runlight 0.2.0__tar.gz → 0.3.0__tar.gz

{runlight-0.2.0 → runlight-0.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: runlight
-Version: 0.2.0
+Version: 0.3.0
 Summary: Privacy friendly web analytics that lives inside your Python app. Mount a route, add a script tag, read your stats at /runlight.
 Project-URL: Homepage, https://runlight.sh
 Project-URL: Documentation, https://runlight.sh/docs/python/
@@ -61,7 +61,7 @@ rl = Runlight(
 )
 ```
 
-If nothing sits in front of your app (no load balancer, CDN, or reverse proxy), add `trust_proxy=False`, so a visitor cannot pick their own address with an `X-Forwarded-For` header. Runlight logs a warning once when it sees requests arrive that way with the default left on.
+Runlight reads the visitor's address from `X-Forwarded-For` and similar headers only when the request comes from this computer or a private network, where proxies and load balancers connect from, so a visitor who reaches your app straight from the internet cannot pick their own address. Behind a CDN that connects from public addresses, such as Cloudflare in front of your server, add `trust_proxy="cf-connecting-ip"` (the header it sets) or `trust_proxy=True`. Runlight logs a warning once when a public address sends forwarding headers that the default did not believe. `trust_proxy=False` never reads them.
 
 Put it in front of your app. In Flask that is one line.
 

{runlight-0.2.0 → runlight-0.3.0}/README.md

@@ -26,7 +26,7 @@ rl = Runlight(
 )
 ```
 
-If nothing sits in front of your app (no load balancer, CDN, or reverse proxy), add `trust_proxy=False`, so a visitor cannot pick their own address with an `X-Forwarded-For` header. Runlight logs a warning once when it sees requests arrive that way with the default left on.
+Runlight reads the visitor's address from `X-Forwarded-For` and similar headers only when the request comes from this computer or a private network, where proxies and load balancers connect from, so a visitor who reaches your app straight from the internet cannot pick their own address. Behind a CDN that connects from public addresses, such as Cloudflare in front of your server, add `trust_proxy="cf-connecting-ip"` (the header it sets) or `trust_proxy=True`. Runlight logs a warning once when a public address sends forwarding headers that the default did not believe. `trust_proxy=False` never reads them.
 
 Put it in front of your app. In Flask that is one line.
 

{runlight-0.2.0 → runlight-0.3.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "runlight"
-version = "0.2.0"
+version = "0.3.0"
 description = "Privacy friendly web analytics that lives inside your Python app. Mount a route, add a script tag, read your stats at /runlight."
 readme = "README.md"
 license = "MIT"

{runlight-0.2.0 → runlight-0.3.0}/src/runlight/accounts/auth.py

@@ -2,15 +2,18 @@
 signed in. The standalone server always has them, and an app turns them on with routes({"accounts": True}).
 
 A user is a dict with the TypeScript User's keys: id, email, hash, role ("owner", "admin", "member", or
-"viewer"), createdAt, twoFactor (whether sign-in also asks for a code), and recoveryLeft (recovery codes not yet
-used). An invite has id, email, role, invitedBy, createdAt, and expiresAt.
+"viewer"), createdAt, twoFactor (whether sign-in also asks for a code), recoveryLeft (recovery codes not yet
+used), and signedOut when set (a mark signing out replaces, which every session is signed with). An invite has
+id, email, role, invitedBy, createdAt, and expiresAt.
 """
 
 from __future__ import annotations
 
+import datetime as _dt
 import re
 import struct
 import threading
+import time as _time
 from collections.abc import Callable
 from typing import TYPE_CHECKING, Any, TypeVar
 
@@ -255,8 +258,14 @@ class Accounts:
             if "role" not in names:
                 db.run(f"ALTER TABLE rl_users ADD COLUMN role {text(20)} NOT NULL DEFAULT 'owner'")
             # Two-factor came later still: the secret (sealed), one being set up, recovery code hashes, and the last
-            # code's step.
-            for name, kind in (("totp_secret", "TEXT"), ("totp_pending", "TEXT"), ("totp_recovery", "TEXT"), ("totp_step", "BIGINT")):
+            # code's step. And the mark signing out replaces, later again.
+            for name, kind in (
+                ("totp_secret", "TEXT"),
+                ("totp_pending", "TEXT"),
+                ("totp_recovery", "TEXT"),
+                ("totp_step", "BIGINT"),
+                ("signed_out", "TEXT"),
+            ):
                 if name not in names:
                     db.run(f"ALTER TABLE rl_users ADD COLUMN {name} {kind}")
             db.run(
@@ -290,6 +299,7 @@ class Accounts:
             "createdAt": _js.number(r["created_at"]),
             "twoFactor": _js.truthy(r.get("totp_secret")),
             "recoveryLeft": len(_recovery_list(r.get("totp_recovery"))),
+            **({"signedOut": _js.string(r["signed_out"])} if _js.truthy(r.get("signed_out")) else {}),
         }
 
