fix: harden discover artwork caching

web/public/artwork-cache-sw.js

@@ -1,4 +1,6 @@
-const ARTWORK_CACHE = 'mediastationgo-artwork-v1'
+const ARTWORK_CACHE_PREFIX = 'mediastationgo-artwork-'
+const ARTWORK_CACHE = `${ARTWORK_CACHE_PREFIX}v2`
+const MIN_CACHEABLE_ARTWORK_BYTES = 128
 const STRIP_QUERY_KEYS = ['token', 'profile_id', 'profile_pin_token']
 
 function isArtworkRequest(url) {
@@ -33,6 +35,14 @@ self.addEventListener('fetch', (event) => {
   event.respondWith(cacheArtwork(request))
 })
 
+self.addEventListener('install', (event) => {
+  event.waitUntil(self.skipWaiting())
+})
+
+self.addEventListener('activate', (event) => {
+  event.waitUntil(deleteOldArtworkCaches().then(() => self.clients.claim()))
+})
+
 async function cacheArtwork(request) {
   const cache = await caches.open(ARTWORK_CACHE)
   const cacheKey = normalizedArtworkRequest(request)
@@ -40,14 +50,43 @@ async function cacheArtwork(request) {
   if (cached) return cached
 
   const response = await fetch(request)
-  const contentType = response.headers.get('Content-Type') || ''
-  if (response.ok && contentType.toLowerCase().startsWith('image/')) {
-    await cache.put(cacheKey, response.clone())
+  const cacheResponse = await cloneCacheableArtworkResponse(response)
+  if (cacheResponse) {
+    await cache.put(cacheKey, cacheResponse)
     await deleteOldArtworkVariants(cache, cacheKey)
   }
   return response
 }
 
+async function cloneCacheableArtworkResponse(response) {
+  if (!response.ok) return null
+  const contentType = response.headers.get('Content-Type') || ''
+  if (!contentType.toLowerCase().startsWith('image/')) return null
+  const cacheControl = response.headers.get('Cache-Control') || ''
+  if (/\bno-store\b/i.test(cacheControl)) return null
+
+  const contentLength = Number(response.headers.get('Content-Length') || '0')
+  if (Number.isFinite(contentLength) && contentLength > 0 && contentLength <= MIN_CACHEABLE_ARTWORK_BYTES) {
+    return null
+  }
+
+  const buffer = await response.clone().arrayBuffer()
+  if (buffer.byteLength <= MIN_CACHEABLE_ARTWORK_BYTES) return null
+  return new Response(buffer, {
+    status: response.status,
+    statusText: response.statusText,
+    headers: new Headers(response.headers),
+  })
+}
+
+async function deleteOldArtworkCaches() {
+  const names = await caches.keys()
+  await Promise.all(names.map((name) => {
+    if (!name.startsWith(ARTWORK_CACHE_PREFIX) || name === ARTWORK_CACHE) return undefined
+    return caches.delete(name)
+  }))
+}
+
 async function deleteOldArtworkVariants(cache, currentRequest) {
   const currentURL = new URL(currentRequest.url)
   const currentIdentity = artworkIdentity(currentURL)