feedkeeper 0.27.2 → 0.28.1

package/web/dist/index.html

@@ -30,7 +30,7 @@
     <meta name="twitter:image" content="/logo.svg" />
     <!-- Inline so the splash paints before any script or stylesheet loads -->
     <style>html{background:#f8fafc}html[data-theme=dark]{background:#0b0f17}@media (prefers-color-scheme:dark){html:not([data-theme=light]){background:#0b0f17}}#splash{z-index:100;background:inherit;justify-content:center;align-items:center;transition:opacity .3s;display:flex;position:fixed;inset:0}#splash img{width:62px;height:62px;animation:.4s both splash-in}#splash.splash-hidden{opacity:0;pointer-events:none}@keyframes splash-in{0%{opacity:0;transform:scale(.92)}}@media (prefers-reduced-motion:reduce){#splash,#splash img{transition:none;animation:none}}</style>
-    <script type="module" crossorigin src="/assets/index-Ci8_fWis.js"></script>
+    <script type="module" crossorigin src="/assets/index-CTTNHCfi.js"></script>
     <link rel="stylesheet" crossorigin href="/assets/index-BprbGvrl.css">
   </head>
   <body>

package/web/dist/sw.js

@@ -1,8 +1,27 @@
 // FeedKeeper service worker. Built into dist/sw.js, where the placeholder below is
 // replaced with a hash of the build's file names so every release gets its own app cache.
-const BUILD_ID = "e34333ade39b";
+const BUILD_ID = "0038c2a9c847";
 const STATIC_CACHE = `fk-static-${BUILD_ID}`;
 const API_CACHE = "fk-api";
+let privateGeneration = 0;
+let authenticationChanges = 0;
+
+async function invalidatePrivateCache() {
+  privateGeneration++;
+  await caches.delete(API_CACHE);
+}
+
+async function authenticate(request) {
+  authenticationChanges++;
+  try {
+    await invalidatePrivateCache();
+    return await fetch(request);
+  } finally {
+    // Responses that started before the cookie changed must not refill the new session's cache.
+    await invalidatePrivateCache();
+    authenticationChanges--;
+  }
+}
 const SHELL = "/index.html";
 const PRECACHE = ["/theme-init.js", "/manifest.webmanifest", "/logo.svg", "/favicon-32.png?v=2", "/app-icon-180.png?v=2", "/app-icon-192.png?v=2", "/app-icon-512.png?v=2"];
 // The server answers with `Vary: Origin`, but entries cached without that header must still match.
@@ -30,6 +49,9 @@ self.addEventListener("activate", (event) => {
     (async () => {
       const names = await caches.keys();
       await Promise.all(names.filter((name) => name.startsWith("fk-static-") && name !== STATIC_CACHE).map((name) => caches.delete(name)));
+      // Older releases stored personal responses without checking account ownership.
+      await invalidatePrivateCache();
+      await caches.delete("fk-offline");
       await self.clients.claim();
     })(),
   );
@@ -42,9 +64,16 @@ self.addEventListener("message", (event) => {
 
 self.addEventListener("fetch", (event) => {
   const { request } = event;
-  if (request.method !== "GET") return;
   const url = new URL(request.url);
   if (url.origin !== self.location.origin) return;
+  if (request.method !== "GET") {
+    if (url.pathname.startsWith("/api/auth/") || url.pathname.startsWith("/auth/") || url.pathname.startsWith("/api/onboarding/")) {
+      event.respondWith(authenticate(request));
+    }
+    return;
+  }
+  // While a login changes the cookie, personal requests must bypass all offline responses.
+  if (authenticationChanges && url.pathname.startsWith("/api/")) return;
   // Server-rendered OAuth pages and discovery documents must never be answered with the app shell.
   if (url.pathname.startsWith("/oauth/") || url.pathname.startsWith("/.well-known/")) return;
 
