mirror of
https://github.com/MBombeck/HealthLog.git
synced 2026-11-08 12:32:43 +00:00
Marc-André Bombeck
bb08aa42dc
An installed PWA opened offline rendered empty skeletons forever: the service worker hard-excluded every /api/* path and there was no client query persistence. Close both gaps for read value. Service worker: add a stale-while-revalidate branch for an allowlist of safe GET /api/* reads (dashboard snapshot + widgets, measurements, medications, insights, analytics, version) in a release-versioned healthlog-data cache. Two-layer refusal — a path deny guard for any auth/token/session/login segment plus a body-level secret refusal for hlk_/hlr_/sk- shapes and no-store responses — so a secret-shaped body or an auth surface can never be persisted. Mutations stay network-only. Client: add a dependency-free IndexedDB query persister that hydrates the last successful reads before the first authenticated paint, build-version and age gated, debounced on cache change, with an auth/session/admin/token denylist. Cleared on logout alongside the SW page and data caches so a shared device never leaks one account's data. Offline banner now states it is showing last-synced data when a cached snapshot is present. Bump release to v1.18.6.