     def _seal(self, text: str) -> str:
@@ -676,10 +686,16 @@ class Accounts:
             return None
         return user if same_text(self._sign(f"{id_}.{expires}", self._session_key(user)), signed) else None
 
+    def end_sessions(self, id: str) -> None:  # noqa: A002
+        """Ends every session an account has, in every browser, as signing out does."""
+        self._init()
+        self.store.db.run("UPDATE rl_users SET signed_out = ? WHERE id = ?", [hex(random_bytes(8)), id])
+
     def _session_key(self, user: dict[str, Any]) -> str:
-        """What a session is signed with: the password hash, and whether two-factor is on, so changing either ends
-        other sessions."""
-        return f"{user['hash']}{'.2fa' if user['twoFactor'] else ''}"
+        """What a session is signed with: the password hash, whether two-factor is on, and a mark that signing out
+        replaces, so changing any of them ends other sessions."""
+        signed_out = user.get("signedOut")
+        return f"{user['hash']}{'.2fa' if user['twoFactor'] else ''}{f'.{signed_out}' if signed_out else ''}"
 
     def device_for(self, user: dict[str, Any]) -> str:
         """A long-lived mark for a browser that signed in to an account. With it, failed tries by others
@@ -701,72 +717,95 @@ class Accounts:
 
 class Throttle:
     """Counts failed sign-ins under a key and refuses more than a few in a while.
-    Keys are hashed, so the counts never hold an address or an email as it was
-    given.
+    Keys are hashed with a key made for the day, so the counts never hold an
+    address or an email as it was given.
 
     TypeScript keeps the counts in its process. A Python app often runs several
     worker processes, so here they live in the database's settings, as the PHP
     port keeps them: "throttle:<name>:<id>" holding {count, until}, and the
-    hashing key as "throttle-key". Every process of an install then shares the
-    same counts, and the two ports read each other's.
+    hashing key as "throttle-key:<UTC day>". Every process of an install then
+    shares the same counts, and the two ports read each other's.
 
-    With `memory`, the counts stay in the process instead, hashed with a key
-    made at start, as TypeScript keeps them. That is for keys holding a client's
-    address: the database never sees them, so a copy of it cannot be used to
-    work out who tried to sign in from where."""
+    Some ids come from an address, so none may last past a day: each UTC day
+    has its own key, keys older than yesterday are deleted, and counts that ran
+    out go when read, when a new count starts, and in the scheduled check. A
+    window that crosses midnight starts again under the new day's key."""
 
-    _KEY = "throttle-key"
+    _KEY = "throttle-key:"
+    # The one key kept before keys were made each day.
+    _OLD_KEY = "throttle-key"
 
