pgkiln 0.86.0 → 0.88.0

package/src/runtime/routes.ts

@@ -444,24 +444,37 @@ export async function runtimeRoutes(app: FastifyInstance) {
     const normalised = normaliseReportParams(ctx.params);
     if (normalised !== null) return reply.redirect(`${ctx.base}/${ctx.page.page_no}${normalised ? `?${normalised}` : ''}`);
 
+    // (168) the service worker fetching the page for offline use (pwa_prefetch_hours): the page runs read-only,
+    // its session state isn't kept and nothing waiting for the next page (a message) is taken; a page that runs
+    // processes when it opens is refused (kept only when the user opens it)
+    const prefetch = req.headers['x-pgkiln-prefetch'] === '1';
+    if (prefetch && (ctx.dialog || ctx.page.processes.some((p) => p.point === 'load')))
+      return reply.code(409).header('cache-control', 'no-store').send('Not kept for offline use: this page runs processes when it opens.');
+
     if (!applyUrlItems(ctx)) return forbidden(ctx, reply, ctx.locale.t('error.checksum'), `checksum error: ${req.url}`);
     // a master grid's selected row (signed link) into its item
     applyRowSelection(ctx);
-    const flash = takeFlash(ctx.session);
-    if (flash) ctx.messages.push(flash);
-    const flashError = takeFlash(ctx.session, '__FLASH_ERROR');
-    if (flashError) ctx.errors.page.push(flashError);
-    const saved = takeFlash(ctx.session, '__GRID_SAVED');
-    if (typeof saved === 'string') ctx.savedGrids = saved.split(',').map(Number).filter(Number.isInteger);
+    if (!prefetch) {
+      const flash = takeFlash(ctx.session);
+      if (flash) ctx.messages.push(flash);
+      const flashError = takeFlash(ctx.session, '__FLASH_ERROR');
+      if (flashError) ctx.errors.page.push(flashError);
+      const saved = takeFlash(ctx.session, '__GRID_SAVED');
+      if (typeof saved === 'string') ctx.savedGrids = saved.split(',').map(Number).filter(Number.isInteger);
+    }
     // Actions → Download CSV / Excel / PDF: r<region id>_csv=1, _xlsx=1 or _pdf=1
     const downloadKey = [...ctx.params.keys()].find((k) => /^r\d+_(csv|xlsx|pdf)$/.test(k));
     // a document template: ?doc=NAME (see documents.ts)
     const docName = ctx.params.get('doc');
 
+    if (prefetch && (docName || downloadKey)) return reply.code(409).header('cache-control', 'no-store').send('Not kept for offline use.');
+
     let result: { html?: string; streamed?: boolean; file?: Buffer; type?: string; name?: string; redirect?: string; download?: Download };
     try {
       result = await appTx(txContext(ctx), async (c) => {
         ctx.client = c;
+        // (168) a prefetch writes nothing: an application process or region that tries fails
+        if (prefetch) await c.query('set local transaction_read_only = on');
         await timed(ctx, 4, 'page', 'page authorization', () => checkPageAccess(ctx));
         await timed(ctx, 4, 'page', 'application processes (before page)', () => runAppProcesses(ctx, 'before_page'));
         // (086) items kept per user: their values from the user's preferences
@@ -516,6 +529,12 @@ export async function runtimeRoutes(app: FastifyInstance) {
       if (e instanceof Forbidden) return forbidden(ctx, reply, e.message, `page ${ctx.page.page_no}`);
       throw e;
     }
+    if (prefetch) {
+      // a redirect (a branch, a sign-in) or anything but the page itself is not kept on the device
+      logActivity({ appId: ctx.app.id, pageNo: ctx.page.page_no, username: ctx.user, event: 'page_prefetch', ip: ctx.ip, elapsedMs: Math.round(performance.now() - started) });
+      if (result.html === undefined) return reply.code(409).header('cache-control', 'no-store').send('Not kept for offline use.');
+      return reply.type('text/html').header('cache-control', 'private, no-store').send(result.html);
+    }
     await saveState(ctx.session);
     if (result.redirect) return reply.redirect(result.redirect, 303);
     logActivity({ appId: ctx.app.id, pageNo: ctx.page.page_no, username: ctx.user, event: 'page_view', ip: ctx.ip, elapsedMs: Math.round(performance.now() - started) });

package/src/runtime/signin.ts

@@ -34,7 +34,7 @@ export const LOGIN_USER = '__LOGIN_USER';
 
 export async function signInForm(
   app: App, locale: Locale, session: Session, next: string,
-  o: { error?: string; username?: string; formId?: string } = {},
+  o: { error?: string; username?: string; formId?: string; autofocus?: boolean } = {},
 ): Promise<Raw> {
   const t = locale.t;
   // database accounts and custom authentication: the user name and password form only
@@ -48,7 +48,7 @@ export async function signInForm(
   const fields = html`<input type="hidden" name="__csrf" value="${session.csrf_token}"${fa}>
     <input type="hidden" name="next" value="${next}"${fa}>
     ${app.time_zone_auto ? html`<input type="hidden" name="__tz" value=""${fa}>` : ''}
-    <div class="field"><label class="label" for="username">${t('login.username')}</label><input id="username" name="username" value="${o.username ?? ''}" autocomplete="username" autofocus required maxlength="100"${fa}></div>
+    <div class="field"><label class="label" for="username">${t('login.username')}</label><input id="username" name="username" value="${o.username ?? ''}" autocomplete="username"${o.autofocus === false ? '' : raw(' autofocus')} required maxlength="100"${fa}></div>
     <div class="field"><label class="label" for="password">${t('login.password')}</label><input id="password" name="password" type="password" autocomplete="current-password" required maxlength="200"${fa}></div>
     ${remember ? html`<label class="check"><input type="checkbox" name="remember" value="true"${fa}> ${t('login.remember', { days: remember })}</label>` : ''}
     <button class="btn btn-hot"${fa}>${t('login.submit')}</button>
@@ -65,8 +65,8 @@ export async function signInForm(
       : providers.length ? '' : html`<p>${t('login.none')}</p>`}`;
 }
 
-/** The "login" region of an application's own login page. */
-export async function renderLoginRegion(ctx: PageContext): Promise<Raw> {
+/** The "login" region of an application's own login page; (167) {"autofocus": false} leaves the focus where the page puts it. */
+export async function renderLoginRegion(ctx: PageContext, config: { autofocus?: unknown } = {}): Promise<Raw> {
   const s = ctx.session.state;
   const error = s[LOGIN_ERROR] ?? undefined;
   const username = s[LOGIN_USER] ?? undefined;
@@ -76,6 +76,6 @@ export async function renderLoginRegion(ctx: PageContext): Promise<Raw> {
   ctx.detached.push(html`<form id="${formId}" method="post" action="/a/${ctx.app.alias}/login"></form>`);
   const next = safeNext(ctx.app, ctx.params.get('next') ?? undefined);
   const here = `${ctx.base}/${ctx.page.page_no}${ctx.params.get('next') ? `?next=${encodeURIComponent(next)}` : ''}`;
-  return html`<div class="login-region">${await signInForm(ctx.app, ctx.locale, ctx.session, next, { error, username, formId })}
+  return html`<div class="login-region">${await signInForm(ctx.app, ctx.locale, ctx.session, next, { error, username, formId, autofocus: config.autofocus !== false })}
     ${languagePicker(ctx.app, ctx.locale, here)}</div>`;
 }