kristianwindandClaude Opus 5.5
b9028e8f7a
Tredje trin mod iOS-appen. I en browser deler fladen og API'et origin: hver sti er relativ, og sessionen er en httpOnly-cookie. I appen ligger fladen i appen selv på capacitor://localhost, og serveren er den, ejeren skrev ind. Alt, der er forskelligt, bor i den nye `platform.js`, så browserens svar er præcis, hvad det var før. - `apiURL()` og `authorize()`: relative stier og cookie i en browser; den valgte server og `Authorization: Bearer` i appen, `credentials: 'omit'`. - Login sender `client: app` og gemmer `session_token`; log ud fjerner det fra telefonen, også når serveren ikke svarede. - Live-synk i appen beder om en billet og åbner socket'en på serveren med den. - Første skærm i appen: "Hvilken Verdande vil du logge ind på?". Adressen prøves med /ping, før et adgangskodefelt vises, så en tastefejl, en router eller en server, der er nede, får sin egen sætning. Passkeys og opsætning af første konto vises ikke i appen; begge hører til serverens eget domæne. - Billeder og downloads under /api/v1 hentes med tokenet og vises fra en blob, i appen og kun dér (`nativemedia.js`). Stien bevares i `data-src`, og `richtext.js` læser den først, så en note aldrig gemmer en blob-adresse. - Service worker og Web Push er slået fra i appen: WKWebView har ingen af dem. Serveren: `VERDANDE_APP_ORIGINS` regner flere origins som appens. Den findes for E2E-projektet `app-origin`, der kører fladen fra app.localhost — samme server, anden origin — med en Capacitor-stub og uden cookie. Prøven vælger server, logger ind, ser et projekt fra "en anden enhed" dukke op over socket'en, viser et billede fra en blob og logger ud. Fire plantede fejl, hver fanget af prøven ved sit eget trin: ingen bearer, socket uden billet, billeder ikke hentet, token efterladt ved log ud. Dokumenterer også `VERDANDE_APP_SESSION_TTL` fra trin 1. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
62 lines
2.4 KiB
JavaScript
62 lines
2.4 KiB
JavaScript
import adapter from '@sveltejs/adapter-static';
|
|
|
|
/** @type {import('@sveltejs/kit').Config} */
|
|
export default {
|
|
kit: {
|
|
// A single-page app: the Go binary embeds `build/` and serves index.html for
|
|
// any route it does not recognise, so the client router owns navigation.
|
|
// Prerendering is off because every page needs a signed-in user.
|
|
adapter: adapter({
|
|
pages: 'build',
|
|
assets: 'build',
|
|
fallback: 'index.html',
|
|
precompress: false
|
|
}),
|
|
alias: {
|
|
$lib: 'src/lib'
|
|
},
|
|
|
|
/**
|
|
* The build's own version string, which SvelteKit puts in
|
|
* `_app/version.json` and the service worker reads to decide whether a new
|
|
* version has been deployed.
|
|
*
|
|
* Its default is `Date.now()`, and that made every build of this frontend
|
|
* produce different bytes: the millisecond lands in version.json, in
|
|
* index.html and in service-worker.js, which changes the content hash of
|
|
* every chunk that references them, which changes those chunks' filenames.
|
|
* So two builds of the same commit had different file names in them.
|
|
*
|
|
* That is not an aesthetic problem, and it had two costs. The Dockerfile
|
|
* said `-trimpath` and an empty buildid "keep the output reproducible", and
|
|
* that sentence had been false for a year — the flags did their job and the
|
|
* frontend embedded in the binary carried a millisecond. And the Dockerfile
|
|
* builds one binary into two images, verdande and urd, where the claim is
|
|
* that they are the same program rather than a fork; with a timestamp in the
|
|
* build, that claim could not be checked, because no two builds ever
|
|
* matched. CI checks it now.
|
|
*
|
|
* Measured by building twice and diffing the tree, before and after.
|
|
*
|
|
* `dev` when nothing sets it, so a local build is stable too. The cost is
|
|
* that a local `npm run build` no longer looks like a new version to the
|
|
* service worker — which only matters on a deployed instance, where the
|
|
* release workflow passes the real tag.
|
|
*/
|
|
version: {
|
|
name: process.env.VERDANDE_VERSION ?? 'dev'
|
|
},
|
|
|
|
/**
|
|
* Not in the iOS app. WKWebView does not run service workers for an app's
|
|
* own scheme, and the offline cache it would keep belongs to an interface
|
|
* served by the instance — the app carries its interface inside itself.
|
|
* `VERDANDE_TARGET=app` is set by the app's build; the browser build is
|
|
* unchanged.
|
|
*/
|
|
serviceWorker: {
|
|
register: process.env.VERDANDE_TARGET !== 'app'
|
|
}
|
|
}
|
|
};
|