{{.Title}}
{{if .Message}}{{.Message}}
{{end}} diff --git a/identity/systemauth/email_verification.go b/identity/systemauth/email_verification.go index cc14c5e4..1a101821 100644 --- a/identity/systemauth/email_verification.go +++ b/identity/systemauth/email_verification.go @@ -171,7 +171,7 @@ func (sl *socialLogin) issueSignInToken(ctx context.Context, cookie, email strin } var verifyEmailTemplate = template.Must(template.New("verify-email").Parse(` - +` + pageStyleLink + `{{.Title}}
{{if .Message}}{{.Message}}
{{end}} diff --git a/identity/systemauth/page_style.go b/identity/systemauth/page_style.go new file mode 100644 index 00000000..05bd9ec9 --- /dev/null +++ b/identity/systemauth/page_style.go @@ -0,0 +1,42 @@ +package systemauth + +import ( + "crypto/sha256" + _ "embed" + "encoding/hex" + "net/http" +) + +// PageStylePath serves the stylesheet SystemAuth's own pages link: sign-in, +// sign-out, consent, sign-up and the email pages. It is served from the +// issuer's origin, which the pages' content security policy allows. +const PageStylePath = "/assets/systemauth.css" + +//go:embed assets/page.css +var pageStyle []byte + +// pageStyleVersion names this build's stylesheet in its link, so a browser +// fetches it again when it changes and may cache it otherwise. +var pageStyleVersion = func() string { + sum := sha256.Sum256(pageStyle) + return hex.EncodeToString(sum[:6]) +}() + +// pageStyleLink is the every page's head carries, after its +// viewport. +var pageStyleLink = `` + +// handlePageStyle serves GET PageStylePath. +func handlePageStyle(w http.ResponseWriter, r *http.Request) { + w.Header().Set("Content-Type", "text/css; charset=utf-8") + // The link names the content, so a versioned request may be cached + // for long; an unversioned one is checked again within the hour. + if r.URL.Query().Get("v") == pageStyleVersion { + w.Header().Set("Cache-Control", "public, max-age=31536000, immutable") + } else { + w.Header().Set("Cache-Control", "public, max-age=3600") + } + if _, err := w.Write(pageStyle); err != nil { + LoggerFromContext(r.Context()).Debug("writing the page stylesheet", "error", err) + } +} diff --git a/identity/systemauth/page_style_test.go b/identity/systemauth/page_style_test.go new file mode 100644 index 00000000..585d37de --- /dev/null +++ b/identity/systemauth/page_style_test.go @@ -0,0 +1,56 @@ +package systemauth + +import ( + "net/http" + "net/http/httptest" + "strings" + "testing" +) + +func TestPageStyleIsServedAndLinked(t *testing.T) { + f := newFakeGitHub(t) + s := newSocialTestServer(t, f, NewMemoryPrincipalDirectory()) + + w := httptest.NewRecorder() + s.ServeHTTP(w, httptest.NewRequest(http.MethodGet, PageStylePath+"?v="+pageStyleVersion, nil)) + if w.Code != http.StatusOK || !strings.HasPrefix(w.Header().Get("Content-Type"), "text/css") || !strings.Contains(w.Body.String(), "prefers-color-scheme") { + t.Fatalf("stylesheet: %d %q", w.Code, w.Header().Get("Content-Type")) + } + if cc := w.Header().Get("Cache-Control"); !strings.Contains(cc, "immutable") { + t.Errorf("a versioned stylesheet is cached as %q", cc) + } + w = httptest.NewRecorder() + s.ServeHTTP(w, httptest.NewRequest(http.MethodGet, PageStylePath, nil)) + if cc := w.Header().Get("Cache-Control"); strings.Contains(cc, "immutable") { + t.Errorf("an unversioned stylesheet is cached as %q", cc) + } + + // The sign-in page links it, from the issuer's own origin, which its + // content security policy allows, and offers each provider in a nav. + w = httptest.NewRecorder() + s.ServeHTTP(w, httptest.NewRequest(http.MethodGet, "/login", nil)) + body := w.Body.String() + if !strings.Contains(body, ``) { + t.Errorf("the sign-in page does not link the stylesheet: %s", body) + } + if !strings.Contains(body, `