-    def __init__(self, store: SqlStore, name: str, limit: int = 10, window_ms: int = 15 * 60_000, memory: bool = False) -> None:
+    def __init__(
+        self, store: SqlStore, name: str, limit: int = 10, window_ms: int = 15 * 60_000, clock: Callable[[], int] | None = None
+    ) -> None:
         self.store = store
         self.name = name
         self.limit = limit
         self.window_ms = window_ms
+        # Milliseconds since the epoch, for forgive() and clear(), which are given no time.
+        self._clock: Callable[[], int] = clock if clock is not None else (lambda: int(_time.time() * 1000))
         self._lock = threading.Lock()
-        self._memory: dict[str, dict[str, int]] | None = {} if memory else None
-        self._memory_salt = random_bytes(16)
-        # Counts kept in the settings before they moved into the process are deleted on first use.
-        self._swept = not memory
-
-    def _salt(self) -> str:
-        saved = self.store.setting(self._KEY)
-        if saved:
-            return saved
-        from ..hash import random_id
-
-        made = random_id(16)
-        self.store.set_setting(self._KEY, made)
-        return made
-
-    def _id(self, key: str) -> str:
-        salt: str | bytes = self._memory_salt if self._memory is not None else self._salt()
-        return base64url(hmac("SHA-256", salt, key))[:22]
-
-    def _sweep(self) -> None:
-        if self._swept:
-            return
-        self._swept = True
-        for setting in self.store.settings_starting_with(self._prefix()):
-            self.store.set_setting(setting["key"], None)
+        # Today's key once read, so each count does not read it again.
+        self._salts: tuple[str, str] | None = None
+
+    @staticmethod
+    def _day(now: int) -> str:
+        return _dt.datetime.fromtimestamp(now // 1000, _dt.UTC).strftime("%Y-%m-%d")
+
+    def _salt(self, now: int) -> str:
+        day = self._day(now)
+        if self._salts is not None and self._salts[0] == day:
+            return self._salts[1]
+        key = self._KEY + day
+        saved = self.store.setting(key)
+        if not saved:
+            from ..hash import random_id
+
+            # Kept only if there is none yet, so two processes starting at once settle on one key.
+            made = random_id(16)
+            db = self.store.db
+            db.run(upsert(db.dialect(), "rl_settings", ['"key"', "value"], ['"key"'], []), [key, made])
+            saved = self.store.setting(key) or made
+            if saved == made:
+                Throttle.sweep(self.store, now)
+        self._salts = (day, saved)
+        return saved
+
+    @staticmethod
+    def sweep(store: SqlStore, now: int) -> None:
+        """Deletes the counts of every throttle that have run out, the hashing keys older than yesterday, and the
+        one key kept before there was one a day, so nothing an id was made from outlasts a day. The scheduled
+        check runs it, and so does the first count of each day."""
+        keep = {Throttle._KEY + Throttle._day(now), Throttle._KEY + Throttle._day(now - 86_400_000)}
+        for setting in store.settings_starting_with(Throttle._KEY):
+            if setting["key"] not in keep:
+                store.set_setting(setting["key"], None)
+        if store.setting(Throttle._OLD_KEY) is not None:
+            store.set_setting(Throttle._OLD_KEY, None)
+        for setting in store.settings_starting_with("throttle:"):
+            ok, entry = _js.try_loads(setting["value"])
+            if not ok or not isinstance(entry, dict) or int(_js.number(entry.get("until", 0))) <= now:
+                store.db.run('DELETE FROM rl_settings WHERE "key" = ? AND value = ?', [setting["key"], setting["value"]])
+
+    def _id(self, key: str, now: int) -> str:
+        return base64url(hmac("SHA-256", self._salt(now), key))[:22]
 
     def _prefix(self) -> str:
         return f"throttle:{self.name}:"
 
-    def _entry(self, id_: str) -> dict[str, int] | None:
-        if self._memory is not None:
-            return self._memory.get(id_)
-        saved = self.store.setting(self._prefix() + id_)
-        ok, entry = _js.try_loads(saved) if saved is not None else (False, None)
-        if not ok or not isinstance(entry, dict):
+    def _entry(self, id_: str, now: int) -> dict[str, int] | None:
+        """A count still running. One that has run out is deleted as it is read."""
+        key = self._prefix() + id_
+        saved = self.store.setting(key)
+        if saved is None:
+            return None
+        ok, entry = _js.try_loads(saved)
+        if not ok or not isinstance(entry, dict) or int(_js.number(entry.get("until", 0))) <= now:
+            self._drop(key, saved)
             return None
         return {"count": int(_js.number(entry.get("count", 0))), "until": int(_js.number(entry.get("until", 0)))}
 
     def _save(self, id_: str, entry: dict[str, int]) -> None:
-        if self._memory is not None:
-            # Newest last, so the map's order is the order entries were made, as a JavaScript Map keeps it.
-            self._memory.pop(id_, None)
-            self._memory[id_] = entry
-            return
         self.store.set_setting(self._prefix() + id_, _js.dumps(entry))
 
     def _turn(self, id_: str, make: bool, fn: Callable[[], T]) -> T:
@@ -774,10 +813,6 @@ class Throttle:
         room under the limit: one thread at a time in this process, and a transaction holding the entry's row
         against other processes. SQLite's transaction holds the whole file; on Postgres and MySQL the row is
         locked, made first (empty, which reads as expired) when `make` asks and it is not there yet."""
-        if self._memory is not None:
-            self._sweep()
-            with self._lock:
-                return fn()
         db = self.store.db
 
