From 72dcd32f7ae9bec891c0625d3edf3f1947728c36 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Bombeck?= <marc@bombeck.io>
Date: Wed, 11 Nov 2026 20:43:23 +0100
Subject: [PATCH] fix(pwa): drop the Medications home-screen shortcut

The manifest is one static file for every account, so the Medications
shortcut was offered with the module switched off and opened its
"switched off" notice. Only shortcuts into pages no module can turn off
remain: Add measurement and Today. The `source=shortcut` parameter goes
too; nothing read it, and the measurements filter discarded it as an
unknown data source. The install `id` keeps its `source=pwa`, which is
an identity string only.
---
 public/manifest.json                        | 12 ++---------
 src/__tests__/sw-security-hardening.test.ts | 24 +++++++++++++++++++++
 2 files changed, 26 insertions(+), 10 deletions(-)

diff --git a/public/manifest.json b/public/manifest.json
index d94dc7fe3..922540d9d 100644
--- a/public/manifest.json
+++ b/public/manifest.json
@@ -40,7 +40,7 @@
     {
       "name": "Add measurement",
       "short_name": "Add",
-      "url": "/measurements?add=WEIGHT&source=shortcut",
+      "url": "/measurements?add=WEIGHT",
       "icons": [
         { "src": "/logo-192.png", "sizes": "192x192", "type": "image/png" }
       ]
@@ -48,15 +48,7 @@
     {
       "name": "Today",
       "short_name": "Today",
-      "url": "/?source=shortcut",
-      "icons": [
-        { "src": "/logo-192.png", "sizes": "192x192", "type": "image/png" }
-      ]
-    },
-    {
-      "name": "Medications",
-      "short_name": "Meds",
-      "url": "/medications?source=shortcut",
+      "url": "/",
       "icons": [
         { "src": "/logo-192.png", "sizes": "192x192", "type": "image/png" }
       ]
diff --git a/src/__tests__/sw-security-hardening.test.ts b/src/__tests__/sw-security-hardening.test.ts
index a587f28ce..71aae3668 100644
--- a/src/__tests__/sw-security-hardening.test.ts
+++ b/src/__tests__/sw-security-hardening.test.ts
@@ -2,6 +2,8 @@ import { describe, expect, it } from "vitest";
 import { readFileSync } from "node:fs";
 import { resolve } from "node:path";
 
+import { surfaceModule } from "@/lib/modules/surface";
+
 /**
  * F-7 (mobile security audit, 2026-05-16): three regressions to lock
  * in for `public/sw.js`.
@@ -107,3 +109,25 @@ describe("public/manifest.json PWA identity hygiene (F-7, 2026-05-16)", () => {
     expect(manifest.start_url).toBe("/");
   });
 });
+
+describe("public/manifest.json shortcuts", () => {
+  const manifest = JSON.parse(readFileSync(MANIFEST_PATH, "utf-8")) as {
+    shortcuts: Array<{ name: string; url: string }>;
+  };
+
+  it("open only pages no module can switch off", () => {
+    // The manifest is static: a shortcut into a module would open the
+    // "switched off" notice for everyone who turned that module off.
+    expect(manifest.shortcuts.length).toBeGreaterThan(0);
+    for (const { name, url } of manifest.shortcuts) {
+      const { pathname } = new URL(url, "https://app.example");
+      expect(surfaceModule(`nav:${pathname}`), name).toBeUndefined();
+    }
+  });
+
+  it("carry no query parameter the app does not read", () => {
+    for (const { name, url } of manifest.shortcuts) {
+      expect(url, name).not.toContain("source=");
+    }
+  });
+});