From bbe84e8614f5d3e2adbb353384511843f6549e4e Mon Sep 17 00:00:00 2001
From: David Dyer <social_davidbdyer@icloud.com>
Date: Wed, 2 Sep 2026 10:23:40 -0400
Subject: [PATCH] Add filemtime-based cache busting for styles.css and main.js
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Safari caches static assets far more aggressively than Chrome/Firefox
and largely ignores heuristic revalidation, so a new deploy could keep
showing the old CSS/JS indefinitely even on a hard refresh — no
Cache-Control headers were set anywhere to guide it otherwise.

inc/assets.php adds asset_version($path), which appends a ?v=<mtime>
query string derived from the file's last-modified time. Every page
that links styles.css or main.js (index.php, menu.php, and all five
admin pages) now uses it, so the URL changes whenever the file's
contents change and browsers always fetch the new version.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
---
 admin/hours.php |  3 ++-
 admin/index.php |  3 ++-
 admin/login.php |  3 ++-
 admin/menu.php  |  3 ++-
 admin/users.php |  3 ++-
 inc/assets.php  | 25 +++++++++++++++++++++++++
 index.php       |  5 +++--
 menu.php        |  5 +++--
 8 files changed, 41 insertions(+), 9 deletions(-)
 create mode 100644 inc/assets.php

diff --git a/admin/hours.php b/admin/hours.php
index 582800e..2ba64e7 100644
--- a/admin/hours.php
+++ b/admin/hours.php
@@ -2,6 +2,7 @@
 declare(strict_types=1);
 
 require_once __DIR__ . '/../inc/auth.php';
+require_once __DIR__ . '/../inc/assets.php';
 require_once __DIR__ . '/../inc/hours.php';
 
 require_auth();
@@ -72,7 +73,7 @@ $justSaved = !$_POST && isset($_GET['saved']);
   <link rel="preconnect" href="https://fonts.googleapis.com">
   <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
   <link href="https://fonts.googleapis.com/css2?family=Fraunces:ital,opsz,wght@0,9..144,400;0,9..144,600;1,9..144,400&family=Karla:wght@400;500;600;700&family=IBM+Plex+Mono:wght@400;500&display=swap" rel="stylesheet">
-  <link rel="stylesheet" href="../styles.css">
+  <link rel="stylesheet" href="../styles.css<?= asset_version('styles.css') ?>">
 </head>
 
 <body>
diff --git a/admin/index.php b/admin/index.php
index 600045b..5cd1495 100644
--- a/admin/index.php
+++ b/admin/index.php
@@ -1,5 +1,6 @@
 <?php
 require_once __DIR__ . '/../inc/auth.php';
+require_once __DIR__ . '/../inc/assets.php';
 require_once __DIR__ . '/../inc/announcements.php';
 
 require_auth();
@@ -108,7 +109,7 @@ $announcements = get_all_announcements();
   <link rel="preconnect" href="https://fonts.googleapis.com">
   <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
   <link href="https://fonts.googleapis.com/css2?family=Fraunces:ital,opsz,wght@0,9..144,400;0,9..144,600;1,9..144,400&family=Karla:wght@400;500;600;700&family=IBM+Plex+Mono:wght@400;500&display=swap" rel="stylesheet">
-  <link rel="stylesheet" href="../styles.css">
+  <link rel="stylesheet" href="../styles.css<?= asset_version('styles.css') ?>">
 </head>
 <body>
 
diff --git a/admin/login.php b/admin/login.php
index 867f1ba..78b6636 100644
--- a/admin/login.php
+++ b/admin/login.php
@@ -1,5 +1,6 @@
 <?php
 require_once __DIR__ . '/../inc/auth.php';
+require_once __DIR__ . '/../inc/assets.php';
 
 $error = '';
 
@@ -24,7 +25,7 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST') {
   <link rel="preconnect" href="https://fonts.googleapis.com">
   <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
   <link href="https://fonts.googleapis.com/css2?family=Fraunces:wght@600&family=Karla:wght@400;500;600&family=IBM+Plex+Mono:wght@400;500&display=swap" rel="stylesheet">
-  <link rel="stylesheet" href="../styles.css">
+  <link rel="stylesheet" href="../styles.css<?= asset_version('styles.css') ?>">
 </head>
 <body class="admin-login-body">
   <div class="login-card">
diff --git a/admin/menu.php b/admin/menu.php
index 4bbc324..3f1a555 100644
--- a/admin/menu.php
+++ b/admin/menu.php
@@ -2,6 +2,7 @@
 declare(strict_types=1);
 
 require_once __DIR__ . '/../inc/auth.php';
+require_once __DIR__ . '/../inc/assets.php';
 require_once __DIR__ . '/../inc/menu.php';
 
 require_auth();
@@ -186,7 +187,7 @@ $menuEnabled = is_menu_enabled();
   <link rel="preconnect" href="https://fonts.googleapis.com">
   <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
   <link href="https://fonts.googleapis.com/css2?family=Fraunces:ital,opsz,wght@0,9..144,400;0,9..144,600;1,9..144,400&family=Karla:wght@400;500;600;700&family=IBM+Plex+Mono:wght@400;500&display=swap" rel="stylesheet">
-  <link rel="stylesheet" href="../styles.css">
+  <link rel="stylesheet" href="../styles.css<?= asset_version('styles.css') ?>">
 </head>
 
