_repository), print_branch_option, &opt);
		html("</select> ");
		html("<input type='submit' value='switch'>");
		html("</form>\n");
	}

	if (ctx.repo) {
		html("<p class='sub desc'>");
		html_txt(ctx.repo->desc);
		html("</p>\n");
		html("<p class='sub owner'>");
		html_txt(ctx.repo->owner);
		html("</p>\n");
	} else if (ctx.cfg.root_desc) {
		html("<p class='sub desc'>");
		html_txt(ctx.cfg.root_desc);
		html("</p>\n");
	}

	html("</header>\n");
}

static const char *tab_class(const char *page)
{
	if (!ctx.qry.page)
		return NULL;

	return strcmp(ctx.qry.page, page) ? NULL : "active";
}

static const char *tab_title(const char *format, const char *fallback, const char *path)
{
	if (!path || !*path || strlen(path) > MAX_TITLE_PATH_LEN)
		return fallback;
	return cgit_fmt(format, path);
}

static void print_repo_tabs(void)
{
	const char *vpath = ctx.qry.vpath;

	html("<ul>\n");
	if (ctx.repo->readme.nr) {
		html("<li>");
		reporevlink("about", "about", "About this repository", tab_class("about"), ctx.qry.head,
			NULL, NULL);
		html("</li>\n");
	}
	html("<li>");
	cgit_summary_link("summary", "Repository summary", tab_class("summary"), ctx.qry.head);
	html("</li>\n<li>");
	cgit_refs_link("refs", "Branches and tags", tab_class("refs"), ctx.qry.head, ctx.qry.oid, NULL);
	html("</li>\n<li>");
	cgit_log_link(
		"log", tab_title("Commit history of %s", "Commit history", vpath),
		tab_class("log"), ctx.qry.head, NULL, ctx.qry.vpath, 0, NULL, NULL,
		ctx.qry.showmsg, ctx.qry.follow
	);
	html("</li>\n<li>");
	if (ctx.qry.page && !strcmp(ctx.qry.page, "blame"))
		cgit_blame_link(
			"blame", tab_title("Line-by-line blame of %s", "Blame", vpath),
			tab_class("blame"), ctx.qry.head, ctx.qry.oid, ctx.qry.vpath
		);
	else
		cgit_tree_link(
			"tree", tab_title("Browse the tree at %s", "Browse the file tree", vpath),
			tab_class("tree"), ctx.qry.head, ctx.qry.oid, ctx.qry.vpath
		);
	html("</li>\n<li>");
	cgit_commit_link(
		"commit", "The current commit", tab_class("commit"),
		ctx.qry.head, ctx.qry.oid, ctx.qry.vpath
	);
	html("</li>\n<li>");
	cgit_diff_link(
		"diff", tab_title("Changes to %s", "Changes in the current commit", vpath),
		tab_class("diff"), ctx.qry.head, ctx.qry.oid, ctx.qry.oid2, ctx.qry.vpath
	);
	html("</li>\n");
	if (ctx.repo->max_stats) {
		html("<li>");
		cgit_stats_link("stats", "Commit activity", tab_class("stats"), ctx.qry.head, ctx.qry.vpath);
		html("</li>\n");
	}
	html("</ul>\n");
}

static void print_repo_search(void)
{
	html("<form class='search' role='search' method='get' action='");
	write_page_url("log", ctx.qry.vpath);
	html("'>\n");
	cgit_add_hidden_formfields(1, 0, "log");
	html("<select name='qt' aria-label='Search type'>\n");
	html_option("grep", "log msg", ctx.qry.grep);
	html_option("author", "author", ctx.qry.grep);
	html_option("committer", "committer", ctx.qry.grep);
	html_option("range", "range", ctx.qry.grep);
	html("</select>\n");
	html("<input class='txt' type='search' name='q' aria-label='Search' value='");
	html_attr(ctx.qry.search);
	html("'>\n");
	html("<input type='submit' value='search'>\n");
	html("</form>\n");
}

static void print_site_tabs(void)
{
	html("<ul>\n<li>");
	site_link(NULL, "index", "Repository index", tab_class("repolist"), NULL, NULL, 0, 1);
	html("</li>\n");
	if (ctx.cfg.root_readme) {
		html("<li>");
		site_link("about", "about", "About this site", tab_class("about"), NULL, NULL, 0, 1);
		html("</li>\n");
	}
	html("</ul>\n");
}

static void print_site_search(void)
{
	char *currenturl = cgit_currenturl();

	html("<form class='search' role='search' method='get' action='");
	html_attr(currenturl);
	html("'>\n");
	html("<input class='txt' type='search' name='q' aria-label='Search' value='");
	html_attr(ctx.qry.search);
	html("'>\n");
	html("<input type='submit' value='search'>\n");
	html("</form>\n");
	free(currenturl);
}

static void snapshot_link(const char *name, const char *title, const char *class,
	const char *head, const char *rev, const char *archivename)
{
	reporevlink("snapshot", name, title, class, head, rev, archivename);
}

/*
 * The link is built out of the request in ctx.qry, so a caller that alters a
 * field of ctx.qry first gets a link differing in exactly that.
 */
static void self_link(const char *name, const char *title, const char *class)
{
	const char *rev = ctx.qry.has_oid ? ctx.qry.oid : NULL;