         def step(_db: Any) -> T:
@@ -793,19 +828,11 @@ class Throttle:
             return db.transaction(step)
 
     def blocked(self, key: str, now: int) -> bool:
-        return self._is_blocked(self._id(key), now)
-
-    def _is_blocked(self, id_: str, now: int) -> bool:
-        if self._memory is not None:
-            with self._lock:
-                return self._blocked_now(id_, now)
-        return self._blocked_now(id_, now)
+        return self._blocked_now(self._id(key, now), now)
 
     def _blocked_now(self, id_: str, now: int) -> bool:
-        entry = self._entry(id_)
-        if entry is None or entry["until"] <= now:
-            return False
-        return entry["count"] >= self.limit
+        entry = self._entry(id_, now)
+        return entry is not None and entry["count"] >= self.limit
 
     def take(self, key: str, now: int) -> bool:
         """Counts a try before the slow check it guards, so a burst that arrives
@@ -813,7 +840,7 @@ class Throttle:
         False, counting nothing, when the key is already at its limit. A try
         that turns out right is taken back with forgive(). The check and the
         count happen as one step, across threads and processes."""
-        id_ = self._id(key)
+        id_ = self._id(key, now)
 
         def step() -> tuple[bool, bool]:
             if self._blocked_now(id_, now):
@@ -827,31 +854,30 @@ class Throttle:
 
     def forgive(self, key: str) -> None:
         """Takes back one counted try, for one that turned out right."""
-        id_ = self._id(key)
+        now = self._clock()
+        id_ = self._id(key, now)
 
         def step() -> None:
-            entry = self._entry(id_)
+            entry = self._entry(id_, now)
             if entry is not None and entry["count"] > 0:
                 entry["count"] -= 1
-                if self._memory is None:
-                    self._save(id_, entry)
+                self._save(id_, entry)
 
         self._turn(id_, False, step)
 
     def fail(self, key: str, now: int) -> None:
-        id_ = self._id(key)
+        id_ = self._id(key, now)
         if self._turn(id_, True, lambda: self._count(id_, now)):
             self._prune(now)
 
     def _count(self, id_: str, now: int) -> bool:
         """Counts a try, and says whether that made a new entry."""
-        entry = self._entry(id_)
-        if entry is None or entry["until"] <= now:
+        entry = self._entry(id_, now)
+        if entry is None:
             self._save(id_, {"count": 1, "until": now + self.window_ms})
             return True
         entry["count"] += 1
-        if self._memory is None:
-            self._save(id_, entry)
+        self._save(id_, entry)
         return False
 
     def _drop(self, key: str, value: str) -> None:
@@ -859,13 +885,10 @@ class Throttle:
         self.store.db.run('DELETE FROM rl_settings WHERE "key" = ? AND value = ?', [key, value])
 
     def _prune(self, now: int) -> None:
-        """Expired entries go first, then the oldest that are not blocked, and blocked ones last, so the counts
-        have a hard ceiling and a flood of made-up names cannot wipe out a real block. Run when a new entry is
-        made, since only then can there be more."""
-        if self._memory is not None:
-            with self._lock:
-                self._prune_memory(now)
-            return
+        """Expired entries go first, then those with the fewest tries, oldest first, down to nine tenths of the
+        ceiling so this runs seldom. A flood of made-up names has one try each, so it cannot wipe out a block,
+        or the count of a name someone is close to blocking. Run when a new entry is made, since only then can
+        there be more."""
         entries = []
         for setting in self.store.settings_starting_with(self._prefix()):
             ok, entry = _js.try_loads(setting["value"])
@@ -874,39 +897,13 @@ class Throttle:
                 self._drop(setting["key"], setting["value"])
                 continue
             count = int(_js.number(entry.get("count", 0))) if isinstance(entry, dict) else 0
-            entries.append({"key": setting["key"], "value": setting["value"], "until": until, "blocked": count >= self.limit})
-        size = len(entries)
-        if size <= MAX_THROTTLED:
-            return
-        # Oldest first: each entry's window started window_ms before its end.
-        entries.sort(key=lambda e: e["until"])
-        for blocked in (False, True):
-            for entry in entries:
-                if size <= MAX_THROTTLED:
-                    return
-                if entry["blocked"] is blocked:
-                    self._drop(entry["key"], entry["value"])
-                    size -= 1
-
-    def _prune_memory(self, now: int) -> None:
-        failures = self._memory
-        assert failures is not None
-        if len(failures) <= MAX_THROTTLED:
+            entries.append({"key": setting["key"], "value": setting["value"], "until": until, "count": count})
+        if len(entries) <= MAX_THROTTLED:
             return
-        for k in [k for k, v in failures.items() if v["until"] <= now]:
-            del failures[k]
-        for k in [k for k, v in failures.items() if v["count"] < self.limit]:
-            if len(failures) <= MAX_THROTTLED:
-                break
-            del failures[k]
-        for k in list(failures):
-            if len(failures) <= MAX_THROTTLED:
-                break
-            del failures[k]
+        # Each entry's window started window_ms before its end, so the earliest end is the oldest.
+        entries.sort(key=lambda e: (e["count"], e["until"]))
+        for entry in entries[: len(entries) - MAX_THROTTLED * 9 // 10]:
+            self._drop(entry["key"], entry["value"])
 
