Security: CSP gehärtet — unsafe-inline + unsafe-eval raus, SW by-v1100

Inline-Scripts extrahiert: - boot-early.js: Theme + theme-color (synchron im <head>, VOR CSS) - boot.js: Offline-Banner + Service-Worker-Registration + Update-Flow - landing-init.js: Dark-mode + Scroll-Animationen + Live-Stats + Stay-In-App-Handler + Details-Toggle Inline onclick-Handler in landing.html: - 5× sessionStorage.setItem('by_stay_in_app','1') → data-stay-in-app - 1× Details-Toggle → data-toggle-target + data-toggle-text-open - JS-Handler in landing-init.js binden die data-Attribute CSP-Header (main.py): - script-src: 'unsafe-inline' und 'unsafe-eval' entfernt - style-src 'unsafe-inline' bleibt (Inline-Styles bleiben für jetzt, zu viele Fundstellen) - Umami bleibt whitelisted SW STATIC_ASSETS erweitert um boot-early.js + boot.js. make bump aktualisiert jetzt auch landing.html ?v= Anker. Tests grün (19/19).
2026-05-27 06:23:47 +02:00 · 2026-05-27 06:23:47 +02:00 · 65cfa25e59
commit 65cfa25e59
parent 15d319fbd5
10 changed files with 267 additions and 226 deletions
--- a/backend/static/js/boot.js
+++ b/backend/static/js/boot.js
@ -0,0 +1,127 @@
+/* ============================================================
+   BAN YARO — Boot-Phase
+   Offline-Banner + Service Worker Registration + Update-Flow
+   Extrahiert aus index.html für CSP-Härtung (kein unsafe-inline)
+   ============================================================ */
+
+// ----------------------------------------------------------
+// Offline-Banner
+// ----------------------------------------------------------
+(function() {
+  function _updateBanner() {
+    var banner = document.getElementById('offline-banner');
+    if (!banner) return;
+    banner.style.display = navigator.onLine ? 'none' : 'flex';
+  }
+  window.addEventListener('offline', function() {
+    _updateBanner();
+    // Einmaliger Hinweis pro Session: App im Vordergrund lassen
+    if (!sessionStorage.getItem('by_offline_hint_shown')) {
+      sessionStorage.setItem('by_offline_hint_shown', '1');
+      setTimeout(function() {
+        window.UI?.toast?.info(
+          'App im Vordergrund lassen — so bleiben Offline-Funktionen wie GPS und Datenspeicherung aktiv.',
+          8000
+        );
+      }, 800);
+    }
+    // Queue-Count abfragen
+    if (navigator.serviceWorker) {
+      navigator.serviceWorker.ready.then(function(reg) {
+        if (reg.active) reg.active.postMessage({ type: 'QUEUE_COUNT' });
+      });
+    }
+  });
+  window.addEventListener('online', function() {
+    _updateBanner();
+    var badge = document.getElementById('offline-queue-badge');
+    if (badge) badge.style.display = 'none';
+    // Queue abarbeiten
+    if (navigator.serviceWorker) {
+      navigator.serviceWorker.ready.then(function(reg) {
+        if (reg.active) reg.active.postMessage({ type: 'PROCESS_QUEUE' });
+      });
+    }
+  });
+  _updateBanner();
+})();
+
+// ----------------------------------------------------------
+// Service Worker Registration + Update-Flow
+// ----------------------------------------------------------
+if ('serviceWorker' in navigator) {
+  window.addEventListener('load', function() {
+    navigator.serviceWorker.register('/sw.js', { updateViaCache: 'none' })
+      .then(function(reg) {
+        function _watchSW(sw) {
+          if (!sw) return;
+          sw.addEventListener('statechange', function() {
+            if (sw.state === 'activated') {
+              if (sessionStorage.getItem('by_skip_sw_reload')) return;
+              window.location.replace('/?_t=' + Date.now());
+            }
+          });
+        }
+        reg.addEventListener('updatefound', function() { _watchSW(reg.installing); });
+        if (reg.installing) _watchSW(reg.installing);
+        reg.update();
+      })
+      .catch(function(err) { console.warn('SW Registration failed:', err); });
+  });
+
+  // App aus dem Hintergrund: erneut prüfen
+  document.addEventListener('visibilitychange', function() {
+    if (document.visibilityState === 'visible') {
+      navigator.serviceWorker.getRegistration().then(function(reg) { if (reg) reg.update(); });
+    }
+  });
+
+  // Backup: controllerchange falls updatefound nicht feuert
+  // NICHT registrieren wenn diese Seite selbst durch SW-Reload entstand
+  if (!window._BY_SW_RELOAD) {
+    navigator.serviceWorker.addEventListener('controllerchange', function() {
+      if (sessionStorage.getItem('by_skip_sw_reload')) {
+        sessionStorage.removeItem('by_skip_sw_reload');
+        return;
+      }
+      window.location.replace('/?_t=' + Date.now());
+    });
+  }
+
+  navigator.serviceWorker.addEventListener('message', function(e) {
+    if (e.data && e.data.type === 'QUEUE_PROCESSED') {
+      var synced = e.data.synced, failed = e.data.failed, total = e.data.total;
+      if (total === 0) return;
+      if (synced > 0 && window.UI && window.UI.toast) {
+        window.UI.toast.success(
+          synced === 1
+            ? '1 offline gespeicherter Eintrag synchronisiert'
+            : synced + ' offline gespeicherte Einträge synchronisiert'
+        );
+        if (window.App && window.App.state && window.pages) {
+          var p = window.pages[window.App.state.page];
+          if (p && p.module && p.module.refresh) p.module.refresh();
+        }
+      }
+      if (failed > 0 && window.UI && window.UI.toast) {
+        window.UI.toast.warning(failed + ' Eintrag' + (failed > 1 ? 'e' : '') + ' noch nicht synchronisiert — kein Netz');
+      }
+      return;
+    }
+    if (e.data && e.data.type === 'QUEUE_COUNT') {
+      var badge = document.getElementById('offline-queue-badge');
+      if (badge) {
+        if (e.data.count > 0) {
+          badge.textContent = e.data.count;
+          badge.style.display = '';
+        } else {
+          badge.style.display = 'none';
+        }
+      }
+      return;
+    }
+    if (e.data && e.data.type === 'CHECK_NEARBY_ALERTS') {
+      if (window.App && window.App._checkNearbyAlerts) window.App._checkNearbyAlerts();
+    }
+  });
+}