From 88515696586702e504263d9e60c05c21adfd3530 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Bombeck?= <mbombeck@gmail.com>
Date: Wed, 29 Jul 2026 13:45:23 +0200
Subject: [PATCH] fix(01-06): isolate PWA install from authenticated root

- remove the dashboard root from immutable precaching
- evict same-version root entries left by older workers
- retain public logos and favicon for offline support
---
 public/sw.js | 17 +++++++++++++----
 1 file changed, 13 insertions(+), 4 deletions(-)

diff --git a/public/sw.js b/public/sw.js
index 8b437990f..fd60ece14 100644
--- a/public/sw.js
+++ b/public/sw.js
@@ -103,15 +103,24 @@ function isCacheableApiResponse(response, bodyText) {
   return true;
 }
 
-// App shell files to precache on install
-const PRECACHE_URLS = ["/", "/logo-192.png", "/logo-512.png", "/favicon.svg"];
+// Public immutable assets to precache on install. Never include `/`: installing
+// while signed in would fetch the authenticated Dashboard document with the
+// browser's session cookies and persist that health-bearing HTML in
+// CacheStorage for replay after logout.
+const PRECACHE_URLS = ["/logo-192.png", "/logo-512.png", "/favicon.svg"];
 
-// ── Install: precache app shell ──────────────────────────────────────────────
+// ── Install: precache public immutable assets ────────────────────────────────
 self.addEventListener("install", (event) => {
   event.waitUntil(
     caches
       .open(STATIC_CACHE)
-      .then((cache) => cache.addAll(PRECACHE_URLS))
+      .then(async (cache) => {
+        // An updated worker can reuse the same release-scoped cache when its
+        // source changes without a version bump. Remove a root document left
+        // by the previous worker before adding the safe public asset set.
+        await cache.delete("/");
+        await cache.addAll(PRECACHE_URLS);
+      })
       .then(() => self.skipWaiting()),
   );
 });