Merge remote-tracking branch 'origin/main' into space

.github/FUNDING.yml

@@ -1 +1 @@
-custom: https://github.com/easrng/enafore#donate
+custom: https://github.com/enafore/enafore#donate

.github/workflows/build-and-deploy.yml

@@ -40,4 +40,4 @@ jobs:
         path: __sapper__/export/
     - name: Deploy to GitHub Pages
       id: deployment
-      uses: actions/deploy-pages@v1
+      uses: actions/deploy-pages@v4

CONTRIBUTING.md

@@ -72,9 +72,9 @@ This is also available locally after `pnpm build` at `.sapper/client/report.html
 
 ## Architecture
 
-See [Architecture.md](https://github.com/easrng/enafore/blob/main/docs/Architecture.md).
+See [Architecture.md](https://github.com/enafore/enafore/blob/main/docs/Architecture.md).
 
 ## Internationalization
 
-See [Internationalization.md](https://github.com/easrng/enafore/blob/main/docs/Internationalization.md).
+See [Internationalization.md](https://github.com/enafore/enafore/blob/main/docs/Internationalization.md).
 

README.md

@@ -4,16 +4,16 @@ A somewhat unstable fediverse client with better support for Akkoma, glitch-soc,
 
 im-in.space's Enafore is available at [pf.im-in.space](https://pf.im-in.space).
 
-See the [user guide](https://github.com/easrng/enafore/blob/main/docs/User-Guide.md) for basic usage. See the [admin guide](https://github.com/easrng/enafore/blob/main/docs/Admin-Guide.md) if Enafore cannot connect to your instance.
+See the [user guide](https://github.com/enafore/enafore/blob/main/docs/User-Guide.md) for basic usage. See the [admin guide](https://github.com/enafore/enafore/blob/main/docs/Admin-Guide.md) if Enafore cannot connect to your instance.
 
-For updates, follow me, I usually post when I fix or add things: [@em@cassilda.house](https://fedi.cassilda.house/users/em). Patch notes are tagged with #enafore.
+For updates, follow [@enafore@enafore.social](https://meta.enafore.social/@enafore).
 
 # Testimonials
 > Literally the best Akkoma client\
 > \- [@Seirdy@pleroma.envs.net](https://pleroma.envs.net/objects/ad9360b2-ae86-4bd1-ba8c-3c24553f92f6)
 
 # Donate
 Want to support my work on Enafore?
-<table><tr><td><a href="http://cash.app/$EmCassilda"><img src="docs/CashAppQR.svg" width="270" alt="Cash App"></a></td><td><img src="docs/MoneroQR.svg" width="270" alt="Monero"></td></tr></table>
-<table><tr><th>Cash&nbsp;App</th><td><a href="http://cash.app/$EmCassilda">$EmCassilda</a></td></tr>
+<table><tr><td><a href="http://cash.app/$enafore"><img src="docs/CashAppQR.svg" width="270" alt="Cash App"></a></td><td><img src="docs/MoneroQR.svg" width="270" alt="Monero"></td></tr></table>
+<table><tr><th>Cash&nbsp;App</th><td><a href="http://cash.app/$enafore">$enafore</a></td></tr>
 <tr><th>Monero</th><td><code>852KMZurkViCzwa8BZM8YPCBjcmzXo54bGpm4qziBriwfbFysPSSC6KVgBRpNrszorZEeAnzKbWR9ZbCC1ZLBvjj3Gp6C9t</code></td></tr></table>

bin/build-assets.js

@@ -2,7 +2,7 @@ import path from 'path'
 import fs from 'fs'
 import { promisify } from 'util'
 import { LOCALE } from '../src/routes/_static/intl.js'
-import { getIntl, trimWhitespace } from './getIntl.js'
+import applyIntl from '../webpack/svelte-intl-loader.js'
 
 const __dirname = path.dirname(new URL(import.meta.url).pathname)
 const readFile = promisify(fs.readFile)
@@ -53,9 +53,8 @@ async function buildEmojiI18nFile () {
 
 async function buildManifestJson () {
   const template = await readFile(path.resolve(__dirname, '../src/build/manifest.json'), 'utf8')
-  // replace {@intl.foo}
-  const output = template
-    .replace(/{intl\.([^}]+)}/g, (match, p1) => trimWhitespace(getIntl(p1)))
+  // replace "intl.foo":
+  const output = applyIntl(template)
 
   await writeFile(
     path.resolve(__dirname, '../static/manifest.json'),

bin/build-inline-script.js

@@ -8,6 +8,7 @@ import terser from '@rollup/plugin-terser'
 import replace from '@rollup/plugin-replace'
 import terserOptions from './terserOptions.js'
 import { inlineThemeColors } from '../webpack/shared.config.js'
+import { sapperInlineScriptChecksums } from '../src/server/sapperInlineScriptChecksums.js'
 