     def clear(self, key: str) -> None:
-        if self._memory is not None:
-            with self._lock:
-                self._memory.pop(self._id(key), None)
-            return
-        self.store.set_setting(self._prefix() + self._id(key), None)
+        self.store.set_setting(self._prefix() + self._id(key, self._clock()), None)

{runlight-0.2.0 → runlight-0.3.0}/src/runlight/accounts/crypto.py

@@ -107,6 +107,10 @@ def _scrypt_cost(parts: list[str]) -> dict[str, int] | None:
     # N a power of two up to 2^20, and r and p small, so a stored hash cannot ask for a huge amount of memory or time.
     if not whole(n, 1 << 20) or n < 2 or (int(n) & (int(n) - 1)) != 0 or not whole(r, 32) or not whole(p, 16):
         return None
+    # N must also be below 2^(16r), as scrypt itself requires, so a stored hash past that fails to match rather than
+    # raises.
+    if int(n).bit_length() - 1 >= 16 * int(r):
+        return None
     return {"N": int(n), "r": int(r), "p": int(p)}
 
 

{runlight-0.2.0 → runlight-0.3.0}/src/runlight/accounts/web.py

@@ -128,7 +128,7 @@ def _role_of(value: Any) -> str | None:
 
 class AccountsWeb:
     """What accounts_web() hands back: `accounts`, and signed_in(), access(), account_of(), token_made(),
-    has_account(), and handle()."""
+    tokens_of(), has_account(), and handle()."""
 
     def __init__(self, options: Mapping[str, Any]) -> None:
         self.rl = options["runlight"]
@@ -153,15 +153,16 @@ class AccountsWeb:
         # cannot keep the server hashing; a request with no known address skips that one,
         # since it would hold up everyone at once.
         # Each try counts before the password is checked, and a right one is taken back.
-        # Counts by address stay in the process, as TypeScript keeps them, so no address reaches the database.
-        self.per_address = Throttle(self.store, "address", 10, memory=True)
-        self.per_account = Throttle(self.store, "account", 50)
-        self.per_ip = Throttle(self.store, "ip", 30, memory=True)
+        # The counts live in the database, so every worker process shares them, hashed with a key for the day, so
+        # nothing made from an address lasts past a day.
+        self.per_address = Throttle(self.store, "address", 10, clock=self.now)
+        self.per_account = Throttle(self.store, "account", 50, clock=self.now)
+        self.per_ip = Throttle(self.store, "ip", 30, clock=self.now)
         # Six-digit codes: five wrong tries an account every fifteen minutes, and five to confirm the first one.
         # Password re-checks in Account: ten.
-        self.code_tries = Throttle(self.store, "code", 5)
-        self.confirm_tries = Throttle(self.store, "confirm", 5)
-        self.rechecks = Throttle(self.store, "recheck", 10)
+        self.code_tries = Throttle(self.store, "code", 5, clock=self.now)
+        self.confirm_tries = Throttle(self.store, "confirm", 5, clock=self.now)
+        self.rechecks = Throttle(self.store, "recheck", 10, clock=self.now)
 
