@open-mercato/ui 0.4.9-develop-7120508245 → 0.4.9-develop-e55592929f

package/dist/backend/utils/api.js

@@ -123,15 +123,15 @@ async function apiFetch(input, init) {
       if (hasAclHints) {
         redirectToForbiddenLogin({ requiredRoles: roles, requiredFeatures: features });
       }
-      const raw = await res.clone().text().catch(() => "Forbidden");
-      let msg = raw;
-      const parsed = await readJsonSafe(raw, null);
-      if (parsed && typeof parsed === "object") {
-        if (typeof parsed.error === "string") {
-          msg = parsed.error;
-        } else if (typeof parsed.message === "string") {
-          msg = parsed.message;
+      let msg = "Forbidden";
+      if (aclData && typeof aclData === "object") {
+        if (typeof aclData.error === "string") {
+          msg = aclData.error;
+        } else if (typeof aclData.message === "string") {
+          msg = aclData.message;
         }
+      } else {
+        msg = await res.clone().text().catch(() => "Forbidden");
       }
       throw new ForbiddenError(msg);
     }

package/dist/backend/utils/api.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/backend/utils/api.ts"],
-  "sourcesContent": ["\"use client\"\n// Simple fetch wrapper that redirects to session refresh on 401 (Unauthorized)\n// Used across UI data utilities to avoid duplication.\nimport { flash } from '../FlashMessages'\nimport { deserializeOperationMetadata } from '@open-mercato/shared/lib/commands/operationMetadata'\nimport { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'\nimport { pushOperation } from '../operations/store'\nimport { pushPartialIndexWarning } from '../indexes/store'\nimport { createScopedHeaderStack } from './scopedHeaderStack'\n\nconst scopedHeaders = createScopedHeaderStack()\n\nfunction mergeHeaders(base: HeadersInit | undefined, scoped: Record<string, string>): Headers {\n  const headers = new Headers(base ?? {})\n  for (const [key, value] of Object.entries(scoped)) {\n    if (headers.has(key)) continue\n    headers.set(key, value)\n  }\n  return headers\n}\n\nexport async function withScopedApiHeaders<T>(headers: Record<string, string>, run: () => Promise<T>): Promise<T> {\n  return scopedHeaders.withScopedHeaders(headers, run)\n}\n\nexport class UnauthorizedError extends Error {\n  readonly status = 401\n  constructor(message = 'Unauthorized') {\n    super(message)\n    this.name = 'UnauthorizedError'\n  }\n}\n\nexport function redirectToSessionRefresh() {\n  if (typeof window === 'undefined') return\n  const current = window.location.pathname + window.location.search\n  // Avoid redirect loops if already on an auth/session route\n  if (window.location.pathname.startsWith('/api/auth')) return\n  // Portal routes have their own customer auth \u2014 never redirect to staff login\n  if (/\\/[^/]+\\/portal(\\/|$)/.test(window.location.pathname)) return\n  try {\n    flash('Session expired. Redirecting to sign in\u2026', 'warning')\n    setTimeout(() => {\n      window.location.href = `/api/auth/session/refresh?redirect=${encodeURIComponent(current)}`\n    }, 20)\n  } catch {\n    // no-op\n  }\n}\n\nexport class ForbiddenError extends Error {\n  readonly status = 403\n  constructor(message = 'Forbidden') {\n    super(message)\n    this.name = 'ForbiddenError'\n  }\n}\n\nlet DEFAULT_FORBIDDEN_ROLES: string[] = ['admin']\n\nexport function setAuthRedirectConfig(cfg: { defaultForbiddenRoles?: readonly string[] }) {\n  if (cfg?.defaultForbiddenRoles && cfg.defaultForbiddenRoles.length) {\n    DEFAULT_FORBIDDEN_ROLES = [...cfg.defaultForbiddenRoles].map(String)\n  }\n}\n\nexport function redirectToForbiddenLogin(options?: { requiredRoles?: string[] | null; requiredFeatures?: string[] | null }) {\n  if (typeof window === 'undefined') return\n  if (window.location.pathname.startsWith('/login')) return\n  // Portal routes have their own customer auth \u2014 never redirect to staff login\n  if (/\\/[^/]+\\/portal(\\/|$)/.test(window.location.pathname)) return\n  try {\n    const current = window.location.pathname + window.location.search\n    const features = options?.requiredFeatures?.filter(Boolean) ?? []\n    const roles = options?.requiredRoles?.filter(Boolean) ?? []\n    const fallbackRoles = DEFAULT_FORBIDDEN_ROLES.filter(Boolean)\n    const effectiveRoles = roles.length ? roles : fallbackRoles\n    const query = features.length\n      ? `requireFeature=${encodeURIComponent(features.join(','))}`\n      : effectiveRoles.length\n        ? `requireRole=${encodeURIComponent(effectiveRoles.map(String).join(','))}`\n        : ''\n    const url = query\n      ? `/login?${query}&redirect=${encodeURIComponent(current)}`\n      : `/login?redirect=${encodeURIComponent(current)}`\n    flash('Insufficient permissions. Redirecting to login\u2026', 'warning')\n    setTimeout(() => { window.location.href = url }, 60)\n  } catch {\n    // no-op\n  }\n}\n\nexport async function apiFetch(input: RequestInfo | URL, init?: RequestInit): Promise<Response> {\n  type FetchType = (input: RequestInfo | URL, init?: RequestInit) => Promise<Response>\n  const originalFetch =\n    typeof window !== 'undefined'\n      ? (window as Window & { __omOriginalFetch?: FetchType }).__omOriginalFetch\n      : undefined\n  const fallbackFetch = (globalThis as typeof globalThis & { fetch?: FetchType }).fetch\n  const baseFetch = originalFetch ?? fallbackFetch\n  if (!baseFetch) {\n    return new Response(\n      JSON.stringify({ error: 'Fetch API is not available in this runtime' }),\n      { status: 503, headers: { 'content-type': 'application/json' } },\n    )\n  }\n  const scoped = scopedHeaders.resolveScopedHeaders()\n  const mergedInit = Object.keys(scoped).length\n    ? { ...(init ?? {}), headers: mergeHeaders(init?.headers, scoped) }\n    : init\n  const disableForbiddenRedirect = new Headers(mergedInit?.headers).get('x-om-forbidden-redirect') === '0'\n  const res = await baseFetch(input, mergedInit)\n  const pathname = typeof window !