| 1 | package memoria |
| 2 | |
| 3 | import ( |
| 4 | "net/http" |
| 5 | |
| 6 | "amadan.net/rastrillo/rastrillo" |
| 7 | ) |
| 8 | |
| 9 | // ServeOptions completes opts with what Memoria serves: mux (App's, with |
| 10 | // MountAuth's routes on it) and the error page. main passes the result to |
| 11 | // rastrillo.Serve, and the CSP tests pass it to rastrillo.Handler, so the |
| 12 | // stack they check is the one production runs. |
| 13 | // |
| 14 | // It sets no CSP, deliberately. rastrillo fb806a2's default refuses every |
| 15 | // inline style attribute (style-src 'self' 'unsafe-hashes' plus pow's |
| 16 | // honeypot hash), and nothing Memoria serves standalone carries one: its |
| 17 | // templates, the estilo and rastrillo partials they draw, and the scripts |
| 18 | // it ships (rastrillo.js, busy.js, chrome.js, drop.js, search.js) write no |
| 19 | // style attribute — drop.js and search.js set attributes, hidden and a |
| 20 | // <progress> value, never style. So the default holds as shipped and there was nothing to |
| 21 | // migrate. TestNoPageCarriesAStyleAttribute and |
| 22 | // TestStandaloneServesRastrillosDefaultCSP keep it that way, and the |
| 23 | // browser check TestPagesRenderUnderTheProductionCSP watches for |
| 24 | // violations in Chromium. |
| 25 | // |
| 26 | // One page is not ours: rastrillo/native's approval page |
| 27 | // (/native/authorize) draws itself with one inline <style>, admitted by |
| 28 | // its hash on that route alone (nativeApprovalCSP, native.go). Every other |
| 29 | // route serves the default exactly. |
| 30 | // |
| 31 | // With Home configured, connect's middleware replaces the policy with |
| 32 | // connect.FormPolicy, whose style-src keeps 'unsafe-inline': estilo's |
| 33 | // account-link page (homeconnect home_link.html) draws the address with |
| 34 | // style="overflow-wrap: anywhere". That page exists only in Home mode. |
| 35 | func (a *app) ServeOptions(opts rastrillo.Options, mux *http.ServeMux) rastrillo.Options { |
| 36 | opts.Mux = mux |
| 37 | // rastrillo.Serve's own panic recovery, for a panic outside the |
| 38 | // router: the same 500 page, with the viewer's chrome, as the |
| 39 | // router's recoverToErrorPage renders (shared chrome §3.3). |
| 40 | opts.ErrorPage = a.ErrorPage |
| 41 | return opts |
| 42 | } |
| 43 | |
amadan