Drop the inline <style> from the shipped logo (4.0.1)

CLAUDE.md

@@ -77,6 +77,14 @@ crafted `next` cannot smuggle a second `uri` to the next hop.
 **`default_auto_field` stays `AutoField`.** The one place the estate departs from
 `conventions.md`'s `BigAutoField` rule, deliberately — see the comment in `apps.py`.
 
+## Templates
+
+**No inline styles or scripts — the logo included.** `login.html` is rendered by every
+consumer, so a single `<style>`, `style=`, `on*=` or `<script>` without `src` in it forces
+`'unsafe-inline'` into all of their CSPs. That includes `logo.svg`, which is
+`{% include %}`d rather than linked. `test_login_page_has_no_inline_style_or_script` and
+chi-platform's `no-inline-style-or-script` check both enforce it (#19).
+
 ## Tests
 
 `python runtests.py` — the suite runs standalone, with no host project. `tests/settings.py`

README.md

@@ -35,15 +35,15 @@ example to copy from.
 Install from GitHub with pip
 
 ```shell
-pip install "user_manager @ git+https://github.com/Center-for-Health-Informatics/django_user_manager.git@v4.0.0"
+pip install "user_manager @ git+https://github.com/Center-for-Health-Informatics/django_user_manager.git@v4.0.1"
 ```
 
 Check the tag against the latest release — this snippet is hand-maintained and has been
 stale before.
 
 or add to a `requirements.txt` file
 ```
-user_manager @ git+https://github.com/Center-for-Health-Informatics/django_user_manager.git@v4.0.0
+user_manager @ git+https://github.com/Center-for-Health-Informatics/django_user_manager.git@v4.0.1
 ```
 
 Add `user_manager` app to your installed apps
@@ -383,6 +383,14 @@ MIDDLEWARE = [..., "user_manager.middleware.InspectHeadersMiddleware"]
 SPECIAL_LOG_FOLDER = "/var/log/myproject/"
 ```
 
+## Upgrading from 4.0.0 to 4.0.1
+
+- **The sign-in page no longer carries an inline `<style>`.** It came from the shipped
+  `logo.svg`, which `login.html` inlines, and it put one inline style on every consumer's
+  sign-in page — enough to rule out a `Content-Security-Policy` without `'unsafe-inline'`
+  in `style-src`. The rule was a no-op, so nothing changes on screen. No consumer changes
+  needed beyond the pin bump. (#19)
+
 ## Upgrading from 3.2 to 4.0
 
 A larger release than the version alone suggests: it closes the whole open issue queue,

tests/test_views.py

@@ -1,3 +1,4 @@
+import re
 from urllib.parse import quote
 
 from django.contrib.auth import get_user_model
@@ -18,6 +19,16 @@ def test_get_renders_login_form(self):
         self.assertEqual(response.status_code, 200)
         self.assertTemplateUsed(response, "user_manager/login.html")
 
+    def test_login_page_has_no_inline_style_or_script(self):
+        """The page ships into every consumer, so one inline site forces 'unsafe-inline'
+        into all of their CSPs. That includes the logo partial, which is {% include %}d
+        (#19; chi-platform's no-inline-style-or-script check)."""
+        html = self.client.get(LOGIN_URL).content.decode()
+        inline = re.compile(
+            r"<style|\s(?:style|on[a-z]+)=[\"']|<script(?![^>]*\ssrc=)", re.IGNORECASE
+        )
+        self.assertEqual([m.group(0) for m in inline.finditer(html)], [])
+
     def test_successful_login_redirects_to_login_redirect_url(self):
         response = self.client.post(LOGIN_URL, {"username": "ada", "password": "hunter2"})
         self.assertRedirects(response, "/dashboard/", fetch_redirect_response=False)

user_manager/__init__.py

@@ -1 +1 @@
-__version__ = "4.0.0"
+__version__ = "4.0.1"