     def now(self) -> int:
         return self._now()
@@ -312,6 +313,11 @@ class AccountsWeb:
             return Response(AUTH_CSS, 200, {"content-type": "text/css; charset=utf-8", "cache-control": "public, max-age=3600"})
         if path == "/auth.js":
             return Response(auth_js(query.get("lang") or "en"), 200, {"content-type": "application/javascript; charset=utf-8", "cache-control": "public, max-age=3600"})
+        # A form posted from another site, or a sibling one, could sign someone in to an account that is not theirs or
+        # plant a session, so these pages take forms only from their own. The browser says where a request came from.
+        cross_site = request.headers.get("sec-fetch-site") in ("cross-site", "same-site")
+        if cross_site and (method == "POST" or path == "/logout") and path in ("/setup", "/login", "/login/code", "/invite", "/logout"):
+            return _html(login_page(base, {"error": t("oauth.anotherSiteTitle"), "next": self.home_path, "forgot": self.forgot}, lang), 403)
 
         if path == "/setup":
             if self.has_account():
@@ -382,6 +388,7 @@ class AccountsWeb:
             self.code_tries.clear(user["id"])
             return self._signed_in_to(request, user, next_)
 
+        # Signing out ends this browser's session; the account page can end them everywhere.
         if path == "/logout":
             return _redirect(f"{base}/login", {"set-cookie": self._session_cookie(request, "", 0)})
 
@@ -505,6 +512,10 @@ class AccountsWeb:
             return _coded("Send JSON", "send_json", 415)
         if path == "/api/account" and method == "GET":
             return _reply({"account": _person(user)})
+        # Ends the account's sessions in every browser, this one too, so a cookie copied before stops working.
+        if path == "/api/account/sign-out-everywhere" and method == "POST":
+            self.accounts.end_sessions(user["id"])
+            return _reply({"ok": True}, 200, {"set-cookie": self._session_cookie(request, "", 0)})
 
         if path == "/api/account/password" and method == "POST":
             input = _body(request)  # noqa: A001
@@ -515,6 +526,9 @@ class AccountsWeb:
                 return refused
             try:
                 updated = self.accounts.set_password(user["email"], _field(input, "next"), now)
+                # Asked for after a password got out: the tokens and apps the account made could still read on.
+                if input.get("revokeTokens") is True:
+                    self._drop_tokens_of(user["id"])
                 # The new password ends every other sign-in; this browser gets a fresh one.
                 return _reply({"ok": True}, 200, self._fresh(request, updated))
             except AccountError as error:
@@ -674,6 +688,10 @@ class AccountsWeb:
         self.store.set_setting(f"{MADE_BY}{token['id']}", by)
         return True
 
+    def tokens_of(self, by: str) -> set[str]:
+        """The ids of the tokens an account made."""
+        return {s["key"][len(MADE_BY) :] for s in self.store.settings_starting_with(MADE_BY) if s["value"] == by}
+
     def handle(self, request: Request, path: str, context: Mapping[str, Any] | None = None) -> Response | None:
         """Answers an account page or API request at a path under the base, or None for anything else."""
         context = context or {}

{runlight-0.2.0 → runlight-0.3.0}/src/runlight/assets/build.json

@@ -1,10 +1,10 @@
 {
   "note": "Written by scripts/python-assets.mts from the TypeScript SDK's generated files. Do not edit.",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "apiVersion": 1,
-  "dashboardHash": "36bad85248ab",
+  "dashboardHash": "89287c3e896f",
   "worldHash": "4422113781f8",
-  "localesHash": "2be1f2e59c89",
+  "localesHash": "0a7b5e462a6b",
   "trackerHash": "52fcb1901ce5",
   "icon": "data:image/svg+xml,%3Csvg%20xmlns%3D%22http%3A//www.w3.org/2000/svg%22%20viewBox%3D%220%200%2032%2032%22%3E%3Cstyle%3E.h%7Bfill%3A%23000%7D.r%7Bstroke%3A%23fff%7D%40media%20%28prefers-color-scheme%3Adark%29%7B.h%7Bfill%3A%23fff%7D.r%7Bstroke%3A%23000%7D%7D%3C/style%3E%3Crect%20class%3D%22h%22%20x%3D%222.5%22%20y%3D%222.5%22%20width%3D%2227%22%20height%3D%2227%22%20rx%3D%227%22/%3E%3Cpath%20class%3D%22r%22%20d%3D%22M11%2023V9h6.2a4.3%204.3%200%200%201%200%208.6H11m6%200%205%205.4%22%20fill%3D%22none%22%20stroke-width%3D%222.8%22%20stroke-linecap%3D%22round%22%20stroke-linejoin%3D%22round%22/%3E%3Ccircle%20cx%3D%2223.6%22%20cy%3D%228.4%22%20r%3D%222.6%22%20fill%3D%22%2322c55e%22/%3E%3C/svg%3E"
 }