From 8a69cd7c98821e2878a6d781f527ed2cff4891c7 Mon Sep 17 00:00:00 2001
From: Tiago <70700766+tiagorangel1@users.noreply.github.com>
Date: Mon, 16 Jun 2025 10:36:43 +0100
Subject: [PATCH] standalone: fixes a bunch of small issues

---
 docs/guide/standalone.md |  2 ++
 standalone/package.json  |  2 +-
 standalone/src/index.js  | 31 ++++++++++++++++++++++---------
 3 files changed, 25 insertions(+), 10 deletions(-)

diff --git a/docs/guide/standalone.md b/docs/guide/standalone.md
index 7b55e6d..ef9b1fc 100644
--- a/docs/guide/standalone.md
+++ b/docs/guide/standalone.md
@@ -130,3 +130,5 @@ And by setting `window.CAP_CUSTOM_WASM_URL` to the path of the `cap_wasm_bg.wasm
 ```js
 window.CAP_CUSTOM_WASM_URL = "https://<server url>/assets/cap_wasm_bg.wasm";
 ```
+
+By default, these fetch from `process.env.CACHE_HOST`. You can change this by setting the `CACHE_HOST` environment variable when running the server. If you don't set it, it defaults to `https://cdn.jsdelivr.net`. You can also set it to `disable` to disable the assets server entirely.
\ No newline at end of file
diff --git a/standalone/package.json b/standalone/package.json
index 76bedc1..e0f6c6c 100644
--- a/standalone/package.json
+++ b/standalone/package.json
@@ -1,6 +1,6 @@
 {
   "name": "cap-standalone",
-  "version": "1.0.15",
+  "version": "1.0.16",
   "scripts": {
     "test": "echo \"Error: no test specified\" && exit 1",
     "dev": "bun run --watch src/index.js",
diff --git a/standalone/src/index.js b/standalone/src/index.js
index 3ba1e2b..0b211e8 100644
--- a/standalone/src/index.js
+++ b/standalone/src/index.js
@@ -60,20 +60,24 @@ const updateCache = async () => {
 
   if (!(currentTime - lastUpdate > updateInterval)) return;
 
+  const CACHE_HOST = process.env.CACHE_HOST || "https://cdn.jsdelivr.net";
+
+  if (CACHE_HOST === "disable") return;
+
   try {
     const [widgetSource, floatingSource, wasmSource, wasmLoaderSource] =
       await Promise.all([
-        fetch("https://cdn.jsdelivr.net/npm/@cap.js/widget@latest").then((r) =>
+        fetch(`${CACHE_HOST}/npm/@cap.js/widget@latest`).then((r) =>
           r.text()
         ),
         fetch(
-          "https://cdn.jsdelivr.net/npm/@cap.js/widget/cap-floating.min.js"
+          `${CACHE_HOST}/npm/@cap.js/widget/cap-floating.min.js`
         ).then((r) => r.text()),
         fetch(
-          "https://cdn.jsdelivr.net/npm/@cap.js/wasm/browser/cap_wasm_bg.wasm"
+          `${CACHE_HOST}/npm/@cap.js/wasm/browser/cap_wasm_bg.wasm`
         ).then((r) => r.arrayBuffer()),
         fetch(
-          "https://cdn.jsdelivr.net/npm/@cap.js/wasm/browser/cap_wasm.min.js"
+          `${CACHE_HOST}/npm/@cap.js/wasm/browser/cap_wasm.min.js`
         ).then((r) => r.text()),
       ]);
 
@@ -161,11 +165,16 @@ const auth = new Elysia({
     })
   )
   .post("/", async ({ body, cookie, set }) => {
-    if (
-      !body?.password ||
-      !timingSafeEqual(Buffer.from(body.password), Buffer.from(ADMIN_KEY))
-    ) {
-      set.status = 401;
+    try {
+      if (
+        !body?.password ||
+        !timingSafeEqual(Buffer.from(body.password), Buffer.from(ADMIN_KEY))
+      ) {
+        set.status = 401;
+        return { success: false };
+      }
+    } catch {
+      set.status = 500;
       return { success: false };
     }
 
@@ -398,8 +407,12 @@ const assetsServer = new Elysia({ prefix: "/assets" })
   .use(
     cors({
       origin: process.env.CORS_ORIGIN || true,
+      methods: ["GET"],
     })
   )
+  .onBeforeHandle(({ set }) => {
+    set.headers["Cache-Control"] = "max-age=31536000, immutable";
+  })
   .get("/widget.js", ({ set }) => {
     set.headers["Content-Type"] = "text/javascript";
     return file(path.join(dataDir, "assets-widget.js"));