also looking at this
Promote main to production: signed-out chrome and the subscriber tables
#17
54 files
+4252
-1353
Review threads live on the whole diff, not on one commit, so none are shown here - a thread's line means something in the branch's final form, and painting it into an intermediate step would put it on code it is not about.
| @@ -1,4 +1,31 @@ | ||
| 1 | // The coming-soon preview bypass. | |
| 2 | // | |
| 3 | // A standalone browser asset, not an stx template: no imports, no stx runtime, | |
| 4 | // no composables. The DOM calls below are marked rather than converted because | |
| 5 | // there is nothing here to convert them to -- a useCookie() or navigate() has | |
| 6 | // no runtime to come from, and this file has to keep working on a page served | |
| 7 | // while the app is in coming-soon mode. | |
| 8 | // | |
| 9 | // Marked per call site rather than added to allowPatterns: that list is a | |
| 10 | // rule-global substring filter with no file scoping, so allowing | |
| 11 | // document.cookie for this asset would stop the validator reporting it | |
| 12 | // anywhere in the app. | |
| 13 | // | |
| 14 | // The markers are defensive rather than currently load-bearing, and it is | |
| 15 | // worth being exact about why. stx 0.2.520 resolves <script src> and scans the | |
| 16 | // asset behind it, attributing what it finds to the view that pulled it in -- | |
| 17 | // that is how this same file came to be reported in the status app, where the | |
| 18 | // markers silence it. stx 0.2.532, which this app runs, does not scan assets | |
| 19 | // that way: measured here by reverting the markers and re-rendering, which | |
| 20 | // reported nothing either way. So these mark an exemption that is real but | |
| 21 | // unenforced today, and that returns the moment the scan does. | |
| 22 | // | |
| 23 | // Nothing in this app loads the file today: no <script src> in any view or | |
| 24 | // layout, and no public/ copy to serve. If this app is not meant to have a | |
| 25 | // coming-soon mode at all, deleting it beats keeping it marked. | |
| 26 | ||
| 1 | 27 | (() => { |
| 28 | // stx-strict-ignore-next-line document.body | |
| 2 | 29 | const body = document.body |
| 3 | 30 | if (!body || body.dataset.siteMode !== 'coming-soon') |
| 4 | 31 | return |
| @@ -10,22 +37,27 @@ | ||
| 10 | 37 | const token = body.dataset.comingSoonBypass || '' |
| 11 | 38 | const expectedValue = token || '1' |
| 12 | 39 | const cookieName = 'stacks_coming_soon_preview' |
| 40 | // stx-strict-ignore-next-line window.location | |
| 13 | 41 | const params = new URLSearchParams(window.location.search) |
| 14 | 42 | const requestedPreview = params.get('preview') || params.get('bypass') || '' |
| 15 | 43 | |
| 16 | 44 | if (requestedPreview === 'off') { |
| 45 | // stx-strict-ignore-next-line document.cookie | |
| 17 | 46 | document.cookie = `${cookieName}=; Path=/; Max-Age=0; SameSite=Lax` |
| 18 | 47 | return |
| 19 | 48 | } |
| 20 | 49 | |
| 21 | 50 | if (requestedPreview && requestedPreview === expectedValue) { |
| 51 | // stx-strict-ignore-next-line document.cookie | |
| 22 | 52 | document.cookie = `${cookieName}=${encodeURIComponent(expectedValue)}; Path=/; Max-Age=2592000; SameSite=Lax` |
| 23 | 53 | body.classList.add('site-mode-unlocked') |
| 54 | // stx-strict-ignore-next-line window.history window.location | |
| 24 | 55 | window.history.replaceState({}, '', `${window.location.pathname}${window.location.hash}`) |
| 25 | 56 | return |
| 26 | 57 | } |
| 27 | 58 | |
| 28 | 59 | const cookies = Object.fromEntries( |
| 60 | // stx-strict-ignore-next-line document.cookie | |
| 29 | 61 | document.cookie |
| 30 | 62 | .split(';') |
| 31 | 63 | .map(cookie => cookie.trim()) |