	if (!strcmp(ctx.qry.page, "repolist"))
		cgit_index_link(name, title, class, ctx.qry.search, ctx.qry.sort, ctx.qry.ofs, 1);
	else if (!strcmp(ctx.qry.page, "summary"))
		cgit_summary_link(name, title, class, ctx.qry.head);
	else if (!strcmp(ctx.qry.page, "tag"))
		cgit_tag_link(name, title, class, ctx.qry.has_oid ? ctx.qry.oid : ctx.qry.head);
	else if (!strcmp(ctx.qry.page, "tree"))
		cgit_tree_link(name, title, class, ctx.qry.head, rev, ctx.qry.path);
	else if (!strcmp(ctx.qry.page, "plain"))
		cgit_plain_link(name, title, class, ctx.qry.head, rev, ctx.qry.path);
	else if (!strcmp(ctx.qry.page, "blame"))
		cgit_blame_link(name, title, class, ctx.qry.head, rev, ctx.qry.path);
	else if (!strcmp(ctx.qry.page, "log"))
		cgit_log_link(
			name, title, class, ctx.qry.head, rev, ctx.qry.path, ctx.qry.ofs, ctx.qry.grep,
			ctx.qry.search, ctx.qry.showmsg, ctx.qry.follow
		);
	else if (!strcmp(ctx.qry.page, "commit"))
		cgit_commit_link(name, title, class, ctx.qry.head, rev, ctx.qry.path);
	else if (!strcmp(ctx.qry.page, "patch"))
		cgit_patch_link(name, title, class, ctx.qry.head, rev, ctx.qry.path);
	else if (!strcmp(ctx.qry.page, "refs"))
		cgit_refs_link(name, title, class, ctx.qry.head, rev, ctx.qry.path);
	else if (!strcmp(ctx.qry.page, "snapshot"))
		snapshot_link(name, title, class, ctx.qry.head, rev, ctx.qry.path);
	else if (!strcmp(ctx.qry.page, "diff"))
		cgit_diff_link(name, title, class, ctx.qry.head, ctx.qry.oid, ctx.qry.oid2, ctx.qry.path);
	else if (!strcmp(ctx.qry.page, "stats"))
		cgit_stats_link(name, title, class, ctx.qry.head, ctx.qry.path);
	else {
		// A page name this switch does not know still gets a plain
		// repolink.
		repolink(title, class, ctx.qry.page, ctx.qry.head, ctx.qry.path);
		html("'>");
		html_txt(name);
		html("</a>");
	}
}

static void print_path_crumbs(char *path)
{
	char *old_path = ctx.qry.path;
	char *start = path, *slash, *end = path + strlen(path);
	int levels = 0;

	ctx.qry.path = NULL;
	self_link("root", NULL, NULL);
	// self_link reads the path out of ctx.qry, so terminating the buffer at
	// each slash is what makes a crumb link to the prefix it stands for.
	ctx.qry.path = start = path;
	while (start < end) {
		if (!(slash = strchr(start, '/')) || levels > MAX_CRUMB_LEVELS)
			slash = end;
		*slash = '\0';
		html_txt("/");
		self_link(start, NULL, NULL);
		if (slash < end)
			*slash = '/';
		start = slash + 1;
		++levels;
	}
	ctx.qry.path = old_path;
}

/*
 * A reverse memchr, which glibc has as memrchr but macOS and the BSDs do not.
 */
static const char *find_last_char(const char *start, const char *end, int c)
{
	while (end > start) {
		if (*--end == c)
			return end;
	}
	return NULL;
}

static void vprint_error(const char *fmt, va_list ap)
{
	va_list cp;

	html("<div class='error'>");
	va_copy(cp, ap);
	html_vtxtf(fmt, cp);
	va_end(cp);
	html("</div>\n");
}

void cgit_print_error(const char *fmt, ...)
{
	va_list ap;

	va_start(ap, fmt);
	vprint_error(fmt, ap);
	va_end(ap);
}

const char *cgit_httpscheme(void)
{
	if (ctx.env.https && !strcmp(ctx.env.https, "on"))
		return "https://";
	else
		return "http://";
}

char *cgit_hosturl(void)
{
	if (ctx.env.http_host)
		return xstrdup(ctx.env.http_host);
	if (!ctx.env.server_name)
		return NULL;
	if (!ctx.env.server_port || atoi(ctx.env.server_port) == DEFAULT_HTTP_PORT)
		return xstrdup(ctx.env.server_name);
	return cgit_fmtalloc("%s:%s", ctx.env.server_name, ctx.env.server_port);
}

char *cgit_currenturl(void)
{
	const char *root = ctx.cfg.virtual_root;

	if (!ctx.qry.url)
		return xstrdup(root);
	if (root[0] && root[strlen(root) - 1] == '/')
		return cgit_fmtalloc("%s%s", root, ctx.qry.url);
	return cgit_fmtalloc("%s/%s", root, ctx.qry.url);
}

char *cgit_currentquery(void)
{
	const char *orig_query = ctx.env.query_string ? ctx.env.query_string : "";
	size_t len = strlen(orig_query);
	char *query = xmalloc(len + 2);
	char *match;

	// The url argument carried the path into this request and every caller
	// spells the path out again, so it is dropped here. The copy keeps a
	// leading question mark so that every match has a character before it,
	// which is what tells the argument itself from the tail of another one.
	memcpy(query + 1, orig_query, len + 1);
	query[0] = '?';
	match = query;
	while ((match = strstr(match, "url="))) {
		if (match[-1] == '?' || match[-1] == '&') {
			const char *next = strchr(match, '&');
			if (next)
				memmove(match, next + 1, strlen(next));
			else
				match[0] = '\0';
		} else {
			match++;
		}
	}
	if (!query[1])
		query[0] = '\0';
	return query;
}

char *cgit_currentfullurl(void)
{
	const char *root = ctx.cfg.virtual_root;
	char *query = cgit_currentquery();
	char *ret;

	if (!ctx.qry.url)
		ret = cgit_fmtalloc("%s%s", root, query);
	else if (root[0] && root[strlen(root) - 1] == '/')
		ret = cgit_fmtalloc("%s%s%s", root, ctx.qry.url, query);
	else
		ret = cgit_fmtalloc("%s/%s%s", root, ctx.qry.url, query);
	free(query);
	return ret;
}

const char *cgit_loginurl(void)
{
	static const char *login_url;

	if (!login_url)
		login_url = cgit_fmtalloc("%s?p=login", ctx.cfg.virtual_root);
	return login_url;
}

char *cgit_repourl(const char *reponame)
{
	struct strbuf sb = STRBUF_INIT;

	strbuf_addstr(&sb, ctx.cfg.virtual_root);
	cgit_add_url_path(&sb, reponame);
	strbuf_addch(&sb, '/');
	return strbuf_detach(&sb, NULL);
}

