2 Commits

Author	SHA1	Message	Date
Dragan Spiridonov	9b9754778f	fix(ui): service worker cached /oauth/status, freezing browser sign-in ... Browser sign-in worked, but the settings panel kept offering "Sign in with Cognitum" afterwards; only a hard reload showed the true state. The server was correct throughout. Root cause: `ui/sw.js` routed cache-first as its CATCH-ALL for every path outside `/api/` and `/health/`. `/oauth/status` therefore had its first (signed-out) response stored in the Cache API and replayed to the page forever. The Cache API is not the HTTP cache and ignores `Cache-Control` entirely, so the `no-store, no-cache, must-revalidate` the server already sends could not prevent it. A hard reload bypasses the service worker, which is why that alone appeared to fix it, and why signing out re-poisoned the entry. Fixes, in order of blast radius: - `/oauth/` is never handled by the worker. Not network-first — that still writes a copy, which would be replayed the moment the server is briefly unreachable, silently reinstating a stale sign-in state. - Cache-first is now an ALLOWLIST (navigations and static asset extensions) rather than the catch-all. This is the underlying defect: any endpoint added outside `/api/` was frozen on its first response. Unrecognised paths now go to the network untouched. - `CACHE_NAME` bumped to `ruview-v2`, so `activate` evicts the poisoned `ruview-v1` from browsers that already ran the old worker. Verified: the cache list went from `[ruview-v1]` to `[ruview-v2]` on update. - Shell lookups use `ignoreSearch` and store a search-less key, so the `?signed_in=<ms>` the callback redirects to does not mint a fresh, never-hit cache entry per sign-in. Also: re-check sign-in state on `pageshow` (bfcache restore, where no script re-runs) and on `visibilitychange` (signed in or out in another tab). Opening the panel alone is not sufficient — it may already be open. Verification, in a real browser driven end-to-end: - Reproduced with a valid session cookie: server returned `signed_in: true` to curl while the page's own fetch got a cached `signed_in: false`, and the request never appeared in the server log at all. - Confirmed the cached entry existed: `caches.open('ruview-v1').match( '/oauth/status')` returned the signed-out body. - After the fix, on a NORMAL (not hard) reload the panel reads "Signed in as <account> - sensing:read" with Sign out shown. Tests: `ui/sw.test.mjs` loads the real `sw.js` with stubbed worker globals and asserts the routing decision per path. 4 of its 10 tests fail against the pre-fix worker and pass after; the other 6 pin pre-existing guards (non-GET, websocket upgrade, cross-origin, API paths, static assets, navigation) and pass in both, so they track behaviour rather than the rewrite. CI: adds a `ui-tests` job. Nothing ran the UI JavaScript before, so both this suite and the ADR-272 ws-ticket suite would have rotted unexecuted — which is the same blind spot that let this defect ship. Removes the temporary `/oauth/status` cookie logging and the panel console diagnostic added while tracking this down. Co-Authored-By: Ruflo & AQE	2026-07-23 11:20:13 +02:00
nai	49fb2ca9f4	feat(ui): UI overhaul — consolidates #305-#309 (keyboard shortcuts, perf monitor, toasts, theme, command palette, activity log, data export, mobile PWA, accessibility, i18n) (#620) ... * feat(ui): add keyboard shortcuts, perf monitor, toast system, theme toggle, and WCAG accessibility - Keyboard shortcuts overlay (press ? for help, 1-8 for tabs, T for theme, P for perf) - Real-time performance monitor with FPS, memory, latency sparklines (draggable) - Enhanced toast notification system with stacking, auto-dismiss, progress bars - Dark/light theme toggle with localStorage persistence and system preference detection - WCAG accessibility: skip-to-content link, ARIA roles/attributes on tabs and panels, arrow key navigation in tab bar, focus-visible outlines - ESLint config for UI directory with security and quality rules * feat(ui): add command palette, activity log, data export, fullscreen mode, connection status - Command palette (Ctrl+K / Cmd+K) with fuzzy search across tabs and actions - Activity log panel (L key) with real-time console interception, filters, resizable - Data export utility (E key) for sensor data as JSON/CSV with dialog - Fullscreen mode (F key / F11) for visualization tabs with exit button - Connection status widget in header showing WebSocket state and reconnect * feat(ui): add mobile hamburger nav, PWA support, and 40 unit tests - Mobile hamburger navigation: slide-out drawer replacing tab bar on <768px, swipe-to-close, animated hamburger icon, auto-sync with tab manager - PWA manifest + service worker: installable dashboard, offline shell caching (cache-first for static, network-first for API), auto-cleanup of old caches - 40 unit tests for ToastManager, ThemeToggle, KeyboardShortcuts, PerfMonitor, TabManager - browser-based test runner at ui/tests/unit-tests.html - PWA meta tags: theme-color, apple-mobile-web-app-capable, manifest link - Icon generator page for creating PWA icons (ui/icons/generate.html) * feat(ui): add URL routing, onboarding tour, idle detection, notification center - Hash router: tabs are bookmarkable/shareable via URL (#demo, #sensing, etc.), syncs with TabManager, supports browser back/forward navigation - Onboarding tour: interactive 6-step first-run walkthrough with spotlight highlighting, step indicators, skip/back/next controls, localStorage persistence - Idle detection: pauses health polling and reduces CSS animations after 3 min of inactivity, resumes on user interaction, integrates with Page Visibility API - Notification center: bell icon in header with unread badge, event history panel with mark-read/clear, persists across page views via sessionStorage * feat(ui): add i18n (EN/PL), screenshot tool, settings panel, reduced motion, uptime clock - i18n: English/Polish translations with auto-detection, language selector in header, data-i18n attributes on dashboard elements, localStorage persistence - Screenshot tool (S key): captures active tab to clipboard or downloads PNG, flash effect, canvas rendering with watermark, fallback for tainted canvases - Quick settings panel (gear icon): reduced motion toggle, high contrast mode, compact layout mode, health polling toggle, clear data, reset onboarding - Uptime clock: current time + session duration in header - prefers-reduced-motion: system-level and manual toggle, disables all animations and transitions for vestibular accessibility - High contrast mode: WCAG AAA compliant colors for both light and dark themes - Compact mode: condensed layout for dense information display	2026-05-19 10:04:59 -04:00