Never serve the service worker from a cache

The deploy on 2026-09-08 went out at the origin and did not arrive. Cloudflare went on handing out the previous `sw.js` -- `cf-cache-status: HIT`, with an edge TTL of four hours, longer than the hour we asked for -- because the file is neither a hashed asset nor HTML and so fell into the ordinary `max-age=3600` case. That is not a freshness preference. The service worker is the app's whole update mechanism: a browser holding the old one goes on being served the shell that worker knows and never learns a deploy happened, so the deploy simply does not land. The manifest matters for a second reason -- the two have to agree. A fresh manifest advertising a share target, answered by a worker that has never heard of one, sends the share to the server for a 405. Either being old is survivable; disagreeing is not. `no-cache` rather than `no-store`: both may still keep a copy, they just have to revalidate it, which is a 304 and costs nothing. Neither gets to answer with its own copy without asking. Narrow on purpose -- two files, named, rather than a policy that quietly stops the icons and fonts being cached as well.
2026-09-07 23:02:19 -07:00
parent 1592f38515
commit 0ad19802f8
2 changed files with 111 additions and 1 deletions
@@ -0,0 +1,81 @@
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { mkdtempSync, writeFileSync, mkdirSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+/*
+ * What may be served stale, and what may not.
+ *
+ * This is not a preference about freshness. The service worker is the app's
+ * whole update mechanism: a browser holding an old one goes on being served
+ * the shell that worker knows and never finds out a deploy happened. On
+ * 2026-09-08 the origin had the new build while Cloudflare handed out the
+ * previous `sw.js` for hours, because it was neither a hashed asset nor HTML
+ * and so went out with an hour's max-age that the CDN then extended.
+ *
+ * A static root of our own, since CI runs the tests before the build and
+ * `web/dist` does not exist yet.
+ */
+const root = mkdtempSync(join(tmpdir(), "ihasmail-cache-"));
+mkdirSync(join(root, "assets"));
+writeFileSync(join(root, "assets", "app-a1b2c3.js"), "console.log(1)\n");
+writeFileSync(join(root, "sw.js"), "/* worker */\n");
+writeFileSync(join(root, "manifest.webmanifest"), `{"name":"ihasmail"}`);
+writeFileSync(join(root, "index.html"), "<!doctype html><title>t</title>");
+writeFileSync(join(root, "img.png"), "not really a png");
+
+process.env.STATIC_DIR = root;
+process.env.STALWART_URL = "http://127.0.0.1:1";
+const { createApp } = await import("./app.js");
+
+const cacheControl = async (path: string) => {
+  const res = await createApp().request(path);
+  assert.equal(res.status, 200, `${path} should be served`);
+  return res.headers.get("cache-control") ?? "";
+};
+
+test("the service worker is never served from a cache without asking", async () => {
+  // `no-cache` permits storing it and requires revalidating it, which is a 304
+  // and costs nothing. What it forbids is a browser or a CDN answering with
+  // its own copy, which is the whole failure.
+  assert.match(await cacheControl("/sw.js"), /no-cache/);
+});
+
+test("nor is the manifest, which the worker has to agree with", async () => {
+  // A fresh manifest advertising a share target, answered by a worker that has
+  // never heard of one, sends the share to the server for a 405. Either being
+  // old is survivable; the two disagreeing is not.
+  assert.match(await cacheControl("/manifest.webmanifest"), /no-cache/);
+});
+
+test("the manifest is still served as a manifest", async () => {
+  const res = await createApp().request("/manifest.webmanifest");
+  assert.match(res.headers.get("content-type") ?? "", /application\/manifest\+json/);
+});
+
+test("index.html was already revalidated, and still is", async () => {
+  assert.match(await cacheControl("/"), /no-cache/);
+});
+
+test("hashed assets are still immutable for a year", async () => {
+  // The name changes when the bytes do, so there is nothing to go stale --
+  // and this is the caching that makes the app load quickly at all.
+  const cc = await cacheControl("/assets/app-a1b2c3.js");
+  assert.match(cc, /immutable/);
+  assert.match(cc, /max-age=31536000/);
+});
+
+test("everything else keeps its ordinary hour", async () => {
+  // The rule is narrow on purpose: two files, named, rather than a policy that
+  // quietly stops the icons and fonts being cached too.
+  assert.match(await cacheControl("/img.png"), /max-age=3600/);
+});
+
+test("under a prefix, the worker is still the worker", async () => {
+  // The mount comes off before the path is matched, so this has to hold for a
+  // subpath deployment as well -- where a stale worker is exactly as bad.
+  const res = await createApp("/mail").request("/mail/sw.js");
+  assert.equal(res.status, 200);
+  assert.match(res.headers.get("cache-control") ?? "", /no-cache/);
+});