char *cgit_fileurl(const char *reponame, const char *pagename, const char *filename,
	const char *query)
{
	struct strbuf sb = STRBUF_INIT;

	strbuf_addstr(&sb, ctx.cfg.virtual_root);
	cgit_add_url_path(&sb, reponame);
	strbuf_addf(&sb, "/%s/%s", pagename, filename ? filename : "");
	if (query)
		strbuf_addf(&sb, "?%s", query);
	return strbuf_detach(&sb, NULL);
}

char *cgit_pageurl(const char *reponame, const char *pagename, const char *query)
{
	return cgit_fileurl(reponame, pagename, NULL, query);
}

void cgit_tree_url(const char *head, struct strbuf *base, struct strbuf *query)
{
	html_capture_begin(base);
	write_page_url("tree", NULL);
	html_capture_end();
	if (!head_is_named(head))
		return;
	html_capture_begin(query);
	html("?h=");
	html_url_arg(head);
	html_capture_end();
}

const char *cgit_snapshot_prefix(const struct cgit_repo *repo)
{
	static struct strbuf name = STRBUF_INIT;
	const char *slash;

	if (repo->snapshot_prefix)
		return repo->snapshot_prefix;

	strbuf_reset(&name);
	strbuf_addstr(&name, repo->url);
	strbuf_trim_trailing_dir_sep(&name);
	strbuf_strip_suffix(&name, ".git");
	strbuf_trim_trailing_dir_sep(&name);
	slash = strrchr(name.buf, '/');
	return slash ? slash + 1 : name.buf;
}

void cgit_index_link(const char *name, const char *title, const char *class,
	const char *pattern, const char *sort, int ofs, int always_root)
{
	site_link(NULL, name, title, class, pattern, sort, ofs, always_root);
}

void cgit_summary_link(const char *name, const char *title, const char *class, const char *head)
{
	reporevlink(NULL, name, title, class, head, NULL, NULL);
}

void cgit_tag_link(const char *name, const char *title, const char *class, const char *tag)
{
	reporevlink("tag", name, title, class, tag, NULL, NULL);
}

void cgit_tree_link(const char *name, const char *title, const char *class,
	const char *head, const char *rev, const char *path)
{
	reporevlink("tree", name, title, class, head, rev, path);
}

void cgit_plain_link(const char *name, const char *title, const char *class,
	const char *head, const char *rev, const char *path)
{
	reporevlink("plain", name, title, class, head, rev, path);
}

void cgit_blame_link(const char *name, const char *title, const char *class,
	const char *head, const char *rev, const char *path)
{
	reporevlink("blame", name, title, class, head, rev, path);
}

void cgit_log_link(const char *name, const char *title, const char *class,
	const char *head, const char *rev, const char *path, int ofs, const char *grep,
	const char *pattern, int showmsg, int follow)
{
	const char *delim;

	delim = repolink(title, class, "log", head, path);
	delim = emit_rev_arg(delim, rev);
	if (grep && pattern) {
		delim = url_arg(delim, "qt", grep);
		delim = url_arg(delim, "q", pattern);
	}
	if (ofs > 0) {
		htmlf("%sofs=%d", delim, ofs);
		delim = "&amp;";
	}
	if (showmsg) {
		html(delim);
		html("showmsg=1");
		delim = "&amp;";
	}
	if (follow) {
		html(delim);
		html("follow=1");
	}
	html("'>");
	html_txt(name);
	html("</a>");
}

void cgit_commit_link(const char *name, const char *title, const char *class,
	const char *head, const char *rev, const char *path)
{
	const char *delim;

	delim = repolink(title, class, "commit", head, path);
	delim = emit_rev_arg(delim, rev);
	emit_diff_args(delim);
	html("'>");
	if (name && name[0] != '\0') {
		if (ctx.cfg.max_msg_len >= MIN_TRUNCATE_LEN && strlen(name) > (size_t)ctx.cfg.max_msg_len) {
			html_ntxt(name, ctx.cfg.max_msg_len - ELLIPSIS_LEN);
			html("...");
		} else {
			html_txt(name);
		}
	} else {
		html_txt("(no commit message)");
	}
	html("</a>");
}

void cgit_refs_link(const char *name, const char *title, const char *class,
	const char *head, const char *rev, const char *path)
{
	reporevlink("refs", name, title, class, head, rev, path);
}

void cgit_diff_link(const char *name, const char *title, const char *class,
	const char *head, const char *new_rev, const char *old_rev, const char *path)
{
	const char *delim;

	delim = repolink(title, class, "diff", head, path);
	delim = emit_rev_arg(delim, new_rev);
	if (old_rev)
		delim = url_arg(delim, "id2", old_rev);
	emit_diff_args(delim);
	html("'>");
	html_txt(name);
	html("</a>");
}

void cgit_patch_link(const char *name, const char *title, const char *class,
	const char *head, const char *rev, const char *path)
{
	reporevlink("patch", name, title, class, head, rev, path);
}

void cgit_stats_link(const char *name, const char *title, const char *class,
	const char *head, const char *path)
{
	reporevlink("stats", name, title, class, head, NULL, path);
}

void cgit_object_link(struct object *obj, int full)
{
	const char *page;
	char *fullrev, *name;

	fullrev = oid_to_hex(&obj->oid);
	if (full)
		name = cgit_fmt("%s %s", type_name(obj->type), fullrev);
	else
		name = cgit_fmt("%s %.*s...", type_name(obj->type), SHORT_HASH_LEN, fullrev);
	if (obj->type == OBJ_COMMIT) {
		cgit_commit_link(name, NULL, NULL, ctx.qry.head, fullrev, NULL);
		return;
	} else if (obj->type == OBJ_TREE)
		page = "tree";
	else if (obj->type == OBJ_TAG)
		page = "tag";
	else
		page = "blob";
	reporevlink(page, name, NULL, NULL, ctx.qry.head, fullrev, NULL);
}