== 'undefined' ? window.location.pathname : ''\n  const onLoginPage = pathname.startsWith('/login')\n  const onPortalRoute = /\\/[^/]+\\/portal(\\/|$)/.test(pathname)\n  if (res.status === 401) {\n    // Trigger same redirect flow as protected pages\n    // Skip for staff login page and all portal routes (portal has its own auth)\n    if (!onLoginPage && !onPortalRoute) {\n      redirectToSessionRefresh()\n      // Throw a typed error for callers that might still handle it\n      throw new UnauthorizedError(await res.text().catch(() => 'Unauthorized'))\n    }\n    return res\n  }\n  if (res.status === 403) {\n    // Try to read requiredRoles from JSON body; ignore if not JSON\n    let roles: string[] | null = null\n    let features: string[] | null = null\n    let payload: unknown = null\n    const aclData = await readJsonSafe<Record<string, unknown>>(res.clone(), null)\n    if (aclData && typeof aclData === 'object') {\n      if (Array.isArray(aclData.requiredRoles)) {\n        roles = aclData.requiredRoles.map((r) => String(r))\n      }\n      if (Array.isArray(aclData.requiredFeatures)) {\n        features = aclData.requiredFeatures.map((f) => String(f))\n      }\n      payload = aclData\n    }\n    // Only redirect if not already on login page or a portal route\n    if (!onLoginPage && !onPortalRoute && !disableForbiddenRedirect) {\n      const target =\n        typeof input === 'string'\n          ? input\n          : input instanceof URL\n            ? input.toString()\n            : (typeof Request !== 'undefined' && input instanceof Request)\n              ? input.url\n              : 'unknown'\n      try {\n        // eslint-disable-next-line no-console\n        console.warn('[apiFetch] Forbidden response', {\n          url: target,\n          status: res.status,\n          requiredRoles: roles,\n          requiredFeatures: features,\n          details: payload,\n        })\n      } catch {}\n      const hasAclHints = Boolean((roles && roles.length) || (features && features.length))\n      if (hasAclHints) {\n        redirectToForbiddenLogin({ requiredRoles: roles, requiredFeatures: features })\n      }\n      const raw = await res.clone().text().catch(() => 'Forbidden')\n      let msg = raw\n      const parsed = await readJsonSafe<Record<string, unknown>>(raw, null)\n      if (parsed && typeof parsed === 'object') {\n        if (typeof parsed.error === 'string') {\n          msg = parsed.error\n        } else if (typeof parsed.message === 'string') {\n          msg = parsed.message\n        }\n      }\n      throw new ForbiddenError(msg)\n    }\n    // If already on login, just return the response for the caller to handle\n  }\n  try {\n    const header = res.headers.get('x-om-operation')\n    const metadata = deserializeOperationMetadata(header)\n    if (metadata) pushOperation(metadata)\n  } catch {\n    // ignore malformed headers\n  }\n  try {\n    const warningRaw = res.headers.get('x-om-partial-index')\n    if (warningRaw) {\n      const parsed = JSON.parse(warningRaw) as Record<string, unknown>\n      if (parsed && typeof parsed === 'object' && parsed.type === 'partial_index') {\n        const entity = typeof parsed.entity === 'string' ? parsed.entity : String(parsed.entity ?? '')\n        if (entity) {\n          const baseCount = typeof parsed.baseCount === 'number' ? parsed.baseCount : null\n          const indexedCount = typeof parsed.indexedCount === 'number' ? parsed.indexedCount : null\n          const scope = parsed.scope === 'global' ? 