v0.22.0 several enhancements and fixes for security, network, doc, test, packaging

internal/sink/http/web/login.js

@@ -1,4 +1,4 @@
-import { login } from "./scram.js";
+import { cookiesUsable, login, loginUnavailable } from "./scram.js";
 
 const base = new URL("..", location.href);
 const form = document.getElementById("login");
@@ -44,5 +44,20 @@ form.addEventListener("submit", async (event) => {
   }
 });
 
+// A sign-in here only sets a cookie; the viewer, when the sink serves it,
+// signs in by itself and keeps a token in memory instead
+async function cookiesUnavailable() {
+  status.textContent = "This browser keeps no cookie for this site, so a sign-in here would not last.";
+  const viewer = await fetch("view", { method: "HEAD", cache: "no-store", redirect: "error" }).catch(() => null);
+  if (!viewer?.ok) return;
+  const link = document.createElement("a");
+  link.href = "view";
+  link.textContent = "Sign in on the viewer instead.";
+  status.append(" ", link);
+}
+
 // Enabled only once this script runs, so a failed load cannot submit the form natively
-button.disabled = false;
+const unavailable = loginUnavailable();
+if (unavailable) status.textContent = unavailable;
+else if (cookiesUsable()) button.disabled = false;
+else cookiesUnavailable();