/**
 * Password Vault service worker — a NETWORK SANDBOX.
 *
 * The vault is offline-first (single-file, zero external deps). When installed
 * as a PWA this worker enforces that: it allows requests ONLY for the app's own
 * same-origin static resources (index.html, manifest, icons, and the worker
 * itself) and rejects every cross-origin/third-party request.
 *
 * What this guards against: if a page within the PWA scope tries to exfiltrate
 * or inject via <img>, <script src>, fetch(), an external manifest link, etc.,
 * the worker refuses it before it leaves the device.
 *
 * Residual boundaries covered by the CSP in index.html (which a service worker
 * cannot catch): WebSockets (connect-src 'none') and user-initiated top-level
 * navigation. Form POSTs are blocked by form-action 'none'. img/media that a
 * site tries to load are blocked here AND by img-src 'self'.
 */

const VERSION = '1.0.0'

self.addEventListener('install', () => self.skipWaiting())
self.addEventListener('activate', () => {
  // Claim control of any pages already open in this scope.
  self.clients?.claim?.()
})

/** URL/string->URL normalizer (worker self.location is unreliable in type). */
const toURL = (u) => (u instanceof URL) ? u : new URL(String(u))

/** Is this an in-scope resource for the app itself? */
function isAppOwnResource(url) {
  const selfLoc = toURL(self.location)
  // Cross-origin is always denied.
  if (url.origin !== selfLoc.origin) return false
  // Same-origin is only allowed WITHIN the worker's own directory scope (the
  // index.html, manifest, and icons the app ships). A same-origin request to
  // another app/dir on the same server is outside the sandbox and denied.
  const dir = selfLoc.pathname.slice(0, selfLoc.pathname.lastIndexOf('/') + 1)
  return url.pathname.startsWith(dir)
}

/** Block cross-origin requests; let same-origin app resources through. */
self.addEventListener('fetch', (event) => {
  const url = new URL(event.request.url)
  if (!isAppOwnResource(url)) {
    event.respondWith(Promise.resolve(new Response(null, { status: 403, statusText: 'Blocked by Vault net policy' })))
    return
  }
  // Same-origin: pass through to network (covers reload of index.html and the
  // manifest/icons). We do not cache, so the app is always the current build.
  event.respondWith(fetch(event.request).catch(() => {
    // Network fallback: serve a minimal offline placeholder so a launched app
    // never hangs open on a dead link. The real HTML is never cached here.
    return new Response('offline', { status: 200 })
  }))
})

console.log(`[vault-sw] ${VERSION} active — network sandbox on`)