/*
 * The tree being listed decides which .gitmodules applies, so the revision
 * the query names is resolved once and reused for every row.
 */
static const struct object_id *page_treeish(void)
{
	static struct object_id oid;
	static int state;

	if (!state) {
		const char *rev = ctx.qry.oid ? ctx.qry.oid : ctx.qry.head;

		state = rev && !repo_get_oid(the_repository, rev, &oid) ? 1 : -1;
	}
	return state > 0 ? &oid : NULL;
}

static void strip_git_suffix(struct strbuf *sb)
{
	while (sb->len && sb->buf[sb->len - 1] == '/')
		strbuf_setlen(sb, sb->len - 1);
	strbuf_strip_suffix(sb, ".git");
}

/*
 * Reduces a submodule url to the path it names on its host, so the tail can
 * be compared against the urls this instance serves. A relative url points
 * at a sibling of the repository's own clone, which maps onto a sibling of
 * its cgit url.
 */
static char *submodule_url_path(const char *url)
{
	struct strbuf sb = STRBUF_INIT;
	const char *rest, *colon;

	if (starts_with(url, "./") || starts_with(url, "../")) {
		strbuf_addf(&sb, "%s/%s", ctx.repo->url, url);
		if (strbuf_normalize_path(&sb)) {
			strbuf_release(&sb);
			return NULL;
		}
	} else if (
		skip_prefix(url, "http://", &rest)  ||
		skip_prefix(url, "https://", &rest) ||
		skip_prefix(url, "git://", &rest)   ||
		skip_prefix(url, "ssh://", &rest)
	) {
		rest = strchr(rest, '/');
		if (!rest)
			return NULL;
		strbuf_addstr(&sb, rest);
	} else if (skip_prefix(url, "file://", &rest)) {
		strbuf_addstr(&sb, rest);
	} else if ((colon = strchr(url, ':')) && !memchr(url, '/', colon - url)) {
		// scp syntax, user@host:path
		strbuf_addstr(&sb, colon + 1);
	} else {
		strbuf_addstr(&sb, url);
	}

	strip_git_suffix(&sb);
	while (sb.len && sb.buf[0] == '/')
		strbuf_remove(&sb, 0, 1);
	if (!sb.len) {
		strbuf_release(&sb);
		return NULL;
	}
	return strbuf_detach(&sb, NULL);
}

/*
 * Finds the served repository whose url matches the most trailing components
 * of the submodule url, whatever scheme carried it.
 */
static struct cgit_repo *repo_serving_url(const char *url)
{
	struct cgit_repo *repo, *best = NULL;
	char *path = submodule_url_path(url);
	size_t plen, rlen, blen = 0;
	int i;

	if (!path)
		return NULL;
	plen = strlen(path);
	for (i = 0; i < cgit_repolist.count; i++) {
		repo = &cgit_repolist.repos[i];
		if (repo->ignore)
			continue;
		rlen = strlen(repo->url);
		if (!rlen || rlen > plen)
			continue;
		if (strcmp(path + plen - rlen, repo->url))
			continue;
		// Only whole trailing components count, so x/foo cannot
		// claim a repository named oo.
		if (rlen < plen && path[plen - rlen - 1] != '/')
			continue;
		if (rlen > blen) {
			best = repo;
			blen = rlen;
		}
	}
	free(path);
	return best;
}

// Hosts whose repository and commit pages follow a known form, so an ssh url
// can still be offered as a browser link. kernel.org runs cgit, which keeps
// the .git suffix in its own page urls.
static const struct forge {
	const char *host;
	const char *commit_seg;
	int keep_dot_git;
} forges[] = {
	{ "github.com", "/commit/", 0 },
	{ "gitlab.com", "/-/commit/", 0 },
	{ "bitbucket.org", "/commits/", 0 },
	{ "codeberg.org", "/commit/", 0 },
	{ "gitea.com", "/commit/", 0 },
	{ "git.sr.ht", "/commit/", 0 },
	{ "git.kernel.org", "/commit/?id=", 1 },
};

static const struct forge *forge_for_host(const char *host, size_t len)
{
	size_t i;

	for (i = 0; i < ARRAY_SIZE(forges); i++)
		if (strlen(forges[i].host) == len && !strncasecmp(forges[i].host, host, len))
			return &forges[i];
	return NULL;
}

/*
 * Derives a submodule row's links from its .gitmodules entry. The url is
 * matched against this instance's own repositories first, so ssh, file and
 * relative urls still land on an internal page when their target is served
 * here, and a scheme cgit cannot vouch for is left unlinked as a tooltip.
 */
static void gitmodules_link(const char *path, const char *rev, char **module,
	char **commit, const char **tooltip)
{
	const struct object_id *treeish = page_treeish();
	const struct submodule *sub;
	const struct forge *forge;
	struct cgit_repo *target;
	struct strbuf sb = STRBUF_INIT;
	const char *url, *rest, *colon;

	if (!treeish)
		return;
	sub = submodule_from_path(the_repository, treeish, path);
	if (!sub || !sub->url)
		return;
	url = sub->url;

	target = repo_serving_url(url);
	if (target) {
		char *query = cgit_fmtalloc("id=%s", rev);

		*module = cgit_pageurl(target->url, "tree", query);
		*commit = cgit_pageurl(target->url, "commit", query);
		free(query);
		return;
	}

	if (skip_prefix(url, "http://", &rest) || skip_prefix(url, "https://", &rest)) {
		*module = xstrdup(url);
		forge = forge_for_host(rest, strcspn(rest, "/"));
		if (forge) {
			strbuf_addstr(&sb, url);
			while (sb.len && sb.buf[sb.len - 1] == '/')
				strbuf_setlen(&sb, sb.len - 1);
			if (!forge->keep_dot_git)
				strbuf_strip_suffix(&sb, ".git");
			strbuf_addstr(&sb, forge->commit_seg);
			strbuf_addstr(&sb, rev);
			*commit = strbuf_detach(&sb, NULL);
		}
		return;
	}

	if ((colon = strchr(url, ':')) && !memchr(url, '/', colon - url)) {
		const char *host = url;
		const char *at = memchr(url, '@', colon - url);

		if (at)
			host = at + 1;
		forge = forge_for_host(host, colon - host);
		if (forge) {
			rest = colon + 1;
			while (*rest == '/')
				rest++;
			strbuf_addf(&sb, "https://%.*s/%s", (int)(colon - host), host, rest);
			while (sb.len && sb.buf[sb.len - 1] == '/')
				strbuf_setlen(&sb, sb.len - 1);
			if (!forge->keep_dot_git)
				strbuf_strip_suffix(&sb, ".git");
			*module = xstrdup(sb.buf);
			strbuf_addstr(&sb, forge->commit_seg);
			strbuf_addstr(&sb, rev);
			*commit = strbuf_detach(&sb, NULL);
			return;
		}
	}

