Jonathan Kirkwood
ae967494bd
The external fund_administrator role (relabeled Administrator) now signs
into the full admin interface, fenced to the funds and SPVs granted to
it via EntityAccess:
- Partners, capital accounts, documents (upload and delete), entity
edits, and eNAV imports for its own funds only; no fund creation,
valuation sign-off, audit log, or investor view.
- Scoped user management: sees and manages only investors tied to its
funds; creates investor accounts only; updates preserve grants on
funds outside its scope.
- New DELETE /api/users/{id} (in-app Delete user button) with the
cascade cleanup factored out of the CLI; Service Admin and self are
protected, and an Administrator can only delete an investor who
belongs solely to its funds.
- Internal fund_admin relabeled 'Staff (all funds)' and dropped from
the create picker to end the two-similar-names confusion.
- Version badge removed from the UI (sidebar and portal header); the
build version now logs to the browser console instead.
- deploy/.startos (signing key) added to .gitignore.
57 lines
1.7 KiB
JavaScript
57 lines
1.7 KiB
JavaScript
// Ten31 Portal service worker. Deliberately conservative so it never serves a stale app:
|
|
// - navigations are network-first (always get the latest index.html), cache only as offline fallback
|
|
// - content-hashed /assets/* are cache-first (immutable, safe forever)
|
|
// - /api/* is never cached
|
|
// Bump CACHE on each release so old entries are purged.
|
|
const CACHE = 'ten31-portal-0.2.42'
|
|
|
|
self.addEventListener('install', () => self.skipWaiting())
|
|
|
|
self.addEventListener('activate', (event) => {
|
|
event.waitUntil(
|
|
(async () => {
|
|
const keys = await caches.keys()
|
|
await Promise.all(keys.filter((k) => k !== CACHE).map((k) => caches.delete(k)))
|
|
await self.clients.claim()
|
|
})(),
|
|
)
|
|
})
|
|
|
|
self.addEventListener('fetch', (event) => {
|
|
const req = event.request
|
|
if (req.method !== 'GET') return
|
|
const url = new URL(req.url)
|
|
if (url.origin !== self.location.origin) return
|
|
if (url.pathname.startsWith('/api/')) return
|
|
|
|
if (req.mode === 'navigate') {
|
|
event.respondWith(
|
|
(async () => {
|
|
try {
|
|
const fresh = await fetch(req)
|
|
const cache = await caches.open(CACHE)
|
|
cache.put('/', fresh.clone())
|
|
return fresh
|
|
} catch {
|
|
const cache = await caches.open(CACHE)
|
|
return (await cache.match('/')) || Response.error()
|
|
}
|
|
})(),
|
|
)
|
|
return
|
|
}
|
|
|
|
if (url.pathname.startsWith('/assets/')) {
|
|
event.respondWith(
|
|
(async () => {
|
|
const cache = await caches.open(CACHE)
|
|
const hit = await cache.match(req)
|
|
if (hit) return hit
|
|
const res = await fetch(req)
|
|
if (res.ok) cache.put(req, res.clone())
|
|
return res
|
|
})(),
|
|
)
|
|
}
|
|
})
|