tempest-react-sdk 0.76.0 → 0.78.0

package/template-pwa/src/sw.ts

@@ -14,15 +14,33 @@ import {
  *
  * Layers, in order:
  *  1. Push + notifications + skip-waiting (the SDK push helpers).
- *  2. Background sync — failed API mutations are queued and replayed online.
- *  3. Runtime caching: API GETs (network-first) + media (cache-first with
- *     Range support, so audio/video seeking works offline).
- *  4. Precache of the app shell so the app launches offline. Reads the
- *     `precache-manifest.json` emitted by `tempestPwaManifest()` in
- *     `vite.config.ts`.
+ *  2. Background sync — failed POST/PUT/PATCH/DELETE to `/api` are queued and
+ *     replayed online. Credential headers are never stored; on replay the
+ *     worker asks the open pages for the current ones and for who is signed in,
+ *     which `src/pwa.tsx` answers from the auth store
+ *     (`provideBackgroundSyncCredentials`). Remove that and queued
+ *     authenticated mutations never replay.
+ *  3. Runtime caching: unauthenticated API GETs (network-first) + media
+ *     (cache-first with Range support, so audio/video seeking works offline).
+ *     Every request the API client sends with a bearer (`Authorization`, or any
+ *     other credential header) bypasses this cache and goes to the network: in
+ *     an app with accounts, most `/api` GETs. To serve them offline, add
+ *     `cacheAuthenticated: true` to the route — entries then vary on the
+ *     credential, so another account never reads them — and keep
+ *     `clearSessionData()` in the logout flow.
+ *  4. Precache of the app shell so the app launches offline (API navigations
+ *     excluded). Reads the `precache-manifest.json` emitted by
+ *     `tempestPwaManifest()` in `vite.config.ts`.
+ *
+ * Cache names carry the `tempest-` prefix so `inspectCaches({ filter: "tempest-" })`
+ * reports them. On logout, call `clearSessionData()` from the page: it drops
+ * the runtime caches and the background-sync queue, keeping the precache.
  *
  * `installRuntimeCache` is registered BEFORE `installPrecache` so its specific
- * routes win over the precache catch-all.
+ * routes win over the precache catch-all. The trailing `activate` listener takes
+ * control of open pages as soon as this worker activates; `installPrecache`
+ * also calls `clients.claim()`, so it is harmless and stays useful if you drop
+ * precaching.
  */
 declare const self: ServiceWorkerGlobalScope;
 
@@ -35,23 +53,21 @@ installPushHandler({
 installNotificationClickHandler();
 installSkipWaitingListener();
 
-// Queue failed POST/PUT/PATCH/DELETE to /api and replay them when back online.
 installBackgroundSync({ match: (url) => url.pathname.startsWith("/api/") });
 
 installRuntimeCache([
     {
         match: (url) => url.pathname.startsWith("/api/"),
         strategy: "network-first",
-        cacheName: "api",
+        cacheName: "tempest-api",
         networkTimeoutSeconds: 5,
         maxEntries: 50,
         maxAgeSeconds: 60 * 5,
     },
     {
-        // Audio/video: cache-first + Range support (seek/scrub works offline).
         match: (url) => /\.(mp3|mp4|webm|ogg|wav)$/.test(url.pathname),
         strategy: "cache-first",
-        cacheName: "media",
+        cacheName: "tempest-media",
         maxEntries: 20,
         rangeRequests: true,
     },
@@ -59,12 +75,9 @@ installRuntimeCache([
 
 installPrecache({
     navigateFallback: "/index.html",
-    // Don't serve the app shell for API navigations.
     navigateFallbackDenylist: [/^\/api\//],
 });
 
-// Take control of open pages as soon as this worker activates. `installPrecache`
-// also calls `clients.claim()`; this is harmless if you drop precaching.
 self.addEventListener("activate", (event) => {
     event.waitUntil(self.clients.claim());
 });

package/dist/components/Markdown/markdown-url.cjs

@@ -1,2 +0,0 @@
-var e=new Set([`http:`,`https:`,`mailto:`,`tel:`,`sms:`]),t=/^data:image\/(png|jpe?g|gif|webp|avif|bmp);base64,[a-z0-9+/=\s]+$/i;function n(e){return e.replace(/[\u0000-\u0020\u007F]/g,``).trim()}function r(t){let r=n(t);if(!r)return null;if(/^[a-z][a-z0-9+.-]*:/i.test(r)){let t=r.slice(0,r.indexOf(`:`)+1).toLowerCase();return e.has(t)?r:null}return r}function i(e){let i=n(e);return i?t.test(i)?i:/^data:/i.test(i)?null:r(i):null}exports.safeImageUrl=i,exports.safeLinkUrl=r;
-//# sourceMappingURL=markdown-url.cjs.map

