Claus Lohmar
dd865d4f27
- One base layout (layout.html) with the header, the nav from Registry.Nav()
(D-038), a content slot and the CSRF token; every page renders inside it and
a module supplies content only
- Embedded same-origin assets (app.css · app.js · webauthn.js · sw.js ·
manifest.webmanifest · icons) served by the reserved `static` workflow
- webauthn.js drives the three ceremonies from data-* attributes — no inline
script, so the CSP `script-src 'self'` holds (AC-3)
- manifest start_url "/" (D-011); the service worker never caches an
authenticated response or /{GUID} (A5)
21 lines
821 B
JavaScript
21 lines
821 B
JavaScript
// MyDay shell bootstrap (SPEC-009 §6). Vanilla: no framework, no build step.
|
|
//
|
|
// It registers the service worker. The worker itself caches NOTHING but static
|
|
// assets — an authenticated response and a /{GUID} page are never intercepted
|
|
// (A5) — see sw.js.
|
|
//
|
|
// This file is served same-origin from the reserved `static` workflow, so the
|
|
// CSP `script-src 'self'` holds. There are no inline scripts anywhere.
|
|
"use strict";
|
|
|
|
(function () {
|
|
if (!("serviceWorker" in navigator)) {
|
|
return;
|
|
}
|
|
window.addEventListener("load", function () {
|
|
navigator.serviceWorker.register("/static/sw.js", { scope: "/" })["catch"](function () {
|
|
// A failed registration (an insecure origin, a locked-down browser) is
|
|
// not fatal: the app is fully server-rendered and works without it.
|
|
});
|
|
});
|
|
})();
|