Updates

Author: aritchie

readme.md

@@ -28,7 +28,7 @@ JWT, OpenAPI, HPACK, QPACK — is built on what is in the box.
 
 ```csharp
 var server = new HttpServer(new HttpServerOptions { Port = 8080 });
-server.OnGet("/ping", ctx => ctx.Response.WriteAsync("pong"));
+server.MapGet("/ping", ctx => ctx.Response.WriteAsync("pong"));
 await server.RunAsync();
 ```
 

samples/Sample.Api/Program.cs

@@ -4,6 +4,7 @@
 using Sample.Api;
 using Shiny.Net.HttpServer;
 using Shiny.Net.HttpServer.Cors;
+using Shiny.Net.HttpServer.FileBrowser;
 using Shiny.Net.HttpServer.Jwt;
 using Shiny.Net.HttpServer.OpenApi;
 using Shiny.Net.HttpServer.RateLimiting;
@@ -15,7 +16,7 @@
 // The whole ramp, in one app. Every tier below is optional and they all compose:
 //
 //   Tier 0  OnRequest      one delegate, no routing
-//   Tier 1  OnGet/OnPost   raw handlers behind a route template
+//   Tier 1  MapGet/MapPost raw handlers behind a route template
 //   Tier 2  Use            middleware, ASP.NET Core shaped
 //   Tier 3  [Route]        generated typed endpoints — see WidgetEndpoints.cs
 // ---------------------------------------------------------------------------
@@ -129,73 +130,97 @@
 // --- Tier 1: routed raw handlers ---
 //
 // Describe() puts a raw route in the OpenAPI document with more than just its path.
-app.OnGet("/ping", ctx => ctx.Response.WriteAsync("pong"))
+app.MapGet("/ping", ctx => ctx.Response.WriteAsync("pong"))
    .Describe(o =>
    {
        o.Summary = "Liveness probe";
        o.Tags.Add("ops");
        o.Responses.Add(new ApiResponse { StatusCode = 200, Type = typeof(string), ContentType = "text/plain" });
    });
 
-app.OnGet("/hello/{name}", ctx =>
+app.MapGet("/hello/{name}", ctx =>
 {
     var greeter = ctx.GetRequiredService<IGreeter>();
     return ctx.Response.WriteAsync(greeter.Greet(ctx.Request.RouteValues["name"]!));
 });
 
 // Per-route policies. Each applies to the route just mapped, the same way RequireAuthorization does.
-app.OnGet("/status", ctx => ctx.Response.WriteAsync("ok"))
+app.MapGet("/status", ctx => ctx.Response.WriteAsync("ok"))
    .RequireCors("public")
    .DisableRateLimiting();
 
-app.OnGet("/admin/keys", ctx => ctx.Response.WriteAsync("nothing to see here"))
+app.MapGet("/admin/keys", ctx => ctx.Response.WriteAsync("nothing to see here"))
    .RequireIpFilter("admin");
 
 // IResult with JsonTypeInfo passed directly — the most explicit AOT-safe JSON you can write.
-app.OnGet("/users/{id:int}", ctx =>
+app.MapGet("/users/{id:int}", ctx =>
 {
     ctx.Request.RouteValues.TryGetInt32("id", out var id);
     return id is > 0 and < 1000
         ? Results.Ok(new User(id, $"user-{id}"), SampleJson.Default.User)
         : Results.NotFound();
 });
 
-app.OnGet("/files/{*path}", ctx =>
+// A catch-all route parameter: everything after the prefix, slashes included, arrives as one value.
+app.MapGet("/catch-all/{*path}", ctx =>
     Results.Text($"catch-all captured: {ctx.Request.RouteValues["path"]}"));
 
 // Proves the scope really is per request: both resolutions inside one request are the same
 // instance, and a second request gets a different one.
-app.OnGet("/scope", ctx =>
+app.MapGet("/scope", ctx =>
 {
     var a = ctx.GetRequiredService<RequestId>();
     var b = ctx.GetRequiredService<RequestId>();
     return ctx.Response.WriteAsync($"same-instance={ReferenceEquals(a, b)} id={a.Value}");
 });
 
