From f1926dc448bd7cfaf459e5ebcea91234e321bbee Mon Sep 17 00:00:00 2001
From: Eugene Blikh <bigbes@gmail.com>
Date: Sun, 26 Apr 2026 18:16:10 +0300
Subject: [PATCH] server/web: fail loud when index.html lacks </head> for
 config injection

---
 internal/server/web/embed.go | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/internal/server/web/embed.go b/internal/server/web/embed.go
index b3d6a1da16bda6789ec0343d288fe90d3e54aab6..52236e76006b23cd8bc9bc2a3f43e63296a01801 100644
--- a/internal/server/web/embed.go
+++ b/internal/server/web/embed.go
@@ -136,8 +136,16 @@ func (h *spaHandler) serveIndex(w http.ResponseWriter, _ *http.Request) {
 		return
 	}
 
+	original := buf.Bytes()
 	script := []byte("<script>window.__LETHE_CONFIG__=" + string(cfgJSON) + ";</script></head>")
-	injected := bytes.Replace(buf.Bytes(), []byte("</head>"), script, 1)
+	injected := bytes.Replace(original, []byte("</head>"), script, 1)
+	if bytes.Equal(injected, original) {
+		// </head> is required for config injection. Failing loud beats serving
+		// uninjected HTML and letting the SPA render its "auth-config missing"
+		// card with no server-side diagnostic.
+		http.Error(w, "internal server error: index.html missing </head> for config injection", http.StatusInternalServerError)
+		return
+	}
 
 	w.Header().Set("Content-Type", "text/html; charset=utf-8")
 	w.WriteHeader(http.StatusOK)