	*tooltip = url;
}

void cgit_submodule_link(const char *class, char *path, const char *rev)
{
	struct string_list *list;
	struct string_list_item *item;
	char tail, *module = NULL, *commit = NULL;
	const char *name, *tooltip = NULL;
	size_t len;

	len = 0;
	tail = 0;
	list = &ctx.repo->submodules;
	item = lookup_path(list, path);
	if (!item) {
		len = strlen(path);
		tail = path[len - 1];
		if (tail == '/') {
			path[len - 1] = 0;
			item = lookup_path(list, path);
		}
	}

	if (!item && !ctx.repo->module_link && ctx.repo->enable_gitmodules_links)
		gitmodules_link(path, rev, &module, &commit, &tooltip);

	// The row shows the entry's own name, like every other row, while
	// the lookups above want the full path.
	name = strrchr(path, '/');
	name = name ? name + 1 : path;

	if (item || ctx.repo->module_link || module) {
		open_link(NULL, class);
		if (item) {
			const char *args[] = { rev };
			emit_module_link(item->util, args, 1);
		} else if (ctx.repo->module_link) {
			const char *args[] = { name, rev };
			emit_module_link(ctx.repo->module_link, args, 2);
		} else {
			html_attr(module);
		}
		html("'>");
		html_txt(name);
		html("</a>");
	} else {
		html("<span");
		if (class) {
			html(" class='");
			html_attr(class);
			html("'");
		}
		if (tooltip) {
			html(" title='");
			html_attr(tooltip);
			html("'");
		}
		html(">");
		html_txt(name);
		html("</span>");
	}
	html(" @ ");
	if (commit) {
		html("<a class='ls-mod-hash' href='");
		html_attr(commit);
		html("' title='");
	} else {
		html("<span class='ls-mod-hash' title='");
	}
	html_attr(rev);
	html("'>");
	html_txtf("%.7s", rev);
	html(commit ? "</a>" : "</span>");
	free(module);
	free(commit);
	if (tail == '/')
		path[len - 1] = tail;
}

struct date_mode cgit_date_mode(enum date_mode_type type)
{
	static struct date_mode mode;

	mode.type = type;
	mode.local = ctx.cfg.local_time;
	return mode;
}

void cgit_print_age(time_t t, int tz, time_t max_relative)
{
	time_t now, secs;

	if (!t)
		return;
	time(&now);
	// A date past now, or one so far off that the difference cannot be
	// held, reads as no age at all.
	secs = t > now ? 0 : now - t;

	if (!ctx.cfg.enable_relative_dates || (secs > max_relative && max_relative >= 0)) {
		print_abs_date(t, tz);
		return;
	}

	if (secs < SECONDS_PER_HOUR * 2) {
		print_rel_date(t, tz, secs * 1.0 / SECONDS_PER_MINUTE, "age-mins", "min.");
		return;
	}
	if (secs < SECONDS_PER_DAY * 2) {
		print_rel_date(t, tz, secs * 1.0 / SECONDS_PER_HOUR, "age-hours", "hours");
		return;
	}
	if (secs < SECONDS_PER_WEEK * 2) {
		print_rel_date(t, tz, secs * 1.0 / SECONDS_PER_DAY, "age-days", "days");
		return;
	}
	if (secs < SECONDS_PER_MONTH * 2) {
		print_rel_date(t, tz, secs * 1.0 / SECONDS_PER_WEEK, "age-weeks", "weeks");
		return;
	}
	if (secs < SECONDS_PER_YEAR * 2) {
		print_rel_date(t, tz, secs * 1.0 / SECONDS_PER_MONTH, "age-months", "months");
		return;
	}
	print_rel_date(t, tz, secs * 1.0 / SECONDS_PER_YEAR, "age-years", "years");
}

/*
 * Whether a content type carries text a charset applies to, which is every
 * text type and the XML types of RFC 7303, the atom feed among them.
 */
static int type_has_charset(const char *mimetype)
{
	return starts_with(mimetype, "text/") ||
		!strcmp(mimetype, "application/xml") ||
		ends_with(mimetype, "+xml");
}

void cgit_print_http_headers(void)
{
	ctx.page.headers_sent = 1;
	if (ctx.env.no_http && !strcmp(ctx.env.no_http, "1"))
		return;

	// CGI treats a missing Status as 200, but writing it keeps every
	// response's header block the same shape.
	if (ctx.page.status)
		htmlf("Status: %d %s\n", ctx.page.status, ctx.page.statusmsg);
	else
		html("Status: 200 OK\n");
	// A charset only means something for text, so an archive or a pack
	// is sent without one.
	if (ctx.page.mimetype && ctx.page.charset && type_has_charset(ctx.page.mimetype))
		htmlf("Content-Type: %s; charset=%s\n", ctx.page.mimetype, ctx.page.charset);
	else if (ctx.page.mimetype)
		htmlf("Content-Type: %s\n", ctx.page.mimetype);
	if (ctx.page.size)
		htmlf("Content-Length: %zu\n", ctx.page.size);
	if (ctx.page.filename) {
		html("Content-Disposition: inline; filename=\"");
		html_header_arg_in_quotes(ctx.page.filename);
		html("\"\n");
	}
	// An untrusted page serves repository bytes verbatim, so the browser is
	// told not to guess a type of its own from them and not to load
	// anything they reference.
	if (ctx.page.untrusted) {
		html("X-Content-Type-Options: nosniff\n");
		html("Content-Security-Policy: default-src 'none'\n");
	}
	// A page behind an auth filter is for the visitor who was let in, so a
	// cache shared with other visitors must not keep it, and it varies on
	// the cookie that got them in.
	if (!ctx.env.authenticated)
		html("Cache-Control: no-cache, no-store\n");
	else if (ctx.cfg.auth_filter)
		html("Cache-Control: private\nVary: Cookie\n");
	html("\n");
	// Some pages follow the headers with output written by git itself, not
	// through html_raw, so the buffer is emptied to keep the headers first.
	html_flush();
	if (ctx.env.request_method && !strcmp(ctx.env.request_method, "HEAD"))
		exit(0);
}

