Function injectBasePathHint

apps/server/internal/httpserver/server.go:1056–1066

injectBasePathHint splices a ` ` tag into the SPA shell so the bundled JS can route API calls through the configured prefix. A meta tag (instead of an inline script) keeps us inside the strict CSP — script-src is locked to 'self'.

(body []byte, basePath string)

// configured prefix. A meta tag (instead of an inline script) keeps us
// inside the strict CSP — script-src is locked to 'self'.
func injectBasePathHint(body []byte, basePath string) []byte {
	snippet := []byte(`<meta name="zn-base-path" content="` + htmlAttrEscape(basePath) + `">`)
	if idx := indexOfFold(body, []byte("</head>")); idx >= 0 {
		out := make([]byte, 0, len(body)+len(snippet))
		out = append(out, body[:idx]...)
		out = append(out, snippet...)
		out = append(out, body[idx:]...)
		return out
	}
	return append(snippet, body...)
}

// htmlAttrEscape escapes the characters that would let a base-path
// value break out of a double-quoted HTML attribute.