package/dist/components/Markdown/markdown-url.cjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"markdown-url.cjs","names":[],"sources":["../../../src/components/Markdown/markdown-url.ts"],"sourcesContent":["/**\n * URL vetting for links and images in rendered Markdown.\n *\n * This is the security boundary of the whole component. Markdown that arrives from\n * a user — a comment, a ticket description, a review — reaches the DOM as a real\n * `href`, and `javascript:alert(1)` in a link is script execution on click. So the\n * scheme is checked against an allowlist rather than a blocklist: a blocklist has\n * to enumerate `javascript:`, `JaVaScRiPt:`, `java\\tscript:`, `&#106;avascript:`\n * and whatever comes next, and misses the one nobody thought of.\n */\n\n/** Schemes a link may use. Anything else is dropped. */\nconst LINK_SCHEMES = new Set([\"http:\", \"https:\", \"mailto:\", \"tel:\", \"sms:\"]);\n\n/**\n * Image `data:` types that are safe to inline.\n *\n * `svg+xml` is deliberately absent: an SVG is a document, it can carry `<script>`\n * and event handlers, and browsers execute them when it loads from a `data:` URL in\n * some contexts. The raster formats cannot carry code.\n */\nconst IMAGE_DATA_TYPES = /^data:image\\/(png|jpe?g|gif|webp|avif|bmp);base64,[a-z0-9+/=\\s]+$/i;\n\n/**\n * Strip the characters a scheme can be smuggled through.\n *\n * `java\\tscript:` and `java\\nscript:` are both parsed as `javascript:` by browsers,\n * and a leading control character defeats a naive `startsWith` check.\n */\nfunction normalize(raw: string): string {\n    // eslint-disable-next-line no-control-regex -- stripping control characters is the point\n    return raw.replace(/[\\u0000-\\u0020\\u007F]/g, \"\").trim();\n}\n\n/**\n * The href to render, or `null` when the URL must not be linked.\n *\n * Relative URLs (`/docs`, `./x`, `#anchor`, `foo/bar`) are kept: they cannot carry\n * a scheme, so they cannot execute anything, and dropping them would break every\n * in-app link.\n *\n * @param raw - URL as written in the Markdown.\n * @returns A safe href, or `null`.\n */\nexport function safeLinkUrl(raw: string): string | null {\n    const url = normalize(raw);\n    if (!url) return null;\n    if (/^[a-z][a-z0-9+.-]*:/i.test(url)) {\n        const scheme = url.slice(0, url.indexOf(\":\") + 1).toLowerCase();\n        return LINK_SCHEMES.has(scheme) ? url : null;\n    }\n    // Protocol-relative (`//host/path`) inherits the page scheme — safe, and real.\n    return url;\n}\n\n/**\n * The `src` to render for an image, or `null`.\n *\n * @param raw - URL as written in the Markdown.\n * @returns A safe src, or `null`.\n */\nexport function safeImageUrl(raw: string): string | null {\n    const url = normalize(raw);\n    if (!url) return null;\n    if (IMAGE_DATA_TYPES.test(url)) return url;\n    if (/^data:/i.test(url)) return null;\n    return safeLinkUrl(url);\n}\n"],"mappings":"AAYA,IAAM,EAAe,IAAI,IAAI,CAAC,QAAS,SAAU,UAAW,OAAQ,MAAM,CAAC,EASrE,EAAmB,qEAQzB,SAAS,EAAU,EAAqB,CAEpC,OAAO,EAAI,QAAQ,yBAA0B,EAAE,CAAC,CAAC,KAAK,CAC1D,CAYA,SAAgB,EAAY,EAA4B,CACpD,IAAM,EAAM,EAAU,CAAG,EACzB,GAAI,CAAC,EAAK,OAAO,KACjB,GAAI,uBAAuB,KAAK,CAAG,EAAG,CAClC,IAAM,EAAS,EAAI,MAAM,EAAG,EAAI,QAAQ,GAAG,EAAI,CAAC,CAAC,CAAC,YAAY,EAC9D,OAAO,EAAa,IAAI,CAAM,EAAI,EAAM,IAC5C,CAEA,OAAO,CACX,CAQA,SAAgB,EAAa,EAA4B,CACrD,IAAM,EAAM,EAAU,CAAG,EAIzB,OAHK,EACD,EAAiB,KAAK,CAAG,EAAU,EACnC,UAAU,KAAK,CAAG,EAAU,KACzB,EAAY,CAAG,EAHL,IAIrB"}

package/dist/components/Markdown/markdown-url.js

@@ -1,28 +0,0 @@
-//#region src/components/Markdown/markdown-url.ts
-var e = /* @__PURE__ */ new Set([
-	"http:",
-	"https:",
-	"mailto:",
-	"tel:",
-	"sms:"
-]), t = /^data:image\/(png|jpe?g|gif|webp|avif|bmp);base64,[a-z0-9+/=\s]+$/i;
-function n(e) {
-	return e.replace(/[\u0000-\u0020\u007F]/g, "").trim();
-}
-function r(t) {
-	let r = n(t);
-	if (!r) return null;
-	if (/^[a-z][a-z0-9+.-]*:/i.test(r)) {
-		let t = r.slice(0, r.indexOf(":") + 1).toLowerCase();
-		return e.has(t) ? r : null;
-	}
-	return r;
-}
-function i(e) {
-	let i = n(e);
-	return i ? t.test(i) ? i : /^data:/i.test(i) ? null : r(i) : null;
-}
-//#endregion
-export { i as safeImageUrl, r as safeLinkUrl };
-
-//# sourceMappingURL=markdown-url.js.map

