Remove non-TLS support

assets/boot.html

@@ -19,13 +19,22 @@
      The pages on disk are fragments and the shell is a template, and it is the
      worker that puts them together. So this page has one job: register the
      worker and reload once it is running, which lands on the real app at the
-     address that was asked for. It is only ever seen once per device. -->
+     address that was asked for. It is only ever seen once per device.
+
+     There is no fallback for a device that cannot install one. There used to
+     be -- this page loaded the renderer itself and composed the page in the
+     browser -- and it existed for one case: the app served over plain http://
+     from a LAN address, which is not a secure context, so no worker can
+     register. This app is served over TLS, where that case cannot arise, and
+     the fallback was a second way of building every page that nothing
+     exercised. What is left when registration fails is a sentence saying so,
+     because there is nothing honest to show instead. -->
 
 <main class="boot container py-5 text-center">
   <div class="spinner-border text-secondary mb-3" role="status" aria-hidden="true"></div>
   <p id="boot-status" class="text-body-secondary">Preparing the offline copy…</p>
   <noscript><p class="alert alert-warning d-inline-block">This app builds its
-    pages in the browser and needs JavaScript.</p></noscript>
+    pages on the device and needs JavaScript.</p></noscript>
 </main>
 
 <script>
@@ -50,7 +59,7 @@
   }
 
   function start() {
-    if (tries >= 2) return compose('The offline copy could not start.');
+    if (tries >= 2) return fail('The offline copy could not start.');
     try { sessionStorage.setItem('boot:tries', String(tries + 1)); } catch (err) {}
 
     navigator.serviceWorker.register('sw.js').then(function (registration) {
@@ -58,70 +67,26 @@
       // controlled yet. Otherwise wait for the one installing to get there.
       if (registration.active) return go();
       var worker = registration.installing || registration.waiting;
-      if (!worker) return compose('The offline copy did not install.');
+      if (!worker) return fail('The offline copy did not install.');
       worker.addEventListener('statechange', function (event) {
         if (event.target.state === 'activated') go();
       });
     }, function (err) {
-      compose('Could not install the offline copy: ' + err.message);
+      fail('Could not install the offline copy: ' + err.message);
     });
   }
 
-  // Everything below is the path where there will never be a worker: a browser
-  // without them, or -- much more likely -- the app served over plain http://
-  // from a LAN address, which is not a secure context. Rather than spin here
-  // forever, the page composes itself, using the same renderer and the same
-  // templates the worker would have used. No offline copy and no bookmark, but
-  // the text reads. Delete this if the app is only ever served over TLS.
-  function compose(why) {
-    console.warn(why);
-    status('Loading…');
-    script('js/nunjucks.min.js')
-      .then(function () { return script('js/render.js'); })
-      .then(function () {
-        var view = createRenderer(readText);
-        var page = location.pathname.split('/').pop();
-        return readText('./' + page + location.search)
-          .catch(function () {
-            return view.notice('Not available',
-              'This page could not be loaded. Check your connection and try again.');
-          })
-          // mark is null: the bookmark lives in the worker's IndexedDB, and
-          // there is no worker to ask. bookmark.njk renders the slot hidden
-          // and it fills itself the moment one appears.
-          .then(function (fragment) { return view.compose(fragment, null); });
-      })
-      .then(become, function (err) { status('Could not start: ' + err.message); });
-  }
-
-  function script(src) {
-    return new Promise(function (resolve, reject) {
-      var el = document.createElement('script');
-      el.src = src;
-      el.onload = function () { resolve(); };
-      el.onerror = function () { reject(new Error('cannot load ' + src)); };
-      document.head.appendChild(el);
-    });
-  }
-
-  function readText(path) {
-    return fetch(path, { credentials: 'same-origin' }).then(function (res) {
-      if (!res.ok) throw new Error(path + ': ' + res.status);
-      return res.text();
-    });
-  }
-
-  // Replaces this document in place: same URL, same history entry, no second
-  // request. Written rather than assigned into the DOM because the shell
-  // carries <script> tags, and scripts put into a page any other way never run.
-  function become(html) {
-    document.open();
-    document.write(html);
-    document.close();
+  // The end of the road. Every page in this app is put together by the
+  // worker, so a device that cannot install one has nothing to read here --
+  // and a spinner that turns forever says less than the reason does.
+  function fail(why) {
+    var spinner = document.querySelector('.boot .spinner-border');
+    if (spinner) spinner.remove();
+    status(why);
   }
 
   if ('serviceWorker' in navigator) start();
-  else compose('This browser has no service worker support.');
+  else fail('This browser has no service worker support.');
 })();
 </script>
 </body>