Merge pull request #41 from niteeshkanna-sh/claude/stoic-rubin-fnglq7

Stop the panel's own scripts being cached for a year

Author: niteeshkanna-sh

admin/.htaccess

@@ -8,6 +8,29 @@
 # its contents, which is how the layout of a panel gets mapped.
 Options -Indexes
 
+# Undo the document root's caching rule for this folder.
+#
+# The site's build assets carry a content hash in the filename, so a changed
+# file is a changed URL and the root .htaccess caches every .js and .css for a
+# year as immutable. Correct for those. Fatal for these: admin.js, admin.css,
+# api.js and car-data.js have fixed names, so a browser that has them once
+# would never ask again -- and every change to the panel would reach nobody who
+# had ever used it, with no error and nothing to notice.
+#
+# Revalidated on each load instead. It costs one conditional request per file
+# and it is the difference between shipping a change and appearing to.
+<IfModule mod_expires.c>
+  <FilesMatch "\.(js|css)$">
+    ExpiresActive On
+    ExpiresDefault "access plus 0 seconds"
+  </FilesMatch>
+</IfModule>
+<IfModule mod_headers.c>
+  <FilesMatch "\.(js|css)$">
+    Header set Cache-Control "no-cache, must-revalidate"
+  </FilesMatch>
+</IfModule>
+
 <IfModule mod_authz_core.c>
     # config.php holds the database password. PHP executes it rather than
     # printing it, so this changes nothing while PHP is healthy -- it matters

admin/content.php

@@ -2,6 +2,7 @@
 declare(strict_types=1);
 
 require_once __DIR__ . '/src/csrf.php';
+require_once __DIR__ . '/src/assets.php';
 require_once __DIR__ . '/src/content.php';
 require_once __DIR__ . '/src/migrate.php';
 require_once __DIR__ . '/src/audit.php';
@@ -105,7 +106,7 @@ function field_input(string $name, array $spec, mixed $value): void
   <title>Website content — NiteSha Cars</title>
   <meta name="robots" content="noindex, nofollow" />
   <link rel="icon" href="data:image/svg+xml,<svg xmlns=%22http://www.w3.org/2000/svg%22 viewBox=%220 0 100 100%22><text y=%22.9em%22 font-size=%2290%22>🔐</text></svg>" />
-  <link rel="stylesheet" href="admin.css" />
+  <link rel="stylesheet" href="<?= asset('admin.css') ?>" />
   <style>
     .c-wrap { max-width: 56rem; margin: 0 auto; padding: 1.5rem 1rem 4rem; }
     .c-top { display: flex; flex-wrap: wrap; gap: 1rem; align-items: baseline; justify-content: space-between; margin-bottom: 1.25rem; }

admin/dashboard.php

@@ -2,6 +2,7 @@
 declare(strict_types=1);
 
 require_once __DIR__ . '/src/csrf.php';
+require_once __DIR__ . '/src/assets.php';
 
 // Anyone reaching this page must already be signed in; require_login sends
 // them to the sign-in form otherwise.
@@ -22,7 +23,7 @@
   <link rel="preconnect" href="https://fonts.googleapis.com">
   <link href="https://fonts.googleapis.com/css2?family=Poppins:wght@400;500;600;700;800&display=swap" rel="stylesheet">
   <meta name="csrf-token" content="<?= e(csrf_token()) ?>">
-  <link rel="stylesheet" href="admin.css" />
+  <link rel="stylesheet" href="<?= asset('admin.css') ?>" />
 </head>
 <body>
 
@@ -751,9 +752,9 @@
     </div>
   </div>
 
-  <script src="api.js"></script>
-  <script src="car-data.js"></script>
-  <script src="booking-data.js"></script>
-  <script src="admin.js"></script>
+  <script src="<?= asset('api.js') ?>"></script>
+  <script src="<?= asset('car-data.js') ?>"></script>
+  <script src="<?= asset('booking-data.js') ?>"></script>
+  <script src="<?= asset('admin.js') ?>"></script>
 </body>
 </html>

admin/index.php

@@ -2,6 +2,7 @@
 declare(strict_types=1);
 
 require_once __DIR__ . '/src/csrf.php';
+require_once __DIR__ . '/src/assets.php';
 
 // Already signed in — go straight through.
 if (current_user() !== null) {
@@ -44,7 +45,7 @@
   <meta name="robots" content="noindex, nofollow">
   <link rel="preconnect" href="https://fonts.googleapis.com">
   <link href="https://fonts.googleapis.com/css2?family=Poppins:wght@400;500;600;700;800&display=swap" rel="stylesheet">
-  <link rel="stylesheet" href="admin.css">
+  <link rel="stylesheet" href="<?= asset('admin.css') ?>">
 </head>
 <body>
 

admin/src/assets.php

@@ -0,0 +1,29 @@
+<?php
+declare(strict_types=1);
+
+/**
+ * URLs for the panel's own stylesheet and scripts.
+ *
+ * admin.js and admin.css have fixed names, unlike the site's build output
+ * which carries a content hash in the filename. The document root caches every
+ * .js and .css for a year as immutable -- correct for hashed files, fatal for
+ * these: a browser that loaded the panel once would never fetch them again, so
+ * a change reached nobody who had ever used it, with no error and nothing to
+ * notice.
+ *
+ * admin/.htaccess now overrides that header, but only for browsers that ask,
+ * and one already holding the file will not ask until next year. The
+ * modification time in the query string is what actually breaks that: a
+ * changed file is a different URL, so the cached copy cannot match.
+ *
+ * Its own file rather than http.php, which is the JSON endpoints' plumbing and
+ * is not loaded by any page that renders HTML. Putting it there defined it
+ * exactly where it was never called from.
+ */
+
+function asset(string $file): string
+{
+    $path = __DIR__ . '/../' . $file;
+    $stamp = is_file($path) ? (string) filemtime($path) : '0';
+    return $file . '?v=' . $stamp;
+}