Jonathan Kirkwood
858bbe10da
New external role administrator_viewer: signs into the admin interface and reads everything for its granted funds and SPVs (overview, partners, capital accounts with every investor's statements, documents, valuation history) but every write is refused: no imports, uploads, deletions, entity edits, exit marking, or account management. No migration needed; roles are stored as strings. Internal admins can flip an Administrator between full management and view only via a new Access level dropdown in Users > Manage. The user-list endpoint is read-widened for the viewer role so investor names resolve on its screens; all mutating endpoints keep the stricter gate.
57 lines
1.7 KiB
JavaScript
57 lines
1.7 KiB
JavaScript
// Ten31 Portal service worker. Deliberately conservative so it never serves a stale app:
|
|
// - navigations are network-first (always get the latest index.html), cache only as offline fallback
|
|
// - content-hashed /assets/* are cache-first (immutable, safe forever)
|
|
// - /api/* is never cached
|
|
// Bump CACHE on each release so old entries are purged.
|
|
const CACHE = 'ten31-portal-0.2.45'
|
|
|
|
self.addEventListener('install', () => self.skipWaiting())
|
|
|
|
self.addEventListener('activate', (event) => {
|
|
event.waitUntil(
|
|
(async () => {
|
|
const keys = await caches.keys()
|
|
await Promise.all(keys.filter((k) => k !== CACHE).map((k) => caches.delete(k)))
|
|
await self.clients.claim()
|
|
})(),
|
|
)
|
|
})
|
|
|
|
self.addEventListener('fetch', (event) => {
|
|
const req = event.request
|
|
if (req.method !== 'GET') return
|
|
const url = new URL(req.url)
|
|
if (url.origin !== self.location.origin) return
|
|
if (url.pathname.startsWith('/api/')) return
|
|
|
|
if (req.mode === 'navigate') {
|
|
event.respondWith(
|
|
(async () => {
|
|
try {
|
|
const fresh = await fetch(req)
|
|
const cache = await caches.open(CACHE)
|
|
cache.put('/', fresh.clone())
|
|
return fresh
|
|
} catch {
|
|
const cache = await caches.open(CACHE)
|
|
return (await cache.match('/')) || Response.error()
|
|
}
|
|
})(),
|
|
)
|
|
return
|
|
}
|
|
|
|
if (url.pathname.startsWith('/assets/')) {
|
|
event.respondWith(
|
|
(async () => {
|
|
const cache = await caches.open(CACHE)
|
|
const hit = await cache.match(req)
|
|
if (hit) return hit
|
|
const res = await fetch(req)
|
|
if (res.ok) cache.put(req, res.clone())
|
|
return res
|
|
})(),
|
|
)
|
|
}
|
|
})
|