'global' : 'scoped'\n          const entityLabel =\n            typeof parsed.entityLabel === 'string' && parsed.entityLabel.trim()\n              ? parsed.entityLabel.trim()\n              : entity\n          pushPartialIndexWarning({ entity, entityLabel, baseCount, indexedCount, scope })\n        }\n      }\n    }\n  } catch {\n    // ignore malformed headers\n  }\n  return res\n}\n"],
-  "mappings": ";AAGA,SAAS,aAAa;AACtB,SAAS,oCAAoC;AAC7C,SAAS,oBAAoB;AAC7B,SAAS,qBAAqB;AAC9B,SAAS,+BAA+B;AACxC,SAAS,+BAA+B;AAExC,MAAM,gBAAgB,wBAAwB;AAE9C,SAAS,aAAa,MAA+B,QAAyC;AAC5F,QAAM,UAAU,IAAI,QAAQ,QAAQ,CAAC,CAAC;AACtC,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,MAAM,GAAG;AACjD,QAAI,QAAQ,IAAI,GAAG,EAAG;AACtB,YAAQ,IAAI,KAAK,KAAK;AAAA,EACxB;AACA,SAAO;AACT;AAEA,eAAsB,qBAAwB,SAAiC,KAAmC;AAChH,SAAO,cAAc,kBAAkB,SAAS,GAAG;AACrD;AAEO,MAAM,0BAA0B,MAAM;AAAA,EAE3C,YAAY,UAAU,gBAAgB;AACpC,UAAM,OAAO;AAFf,SAAS,SAAS;AAGhB,SAAK,OAAO;AAAA,EACd;AACF;AAEO,SAAS,2BAA2B;AACzC,MAAI,OAAO,WAAW,YAAa;AACnC,QAAM,UAAU,OAAO,SAAS,WAAW,OAAO,SAAS;AAE3D,MAAI,OAAO,SAAS,SAAS,WAAW,WAAW,EAAG;AAEtD,MAAI,wBAAwB,KAAK,OAAO,SAAS,QAAQ,EAAG;AAC5D,MAAI;AACF,UAAM,iDAA4C,SAAS;AAC3D,eAAW,MAAM;AACf,aAAO,SAAS,OAAO,sCAAsC,mBAAmB,OAAO,CAAC;AAAA,IAC1F,GAAG,EAAE;AAAA,EACP,QAAQ;AAAA,EAER;AACF;AAEO,MAAM,uBAAuB,MAAM;AAAA,EAExC,YAAY,UAAU,aAAa;AACjC,UAAM,OAAO;AAFf,SAAS,SAAS;AAGhB,SAAK,OAAO;AAAA,EACd;AACF;AAEA,IAAI,0BAAoC,CAAC,OAAO;AAEzC,SAAS,sBAAsB,KAAoD;AACxF,MAAI,KAAK,yBAAyB,IAAI,sBAAsB,QAAQ;AAClE,8BAA0B,CAAC,GAAG,IAAI,qBAAqB,EAAE,IAAI,MAAM;AAAA,EACrE;AACF;AAEO,SAAS,yBAAyB,SAAmF;AAC1H,MAAI,OAAO,WAAW,YAAa;AACnC,MAAI,OAAO,SAAS,SAAS,WAAW,QAAQ,EAAG;AAEnD,MAAI,wBAAwB,KAAK,OAAO,SAAS,QAAQ,EAAG;AAC5D,MAAI;AACF,UAAM,UAAU,OAAO,SAAS,WAAW,OAAO,SAAS;AAC3D,UAAM,WAAW,SAAS,kBAAkB,OAAO,OAAO,KAAK,CAAC;AAChE,UAAM,QAAQ,SAAS,eAAe,OAAO,OAAO,KAAK,CAAC;AAC1D,UAAM,gBAAgB,wBAAwB,OAAO,OAAO;AAC5D,UAAM,iBAAiB,MAAM,SAAS,QAAQ;AAC9C,UAAM,QAAQ,SAAS,SACnB,kBAAkB,mBAAmB,SAAS,KAAK,GAAG,CAAC,CAAC,KACxD,eAAe,SACb,eAAe,mBAAmB,eAAe,IAAI,MAAM,EAAE,KAAK,GAAG,CAAC,CAAC,KACvE;AACN,UAAM,MAAM,QACR,UAAU,KAAK,aAAa,mBAAmB,OAAO,CAAC,KACvD,mBAAmB,mBAAmB,OAAO,CAAC;AAClD,UAAM,wDAAmD,SAAS;AAClE,eAAW,MAAM;AAAE,aAAO,SAAS,OAAO;AAAA,IAAI,GAAG,EAAE;AAAA,EACrD,QAAQ;AAAA,EAER;AACF;AAEA,eAAsB,SAAS,OAA0B,MAAuC;AAE9F,QAAM,gBACJ,OAAO,WAAW,cACb,OAAsD,oBACvD;AACN,QAAM,gBAAiB,WAAyD;AAChF,QAAM,YAAY,iBAAiB;AACnC,MAAI,CAAC,WAAW;AACd,WAAO,IAAI;AAAA,MACT,KAAK,UAAU,EAAE,OAAO,6CAA6C,CAAC;AAAA,MACtE,EAAE,QAAQ,KAAK,SAAS,EAAE,gBAAgB,mBAAmB,EAAE;AAAA,IACjE;AAAA,EACF;AACA,QAAM,SAAS,cAAc,qBAAqB;AAClD,QAAM,aAAa,OAAO,KAAK,MAAM,EAAE,SACnC,EAAE,GAAI,QAAQ,CAAC,GAAI,SAAS,aAAa,MAAM,SAAS,MAAM,EAAE,IAChE;AACJ,QAAM,2BAA2B,IAAI,QAAQ,YAAY,OAAO,EAAE,IAAI,yBAAyB,MAAM;AACrG,QAAM,MAAM,MAAM,UAAU,OAAO,UAAU;AAC7C,QAAM,WAAW,OAAO,WAAW,cAAc,OAAO,SAAS,WAAW;AAC5E,QAAM,cAAc,SAAS,WAAW,QAAQ;AAChD,QAAM,gBAAgB,wBAAwB,KAAK,QAAQ;AAC3D,MAAI,IAAI,WAAW,KAAK;AAGtB,QAAI,CAAC,eAAe,CAAC,eAAe;AAClC,+BAAyB;AAEzB,YAAM,IAAI,kBAAkB,MAAM,IAAI,KAAK,EAAE,MAAM,MAAM,cAAc,CAAC;AAAA,IAC1E;AACA,WAAO;AAAA,EACT;AACA,MAAI,IAAI,WAAW,KAAK;AAEtB,QAAI,QAAyB;AAC7B,QAAI,WAA4B;AAChC,QAAI,UAAmB;AACvB,UAAM,UAAU,MAAM,aAAsC,IAAI,MAAM,GAAG,IAAI;AAC7E,QAAI,WAAW,OAAO,YAAY,UAAU;AAC1C,UAAI,MAAM,QAAQ,QAAQ,aAAa,GAAG;AACxC,gBAAQ,QAAQ,cAAc,IAAI,CAAC,MAAM,OAAO,CAAC,CAAC;AAAA,MACpD;AACA,UAAI,MAAM,QAAQ,QAAQ,gBAAgB,GAAG;AAC3C,mBAAW,QAAQ,iBAAiB,IAAI,CAAC,MAAM,OAAO,CAAC,CAAC;AAAA,MAC1D;AACA,gBAAU;AAAA,IACZ;AAEA,QAAI,CAAC,eAAe,CAAC,iBAAiB,CAAC,0BAA0B;AAC/D,YAAM,SACJ,OAAO,UAAU,WACb,QACA,iBAAiB,MACf,MAAM,SAAS,IACd,OAAO,YAAY,eAAe,iBAAiB,UAClD,MAAM,MACN;AACV,UAAI;AAEF,gBAAQ,KAAK,iCAAiC;AAAA,UAC5C,KAAK;AAAA,UACL,QAAQ,IAAI;AAAA,UACZ,eAAe;AAAA,UACf,kBAAkB;AAAA,UAClB,SAAS;AAAA,QACX,CAAC;AAAA,MACH,QAAQ;AAAA,MAAC;AACT,YAAM,cAAc,QAAS,SAAS,MAAM,UAAY,YAAY,SAAS,MAAO;AACpF,UAAI,aAAa;AACf,iCAAyB,EAAE,eAAe,OAAO,kBAAkB,SAAS,CAAC;AAAA,MAC/E;AACA,YAAM,MAAM,MAAM,IAAI,MAAM,EAAE,KAAK,EAAE,MAAM,MAAM,WAAW;AAC5D,UAAI,MAAM;AACV,YAAM,SAAS,MAAM,aAAsC,KAAK,IAAI;AACpE,UAAI,UAAU,OAAO,WAAW,UAAU;AACxC,YAAI,OAAO,OAAO,UAAU,UAAU;AACpC,gBAAM,OAAO;AAAA,QACf,WAAW,OAAO,OAAO,YAAY,UAAU;AAC7C,gBAAM,OAAO;AAAA,QACf;AAAA,MACF;AACA,YAAM,IAAI,eAAe,GAAG;AAAA,IAC9B;AAAA,EAEF;AACA,MAAI;AACF,UAAM,SAAS,IAAI,QAAQ,IAAI,gBAAgB;AAC/C,UAAM,WAAW,6BAA6B,MAAM;AACpD,QAAI,SAAU,eAAc,QAAQ;AAAA,EACtC,QAAQ;AAAA,EAER;AACA,MAAI;AACF,UAAM,aAAa,IAAI,QAAQ,IAAI,oBAAoB;AACvD,QAAI,YAAY;AACd,YAAM,SAAS,KAAK,MAAM,UAAU;AACpC,UAAI,UAAU,OAAO,WAAW,YAAY,OAAO,SAAS,iBAAiB;AAC3E,cAAM,SAAS,OAAO,OAAO,WAAW,WAAW,OAAO,SAAS,OAAO,OAAO,UAAU,EAAE;AAC7F,YAAI,QAAQ;AACV,gBAAM,YAAY,OAAO,OAAO,cAAc,WAAW,OAAO,YAAY;AAC5E,gBAAM,eAAe,OAAO,OAAO,iBAAiB,WAAW,OAAO,eAAe;AACrF,gBAAM,QAAQ,OAAO,UAAU,WAAW,WAAW;AACrD,gBAAM,cACJ,OAAO,OAAO,gBAAgB,YAAY,OAAO,YAAY,KAAK,IAC9D,OAAO,YAAY,KAAK,IACxB;AACN,kCAAwB,EAAE,QAAQ,aAAa,WAAW,cAAc,MAAM,CAAC;AAAA,QACjF;AAAA,MACF;AAAA,IACF;AAAA,EACF,QAAQ;AAAA,EAER;AACA,SAAO;AACT;",
+  "sourcesContent": ["\"use client\"\n// Simple fetch wrapper that redirects to session refresh on 401 (Unauthorized)\n// Used across UI data utilities to avoid duplication.\nimport { flash } from '../FlashMessages'\nimport { deserializeOperationMetadata } from '@open-mercato/shared/lib/commands/operationMetadata'\nimport { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'\nimport { pushOperation } from '../operations/store'\nimport { pushPartialIndexWarning } from '../indexes/store'\nimport { createScopedHeaderStack } from './scopedHeaderStack'\n\nconst scopedHeaders = createScopedHeaderStack()\n\nfunction mergeHeaders(base: HeadersInit | undefined, scoped: Record<string, string>): Headers {\n  const headers = new Headers(base ?? {})\n  for (const [key, value] of Object.entries(scoped)) {\n    if (headers.has(key)) continue\n    headers.set(key, value)\n  }\n  return headers\n}\n\nexport async function withScopedApiHeaders<T>(headers: Record<string, string>, run: () => Promise<T>): Promise<T> {\n  return scopedHeaders.withScopedHeaders(headers, run)\n}\n\nexport class UnauthorizedError extends Error {\n  readonly status = 401\n  constructor(message = 'Unauthorized') {\n    super(message)\n    this.name = 'UnauthorizedError'\n  }\n}\n\nexport function redirectToSessionRefresh() {\n  if (typeof