doxa-life/doxa-maps
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

No pin, no fetch: keep the flag-off build off the network

Browse source 
The build writes a locale's sha384 only for a file it actually emitted, so
the pin's presence is the one reliable statement that there is something to
fetch. loadLocale keyed on messages[c] instead, which is not the same
question: a bundle that includes no areas inlines nothing, so messages is
empty with the flag OFF too and the preload requested locales/<lc>.json on
every non-English page — a 404 per reader, fetched with no integrity
because there was no hash to pass.

Keying on the pin makes the flag-off build inert and the flag-on build fail
closed to English. The integrity argument is now unconditional: reaching the
fetch at all means a hash exists.

Found by studio in review. Verified both ways: flag off is byte-identical
at 284.61 kB gzip with no locale pin map in the output at all, flag on is
unchanged at 165.23 kB with all ten hashes present.
This commit is contained in:
Doxa Maps 2026-09-29 05:18:39 +00:00
parent 41d33d9a40
commit 89ab0d2a7b
1 changed files with 8 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
library/i18n/index.js
View file

@ -123,12 +123,18 @@ export function loadLocale(i18n, code) {
return okEarlier
})
}
// ★ NO PIN, NO FETCH (studio). The hash map is written by the build ONLY for locales it actually
// emitted, so its presence is the one reliable statement that a file is there to fetch. Without
// this guard the flag-OFF build still reaches the network: a bundle with no areas inlines nothing,
// so messages[c] is empty and the preload requests locales/<lc>.json on every non-English page —
// a 404 per reader, and fetched with no integrity because there was no hash to pass. Keying on the
// pin makes the flag-off build inert and the flag-on build fail closed to English.
if (!LOCALE_SRI[c]) return Promise.resolve(!!messages[c])
const run = (async () => {
try {
if (!LOCALE_BASE) return false // base unknown: stay on English
const url = new URL(`locales/${c}.json`, LOCALE_BASE).href
const init = LOCALE_SRI[c] ? { integrity: LOCALE_SRI[c] } : {}
const res = await fetch(url, init)
const res = await fetch(url, { integrity: LOCALE_SRI[c] })
if (!res.ok) return false
const tree = await res.json()
if (!tree || typeof tree !== 'object') return false