Function injectConfigIntoHtml

server/src/utils/html-config.ts:107–124

(html: string, user?: AppUser | null)

 * Also injects PostHog script if configured.
 */
export function injectConfigIntoHtml(html: string, user?: AppUser | null): string {
  const configScript = getAppConfigScript(user);

  // Add early error buffer (sync) and PostHog script (deferred) if API key is configured
  const posthogScripts = POSTHOG_API_KEY
    ? `${EARLY_ERROR_BUFFER_SCRIPT}\n<script src="/posthog-init.js" defer></script>`
    : '';

  // csrf.js patches fetch() to include X-CSRF-Token on state-changing requests
  const csrfScript = `<script src="/csrf.js"></script>`;

  const injectedScripts = `${configScript}\n${csrfScript}\n${posthogScripts}`;

  if (html.includes("</head>")) {
    return html.replace("</head>", `${injectedScripts}\n</head>`);
  }
  return html.replace("<body", `${injectedScripts}\n<body`);
}

/**
 * Resolve path to a public HTML file.