From b6de489be7da3ddebcb0ba736dd014af61e96bcc Mon Sep 17 00:00:00 2001
From: Nathan Coad <nathan@thecoads.com>
Date: Mon, 12 Jan 2026 15:52:58 +1100
Subject: [PATCH] embed diagram in url

---
 cmd/server/main.go | 21 +++++++++++++--------
 1 file changed, 13 insertions(+), 8 deletions(-)

diff --git a/cmd/server/main.go b/cmd/server/main.go
index 4bf1154..3e61d41 100644
--- a/cmd/server/main.go
+++ b/cmd/server/main.go
@@ -1,6 +1,7 @@
 package main
 
 import (
+	"encoding/base64"
 	"encoding/json"
 	"fmt"
 	"html/template"
@@ -238,8 +239,8 @@ func uploadOpenHandler(w http.ResponseWriter, r *http.Request) {
 	}
 
 	id := storeDiagram(xml)
-	targetURL := buildDiagramsNetURL(r, id)
-	log.Printf("[open] redirecting to %s", targetURL)
+	targetURL := buildDiagramsNetURL(r, id, xml)
+	log.Printf("[open] redirecting to %s (data bytes=%d)", targetURL, len(xml))
 	http.Redirect(w, r, targetURL, http.StatusFound)
 }
 
@@ -333,18 +334,22 @@ func storeDiagram(xml string) string {
 	return id
 }
 
-func buildDiagramsNetURL(r *http.Request, id string) string {
+func buildDiagramsNetURL(r *http.Request, id string, xml string) string {
 	scheme := "http"
 	if r.Header.Get("X-Forwarded-Proto") == "https" || r.TLS != nil {
 		scheme = "https"
 	}
 	base := fmt.Sprintf("%s://%s/diagram?id=%s", scheme, r.Host, url.QueryEscape(id))
 	// Request AWS library for custom shapes (e.g., aws4) to render correctly.
-	// Use only the fragment form (#U) to maximize compatibility with self-hosted draw.io instances that
-	// expect the remote URL there. The fragment keeps the remote file URL intact and avoids the `url=` query
-	// parameter, which some deployments ignore.
-	encoded := url.QueryEscape(base)
-	return fmt.Sprintf("%s/?splash=0&ui=min&libs=aws4#U%s", drawioBaseURL, encoded)
+	// Use the fragment form (#U) to point at a downloadable URL.
+	encodedURL := url.QueryEscape(base)
+	redirect := fmt.Sprintf("%s/?splash=0&ui=min&libs=aws4", drawioBaseURL)
+	// Also embed the XML directly via `data=` so self-hosted instances that block remote fetches can still open it.
+	if xml != "" {
+		data := base64.StdEncoding.EncodeToString([]byte(xml))
+		redirect += "&data=" + url.QueryEscape(data)
+	}
+	return fmt.Sprintf("%s#U%s", redirect, encodedURL)
 }
 
 func addCORS(w http.ResponseWriter) {