@rmdes/indiekit-frontend 1.0.0-beta.39 → 1.0.0-beta.40

package/lib/serviceworker.js

@@ -87,6 +87,31 @@ async function notifyClients() {
   }
 }
 
+/**
+ * Remove any cached auth/session pages from the pages cache.
+ * Called on activate to purge stale entries from before the fetch bypass was added.
+ */
+async function clearAuthSessionEntries() {
+  try {
+    const pagesCache = await caches.open(pagesCacheName);
+    const keys = await pagesCache.keys();
+
+    await Promise.all(
+      keys
+        .filter((request) => {
+          const url = new URL(request.url);
+          return (
+            url.origin === self.location.origin &&
+            /^\/(auth|session)(?:\/|$)/.test(url.pathname)
+          );
+        })
+        .map((request) => pagesCache.delete(request)),
+    );
+  } catch (error) {
+    console.error("Error clearing auth/session cache entries", error);
+  }
+}
+
 /**
  * Trim cache
  * @param {string} cacheName - Name of cache
@@ -120,6 +145,7 @@ self.addEventListener("activate", async (event) => {
   event.waitUntil(
     (async () => {
       await clearOldCaches();
+      await clearAuthSessionEntries();
       // Don't clear pages cache on activate — stale cached pages provide a
       // valuable fallback when the network is slow (e.g. right after a deploy).
       // The network-first fetch strategy naturally updates cached pages on
@@ -150,13 +176,23 @@ self.addEventListener("fetch", (event) => {
   // Cross-origin images (avatars, album covers, etc.) must be handled
   // by the browser natively — opaque responses from SW fetch are unreliable
   // and caching them wastes ~7MB each against storage quota.
+  const requestUrl = new URL(request.url);
   if (
-    new URL(request.url).origin !== self.location.origin ||
+    requestUrl.origin !== self.location.origin ||
     request.method !== "GET"
   ) {
     return;
   }
 
+  // Never cache auth/session pages — always go to network.
+  // Stale cached auth responses break login detection (admin.js probes
+  // /session/login to check if owner is logged in) and can serve
+  // authenticated pages after session expiry.
+  if (/^\/(auth|session)(?:\/|$)/.test(requestUrl.pathname)) {
+    event.respondWith(fetch(request));
+    return;
+  }
+
   // For HTML requests: network-first with conditional timeout
   // - If a cached version exists: race network against timeout, serve cache on timeout
   // - If no cached version: wait for network without timeout (avoid premature "Offline")

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rmdes/indiekit-frontend",
-  "version": "1.0.0-beta.39",
+  "version": "1.0.0-beta.40",
   "description": "Frontend components for Indiekit (fork with floating toolbar)",
   "keywords": [
     "express",