void cgit_redirect(const char *url, const char *query, bool permanent)
{
	htmlf("Status: %d %s\n", permanent ? 301 : 302, permanent ? "Moved Permanently" : "Found");
	html("Location: ");
	html_header_query(url);
	if (query)
		html_header_query(query);
	html("\n\n");
}

void cgit_print_docstart(void)
{
	const struct object_id *pinned;
	struct string_list_item *item;
	char *host;

	if (ctx.cfg.embedded) {
		if (ctx.cfg.header)
			html_include(ctx.cfg.header);
		return;
	}

	html("<!DOCTYPE html>\n");
	html("<html lang='en' class='cgit-standalone'>\n");
	html("<head>\n");
	html("<meta charset='UTF-8'>\n");
	html("<meta name='viewport' content='width=device-width, initial-scale=1'>\n");
	html("<meta name='color-scheme' content='light dark'>\n");
	html("<meta name='theme-color' media='(prefers-color-scheme: light)' content='#ffffff'>\n");
	html("<meta name='theme-color' media='(prefers-color-scheme: dark)' content='#1b1b1b'>\n");
	html("<title>");
	// An error page reached before a title was chosen still has to name
	// itself, since an empty title element is not valid.
	html_txt(ctx.page.title ? ctx.page.title : ctx.cfg.root_title);
	// The auth page goes out before the repository is opened, when
	// pinned_oid cannot resolve anything yet.
	if (ctx.env.authenticated && (pinned = pinned_oid()))
		html_txtf(" @ %.*s", SHORT_HASH_LEN, oid_to_hex(pinned));
	html("</title>\n");
	// The placeholder a scanned repository carries instead of a description
	// is left out, since it describes nothing.
	if (ctx.repo && ctx.repo->desc && *ctx.repo->desc && ctx.repo->desc != cgit_default_repo_desc) {
		html("<meta name='description' content='");
		html_attr(ctx.repo->desc);
		html("'>\n");
	} else if (!ctx.repo && ctx.cfg.root_desc && *ctx.cfg.root_desc) {
		html("<meta name='description' content='");
		html_attr(ctx.cfg.root_desc);
		html("'>\n");
	}
	if (ctx.cfg.enable_version_info)
		htmlf("<meta name='generator' content='cgit %s'>\n", cgit_version);
	else
		html("<meta name='generator' content='cgit'>\n");
	if (ctx.cfg.robots && *ctx.cfg.robots) {
		html("<meta name='robots' content='");
		html_attr(ctx.cfg.robots);
		html("'>\n");
	}

	if (ctx.cfg.css.nr)
		for_each_string_list_item(item, &ctx.cfg.css)
			emit_css_link(item->string);
	else
		emit_css_link("/cgit.css");

	if (ctx.cfg.js.nr)
		for_each_string_list_item(item, &ctx.cfg.js)
			emit_js_link(item->string);
	else
		emit_js_link("/cgit.js");

	if (ctx.cfg.favicon && *ctx.cfg.favicon) {
		html("<link rel='icon' href='");
		html_attr(ctx.cfg.favicon);
		html("'>\n");
	}
	if (ctx.repo && ctx.qry.head && (host = cgit_hosturl())) {
		html("<link rel='alternate' title='Atom feed' href='");
		html(cgit_httpscheme());
		html_attr(host);
		write_page_url("atom", ctx.qry.vpath);
		html("?h=");
		html_url_arg(ctx.qry.head);
		html("' type='application/atom+xml'>\n");
		free(host);
	}
	if (ctx.repo)
		cgit_add_clone_urls(print_rel_vcs_link);
	if (ctx.cfg.head_include)
		html_include(ctx.cfg.head_include);
	if (ctx.repo && ctx.repo->head_content)
		html(ctx.repo->head_content);
	html("</head>\n");
	html("<body>\n");
	if (ctx.cfg.header)
		html_include(ctx.cfg.header);
}

void cgit_print_docend(void)
{
	html("</main>\n");
	if (ctx.cfg.embedded) {
		html("</div>\n");
		if (ctx.cfg.footer)
			html_include(ctx.cfg.footer);
		return;
	}
	if (ctx.cfg.footer)
		html_include(ctx.cfg.footer);
	else if (ctx.cfg.enable_version_info)
		htmlf("<footer class='footer'>generated by "
			"<a href='https://github.com/brycekwon/cgit'>cgit %s</a> "
			"(<a href='https://git-scm.com/'>git %s</a>)</footer>\n",
			cgit_version, git_version_string);
	else
		html("<footer class='footer'>generated by <a href='https://github.com/brycekwon/cgit'>cgit</a></footer>\n");
	html("</div>\n");
	html("</body>\n</html>\n");
}

void cgit_print_error_page(int code, const char *msg, const char *fmt, ...)
{
	va_list ap;

	va_start(ap, fmt);
	cgit_vprint_error_page(code, msg, fmt, ap);
	va_end(ap);
}

void cgit_vprint_error_page(int code, const char *msg, const char *fmt, va_list ap)
{
	// An error page describes a condition that may not outlast the slot
	// holding it. A request naming a commit not yet pushed would cache its
	// 404 under the never-expiring static ttl and keep serving it after
	// the push, so the error is rendered straight to the visitor instead.
	html_flush();
	cache_abandon_fill();
	// Once the status line is out the error can only join the body under
	// way, and the page that hit it carries on to its own end.
	if (ctx.page.headers_sent) {
		vprint_error(fmt, ap);
		return;
	}
	ctx.page.status = code;
	ctx.page.statusmsg = msg;
	// A page that had already chosen another type, such as an image
	// served through the about page, still answers its error as html.
	ctx.page.mimetype = "text/html";
	ctx.page.charset = PAGE_ENCODING;
	ctx.page.filename = NULL;
	cgit_print_layout_start();
	vprint_error(fmt, ap);
	cgit_print_layout_end();
}

