Function dispatch_request

src/ui/http_server.c:1812–1934

}

static void dispatch_request(cbm_http_server_t *srv, cbm_http_conn_t *c,
                             const cbm_http_req_t *req) {
    if (!request_passes_http_security(srv, c, req))
        return;

    bool is_get = strcmp(req->method, "GET") == 0;
    bool is_post = strcmp(req->method, "POST") == 0;
    bool is_delete = strcmp(req->method, "DELETE") == 0;

    /* OPTIONS preflight for CORS */
    if (strcmp(req->method, "OPTIONS") == 0) {
        cbm_http_replyf(c, 204, g_cors, "%s", "");
        return;
    }

    /* Private-generation proof used only by `daemon start --open`. The
     * challenge is public; the HMAC key exists only in this daemon's
     * authenticated application and HTTP server instances. */
    if (is_get && strcmp(req->path, "/__cbm/ui-readiness") == 0) {
        handle_ui_readiness(srv, c, req);
        return;
    }

    /* POST /rpc → JSON-RPC dispatch (reuses existing MCP tools) */
    if (is_post && cbm_http_path_match(req->path, "/rpc")) {
        handle_rpc(c, req, srv->mcp);
        return;
    }

    /* GET /api/layout → 3D graph layout */
    if (is_get && cbm_http_path_match(req->path, "/api/layout*")) {
        handle_layout(c, req);
        return;
    }

    /* GET /api/repo-info → git remote / branch for GitHub deep-links */
    if (is_get && cbm_http_path_match(req->path, "/api/repo-info*")) {
        handle_repo_info(c, req);
        return;
    }

    /* POST /api/index → start background indexing */
    if (is_post && cbm_http_path_match(req->path, "/api/index")) {
        handle_index_start(srv, c, req);
        return;
    }

    /* GET /api/index-status → check indexing progress */
    if (is_get && cbm_http_path_match(req->path, "/api/index-status")) {
        handle_index_status(srv, c);
        return;
    }

    /* GET /api/ui-config → language and local UI preferences */
    if (is_get && cbm_http_path_match(req->path, "/api/ui-config")) {
        handle_ui_config(c, req);
        return;
    }