# `gno.land/p/moul/realmpath`

Parse the `path` argument that `Render` receives, with an API shaped like
`net/url`, and rebuild a URL from it.

```go
func Render(path string) string {          // path = "hello/world?foo=bar"
	req := realmpath.Parse(path)

	req.Path             // "hello/world"
	req.PathPart(0)      // "hello"
	req.PathPart(1)      // "world"
	req.Query.Get("foo") // "bar"

	req.String()         // "/r/current/realm:hello/world?foo=bar"
}
```

That is the whole surface: `Parse`, `PathParts`, `PathPart(i)`, `Query` (a real
`url.Values`), and `String`.

`PathPart` is bounds-checked and returns `""` for an index that is not there, so
routing reads as a plain switch with no length guards:

```go
switch req.PathPart(0) {
case "":      return renderIndex(req)
case "posts": return renderPost(req.PathPart(1))
default:      return "404"
}
```

`String()` fills `Realm` from the current realm when it is unset, which is what
makes pagination and filter links survive the realm being moved or versioned.

## One security note, worth reading before you trust `req.Realm`

The package doc carries it in full. In short: `String()` lazily fills
`r.Realm` from `unsafe.CurrentRealm()` inside a non-crossing `/p/` method,
which walks past non-crossing frames to the most recent crossing ancestor
rather than the immediate caller. Under a contrived call chain, **`r.Realm` is
not a reliable identity claim.**

That is accepted here because `r.Realm` is only ever consumed as a display
string. If you add a consumer that gates a write or an authorization decision
on `r.Realm`, do not: set `req.Realm = cur.PkgPath()` explicitly from the
caller under `rlm.IsCurrent()` instead.

Going the other way, from a route to a link, is
[`p/moul/txlink`](../txlink).

<!-- BEGIN GNOCONTRACTS FOOTER (generated by `make readmes`; do not edit below) -->

---

Part of **[moul/gno-contracts](https://github.com/moul/gno-contracts)** — moul's versioned gno.land contracts. See the repository for the full catalog, build/test tooling, and usage.

> ⚠️ **Disclaimer:** provided as-is, without warranty; not security-audited. Full disclaimer: [DISCLAIMER](https://github.com/moul/gno-contracts/blob/main/DISCLAIMER.md).

<!-- END GNOCONTRACTS FOOTER -->