 const __dirname = path.dirname(new URL(import.meta.url).pathname)
 const writeFile = promisify(fs.writeFile)
@@ -23,7 +24,7 @@ export async function buildInlineScript () {
           'process.browser': true,
           'process.env.THEME_COLORS': JSON.stringify(inlineThemeColors)
         },
-        preventAssignment: true
+        preventAssignment: false
       }),
       // TODO: can't disable terser at all, it causes the CSP checksum to stop working
       // because the HTML gets minified as some point so the checksums don't match.
@@ -37,18 +38,30 @@ export async function buildInlineScript () {
   })
   const { output } = await bundle.generate({
     format: 'iife',
-    sourcemap: true
+    sourcemap: 'hidden'
   })
 
   const { code, map } = output[0]
 
   const fullCode = `${code}//# sourceMappingURL=/inline-script.js.map`
-  const checksum = crypto.createHash('sha256').update(fullCode, 'utf8').digest('base64')
-
-  await writeFile(path.resolve(__dirname, '../src/inline-script/checksum.js'),
-    `export default ${JSON.stringify(checksum)}`, 'utf8')
+  const SCRIPT_CHECKSUMS = [crypto.createHash('sha256').update(fullCode, 'utf8').digest('base64'), ...sapperInlineScriptChecksums]
+    .map((_) => `'sha256-${_}'`)
+    .join(' ')
+  const policy = [
+    "default-src 'self'",
+    `script-src 'self' ${SCRIPT_CHECKSUMS}`,
+    "worker-src 'self'",
+    "style-src 'self' 'unsafe-inline'",
+    "img-src 'self' * data: blob:",
+    "media-src 'self' *",
+    "connect-src 'self' * data: blob:",
+    "frame-src 'none'",
+    "object-src 'none'",
+    "manifest-src 'self'",
+    "form-action 'self'", // we need form-action for the Web Share Target API
+    "base-uri 'self'"
+  ].join(';')
   await writeFile(path.resolve(__dirname, '../static/inline-script.js.map'),
     map.toString(), 'utf8')
-
-  return '<script>' + fullCode + '</script>'
+  return `<meta http-equiv="Content-Security-Policy" content="${policy}" /></head><body><script>${fullCode}</script>`
 }

bin/build-sass.js

@@ -2,7 +2,7 @@ import * as sass from 'sass'
 import path from 'path'
 import fs from 'fs'
 import { promisify } from 'util'
-import cssDedoupe from 'css-dedoupe'
+import { minify } from 'csso'
 
 const writeFile = promisify(fs.writeFile)
 const readdir = promisify(fs.readdir)
@@ -15,6 +15,9 @@ const assetsDir = path.join(__dirname, '../static')
 
 async function renderCss (file) {
   const result = await sass.compile(file, { outputStyle: 'compressed' })
+  if (process.env.NODE_ENV === 'production') {
+    return minify(result.css).css
+  }
   return result.css
 }
 
@@ -29,8 +32,7 @@ async function compileGlobalSass () {
 async function compileThemesSass () {
   const files = (await readdir(themesScssDir)).filter(file => !path.basename(file).startsWith('_') && !path.basename(file).startsWith('.'))
   await Promise.all(files.map(async file => {
-    let css = await renderCss(path.join(themesScssDir, file))
-    css = cssDedoupe(css) // remove duplicate custom properties
+    const css = await renderCss(path.join(themesScssDir, file))
     const outputFilename = 'theme-' + path.basename(file).replace(/\.scss$/, '.css')
     await writeFile(path.join(assetsDir, outputFilename), css, 'utf8')
     if (outputFilename === 'theme-default.css') {

bin/build-template-html.js

@@ -26,7 +26,10 @@ const builders = [
   },
   {
     watch: 'src/inline-script/inline-script.js',
-    comment: '<!-- inline JS -->',
+    comment: String.raw`<!--( CSP )--
+</head>
+<body>
+  --( inline JS )-->`,
     rebuild: buildInlineScript
   },
   {

bin/getIntl.js

@@ -1,10 +1,10 @@
-import { get } from '../src/routes/_utils/lodash-lite.js'
 import { DEFAULT_LOCALE, LOCALE } from '../src/routes/_static/intl.js'
 
 import enUS from '../src/intl/en-US.js'
 import fr from '../src/intl/fr.js'
 import de from '../src/intl/de.js'
 import es from '../src/intl/es.js'
+import parse from 'format-message-parse'
 
 // TODO: make it so we don't have to explicitly list these out
 const locales = {
@@ -25,15 +25,18 @@ export function warningOrError (message) { // avoid crashing the whole server on
   return '(Placeholder intl string)'
 }
 
-export function getIntl (path) {
-  path = path.split('.')
-  const res = get(intl, path, get(defaultIntl, path))
+const cache = {}
+export function getIntl (key) {
+  if (cache[key]) return cache[key]
+  const res = intl[key] || defaultIntl[key]
   if (typeof res !== 'string') {
-    return warningOrError('Unknown intl string: ' + JSON.stringify(path))
+    return warningOrError('Unknown intl string: ' + key)
   }
-  return res
-}
-
-export function trimWhitespace (str) {
-  return str.trim().replace(/\s+/g, ' ')
+  const parsed = parse(res.trim().replace(/\s+/g, ' '))
+  if (parsed.length === 1 && typeof parsed[0] === 'string') {
+    cache[key] = parsed[0]
+    return cache[key]
+  }
+  cache[key] = parsed
+  return parsed
 }