package/dist/components/Markdown/markdown-url.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"markdown-url.js","names":[],"sources":["../../../src/components/Markdown/markdown-url.ts"],"sourcesContent":["/**\n * URL vetting for links and images in rendered Markdown.\n *\n * This is the security boundary of the whole component. Markdown that arrives from\n * a user — a comment, a ticket description, a review — reaches the DOM as a real\n * `href`, and `javascript:alert(1)` in a link is script execution on click. So the\n * scheme is checked against an allowlist rather than a blocklist: a blocklist has\n * to enumerate `javascript:`, `JaVaScRiPt:`, `java\\tscript:`, `&#106;avascript:`\n * and whatever comes next, and misses the one nobody thought of.\n */\n\n/** Schemes a link may use. Anything else is dropped. */\nconst LINK_SCHEMES = new Set([\"http:\", \"https:\", \"mailto:\", \"tel:\", \"sms:\"]);\n\n/**\n * Image `data:` types that are safe to inline.\n *\n * `svg+xml` is deliberately absent: an SVG is a document, it can carry `<script>`\n * and event handlers, and browsers execute them when it loads from a `data:` URL in\n * some contexts. The raster formats cannot carry code.\n */\nconst IMAGE_DATA_TYPES = /^data:image\\/(png|jpe?g|gif|webp|avif|bmp);base64,[a-z0-9+/=\\s]+$/i;\n\n/**\n * Strip the characters a scheme can be smuggled through.\n *\n * `java\\tscript:` and `java\\nscript:` are both parsed as `javascript:` by browsers,\n * and a leading control character defeats a naive `startsWith` check.\n */\nfunction normalize(raw: string): string {\n    // eslint-disable-next-line no-control-regex -- stripping control characters is the point\n    return raw.replace(/[\\u0000-\\u0020\\u007F]/g, \"\").trim();\n}\n\n/**\n * The href to render, or `null` when the URL must not be linked.\n *\n * Relative URLs (`/docs`, `./x`, `#anchor`, `foo/bar`) are kept: they cannot carry\n * a scheme, so they cannot execute anything, and dropping them would break every\n * in-app link.\n *\n * @param raw - URL as written in the Markdown.\n * @returns A safe href, or `null`.\n */\nexport function safeLinkUrl(raw: string): string | null {\n    const url = normalize(raw);\n    if (!url) return null;\n    if (/^[a-z][a-z0-9+.-]*:/i.test(url)) {\n        const scheme = url.slice(0, url.indexOf(\":\") + 1).toLowerCase();\n        return LINK_SCHEMES.has(scheme) ? url : null;\n    }\n    // Protocol-relative (`//host/path`) inherits the page scheme — safe, and real.\n    return url;\n}\n\n/**\n * The `src` to render for an image, or `null`.\n *\n * @param raw - URL as written in the Markdown.\n * @returns A safe src, or `null`.\n */\nexport function safeImageUrl(raw: string): string | null {\n    const url = normalize(raw);\n    if (!url) return null;\n    if (IMAGE_DATA_TYPES.test(url)) return url;\n    if (/^data:/i.test(url)) return null;\n    return safeLinkUrl(url);\n}\n"],"mappings":";AAYA,IAAM,oBAAe,IAAI,IAAI;CAAC;CAAS;CAAU;CAAW;CAAQ;AAAM,CAAC,GASrE,IAAmB;AAQzB,SAAS,EAAU,GAAqB;CAEpC,OAAO,EAAI,QAAQ,0BAA0B,EAAE,CAAC,CAAC,KAAK;AAC1D;AAYA,SAAgB,EAAY,GAA4B;CACpD,IAAM,IAAM,EAAU,CAAG;CACzB,IAAI,CAAC,GAAK,OAAO;CACjB,IAAI,uBAAuB,KAAK,CAAG,GAAG;EAClC,IAAM,IAAS,EAAI,MAAM,GAAG,EAAI,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAC,YAAY;EAC9D,OAAO,EAAa,IAAI,CAAM,IAAI,IAAM;CAC5C;CAEA,OAAO;AACX;AAQA,SAAgB,EAAa,GAA4B;CACrD,IAAM,IAAM,EAAU,CAAG;CAIzB,OAHK,IACD,EAAiB,KAAK,CAAG,IAAU,IACnC,UAAU,KAAK,CAAG,IAAU,OACzB,EAAY,CAAG,IAHL;AAIrB"}