-app.OnPost("/echo", async ctx =>
+app.MapPost("/echo", async ctx =>
 {
     var body = await ctx.Request.ReadBodyAsStringAsync();
     await ctx.Response.WriteAsync($"echo:{body}");
 });
 
-app.OnGet("/boom", _ => throw new InvalidOperationException("deliberate failure"));
+app.MapGet("/boom", _ => throw new InvalidOperationException("deliberate failure"));
 
-// --- A directory, as a drive ---
+// --- One directory, served two ways ---
+//
+// The same folder is mapped below as a JSON API and as a drive. Which one a caller wants depends
+// entirely on what the caller is: a script speaks HTTP, a desktop speaks WebDAV.
+var filesRoot = Directory.CreateDirectory(Path.Combine(AppContext.BaseDirectory, "files-root"));
+
+if (!File.Exists(Path.Combine(filesRoot.FullName, "readme.txt")))
+    File.WriteAllText(Path.Combine(filesRoot.FullName, "readme.txt"), "Edit me from your file manager.\n");
+
+// --- A directory, as an API ---
+//
+//   curl http://localhost:8080/files                                   # JSON listing
+//   curl http://localhost:8080/files/readme.txt                        # the bytes
+//   curl -X PUT --data 'hello' -H "Authorization: Bearer $TOKEN" http://localhost:8080/files/notes.txt
+//   curl -X DELETE -H "Authorization: Bearer $TOKEN" http://localhost:8080/files/notes.txt
+//
+// The file browser is mapped as routes rather than middleware, and that is the whole reason it
+// hands its endpoints back: reads stay open here while anything that changes a file needs an admin
+// token — a distinction middleware could not express. Get a token from POST /api/auth/login as
+// ada/hunter2, or swap the call below for .RequireAuthorization() to close the reads too.
+app.MapFileBrowser("/files", o =>
+{
+    o.RootPath = filesRoot.FullName;
+    o.AllowWrite = true;
+    o.AllowDelete = true;
+})
+.RequireAuthorizationForChanges("admin");
+
+// --- The same directory, as a drive ---
 //
 // One call maps the twenty-two routes of an RFC 4918 class 1 & 2 WebDAV mount. Point Finder (Go →
 // Connect to Server) or Explorer (Map network drive) at http://localhost:8080/dav and the folder
-// below opens as a drive — no client to write, and no client to install.
+// opens as a drive — no client to write, and no client to install.
 //
 // A browser GET of the same URL shows a plain HTML index, which is the quickest way to see it
 // working without mounting anything.
-var davRoot = Directory.CreateDirectory(Path.Combine(AppContext.BaseDirectory, "dav-root"));
-
-if (!File.Exists(Path.Combine(davRoot.FullName, "readme.txt")))
-    File.WriteAllText(Path.Combine(davRoot.FullName, "readme.txt"), "Edit me from your file manager.\n");
-
 app.MapWebDav("/dav", o =>
 {
-    o.RootPath = davRoot.FullName;
+    o.RootPath = filesRoot.FullName;
     o.AllowWrite = true;
     o.AllowDelete = true;
     o.DisplayName = "Sample";
@@ -213,9 +238,9 @@
 // sample exposes it over HTTP for demonstration, but the same two calls sit behind a toggle in a
 // MAUI app. With AddHttpServer(..., autoStart: false) the server is registered and configured but
 // never listening until something asks it to.
-app.OnGet("/server/status", ctx => ctx.Response.WriteAsync($"{app.State} {app.ListenUrl}"));
+app.MapGet("/server/status", ctx => ctx.Response.WriteAsync($"{app.State} {app.ListenUrl}"));
 
-app.OnPost("/server/restart", async ctx =>
+app.MapPost("/server/restart", async ctx =>
 {
     // Not awaited inline: restarting tears down the connection this request arrived on.
     _ = Task.Run(async () =>

samples/Sample.Maui/Pages/ServerPage.xaml

@@ -67,6 +67,21 @@
                     <Label Text="{Binding McpUrl, TargetNullValue='Server not started'}"
                            LineBreakMode="CharacterWrap" />
 
