Timmy
dd86d6675d
Some checks failed
Quality gates / quality (pull_request) Failing after 1m28s
- provenance origin set is own-safe exact membership (Set.has); inherited toString/constructor/__proto__ names can never become origins - import/export symmetry restored with an explicit bounded policy: MAX_IMPORT_BYTES raised 2 MiB -> 16 MiB UTF-8 bytes, above any export this app can produce (photos capped at 4 MiB binary), so valid exports always re-import without silent data loss while hostile files stay bounded - byte limit is byte-exact now: utf8ByteLength() measures real UTF-8 bytes (multibyte boundaries tested), and the browser rejects oversized files by File.size BEFORE File.text() reads user data - collision-safe deterministic mergeLedgers(): existing user-owned rows win, incoming rows only ever added for new ids, intra-file duplicates collapse deterministically, every collision reported explicitly in the import toast (no duplicate/overwrite/shadow of user records) - base-path Delete Everything is namespace-scoped: root still cleans/ migrates the legacy store to prevent resurrection, /timmy-staging no longer erases another namespace's global legacy ledger (browser regression covers deletion with root legacy data present) - strict current-schema values: Bristol 1-7 / urgency 0-4 / discomfort 0-4 must be true integers (out-of-range falls back instead of silent clamping), photos restricted to JPEG/PNG/WebP base64 raster data URLs (SVG/GIF/non-base64 dropped), invalid dates never throw or persist Invalid Date values Verification: npm test 91/91, test:ui/test:photo/test:sleek/test:portability PASS, staging-deploy 20/20 OK, check:syntax clean, npm audit 0 high, check_diff clean, adversarial probe battery (exact-byte boundary at cap, prototype pollution via JSON, lone surrogates, data-URL strictness) green.
51 lines
1.6 KiB
JavaScript
51 lines
1.6 KiB
JavaScript
const ROOT = new URL(self.registration.scope).pathname;
|
|
const appPath = path => `${ROOT}${String(path).replace(/^\/+/, '')}`;
|
|
const CACHE_NAMESPACE = `timmy-shell:${ROOT}:`;
|
|
const CACHE = `${CACHE_NAMESPACE}v7`;
|
|
const ASSETS = [
|
|
'',
|
|
'index.html',
|
|
'styles.css',
|
|
'app.js',
|
|
'src/domain.js',
|
|
'src/analysis.js',
|
|
'manifest.webmanifest',
|
|
'assets/timmy.svg',
|
|
'assets/icon-192.svg',
|
|
'assets/icon-512.svg',
|
|
].map(appPath);
|
|
|
|
self.addEventListener('install', event => event.waitUntil(
|
|
caches.open(CACHE).then(cache => cache.addAll(ASSETS)).then(() => self.skipWaiting()),
|
|
));
|
|
self.addEventListener('activate', event => event.waitUntil(
|
|
caches.keys()
|
|
.then(keys => Promise.all(keys.filter(key =>
|
|
(key.startsWith(CACHE_NAMESPACE) && key !== CACHE)
|
|
|| (ROOT === '/' && key === 'timmy-shell-v4')
|
|
).map(key => caches.delete(key))))
|
|
.then(() => self.clients.claim()),
|
|
));
|
|
self.addEventListener('fetch', event => {
|
|
if (event.request.method !== 'GET') return;
|
|
const pathname = new URL(event.request.url).pathname;
|
|
if (!pathname.startsWith(ROOT)) return;
|
|
if (pathname.startsWith(appPath('api/'))) {
|
|
event.respondWith(fetch(event.request));
|
|
return;
|
|
}
|
|
event.respondWith(
|
|
fetch(event.request)
|
|
.then(response => {
|
|
if (!/\bno-store\b/i.test(response.headers.get('cache-control') || '')) {
|
|
const copy = response.clone();
|
|
caches.open(CACHE).then(cache => cache.put(event.request, copy));
|
|
}
|
|
return response;
|
|
})
|
|
.catch(() => caches.open(CACHE).then(async cache =>
|
|
(await cache.match(event.request)) || cache.match(appPath('index.html'))
|
|
)),
|
|
);
|
|
});
|