Function dispatch_request

src/ui/http_server.c:1634–1762

}

static void dispatch_request(cbm_http_server_t *srv, cbm_http_conn_t *c,
                             const cbm_http_req_t *req) {
    /* Build per-request CORS headers (only reflects localhost origins) */
    update_cors(req);

    /* DNS-rebinding / cross-site guard: the server binds to loopback only, so a
     * request carrying any non-loopback Host was routed here under a foreign
     * name (a rebinding DNS record, a proxy) and must be refused before it can
     * reach a state-changing endpoint. A bare request with no Host header
     * (HTTP/1.0 local tooling) is still allowed. */
    if (req->host[0] != '\0' && !host_is_loopback(req->host)) {
        cbm_http_replyf(c, 403, g_cors, "%s", "{\"error\":\"forbidden host\"}");
        return;
    }

    bool is_get = strcmp(req->method, "GET") == 0;
    bool is_post = strcmp(req->method, "POST") == 0;
    bool is_delete = strcmp(req->method, "DELETE") == 0;

    /* OPTIONS preflight for CORS */
    if (strcmp(req->method, "OPTIONS") == 0) {
        cbm_http_replyf(c, 204, g_cors, "%s", "");
        return;
    }

    /* POST /rpc → JSON-RPC dispatch (reuses existing MCP tools) */
    if (is_post && cbm_http_path_match(req->path, "/rpc")) {
        handle_rpc(c, req, srv->mcp);
        return;
    }

    /* GET /api/layout → 3D graph layout */
    if (is_get && cbm_http_path_match(req->path, "/api/layout*")) {
        handle_layout(c, req);
        return;
    }

    /* GET /api/repo-info → git remote / branch for GitHub deep-links */
    if (is_get && cbm_http_path_match(req->path, "/api/repo-info*")) {
        handle_repo_info(c, req);
        return;
    }

    /* POST /api/index → start background indexing */
    if (is_post && cbm_http_path_match(req->path, "/api/index")) {
        handle_index_start(c, req);
        return;
    }

    /* GET /api/index-status → check indexing progress */
    if (is_get && cbm_http_path_match(req->path, "/api/index-status")) {
        handle_index_status(c);
        return;
    }

    /* GET /api/ui-config → language and local UI preferences */
    if (is_get && cbm_http_path_match(req->path, "/api/ui-config")) {
        handle_ui_config(c, req);