+                    <!-- The file browser over the app's own storage. Tapping it opens the JSON
+                         listing of the root; every entry's path hangs off this address, so the
+                         browser walks the tree and curl scripts against the same URLs. The mount
+                         below is the same directory for a client that would rather have a drive. -->
+                    <Label Text="File browser — the app's storage as JSON" TextColor="Gray" Margin="0,6,0,0" />
+                    <Label Text="{Binding FilesUrl, TargetNullValue='Server not started'}"
+                           TextColor="{StaticResource Primary}"
+                           TextDecorations="Underline"
+                           LineBreakMode="CharacterWrap">
+                        <Label.GestureRecognizers>
+                            <TapGestureRecognizer Command="{Binding OpenUrlCommand}"
+                                                  CommandParameter="{Binding FilesUrl}" />
+                        </Label.GestureRecognizers>
+                    </Label>
+
                     <!-- The WebDAV mount, both ways to reach it. Finder: Go → Connect to Server.
                          Explorer: Map network drive. Same server, same password — the app's storage
                          as a drive. Tapping either one browses the mount here instead: GET on a

samples/Sample.Maui/README.md

@@ -120,7 +120,9 @@ required. `Server/RequireAuthentication.cs` is the ten lines that close that.
 
 ## Browsing the device's files
 
-`/files` maps the file browser over `FileSystem.AppDataDirectory`:
+`/files` maps the file browser over `FileSystem.AppDataDirectory`. The **Server** tab shows it as a
+tappable link — the address on this network, because the endpoint hands out the contents of the
+device's storage and the tunnel is cleartext HTTP through a shared host:
 
 ```bash
 curl -u admin:PASSWORD https://xxxx.lhr.life/files                 # JSON listing

samples/Sample.Maui/ViewModels/ServerViewModel.cs

@@ -42,12 +42,14 @@ IMainThread mainThread
     [NotifyPropertyChangedFor(nameof(HasPublicUrl))]
     [NotifyPropertyChangedFor(nameof(CanStopSharing))]
     [NotifyPropertyChangedFor(nameof(McpUrl))]
+    [NotifyPropertyChangedFor(nameof(FilesUrl))]
     [NotifyPropertyChangedFor(nameof(PublicWebDavUrl))]
     string? publicUrl;
 
     /// <summary>The address on this Wi-Fi network. Works with no internet at all.</summary>
     [ObservableProperty]
     [NotifyPropertyChangedFor(nameof(McpUrl))]
+    [NotifyPropertyChangedFor(nameof(FilesUrl))]
     [NotifyPropertyChangedFor(nameof(LocalWebDavUrl))]
     string? localUrl;
 
@@ -99,6 +101,19 @@ IMainThread mainThread
         ? $"{url.TrimEnd('/')}/mcp"
         : null;
 
+    /// <summary>
+    /// The file browser over the app's own storage — a JSON listing a script or a browser can walk,
+    /// which is the same directory the WebDAV mount below exposes as a drive.
+    /// <para>
+    /// The address on this network comes first, the same way round as the mount and for the same
+    /// reason: this hands out the contents of the device's storage, and the tunnel is cleartext HTTP
+    /// through a shared host.
+    /// </para>
+    /// </summary>
+    public string? FilesUrl => (this.LocalUrl ?? this.PublicUrl) is { Length: > 0 } url
+        ? $"{url.TrimEnd('/')}/files"
+        : null;
+
     /// <summary>
     /// The mount on this network — what to type into Finder's "Connect to Server" or Explorer's
     /// "Map network drive", and what to tap to browse it from the phone itself.

samples/Sample.Mcp/Program.cs

@@ -50,7 +50,7 @@
 app.MapMcp();
 
 // The MCP endpoint is just another route: everything else the server does still works alongside it.
-app.OnGet("/health", ctx => ctx.Response.WriteAsync("ok"));
+app.MapGet("/health", ctx => ctx.Response.WriteAsync("ok"));
 
 Console.WriteLine("MCP endpoint:  http://localhost:8181/mcp");
 Console.WriteLine("Press Ctrl+C to stop.");

skills/shiny-httpserver/SKILL.md

@@ -11,9 +11,9 @@ triggers:
 - HttpServerOptions
 - HttpServerBuilder
 - AddHttpServer
-- OnGet
-- OnRequest
 - MapGet
+- MapPost
+- OnRequest
 - IHttpMiddleware
 - RequestDelegate
 - HttpContext
@@ -202,7 +202,7 @@ Every new API belongs to one of these. Say which when you introduce one. They co
 | Tier | What it is | Use when |
 | --- | --- | --- |
 | 0 | `OnRequest(ctx => …)` — one delegate, no routing | A single handler, a test fixture, a fallback |
-| 1 | `OnGet`/`OnPost`/… — raw handlers behind a route template | A handful of routes, no binding wanted |
+| 1 | `MapGet`/`MapPost`/… — raw handlers behind a route template | A handful of routes, no binding wanted |
 | 2 | `Use(...)` / `IHttpMiddleware` — the pipeline | Cross-cutting work |
 | 3 | `[Route]` classes + the source generator | Anything real: typed parameters, DI, OpenAPI |
 
@@ -216,7 +216,7 @@ Choose the host shape from who owns the container:
 ```csharp
 // (a) No container — smallest possible
 var server = new HttpServer(new HttpServerOptions { Port = 8080 });
-server.OnGet("/ping", ctx => ctx.Response.WriteAsync("pong"));
+server.MapGet("/ping", ctx => ctx.Response.WriteAsync("pong"));
 await server.RunAsync();
 
