jaredandClaude Opus 5
96a97a2f86
public/manifest.json declares share_target (POST multipart to /share-target: title/text/url + image/video/audio/pdf/text files). The service worker answers that POST itself: it stashes the form in a Cache API bucket and 303s to the in-app /share page, which lists what arrived, offers a room search, and on pick writes the files into that room's upload-board atom (encrypting first for E2EE rooms via the composer's shared filesToUploadItems) and the title/text/url into its draft, then opens the room — the user still presses Send. The stash is cleared once placed; reopening /share afterwards says so. nginx/caddy examples and the prod image config gain a 303 for /share-target so a POST that reaches the origin before the worker controls the page lands on /share instead of a 405. iOS has no share target support and ignores the manifest entry. Verified headless against the built preview: SW-controlled page → POST /share-target (two PNGs + title + text) → /share lists both files and the text → pick the DM → composer shows both files on the upload board and the text in the draft → /share reports nothing pending. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PPmy3tPq869XDW4njjVaKA
22 lines
988 B
Plaintext
22 lines
988 B
Plaintext
# more info: https://caddyserver.com/docs/caddyfile/patterns#single-page-apps-spas
|
|
cinny.domain.tld {
|
|
root * /path/to/cinny/dist
|
|
# [Gitea #155] PWA share target: the service worker answers this POST; if it
|
|
# isn't controlling the page yet, land on /share instead of a 405.
|
|
redir /share-target /share 303
|
|
|
|
try_files {path} /index.html
|
|
file_server
|
|
|
|
# Security headers (generic; add a Content-Security-Policy suited to your
|
|
# homeserver + any embedded services). Caddy serves HTTPS automatically, so
|
|
# HSTS is delivered over TLS.
|
|
header {
|
|
X-Frame-Options SAMEORIGIN
|
|
X-Content-Type-Options nosniff
|
|
Referrer-Policy strict-origin-when-cross-origin
|
|
Strict-Transport-Security "max-age=63072000; includeSubDomains"
|
|
Permissions-Policy "accelerometer=(), autoplay=(self), camera=(self), display-capture=(self), encrypted-media=(self), fullscreen=(self), geolocation=(self), gyroscope=(), magnetometer=(), microphone=(self), midi=(), payment=(), usb=()"
|
|
}
|
|
}
|