SDK auto-update mechanism

[ithinkihaveacat]

Do you have a system for updating your SDKs? If not, you might want to have a look at https://stackoverflow.com/a/43471531/. (It looks like some identifiers are used to load the JS libraries, but I can't tell if they're per-site or content based, such that they change when the libraries themselves are updated.)

[jasonpang]

Hey @ithinkihaveacat,

The current way service workers update is as follows for HTTPS sites:

1. When a visitor visits your site, after the visitor accepts notification permissions, the OneSignal web SDK installs the service worker https://site.com/OneSignalSDKWorker.js.

   The service worker script contains a version constant that should be equal to the OneSignal web SDK version constant.

2. Sooner or later, the OneSignal web SDK updates, and we'll deploy a new version globally to https://cdn.onesignal.com/sdks/OneSignalSDK.js.

3. When a visitor visits your site, the https://cdn.onesignal.com/sdks/OneSignalSDK.js they download will probably be our newer updated version. When the SDK loads, one of the things it does is checks what the installed service worker's version is, and if the service worker's version constant is different from the current web SDK's version constant:

   • Without unregistering OneSignalSDKWorker.js, https://site.com/OneSignalSDKUpdaterWorker.js is installed over OneSignalSDKWorker.js.
   • This new registration kicks out the existing service worker, and causes the service worker to be updated, because the registration URL is different. While our new registration kicked out the existing worker, we didn't explicitly unregister our existing worker, which would cause our push subscription to be lost. Because we didn't unregister the existing worker, our push subscription stays intact.
   • https://site.com/OneSignalSDKWorker.js is installed again.

This isn't the best way to overwrite workers, a hash would be better, but we have some legacy requirements that made this path safer.

[ithinkihaveacat]

@jasonpang The issue is that the browser might take quite a while to discover that https://cdn.onesignal.com/sdks/OneSignalSDK.js has been updated, because in most cases it will only fetch that resource if/when https://site.com/OneSignalSDKWorker.js changes. (See w3c/ServiceWorker#839 for more information.)

If you're not experiencing any problems with old service workers then you don't need to worry about this, but if you want to push workers to update promptly then using hashes somewhere in the dependency graph might be helpful.