From c52a357e29df09b4da1db3a60b7ea3b6d54e3df6 Mon Sep 17 00:00:00 2001
From: Jake Jarvis <jake@jarv.is>
Date: Sun, 26 Apr 2020 23:43:10 -0400
Subject: [PATCH] revert Access-Control-Allow-Origin: * header

---
 assets/js/dark-mode.js                | 31 +++++++++++++--------------
 assets/vendor/emoji/emoji.js          | 10 ++++-----
 config.toml                           |  7 +-----
 layouts/partials/head/webmention.html |  6 ++++--
 netlify.toml                          |  5 +----
 5 files changed, 26 insertions(+), 33 deletions(-)

diff --git a/assets/js/dark-mode.js b/assets/js/dark-mode.js
index cf371256..e9267adf 100644
--- a/assets/js/dark-mode.js
+++ b/assets/js/dark-mode.js
@@ -13,32 +13,31 @@
   let pref = localStorage.getItem('dark_mode_pref');
 
   // keep track of current state (light by default)
-  let activated = false;
+  let dark = false;
 
-  // dynamically switch utteranc.es's theme
-  let utterancesInit = false;
-  const setUtterances = function() {
-    let theme = activated ? 'github-dark' : 'github-light';
+  // load utteranc.es with proper theme and dynamically switch it
+  let utterancesLoaded = false;
+  const setUtterancesTheme = function(theme) {
     const container = document.querySelector('div#comments');
 
     // don't do any of this if we're not on a page with comments enabled
     if (container) {
-      if (!utterancesInit) {
+      if (!utterancesLoaded) {
         const script = document.createElement('script');
         script.type = 'text/javascript';
         script.async = true;
         script.defer = true;
         script.src = 'https://utteranc.es/client.js';
-        script.crossorigin = true;
+        script.crossOrigin = 'anonymous';
         script.setAttribute('data-repo', '{{ .Site.Params.github | safeJS }}');
+        script.setAttribute('data-label', 'comments');
         script.setAttribute('data-issue-term', 'og:title');
         script.setAttribute('data-theme', theme);
-        script.setAttribute('data-label', 'comments');
         container.appendChild(script);
 
-        utterancesInit = true;
+        utterancesLoaded = true;
       } else {
-        const frame = document.querySelector('.utterances-frame');
+        const frame = document.querySelector('iframe.utterances-frame');
 
         // be extra sure frame exists
         if (frame) {
@@ -46,7 +45,7 @@
           frame.contentWindow.postMessage({
             type: 'set-theme',
             theme: theme
-          }, '*');
+          }, 'https://utteranc.es');
         }
       }
     }
@@ -56,18 +55,18 @@
     document.body.classList.remove('light');
     document.body.classList.add('dark');
 
-    activated = true;
+    dark = true;
 
-    setUtterances();
+    setUtterancesTheme('github-dark');
   };
 
   const activateLightMode = function() {
     document.body.classList.remove('dark');
     document.body.classList.add('light');
 
-    activated = false;
+    dark = false;
 
-    setUtterances();
+    setUtterancesTheme('github-light');
   };
 
   // if user already explicitly toggled in the past, restore their preference.
@@ -93,7 +92,7 @@
   // handle lightbulb click
   toggle.addEventListener('click', function() {
     // switch to the opposite theme & save preference in local storage
-    if (!activated) {
+    if (!dark) {
       activateDarkMode();
       localStorage.setItem('dark_mode_pref', 'true');
     } else {
diff --git a/assets/vendor/emoji/emoji.js b/assets/vendor/emoji/emoji.js
index 1e630191..1a6d2c89 100644
--- a/assets/vendor/emoji/emoji.js
+++ b/assets/vendor/emoji/emoji.js
@@ -1,11 +1,11 @@
 /* jshint indent: 2, browser: true, bitwise: true, plusplus: true */
 
 /*!
-*
-*  Copyright Twitter Inc. and other contributors. Licensed under MIT.
-*  https://github.com/twitter/twemoji/blob/gh-pages/LICENSE
-*
-*/
+ *
+ *  Copyright Twitter Inc. and other contributors. Licensed under MIT.
+ *  https://github.com/twitter/twemoji/blob/gh-pages/LICENSE
+ *
+ */
 
 (function (
 
diff --git a/config.toml b/config.toml
index 2a883ffb..23f7edd4 100644
--- a/config.toml
+++ b/config.toml
@@ -30,6 +30,7 @@ disableAliases = true
   defaultImage = "img/me_large.jpg"
   github = "jakejarvis/jarv.is"
   facebookAppID = "3357248167622283"
+  webmention = "jarv.is"
   copyrightFirstYear = "2001"
   license = "CC-BY-4.0"
   licenseFull = "Creative Commons Attribution 4.0 International"
@@ -157,9 +158,3 @@ disableAliases = true
     lineNumbersInTable = true
     noClasses = true
     tabWidth = 4
-
-[server]
-  [[server.headers]]
-    for = "/**"
-    [server.headers.values]
-      Access-Control-Allow-Origin = "*"
diff --git a/layouts/partials/head/webmention.html b/layouts/partials/head/webmention.html
index 61d44dae..5ba43705 100644
--- a/layouts/partials/head/webmention.html
+++ b/layouts/partials/head/webmention.html
@@ -1,2 +1,4 @@
-<link rel="pingback" href="https://webmention.io/jarv.is/xmlrpc">
-<link rel="webmention" href="https://webmention.io/jarv.is/webmention">
+{{ with .Site.Params.webmention }}
+<link rel="pingback" href="https://webmention.io/{{ . }}/xmlrpc">
+<link rel="webmention" href="https://webmention.io/{{ . }}/webmention">
+{{ end }}
diff --git a/netlify.toml b/netlify.toml
index da343c94..a369da66 100644
--- a/netlify.toml
+++ b/netlify.toml
@@ -44,10 +44,7 @@
 [[headers]]
   for = "/*"
   [headers.values]
-    # Needed to fix utteranc.es + CORS issues.
-    # Cringey but not a huge deal for this site.
-    Access-Control-Allow-Origin = "*"
-    # 🐄🐄🐄
+    # 🐄
     X-Got-Milk = "2%"
 
 # PGP file: open in browser, download correctly