feat(pwa): dashboard PWA parity polish — scoped manifest, PNG+maskable icons, SW auth/SSE bypass guards (PR-F, audit item 22) - #377
Merged
Conversation
…e icons, SW auth/SSE bypass guards (PR-F, audit item 22) The dashboard was already installable (bb1cb86: manifest + sw + push). This closes the measured gaps against pi-lab's installable mobile page: - manifest: scope /dashboard (+id) so the installed app stops claiming the whole origin; 192/512 PNG icons and 512 maskable variants (rasterized from crow-icon.svg via rsvg-convert; maskable ships full-bleed square bg with art at 0.78 inside the safe zone); categories. - layout head: apple-mobile-web-app-title 'Crow'; apple-touch-icon now points at a 180px PNG — iOS renders an SVG touch icon as a blank tile. - sw.js: explicit pass-through (no respondWith) for /dashboard/perch-api/* and any eventsource / text/event-stream request — authed JSON never touches a cache path and SSE keeps native browser streaming instead of the SW fetch pipe. Bumped crow-v1 -> crow-v2. - tests/dashboard-pwa.test.js: 5 static-asset pins incl. bypass ordering (perch bypass must precede the /dashboard/ branch) and return-shape. Funnel invariant untouched: no enforcement-layer file changed; /sw.js stays off PUBLIC_FUNNEL_PREFIXES (measured 403 via funnel header).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Audit item 22 recon found the dashboard already installable (
bb1cb865shipped manifest + SW + push + apple metas). This PR ships the measured gap list vs pi-lab's mobile PWA (operator-approved scope: "polish + guards"):scope: /dashboard+id(installed app stops claiming the whole origin incl./blog); real 192/512 PNG icons + 512 maskable variants (rsvg-convert fromcrow-icon.svg; maskable = full-bleed square bg, art scaled 0.78 into the safe zone);categories.apple-mobile-web-app-title;apple-touch-icon→ 180px PNG (iOS renders an SVG touch icon as a blank home-screen tile)./dashboard/perch-api/*and anyeventsource/Accept: text/event-streamrequest — authed JSON never touches a cache path, SSE keeps native browser streaming.crow-v1→crow-v2./dashboard/respondWith branch) and per-line return shape.Funnel invariant
None of the three enforcement layers touched;
/sw.jsremains outsidePUBLIC_FUNNEL_PREFIXES(measured 403 through the funnel header on R4). No new bundle host ports.Tests
node --check sw.jsclean