void cgit_print_blob_too_large(size_t size)
{
	cgit_print_error_page(413, "Content Too Large", "Blob size (%zu KB) exceeds the limit (%d KB)",
		size / 1024, ctx.cfg.max_blob_size);
}

void cgit_print_layout_start(void)
{
	cgit_print_http_headers();
	cgit_print_docstart();
	cgit_print_pageheader();
}

void cgit_print_layout_end(void)
{
	cgit_print_docend();
}

void cgit_add_clone_urls(void (*fn)(const char *))
{
	if (ctx.repo->clone_url)
		add_clone_urls(fn, cgit_expand_macros(ctx.repo->clone_url), NULL);
	else if (ctx.cfg.clone_prefix)
		add_clone_urls(fn, ctx.cfg.clone_prefix, ctx.repo->url);
}

static char *http_clone_url;
static int http_clone_url_scanned;

/*
 * Scheme names compare case-insensitively.
 */
static int is_http_url(const char *url)
{
	return istarts_with(url, "http://") || istarts_with(url, "https://");
}

static void capture_http_clone_url(const char *url)
{
	if (!http_clone_url && is_http_url(url))
		http_clone_url = xstrdup(url);
}

/*
 * One row of the clone table. Every row is a link, but a browser cannot
 * follow the ssh, scp or git forms, so those rows point at the first http
 * url in the clone list, or at the repository's own page when the list has
 * none. A colspan of zero leaves the attribute out.
 */
void cgit_print_clone_row(const char *url, int colspan)
{
	const char *href = url;
	char *fallback = NULL;

	if (!is_http_url(url)) {
		if (!http_clone_url_scanned) {
			http_clone_url_scanned = 1;
			cgit_add_clone_urls(capture_http_clone_url);
		}
		href = http_clone_url;
		if (!href)
			href = fallback = cgit_repourl(ctx.repo->url);
	}

	if (colspan)
		htmlf("<tr><td colspan='%d' class='clone-url'>", colspan);
	else
		html("<tr><td class='clone-url'>");
	html("<a rel='vcs-git' title='");
	html_attr(ctx.repo->name);
	html(" Git repository' href='");
	html_attr(href);
	html("'>");
	html_txt(url);
	html("</a></td></tr>\n");
	free(fallback);
}

void cgit_add_hidden_formfields(int incl_head, int incl_search, const char *page UNUSED)
{
	if (incl_head && ctx.qry.head && ctx.repo->defbranch && strcmp(ctx.qry.head, ctx.repo->defbranch))
		html_hidden("h", ctx.qry.head);

	if (ctx.qry.oid)
		html_hidden("id", ctx.qry.oid);
	if (ctx.qry.oid2)
		html_hidden("id2", ctx.qry.oid2);
	if (ctx.qry.showmsg)
		html_hidden("showmsg", "1");

	if (incl_search) {
		if (ctx.qry.grep)
			html_hidden("qt", ctx.qry.grep);
		if (ctx.qry.search)
			html_hidden("q", ctx.qry.search);
	}
}

void cgit_print_pageheader(void)
{
	const struct object_id *pinned;

	// The root names the page and the repository so a stylesheet or script
	// can tell them apart without reading the tabs.
	html("<div id='cgit'");
	if (ctx.cfg.embedded)
		html(" class='cgit-embedded'");
	if (ctx.qry.page) {
		html(" data-page='");
		html_attr(ctx.qry.page);
		html("'");
	}
	if (ctx.repo) {
		html(" data-repo='");
		html_attr(ctx.repo->url);
		html("'");
	}
	html(">\n");
	if (!ctx.env.authenticated || ctx.cfg.enable_header)
		print_header();

	if (ctx.env.authenticated)
		html("<nav class='tabs' aria-label='Pages'>\n");
	if (ctx.env.authenticated && ctx.repo && ctx.empty_repo) {
		// Every other tab needs a commit to render and the search form
		// has nothing to search, so an empty repo gets summary alone.
		html("<ul>\n<li>");
		cgit_summary_link("summary", "Repository summary", tab_class("summary"), ctx.qry.head);
		html("</li>\n</ul>\n");
	} else if (ctx.env.authenticated && ctx.repo) {
		print_repo_tabs();
		print_repo_search();
	} else if (ctx.env.authenticated) {
		print_site_tabs();
		print_site_search();
	}
	if (ctx.env.authenticated)
		html("</nav>\n");
	pinned = ctx.env.authenticated && ctx.repo ? pinned_oid() : NULL;
	// The commit and diff pages name the commit they show as their own
	// content, so the rev crumb would only repeat them.
	if (pinned && ctx.qry.page && (!strcmp(ctx.qry.page, "commit") || !strcmp(ctx.qry.page, "diff")))
		pinned = NULL;
	if ((ctx.env.authenticated && ctx.repo && ctx.qry.vpath) || pinned) {
		html("<nav class='path' aria-label='");
		html(ctx.qry.vpath ? "breadcrumb" : "revision");
		html("'>");
		if (ctx.qry.vpath) {
			// The nav lays out as a flex row, which would make
			// every crumb its own item and swallow the spaces
			// between them, so the run stays inline in a span.
			html("<span>path: ");
			print_path_crumbs(ctx.qry.vpath);
			if (ctx.repo->enable_follow_links && !strcmp(ctx.qry.page, "log")) {
				html(" (");
				ctx.qry.follow = !ctx.qry.follow;
				self_link(ctx.qry.follow ? "follow" : "unfollow", NULL, NULL);
				ctx.qry.follow = !ctx.qry.follow;
				html(")");
			}
			html("</span>");
		}
		if (pinned) {
			const char *hex = oid_to_hex(pinned);
			char *oid = ctx.qry.oid;