@@ -106,11 +135,12 @@ async function navigate(request) {
 }
 
 async function cacheFirst(cacheName, request, limit = 0) {
+  const generation = privateGeneration;
   const cache = await caches.open(cacheName);
   const cached = await cache.match(request, MATCH);
-  if (cached) return cached;
+  if (cached && (cacheName !== API_CACHE || generation === privateGeneration)) return cached;
   const response = await fetch(request);
-  if (response.ok) {
+  if (response.ok && (cacheName !== API_CACHE || generation === privateGeneration)) {
     await cache.put(request, response.clone());
     if (limit) await trim(cache, (key) => /\/api\/(archive\/images\/|items\/\d+\/image)/.test(key.url), limit);
   }
@@ -118,12 +148,13 @@ async function cacheFirst(cacheName, request, limit = 0) {
 }
 
 async function mutableImage(request) {
+  const generation = privateGeneration;
   const cache = await caches.open(API_CACHE);
   const cached = await cache.match(request, MATCH);
   const date = cached && Date.parse(cached.headers.get("date") ?? "");
   const maxAge = Number(cached?.headers.get("cache-control")?.match(/max-age=(\d+)/)?.[1] ?? 0);
   // Old immutable proxy responses must also expire at the new six-hour boundary.
-  if (cached && !cached.headers.get("cache-control")?.includes("no-store") && Date.now() - date < Math.min(maxAge, 21600) * 1000) return cached;
+  if (cached && generation === privateGeneration && !cached.headers.get("cache-control")?.includes("no-store") && Date.now() - date < Math.min(maxAge, 21600) * 1000) return cached;
   try {
     const headers = new Headers(request.headers);
     if (cached?.headers.get("etag")) headers.set("If-None-Match", cached.headers.get("etag"));
@@ -134,40 +165,58 @@ async function mutableImage(request) {
       refreshed.set("date", response.headers.get("date") ?? new Date().toUTCString());
       response = new Response(await cached.arrayBuffer(), { status: 200, headers: refreshed });
     }
-    if (response.ok) {
+    if (response.ok && generation === privateGeneration) {
       if (response.headers.get("cache-control")?.includes("no-store")) await cache.delete(request);
       else { await cache.put(request, response.clone()); await trim(cache, key => /\/api\/(archive\/images\/|items\/\d+\/image)/.test(key.url), MAX_CACHED_IMAGES); }
     }
     return response; // An online denial must never fall back to the previous account's bytes.
-  } catch { return cached ?? Response.error(); }
+  } catch { return generation === privateGeneration ? cached ?? Response.error() : Response.error(); }
 }
 
 async function networkFirst(cacheName, request, limit) {
-  const cache = await caches.open(cacheName);
+  let generation = privateGeneration;
+  let cache = await caches.open(cacheName);
   try {
     const response = await withTimeout(fetch(request), NETWORK_TIMEOUT_MS);
-    if (response.ok) {
+    if (generation !== privateGeneration) throw new Error("session_changed");
+    if (new URL(request.url).pathname === "/api/auth/me" && generation === privateGeneration) {
+      if (response.ok) {
+        const user = await response.clone().json();
+        const previous = await cache.match(request, MATCH);
+        const previousUser = previous ? await previous.json() : null;
+        if (!Number.isSafeInteger(user.id) || user.id <= 0) return Response.error();
+        if (previousUser?.id !== user.id) {
+          await invalidatePrivateCache();
+          generation = privateGeneration;
+          cache = await caches.open(cacheName);
+        }
+      } else if (response.status === 401) {
+        await invalidatePrivateCache();
+      }
+    }
+    if (response.ok && generation === privateGeneration && !authenticationChanges) {
       await cache.put(request, response.clone());
       if (limit) await trim(cache, (key) => new URL(key.url).pathname === new URL(request.url).pathname, limit);
     }
     return response;
   } catch (error) {
-    const cached = await cache.match(request, MATCH);
-    if (cached) return cached;
+    const cached = generation === privateGeneration && !authenticationChanges ? await cache.match(request, MATCH) : null;
+    if (cached && generation === privateGeneration) return cached;
     throw error;
   }
 }
 
 async function staleWhileRevalidate(cacheName, request) {
+  const generation = privateGeneration;
   const cache = await caches.open(cacheName);
   const cached = await cache.match(request, MATCH);
   const refresh = fetch(request)
     .then((response) => {
-      if (response.ok) cache.put(request, response.clone());
+      if (response.ok && (cacheName !== API_CACHE || generation === privateGeneration)) return cache.put(request, response.clone()).then(() => response);
       return response;
     })
     .catch(() => undefined);
-  return cached ?? (await refresh) ?? Response.error();
+  return (cacheName !== API_CACHE || generation === privateGeneration ? cached : null) ?? (await refresh) ?? Response.error();
 }
 
 /** Drop the oldest entries so a long-lived install does not grow without bound. */