stackchain/stackchain-dashboard
1
0
Fork 0
Code Issues 9 Pull Requests 1 Actions Packages Projects Releases 713 Wiki Activity

Preserve mobile share capture through sign-in #313

New Issue
Closed
opened 2026-08-08 15:10:24 +00:00 by timmy · 0 comments
timmy commented 2026-08-08 15:10:24 +00:00
Owner
Copy Link

Problem

An unauthenticated PWA Share Target launch redirects to login before dashboard JavaScript can stage the shared title/text/URL. The redirect drops the payload, successful login always returns to ./, and the service worker can cache a followed login redirect as the dashboard shell.

User impact

A mobile user whose operator session expired loses content shared from another app and must copy it again. A redirected login response may also poison the cached offline shell.

Acceptance criteria

  • An unauthenticated root Share Target request preserves bounded, allowlisted title, text, and url fields in a same-origin relative continuation.
  • Successful sign-in resumes that validated continuation; malformed, oversized, cross-origin, or non-share continuations fall back to ./.
  • Login explains that sign-in will continue the shared capture.
  • Redirected navigation responses are never cached as the dashboard shell.
  • Existing authenticated and offline Share Target behavior remains intact.
  • Behavioral tests cover redirect construction, login continuation validation, and service-worker cache protection.

No open/closed issue title or recent commit covers authentication-safe Share Target continuation; #223, #230, #301, and #309 cover adjacent but distinct capture/session behavior.

## Problem An unauthenticated PWA Share Target launch redirects to `login` before dashboard JavaScript can stage the shared title/text/URL. The redirect drops the payload, successful login always returns to `./`, and the service worker can cache a followed login redirect as the dashboard shell. ## User impact A mobile user whose operator session expired loses content shared from another app and must copy it again. A redirected login response may also poison the cached offline shell. ## Acceptance criteria - An unauthenticated root Share Target request preserves bounded, allowlisted `title`, `text`, and `url` fields in a same-origin relative continuation. - Successful sign-in resumes that validated continuation; malformed, oversized, cross-origin, or non-share continuations fall back to `./`. - Login explains that sign-in will continue the shared capture. - Redirected navigation responses are never cached as the dashboard shell. - Existing authenticated and offline Share Target behavior remains intact. - Behavioral tests cover redirect construction, login continuation validation, and service-worker cache protection. No open/closed issue title or recent commit covers authentication-safe Share Target continuation; #223, #230, #301, and #309 cover adjacent but distinct capture/session behavior.
timmy closed this issue 2026-08-08 15:20:02 +00:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels   
P0

Drop everything

  
P1

High priority

  
P2

Medium priority

  
agent:nightprowl

Assignments routed to the LongCat NightProwl evaluation worker

  
backend

Backend service

  
ci

Continuous integration / actions

  
frontend

Frontend / UI

  
meta

Meta / planning

  
pages

Gitea Pages

  
template

Repo template / standards

No Label
P0
P1
P2
agent:nightprowl
backend
ci
frontend
meta
pages
template
Milestone
Clear milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
No Assignees
1 Participants
Notifications
Due Date
The due date is invalid or out of range. Please use the format 'yyyy-mm-dd'.

No due date set.

Dependencies

No dependencies set.

Reference: stackchain/stackchain-dashboard#313
No description provided.
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?