fix: dark-mode email body legibility and cross-subdomain visited flag

rubenhensen · rubenhensen · commit 557494ee04d9 · 2026-05-12T11:43:46.000+02:00
- EmailView: render decrypted email in a forced light-themed iframe so emails that hardcode dark text on no background stay legible when the host page is in dark mode (#159). - Marketing page: store the returning-visitor flag in a cookie scoped to the registrable domain so it carries across postguard.eu subdomains instead of being trapped per-origin in localStorage (#208).
diff --git a/src/lib/components/fallback/EmailView.svelte b/src/lib/components/fallback/EmailView.svelte
@@ -70,7 +70,7 @@
 
         <div class="email-body">
             <iframe
-                srcdoc={`<style>body{margin:1rem}</style>${parsed.html ?? parsed.text ?? ''}`}
+                srcdoc={`<!doctype html><html><head><meta charset="utf-8"><style>:root{color-scheme:light}html,body{background:#fff;color:#000}body{margin:1rem}</style></head><body>${parsed.html ?? parsed.text ?? ''}</body></html>`}
                 title="Mail message"
                 sandbox=""
             ></iframe>
diff --git a/src/lib/visitedCookie.ts b/src/lib/visitedCookie.ts
@@ -0,0 +1,25 @@
+const COOKIE_NAME = 'pg_visited'
+const ONE_YEAR_SECONDS = 60 * 60 * 24 * 365
+
+function registrableDomain(hostname: string): string | null {
+    if (!hostname || hostname === 'localhost') return null
+    if (/^\d+\.\d+\.\d+\.\d+$/.test(hostname)) return null
+    const parts = hostname.split('.')
+    if (parts.length < 2) return null
+    return parts.slice(-2).join('.')
+}
+
+export function hasVisited(): boolean {
+    if (typeof document === 'undefined') return false
+    return document.cookie
+        .split(';')
+        .some((c) => c.trim().startsWith(`${COOKIE_NAME}=`))
+}
+
+export function markVisited(): void {
+    if (typeof document === 'undefined') return
+    const domain = registrableDomain(window.location.hostname)
+    const secure = window.location.protocol === 'https:' ? '; Secure' : ''
+    const domainAttr = domain ? `; Domain=.${domain}` : ''
+    document.cookie = `${COOKIE_NAME}=1; Max-Age=${ONE_YEAR_SECONDS}; Path=/; SameSite=Lax${domainAttr}${secure}`
+}
diff --git a/src/routes/(marketing)/+page.js b/src/routes/(marketing)/+page.js
@@ -1,13 +1,14 @@
 import { browser } from '$app/environment'
 import { redirect } from '@sveltejs/kit'
+import { hasVisited } from '$lib/visitedCookie'
 
 export function load() {
     // Only redirect returning visitors on direct/external navigation (full page load),
     // not on client-side navigations (e.g. clicking "Home" in the navbar).
     if (
         browser &&
         !(/** @type {any} */ (window).__pg_client_nav) &&
-        localStorage.getItem('pg_visited')
+        hasVisited()
     ) {
         redirect(302, '/fileshare')
     }
diff --git a/src/routes/(marketing)/+page.svelte b/src/routes/(marketing)/+page.svelte
@@ -4,11 +4,12 @@
     import { resolve } from '$app/paths'
     import SEO from '$lib/components/SEO.svelte'
     import { FF_BUSINESS } from '$lib/env'
+    import { markVisited } from '$lib/visitedCookie'
 
     let contactEl: HTMLAnchorElement
 
     onMount(() => {
-        localStorage.setItem('pg_visited', 'true')
+        markVisited()
         if (contactEl) {
             const addr = `${contactEl.dataset.name}@${contactEl.dataset.domain}`
             contactEl.href = `mailto:${addr}`
