Repository navigation
Open the iPhone app for an assistant's consent link at /a - #93
Conversation
FTW Cloud's consent page links the owner to https://app.ftw.energy/a#<request>.<offer>. The app approves it with Face ID. Anywhere without the app, a small static page says to open it on the iPhone with FTW; it reads nothing and runs no script. The rest of the web app is untouched. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
Deploying with
|
| Status | Name | Latest Commit | Preview URL | Updated (UTC) |
|---|---|---|---|---|
| ✅ Deployment successful! View logs |
ftw-webapp | 3e6ebcc | Commit Preview URL Branch Preview URL |
Oct 16 2026, 08:53 AM |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 5aae1c5a93
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| /a /access-link.html 200 | ||
| /a/* /access-link.html 200 |
There was a problem hiding this comment.
When /a falls back to a browser profile that has previously loaded the web app, the root-scoped worker registered in src/lib/pwa/service-worker.svelte.ts:48 intercepts the navigation and src/sw.ts:83-85 always responds with the cached / shell. The request therefore never reaches these Cloudflare rewrites, so precisely those existing web-app users see the ordinary application instead of access-link.html and its consent instructions. Exclude /a and /a/* from the worker's generic navigation handling, with a service-worker test covering this route.
Useful? React with 👍 / 👎.
FTW Cloud makes only https://app.ftw.energy/a#<request>.<offer>. A request id in a path would land in a server's log, and alone it is worth asking FTW Cloud about, so /a/* goes from the file and from the rewrites. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A browser that once loaded the web app answered every navigation with the cached shell, so a consent link opened the app's shell instead of the page that says to open it on the iPhone (Codex review, P1). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A rewrite to access-link.html came back as a 307 to /access-link on the preview: Cloudflare redirects a .html path to its bare one. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
1 participant
FTW Cloud's consent page sends the owner to
https://app.ftw.energy/a#<request>.<offer>(srcfl/ftw-cloud#21,oauth.AppLink). This opens the FTW iPhone app there, and answers the link with a small page where the app is not installed.Paired with srcfl/ftw-app#76, where the app reads the link, checks the signed offer and approves with Face ID.
public/.well-known/apple-app-site-association:/abeside/p. Only/a: the request and the offer ride in the fragment, which never reaches a server; a request in a path (/a/<request>) would land in a log, so neither the file nor the rewrites take one.public/access-link.html: "Open this on your iPhone with FTW", in English and Swedish, with the way to type the code instead. No script, no form, no fetch: it reads nothing, and the fragment that carries the offer never reaches the server.public/_redirects:/arewrites to that page with a 200. The target is/access-link, not/access-link.html: Cloudflare answers a.htmlpath with a 307, which turned the first version of the rule into a redirect on the preview. The rest of the web app is untouched.src/sw.ts: the service worker leaves/ato the network. It answered every navigation with the cached shell, so in a browser that once loaded the web app the link opened the shell instead of the page (Codex review).tests/service-worker.test.tsholds it.tests/apple-app-site-association.test.tsholds the paths, the rewrites and the page's promise.npm run verifypasses locally (1106 tests), anddist/carries the page and the rules.On the preview (
claude-access-link-ftw-webapp.sourceful-labs.workers.dev, 3e6ebcc):/a200 text/html with the page,/a/x404,/.well-known/apple-app-site-association200 application/json with/pand/a.Apple caches the file. A phone picks up
/aafter it next fetches it, usually within a day of the deploy.🤖 Generated with Claude Code