 // (b) The builder — a console app or service that wants DI
@@ -552,7 +552,7 @@ app.MapWebDav("/dav", o =>
 
 ```csharp
 // WebSockets — the handler owns the socket; loop inside it
-app.OnGet("/ws", async ctx =>
+app.MapGet("/ws", async ctx =>
 {
     if (!ctx.Request.IsWebSocketRequest()) { ctx.Response.StatusCode = 400; return; }
 
@@ -562,7 +562,7 @@ app.OnGet("/ws", async ctx =>
 });
 
 // SSE
-app.OnGet("/events", ctx => ctx.SendEventsAsync(async stream =>
+app.MapGet("/events", ctx => ctx.SendEventsAsync(async stream =>
 {
     while (!stream.Aborted.IsCancellationRequested)
     {

src/Shiny.Net.HttpServer/Cors/CorsExtensions.cs

@@ -84,7 +84,7 @@ public static HttpServer UseCors(this HttpServer server, CorsPolicy? policy)
     /// <summary>
     /// Applies a named CORS policy to the most recently mapped route.
     /// <code>
-    /// app.OnGet("/status", Handler).RequireCors("public");
+    /// app.MapGet("/status", Handler).RequireCors("public");
     /// </code>
     /// </summary>
     public static HttpServer RequireCors(this HttpServer server, string policyName)

src/Shiny.Net.HttpServer/Cors/CorsOptions.cs

@@ -10,7 +10,7 @@ namespace Shiny.Net.HttpServer.Cors;
 /// });
 ///
 /// app.UseCors();
-/// app.OnGet("/status", Handler).RequireCors("public");
+/// app.MapGet("/status", Handler).RequireCors("public");
 /// </code>
 /// </summary>
 public sealed class CorsOptions

src/Shiny.Net.HttpServer/Hosting/HttpServer.cs

@@ -176,19 +176,6 @@ public HttpServer ClearRoutes()
 
     public HttpServer MapPatch(string pattern, RequestDelegate handler) => this.Map(HttpMethods.Patch, pattern, handler);
 
-    // On* reads better next to OnRequest — "when a GET for /hello arrives, do this" — and is the
-    // spelling the tier-1 examples use. Map* is kept because it is what ASP.NET Core calls these.
-
-    public HttpServer OnGet(string pattern, RequestDelegate handler) => this.Map(HttpMethods.Get, pattern, handler);
-
-    public HttpServer OnPost(string pattern, RequestDelegate handler) => this.Map(HttpMethods.Post, pattern, handler);
-
-    public HttpServer OnPut(string pattern, RequestDelegate handler) => this.Map(HttpMethods.Put, pattern, handler);
-
-    public HttpServer OnDelete(string pattern, RequestDelegate handler) => this.Map(HttpMethods.Delete, pattern, handler);
-
-    public HttpServer OnPatch(string pattern, RequestDelegate handler) => this.Map(HttpMethods.Patch, pattern, handler);
-
     // ---- Tier 2: middleware ----
 
     /// <summary>