Version 5.0.0 beta 1

applications/core/interface/js/serviceWorker.js

@@ -194,24 +194,6 @@ self.addEventListener("notificationclick", (e) => {
 self.addEventListener("fetch", (e) => {
 	const { request } = e;
 
-	// test the offline page
-	const offlineResponse = () => {
-		const response = new Response(OFFLINE_PAGE, {
-			headers: {
-				"Content-Type": "text/html",
-				"Content-Length": OFFLINE_PAGE_SIZE
-			},
-			status: 200,
-			statusText: "OK"
-		});
-		return response;
-	}
-
-	// Leaving this in but commented out for now; It could be useful
-	// if ((new URL(request.url).searchParams.has('forceOfflinePage'))) {
-	// 	e.respondWith(offlineResponse());
-	// }
-
 	// We test /admin/ first and then a fallback for the deprecated custom admin directory name feature
 	if (request.url.startsWith(BASE_URL + "admin/") || e.currentTarget.location.href.match(/type=admin/)) {
 		log("In ACP, nothing to do...");
@@ -222,16 +204,81 @@ self.addEventListener("fetch", (e) => {
 		return;
 	}
 
-	// We intercept fetch requests in the following situation:
+	// We intercept fetch requests in the following situations:
 	// 1: GET requests where we're offline
 	//    	Show a cached offline page instead
+	// 2: POST requests when we're a guest
+	// 		We need to wrap POST requests in an additional call to get the correct csrf token first
+
+	// Situation 1: offline GET requests
 	if (request.mode === "navigate" && request.method === "GET" && !navigator.onLine) {
 		e.respondWith(
 			fetch(request).catch((err) => {
-				return offlineResponse();
+				return caches.open(CACHE_NAME).then((cache) => {
+					console.log(`Browser appears to be offline: ${request.url}`);
+					return cache.match(OFFLINE_URL);
+				});
 			})
 		);
+		return;
 	}
+
+	let matches = e.currentTarget.location.href.match(/loggedIn=(true|false)/);
+	const loggedIn = matches[1];
+
+	// If we're logged in, we need none of this
+	if (loggedIn == 'true') {
+		log("Logged in, nothing to do...");
+		return;
+	}
+
+	e.respondWith(
+		new Promise((resolve, reject) => {
+			log(`On navigation, logged_in is ${loggedIn}`);
+
+			// Situation 2: POST requests when we're a guest
+			if (loggedIn == 'false' && request.method === "POST") {
+				// Clone current request because we can't use it after reading headers later
+				const curRequest = request.clone();
+
+				log("Intercepting guest post request");
+
+				// Grab the path so we can check in PHP if it's an admin URL
+				let url = new URL(curRequest.url);
+				let path = url.pathname;
+
+				// First get the current csrf key from the server
+				fetch(`${BASE_URL}index.php?app=core&module=system&controller=ajax&do=getCsrfKey&path=${path}`)
+					.then((response) => response.json())
+					.then((response) => {
+						log(`Got new csrf key: ${response.key}`);
+
+						// Create new header object starting with existing headers and adding csrf
+						const headers = new Headers(curRequest.headers);
+						headers.set("X-Csrf-Token", response.key);
+
+						const newRequest = new Request(curRequest, {
+							headers,
+							credentials: curRequest.credentials,
+							referrer: curRequest.referrer,
+						});
+
+						// Send cloned request
+						resolve(fetch(newRequest));
+					})
+					.catch((err) => {
+						console.log(err);
+						reject(err);
+					});
+
+				return;
+			}
+
+			resolve(fetch(request));
+		}).catch((err) => {
+			console.log(err);
+		})
+	);
 });
 
 // ------------------------------------------------