app/routes/theme.ts

Functions

Imports

It imports app/lib/origin.mjs, app/lib/return-to.mjs, app/lib/theme.ts. No module of this repo imports it.

Source

1import { ORIGIN_REFUSAL, originVerdict } from "~/lib/origin.mjs";
2import { safeReturnTo } from "~/lib/return-to.mjs";
3import { isWritableTheme, serializeThemeCookie } from "~/lib/theme";
4
5import type { Route } from "./+types/theme";
6
7/** The Referer is checked against this origin before it is trusted, or this is an open redirect. */
8export async function action({ request }: Route.ActionArgs) {
9  /* An absent Origin is allowed: the no-script form post carries none. The literal "null" is refused. */
10  const verdict = originVerdict(request.headers.get("origin"), request.url);
11  if (!verdict.ok) {
12    return new Response(ORIGIN_REFUSAL, {
13      status: 403,
14      headers: { "cache-control": "no-store" },
15    });
16  }
17
18  const form = await request.formData();
19  const choice = form.get("theme");
20
21  /*
22   * Only writable themes: substituting a default turns a malformed request into a silent theme
23   * change. `no-store`: a cacheable refusal is a refusal served to somebody else.
24   */
25  if (!isWritableTheme(choice)) {
26    return new Response("Theme must be light or dark.\n", {
27      status: 400,
28      headers: { "content-type": "text/plain; charset=utf-8", "cache-control": "no-store" },
29    });
30  }
31
32  return new Response(null, {
33    status: 303,
34    headers: {
35      "Set-Cookie": serializeThemeCookie(choice),
36      Location: safeReturnTo(request),
37    },
38  });
39}
40
41export function loader() {
42  return new Response(null, { status: 303, headers: { Location: "/" } });
43}