Changeset e2ea5c4 in Klonkt

Timestamp:

07/21/2026 03:55:26 AM (7 weeks ago)

Author:

Robin <roboburr@…>

Branches:

main

Children:

fb30b5d

Parents:

f574435

git-author:

Robin <roboburr@…> (07/21/2026 03:55:23 AM)

git-committer:

Robin <roboburr@…> (07/21/2026 03:55:26 AM)

Message:

Fix: online visitors always get the fresh site, never a cached copy

The service worker was already network-first, but two gaps let a stale page
through while online:

• the SW's navigation fetch used the browser HTTP cache, so it could return a heuristically-cached page even though it "fetched",
• full HTML pages carried no Cache-Control, so the browser was free to cache them heuristically.

Now the SW fetches navigations with { cache: 'no-store' } (straight to the
network, cache is only the offline .catch fallback), and renderPage sends
Cache-Control: no-cache on full pages (revalidate; still bfcache-friendly,
partials stay no-store). Verified live: /sw.js uses no-store and GET / returns
Cache-Control: no-cache. Bumped the SW cache name v17 -> v18.

Changed files:
src/server.js

• sw.js navigation fetch uses { cache: 'no-store' }; cache name v18

src/middleware/render.js

• full HTML pages get Cache-Control: no-cache (partials stay no-store)

-robo
Co-Authored-By: Claude Opus 4.8 <noreply@…>

Location:

src

Files:

• middleware/render.js (modified) (1 diff)
• server.js (modified) (2 diffs)

src/middleware/render.js

@@ -73 +73 @@
   // (Vary also applies to intermediate caches / Cloudflare.)
   res.setHeader('Vary', 'HX-Request');
-  if (isPartial) res.setHeader('Cache-Control', 'no-store');
+  // A full HTML page must always be revalidated so an online visitor gets the
+  // fresh site, never a heuristically-cached copy. no-cache (not no-store) still
+  // allows bfcache and conditional requests. Partials stay no-store (see above).
+  res.setHeader('Cache-Control', isPartial ? 'no-store' : 'no-cache');
 
   // Does this (non-god) user own a site? Determines whether they see an "Admin"

src/server.js

@@ -478 +478 @@
   res.set('Cache-Control', 'no-cache');
   res.send(`
-const CACHE_VERSION = 'pcms-v17-' + new Date().toISOString().split('T')[0];
+const CACHE_VERSION = 'pcms-v18-' + new Date().toISOString().split('T')[0];
 self.addEventListener('install', e => {
   e.waitUntil(caches.open(CACHE_VERSION).then(c => c.addAll(['/'])));
@@ -503 +503 @@
   try { if (new URL(e.request.url).origin !== self.location.origin) return; } catch (err) { return; }
   e.respondWith(
-    fetch(e.request).then(resp => {
+    // { cache: 'no-store' }: go to the network for the page, bypassing the browser's
+    // HTTP cache, so an online visitor ALWAYS gets the fresh site and never a
+    // heuristically-cached copy served through the SW. The cache is only a
+    // last-resort offline fallback (the .catch below).
+    fetch(e.request, { cache: 'no-store' }).then(resp => {
       // Network-first: always serve fresh when online. Also refresh the '/' offline
       // fallback with the homepage we just served, so a later cold start on a flaky or