externalise deeplinks

sw.js

@@ -8,6 +8,7 @@ const CACHE_FILES = [
   '/index.html',
   '/app.js',
   '/audio.js',
+  '/deeplinks.js',
   '/styles.css',
   '/manifest.json',
   '/icons/android-chrome-192x192.png',
@@ -17,6 +18,9 @@ const CACHE_FILES = [
   '/icons/favicon-16x16.png'
 ];
 
+// Valid deep link actions
+const VALID_ACTIONS = ['start', 'pause', 'toggle', 'nextplayer', 'reset'];
+
 // Install event - Cache files
 self.addEventListener('install', event => {
   console.log('[ServiceWorker] Install');
@@ -64,7 +68,18 @@ self.addEventListener('fetch', event => {
     // Check if request has action parameter or hash
     if (url.searchParams.has('action') || url.hash.includes('action=')) {
       console.log('[ServiceWorker] Processing deep link navigation');
-      return;
+      
+      // Verify the action is valid
+      const action = url.searchParams.get('action') || 
+                    new URLSearchParams(url.hash.substring(1)).get('action');
+                    
+      if (action && VALID_ACTIONS.includes(action)) {
+        console.log('[ServiceWorker] Valid action found:', action);
+        
+        // For navigation requests with valid actions, let the request go through
+        // so our app can handle the deep link
+        return;
+      }
     }
   }
   
@@ -115,6 +130,12 @@ self.addEventListener('message', event => {
     const action = event.data.action;
     console.log('[ServiceWorker] Received action message:', action);
     
+    // Validate the action
+    if (!VALID_ACTIONS.includes(action)) {
+      console.warn('[ServiceWorker] Invalid action received:', action);
+      return;
+    }
+    
     // Broadcast the action to all clients
     self.clients.matchAll().then(clients => {
       clients.forEach(client => {