c2e857bbbd
Carries the still-applicable findings from the PR #116 review into PR #120, since #120 includes the mobile-bootstrap commit. CORS hardening (removing the unconditional localhost/capacitor origins) is intentionally left out of scope. Service worker routing (latent bug fix + testability): - vite.config.ts: anchor Workbox path matching to a segment boundary (^/<seg>(/|$)) instead of startsWith, so siblings like /apidocs, /collaborators, /socket.iox are no longer mis-routed as API/realtime and forced NetworkOnly; align navigateFallbackDenylist with the same anchors. - new apps/client/src/pwa/sw-strategy.ts holds the canonical predicates (isApiPath, isCollabOrSocketPath) + unit tests; the vite.config regexes mirror it inline (Workbox generateSW serializes urlPattern fns standalone, so they cannot import the module). Server CORS (R1 extraction + coverage): - extract buildCorsAllowlist / isOriginAllowed into cors.util.ts with unit tests (evil-origin rejected, WebView/no-Origin allowed); main.ts rewired to use them with byte-for-byte identical behavior. Privacy — clear offline cache on logout: - new clear-offline-cache.ts purges the persisted query cache (idb-keyval gitmost-rq-cache), the Yjs page.* IndexedDB databases, and the service-worker api-get-cache; wired into handleLogout (best-effort, before the redirect) so a previous user's private data does not linger locally. Conventions & docs: - prettier fixes on main.ts and login.dto.ts. - CHANGELOG: document offline reading, returnToken opt-in, optional Swagger, new env vars, logout cache-clear, and the CORS open->allowlist breaking change. - docs/mobile-app-plan.md: correct the now-false §2.4 claims and update the §12 checklist (native cap add ios left unchecked — generated locally, gitignored). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
33 lines
1.3 KiB
TypeScript
33 lines
1.3 KiB
TypeScript
/**
|
|
* Canonical service-worker routing predicates.
|
|
*
|
|
* IMPORTANT: With vite-plugin-pwa using Workbox `generateSW`, the
|
|
* `runtimeCaching[].urlPattern` functions are serialized standalone into the
|
|
* generated service worker and CANNOT reference imported symbols. The matching
|
|
* logic is therefore duplicated as inline regex literals in
|
|
* apps/client/vite.config.ts. This module is the testable source of truth, and
|
|
* the two MUST be kept in sync. This duplication is intentional and is the
|
|
* documented Workbox limitation.
|
|
*
|
|
* Matching is anchored to a path SEGMENT boundary (`^/<seg>(/|$)`) so that
|
|
* sibling paths like `/apidocs`, `/collaborators`, `/socket.iox` are NOT
|
|
* wrongly treated as API/realtime traffic.
|
|
*/
|
|
|
|
/**
|
|
* True when `pathname` is the `/api` segment or anything beneath it.
|
|
* `/api` and `/api/...` -> true; `/apidocs`, `/apixyz` -> false.
|
|
*/
|
|
export function isApiPath(pathname: string): boolean {
|
|
return /^\/api(\/|$)/.test(pathname);
|
|
}
|
|
|
|
/**
|
|
* True when `pathname` is the `/collab` or `/socket.io` segment (or beneath it).
|
|
* `/collab`, `/collab/x`, `/socket.io`, `/socket.io/abc` -> true;
|
|
* `/collaborators`, `/collabx`, `/socket.iox` -> false.
|
|
*/
|
|
export function isCollabOrSocketPath(pathname: string): boolean {
|
|
return /^\/(collab|socket\.io)(\/|$)/.test(pathname);
|
|
}
|