From 9357d959ceaa11d92d2c500cc27d68302f658169 Mon Sep 17 00:00:00 2001
From: Wayland <wayland@agents.flopbut.local>
Date: Sun, 14 Jun 2026 22:09:36 +0200
Subject: [PATCH] fix(ui): harden service worker + manifest crossorigin behind
 auth proxy
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Behind Cloudflare Access the console threw on every load:
- A CORS error because /site.webmanifest was fetched without credentials
  and 302-redirected cross-origin to the Access login.
- `TypeError: Failed to convert value to 'Response'` because the SW catch
  handler passed `caches.match(request)` (undefined on a miss) straight
  into `event.respondWith`.

Changes:
- SW now skips cross-origin requests and the auth-sensitive /site.webmanifest
  and /sw.js paths, letting the network/auth proxy own them untouched.
- Never caches redirected / opaqueredirect responses (auth challenges).
- Both catch branches await the cache lookup and fall back to a real
  Response (503 navigate, 504 otherwise) — respondWith never sees undefined.
- Bump CACHE_NAME paperclip-v2 -> paperclip-v3 so the new worker replaces
  the cached old one.
- index.html manifest link gains crossorigin="use-credentials".

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 ui/index.html   |  2 +-
 ui/public/sw.js | 33 +++++++++++++++++++++++++--------
 2 files changed, 26 insertions(+), 9 deletions(-)

diff --git a/ui/index.html b/ui/index.html
index 6a5781e711d..8c2cbaa6f54 100644
--- a/ui/index.html
+++ b/ui/index.html
@@ -15,7 +15,7 @@
     <link rel="icon" type="image/png" sizes="16x16" href="/favicon-16x16.png" />
     <!-- PAPERCLIP_FAVICON_END -->
     <link rel="apple-touch-icon" sizes="180x180" href="/apple-touch-icon.png" />
-    <link rel="manifest" href="/site.webmanifest" />
+    <link rel="manifest" href="/site.webmanifest" crossorigin="use-credentials" />
     <script>
       (() => {
         const key = "paperclip.theme";
diff --git a/ui/public/sw.js b/ui/public/sw.js
index f90d12156f8..a3f21e725f8 100644
--- a/ui/public/sw.js
+++ b/ui/public/sw.js
@@ -1,4 +1,7 @@
-const CACHE_NAME = "paperclip-v2";
+const CACHE_NAME = "paperclip-v3";
+
+// Auth-sensitive / self-referential paths the SW must never intercept.
+const PASS_THROUGH = new Set(["/site.webmanifest", "/sw.js"]);
 
 self.addEventListener("install", () => {
   self.skipWaiting();
@@ -17,26 +20,40 @@ self.addEventListener("fetch", (event) => {
   const { request } = event;
   const url = new URL(request.url);
 
-  // Skip non-GET requests and API calls
-  if (request.method !== "GET" || url.pathname.startsWith("/api")) {
+  // Skip non-GET, API calls, cross-origin requests, and auth-sensitive assets.
+  // Returning (not calling respondWith) lets the network handle them untouched.
+  if (
+    request.method !== "GET" ||
+    url.origin !== self.location.origin ||
+    url.pathname.startsWith("/api") ||
+    PASS_THROUGH.has(url.pathname)
+  ) {
     return;
   }
 
-  // Network-first for everything — cache is only an offline fallback
+  // Network-first; cache is only an offline fallback.
   event.respondWith(
     fetch(request)
       .then((response) => {
-        if (response.ok && url.origin === self.location.origin) {
+        // Never cache redirected / opaqueredirect responses (auth challenges).
+        if (
+          response.ok &&
+          !response.redirected &&
+          response.type !== "opaqueredirect"
+        ) {
           const clone = response.clone();
           caches.open(CACHE_NAME).then((cache) => cache.put(request, clone));
         }
         return response;
       })
-      .catch(() => {
+      .catch(async () => {
+        // Always resolve to a real Response — never undefined.
         if (request.mode === "navigate") {
-          return caches.match("/") || new Response("Offline", { status: 503 });
+          const cached = await caches.match("/");
+          return cached || new Response("Offline", { status: 503 });
         }
-        return caches.match(request);
+        const cached = await caches.match(request);
+        return cached || new Response("", { status: 504, statusText: "Offline" });
       })
   );
 });