Stop the panel's own scripts being cached for a year

The document root caches every .js and .css for a year as immutable. That
is right for the site's build output, where a changed file is a changed
filename because the name carries a content hash. It is wrong for the
panel: admin.js, admin.css, api.js, car-data.js and booking-data.js have
fixed names, so a browser that loaded the panel once would not ask for
them again until 2027 -- and every change to the panel would reach nobody
who had ever used it, with no error and nothing to notice. The vehicle
photograph upload merged minutes ago would have been the first casualty.

Two parts, because one alone does not finish the job. admin/.htaccess
overrides the header for this folder, which fixes it for browsers that
ask -- and a browser already holding the file will not ask. So the tags
now carry the file's modification time: a changed file is a different
URL, and the cached copy cannot match it.

asset() lives in its own src/assets.php. It went into http.php first,
which was wrong in a way worth recording: http.php is the JSON endpoints'
plumbing, and no page that renders HTML loads it. dashboard.php,
index.php and content.php all require csrf.php and nothing else, so
asset() was defined precisely where it was never called from and every
panel page would have died on an undefined function. Caught by loading
the pages rather than by reading them -- php -l passes on a file that
calls a function that does not exist.

Verified: asset() returns admin.css?v=<mtime> and falls back to ?v=0 for
a file that is not there; the require precedes the first call in all
three pages; index.php reaches its database call, which is as far as
anything gets here.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0128YzbhrfGdegUSc9RrARRf

Author: claude

admin/.htaccess

@@ -8,6 +8,29 @@
 # its contents, which is how the layout of a panel gets mapped.
 Options -Indexes
 
+# Undo the document root's caching rule for this folder.
+#
+# The site's build assets carry a content hash in the filename, so a changed
+# file is a changed URL and the root .htaccess caches every .js and .css for a
+# year as immutable. Correct for those. Fatal for these: admin.js, admin.css,
+# api.js and car-data.js have fixed names, so a browser that has them once
+# would never ask again -- and every change to the panel would reach nobody who
+# had ever used it, with no error and nothing to notice.
+#
+# Revalidated on each load instead. It costs one conditional request per file
+# and it is the difference between shipping a change and appearing to.
+<IfModule mod_expires.c>
+  <FilesMatch "\.(js|css)$">
+    ExpiresActive On
+    ExpiresDefault "access plus 0 seconds"
+  </FilesMatch>
+</IfModule>
+<IfModule mod_headers.c>
+  <FilesMatch "\.(js|css)$">
+    Header set Cache-Control "no-cache, must-revalidate"
+  </FilesMatch>
+</IfModule>
+
 <IfModule mod_authz_core.c>
     # config.php holds the database password. PHP executes it rather than
     # printing it, so this changes nothing while PHP is healthy -- it matters

admin/content.php

@@ -2,6 +2,7 @@
 declare(strict_types=1);
 
 require_once __DIR__ . '/src/csrf.php';
+require_once __DIR__ . '/src/assets.php';
 require_once __DIR__ . '/src/content.php';
 require_once __DIR__ . '/src/migrate.php';
 require_once __DIR__ . '/src/audit.php';
@@ -105,7 +106,7 @@ function field_input(string $name, array $spec, mixed $value): void
   <title>Website content — NiteSha Cars</title>
   <meta name="robots" content="noindex, nofollow" />
   <link rel="icon" href="data:image/svg+xml,<svg xmlns=%22http://www.w3.org/2000/svg%22 viewBox=%220 0 100 100%22><text y=%22.9em%22 font-size=%2290%22>🔐</text></svg>" />
-  <link rel="stylesheet" href="admin.css" />
+  <link rel="stylesheet" href="<?= asset('admin.css') ?>" />
   <style>
     .c-wrap { max-width: 56rem; margin: 0 auto; padding: 1.5rem 1rem 4rem; }
     .c-top { display: flex; flex-wrap: wrap; gap: 1rem; align-items: baseline; justify-content: space-between; margin-bottom: 1.25rem; }

admin/dashboard.php

@@ -2,6 +2,7 @@
 declare(strict_types=1);
 
 require_once __DIR__ . '/src/csrf.php';
+require_once __DIR__ . '/src/assets.php';
 
 // Anyone reaching this page must already be signed in; require_login sends
 // them to the sign-in form otherwise.
@@ -22,7 +23,7 @@
   <link rel="preconnect" href="https://fonts.googleapis.com">
   <link href="https://fonts.googleapis.com/css2?family=Poppins:wght@400;500;600;700;800&display=swap" rel="stylesheet">
   <meta name="csrf-token" content="<?= e(csrf_token()) ?>">
-  <link rel="stylesheet" href="admin.css" />
+  <link rel="stylesheet" href="<?= asset('admin.css') ?>" />
 </head>
 <body>
 
@@ -751,9 +752,9 @@
     </div>
   </div>
 
-  <script src="api.js"></script>
-  <script src="car-data.js"></script>
-  <script src="booking-data.js"></script>
-  <script src="admin.js"></script>
+  <script src="<?= asset('api.js') ?>"></script>
+  <script src="<?= asset('car-data.js') ?>"></script>
+  <script src="<?= asset('booking-data.js') ?>"></script>
+  <script src="<?= asset('admin.js') ?>"></script>
 </body>
 </html>

admin/index.php

@@ -2,6 +2,7 @@
 declare(strict_types=1);
 
 require_once __DIR__ . '/src/csrf.php';
+require_once __DIR__ . '/src/assets.php';
 
 // Already signed in — go straight through.
 if (current_user() !== null) {
@@ -44,7 +45,7 @@
   <meta name="robots" content="noindex, nofollow">
   <link rel="preconnect" href="https://fonts.googleapis.com">
   <link href="https://fonts.googleapis.com/css2?family=Poppins:wght@400;500;600;700;800&display=swap" rel="stylesheet">
-  <link rel="stylesheet" href="admin.css">
+  <link rel="stylesheet" href="<?= asset('admin.css') ?>">
 </head>
 <body>
 

admin/src/assets.php

@@ -0,0 +1,29 @@
+<?php
+declare(strict_types=1);
+
+/**
+ * URLs for the panel's own stylesheet and scripts.
+ *
+ * admin.js and admin.css have fixed names, unlike the site's build output
+ * which carries a content hash in the filename. The document root caches every
+ * .js and .css for a year as immutable -- correct for hashed files, fatal for
+ * these: a browser that loaded the panel once would never fetch them again, so
+ * a change reached nobody who had ever used it, with no error and nothing to
+ * notice.
+ *
+ * admin/.htaccess now overrides that header, but only for browsers that ask,
+ * and one already holding the file will not ask until next year. The
+ * modification time in the query string is what actually breaks that: a
+ * changed file is a different URL, so the cached copy cannot match.
+ *
+ * Its own file rather than http.php, which is the JSON endpoints' plumbing and
+ * is not loaded by any page that renders HTML. Putting it there defined it
+ * exactly where it was never called from.
+ */
+
+function asset(string $file): string
+{
+    $path = __DIR__ . '/../' . $file;
+    $stamp = is_file($path) ? (string) filemtime($path) : '0';
+    return $file . '?v=' . $stamp;
+}