 <body data-csrf-token="<?= htmlspecialchars(get_csrf_token(), ENT_QUOTES, 'UTF-8') ?>">
diff --git a/admin/users.php b/admin/users.php
index bf666b9..377f0af 100644
--- a/admin/users.php
+++ b/admin/users.php
@@ -2,6 +2,7 @@
 declare(strict_types=1);
 
 require_once __DIR__ . '/../inc/auth.php';
+require_once __DIR__ . '/../inc/assets.php';
 require_once __DIR__ . '/../inc/users.php';
 
 require_auth();
@@ -173,7 +174,7 @@ $users = get_all_users();
   <link rel="preconnect" href="https://fonts.googleapis.com">
   <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
   <link href="https://fonts.googleapis.com/css2?family=Fraunces:ital,opsz,wght@0,9..144,400;0,9..144,600;1,9..144,400&family=Karla:wght@400;500;600;700&family=IBM+Plex+Mono:wght@400;500&display=swap" rel="stylesheet">
-  <link rel="stylesheet" href="../styles.css">
+  <link rel="stylesheet" href="../styles.css<?= asset_version('styles.css') ?>">
 </head>
 
 <body data-csrf-token="<?= htmlspecialchars(get_csrf_token(), ENT_QUOTES, 'UTF-8') ?>" data-current-user-id="<?= (int) $user['id'] ?>">
diff --git a/inc/assets.php b/inc/assets.php
new file mode 100644
index 0000000..4c4787d
--- /dev/null
+++ b/inc/assets.php
@@ -0,0 +1,25 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * Cache-busting query string for a static asset (styles.css, main.js),
+ * derived from the file's last-modified time.
+ *
+ * Without this, browsers — Safari especially, which caches static
+ * assets far more aggressively than Chrome/Firefox and largely ignores
+ * heuristic revalidation — can keep serving a stale styles.css/main.js
+ * indefinitely after a deploy, even on a hard refresh. Appending
+ * ?v=<mtime> changes the URL every time the file's contents change, so
+ * it's always treated as a brand new resource rather than a cached one.
+ *
+ * Usage: <link rel="stylesheet" href="styles.css<?= asset_version('styles.css') ?>">
+ *        <link rel="stylesheet" href="../styles.css<?= asset_version('styles.css') ?>">
+ */
+function asset_version(string $relativePath): string
+{
+    $path = dirname(__DIR__) . '/' . ltrim($relativePath, '/');
+    $mtime = @filemtime($path);
+
+    return $mtime !== false ? '?v=' . $mtime : '';
+}
diff --git a/index.php b/index.php
index f6aeb9e..8551a0a 100644
--- a/index.php
+++ b/index.php
@@ -1,5 +1,6 @@
 <?php
 require __DIR__ . '/config.php';
+require __DIR__ . '/inc/assets.php';
 require __DIR__ . '/inc/google-reviews.php';
 require __DIR__ . '/inc/announcements.php';
 require __DIR__ . '/inc/hours.php';
@@ -17,7 +18,7 @@ $siteUrl = rtrim(SITE_URL, '/');
   <title>The Old Fitz Public House</title>
   <link rel="preconnect" href="https://fonts.googleapis.com">
   <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
-  <link rel="stylesheet" href="styles.css">
+  <link rel="stylesheet" href="styles.css<?= asset_version('styles.css') ?>">
   <link href="https://fonts.googleapis.com/css2?family=Fraunces:ital,opsz,wght@0,9..144,300;0,9..144,400;0,9..144,500;0,9..144,600;0,9..144,700;1,9..144,400;1,9..144,500&family=Karla:wght@400;500;600;700&family=IBM+Plex+Mono:wght@400;500&display=swap" rel="stylesheet">
 
   <meta name="description" content="The Old Fitz Public House — a traditional Irish pub in Marion, Indiana. Open Thursday through Saturday, 4–10pm. Family friendly, no reservations.">
@@ -284,7 +285,7 @@ $siteUrl = rtrim(SITE_URL, '/');
     </div>
   </footer>
 
-  <script src="main.js" defer></script>
+  <script src="main.js<?= asset_version('main.js') ?>" defer></script>
 </body>
 
 </html>
\ No newline at end of file
diff --git a/menu.php b/menu.php
index 11ccd03..d97bc70 100644
--- a/menu.php
+++ b/menu.php
@@ -2,6 +2,7 @@
 declare(strict_types=1);
 
 require __DIR__ . '/config.php';
+require __DIR__ . '/inc/assets.php';
 require __DIR__ . '/inc/announcements.php';
 require __DIR__ . '/inc/menu.php';
 require __DIR__ . '/inc/hours.php';
@@ -38,7 +39,7 @@ $siteUrl = rtrim(SITE_URL, '/');
 
   <link rel="preconnect" href="https://fonts.googleapis.com">
   <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
-  <link rel="stylesheet" href="styles.css">
+  <link rel="stylesheet" href="styles.css<?= asset_version('styles.css') ?>">
   <link href="https://fonts.googleapis.com/css2?family=Fraunces:ital,opsz,wght@0,9..144,300;0,9..144,400;0,9..144,500;0,9..144,600;0,9..144,700;1,9..144,400;1,9..144,500&family=Karla:wght@400;500;600;700&family=IBM+Plex+Mono:wght@400;500&display=swap" rel="stylesheet">
 </head>
 
@@ -210,7 +211,7 @@ $siteUrl = rtrim(SITE_URL, '/');
     </div>
   </footer>
 
-  <script src="main.js" defer></script>
+  <script src="main.js<?= asset_version('main.js') ?>" defer></script>
 
 </body>