			html("<span class='rev'>rev: ");
			cgit_commit_link(cgit_fmt("%.*s", SHORT_HASH_LEN, hex),
				NULL, NULL, ctx.qry.head, hex, ctx.qry.vpath);
			html(" (");
			// self_link reads the pin out of ctx.qry, so lifting
			// it is what makes the link land back on the tip of
			// the branch.
			ctx.qry.oid = NULL;
			ctx.qry.has_oid = 0;
			self_link("latest", NULL, NULL);
			ctx.qry.oid = oid;
			ctx.qry.has_oid = 1;
			html(")</span>");
		}
		html("</nav>\n");
	}
	html("<main class='content'>\n");
}

void cgit_print_filemode(unsigned short mode)
{
	if (S_ISDIR(mode))
		html("d");
	else if (S_ISLNK(mode))
		html("l");
	else if (S_ISGITLINK(mode))
		html("m");
	else
		html("-");
	html_fileperm(mode >> 6);
	html_fileperm(mode >> 3);
	html_fileperm(mode);
}

// The tag names and their stems, a stem being the name with any leading v or V
// removed, gathered once per request. Claims on a stem are counted over the
// tag list itself rather than by looking refs up by name, because a loose ref
// lookup on a case-insensitive filesystem finds v1.2 when asked for V1.2 and
// would call every tag still stored loose ambiguous.
static struct string_list tag_names = STRING_LIST_INIT_DUP;
static struct string_list tag_stems = STRING_LIST_INIT_DUP;
static int tags_collected;

static int collect_tag(const struct reference *ref, void *data UNUSED)
{
	const char *name = ref->name;

	string_list_append(&tag_names, name);
	if (name[0] == 'v' || name[0] == 'V')
		name++;
	string_list_append(&tag_stems, name);
	return 0;
}

/*
 * Whether ref is a tag whose stem no other tag shares.
 */
static int stem_is_unique(const char *ref)
{
	struct string_list_item *stem;
	size_t i;

	if (!tags_collected) {
		tags_collected = 1;
		refs_for_each_tag_ref(get_main_ref_store(the_repository), collect_tag, NULL);
		string_list_sort(&tag_names);
		string_list_sort(&tag_stems);
	}
	if (!string_list_has_string(&tag_names, ref))
		return 0;
	stem = string_list_lookup(&tag_stems, ref + 1);
	if (!stem)
		return 0;
	// The lookup lands on any one of equal entries, so both neighbours
	// are checked.
	i = stem - tag_stems.items;
	return (i == 0 || strcmp(tag_stems.items[i - 1].string, stem->string)) &&
		(i + 1 == tag_stems.nr || strcmp(tag_stems.items[i + 1].string, stem->string));
}

static void compose_snapshot_prefix(struct strbuf *filename, const char *base, const char *ref)
{
	// A tag named v1.2 or V1.2 gives its snapshot the prettier name 1.2,
	// but only where dropping the letter cannot land two different tags on
	// one name, so that a snapshot can still be traced back to the tag it
	// was made from.
	if ((ref[0] == 'v' || ref[0] == 'V') && isdigit((unsigned char)ref[1]) && stem_is_unique(ref))
		ref++;

	strbuf_addf(filename, "%s-%s", base, ref);
}

void cgit_print_snapshot_links(const struct cgit_repo *repo, const char *ref, const char *separator)
{
	const struct cgit_snapshot_format *f;
	struct strbuf filename = STRBUF_INIT;
	const char *basename;
	size_t prefixlen;

	basename = cgit_snapshot_prefix(repo);
	if (starts_with(ref, basename))
		strbuf_addstr(&filename, ref);
	else
		compose_snapshot_prefix(&filename, basename, ref);

	prefixlen = filename.len;
	for (f = cgit_snapshot_formats; f->suffix; f++) {
		if (!(repo->snapshots & cgit_snapshot_format_bit(f)))
			continue;
		strbuf_setlen(&filename, prefixlen);
		strbuf_addstr(&filename, f->suffix);
		// A file and its signature are one unit, which the stylesheet
		// keeps from breaking across lines.
		html("<span class='snapshot'>");
		snapshot_link(filename.buf, NULL, NULL, NULL, NULL, filename.buf);
		if (cgit_snapshot_get_sig(ref, f)) {
			strbuf_addstr(&filename, ".asc");
			html(" (");
			snapshot_link("sig", NULL, NULL, NULL, NULL, filename.buf);
			html(")");
		} else if (
			starts_with(f->suffix, ".tar") &&
			cgit_snapshot_get_sig(ref, &cgit_snapshot_formats[0])
		) {
			// A compressed tarball offers the signature made for
			// the plain tar it expands to, which is the first
			// format in the table.
			strbuf_setlen(&filename, filename.len - strlen(f->suffix));
			strbuf_addstr(&filename, ".tar.asc");
			html(" (");
			snapshot_link("sig", NULL, NULL, NULL, NULL, filename.buf);
			html(")");
		}
		html("</span>");
		html(separator);
	}
	strbuf_release(&filename);
}

void cgit_set_title_from_path(const char *path)
{
	struct strbuf sb = STRBUF_INIT;
	const char *slash, *last_slash;

	if (!path)
		return;

	// The path is read from the end so that the title names the file first
	// and the directories it sits in after it.
	last_slash = path + strlen(path);
	while ((slash = find_last_char(path, last_slash, '/'))) {
		strbuf_add(&sb, slash + 1, last_slash - slash - 1);
		strbuf_addstr(&sb, " < ");
		last_slash = slash;
	}
	strbuf_add(&sb, path, last_slash - path);
	strbuf_addf(&sb, " - %s", ctx.page.title);
	ctx.page.title = strbuf_detach(&sb, NULL);
}

/*
 * Names the page ahead of the repository and the site, so that the pages of one
 * repository can be told apart in tabs, history and search results.
 */
void cgit_prefix_title(const char *name)
{
	ctx.page.title = cgit_fmtalloc("%s - %s", name,
		ctx.page.title ? ctx.page.title : ctx.cfg.root_title);
}