window === 'undefined') return\n  const current = window.location.pathname + window.location.search\n  // Avoid redirect loops if already on an auth/session route\n  if (window.location.pathname.startsWith('/api/auth')) return\n  // Portal routes have their own customer auth \u2014 never redirect to staff login\n  if (/\\/[^/]+\\/portal(\\/|$)/.test(window.location.pathname)) return\n  try {\n    flash('Session expired. Redirecting to sign in\u2026', 'warning')\n    setTimeout(() => {\n      window.location.href = `/api/auth/session/refresh?redirect=${encodeURIComponent(current)}`\n    }, 20)\n  } catch {\n    // no-op\n  }\n}\n\nexport class ForbiddenError extends Error {\n  readonly status = 403\n  constructor(message = 'Forbidden') {\n    super(message)\n    this.name = 'ForbiddenError'\n  }\n}\n\nlet DEFAULT_FORBIDDEN_ROLES: string[] = ['admin']\n\nexport function setAuthRedirectConfig(cfg: { defaultForbiddenRoles?: readonly string[] }) {\n  if (cfg?.defaultForbiddenRoles && cfg.defaultForbiddenRoles.length) {\n    DEFAULT_FORBIDDEN_ROLES = [...cfg.defaultForbiddenRoles].map(String)\n  }\n}\n\nexport function redirectToForbiddenLogin(options?: { requiredRoles?: string[] | null; requiredFeatures?: string[] | null }) {\n  if (typeof window === 'undefined') return\n  if (window.location.pathname.startsWith('/login')) return\n  // Portal routes have their own customer auth \u2014 never redirect to staff login\n  if (/\\/[^/]+\\/portal(\\/|$)/.test(window.location.pathname)) return\n  try {\n    const current = window.location.pathname + window.location.search\n    const features = options?.requiredFeatures?.filter(Boolean) ?? []\n    const roles = options?.requiredRoles?.filter(Boolean) ?? []\n    const fallbackRoles = DEFAULT_FORBIDDEN_ROLES.filter(Boolean)\n    const effectiveRoles = roles.length ? roles : fallbackRoles\n    const query = features.length\n      ? `requireFeature=${encodeURIComponent(features.join(','))}`\n      : effectiveRoles.length\n        ? `requireRole=${encodeURIComponent(effectiveRoles.map(String).join(','))}`\n        : ''\n    const url = query\n      ? `/login?${query}&redirect=${encodeURIComponent(current)}`\n      : `/login?redirect=${encodeURIComponent(current)}`\n    flash('Insufficient permissions. Redirecting to login\u2026', 'warning')\n    setTimeout(() => { window.location.href = url }, 60)\n  } catch {\n    // no-op\n  }\n}\n\nexport async function apiFetch(input: RequestInfo | URL, init?: RequestInit): Promise<Response> {\n  type FetchType = (input: RequestInfo | URL, init?: RequestInit) => Promise<Response>\n  const originalFetch =\n    typeof window !== 'undefined'\n      ? (window as Window & { __omOriginalFetch?: FetchType }).__omOriginalFetch\n      : undefined\n  const fallbackFetch = (globalThis as typeof globalThis & { fetch?: FetchType }).fetch\n  const baseFetch = originalFetch ?? fallbackFetch\n  if (!baseFetch) {\n    return new Response(\n      JSON.stringify({ error: 'Fetch API is not available in this runtime' }),\n      { status: 503, headers: { 'content-type': 'application/json' } },\n    )\n  }\n  const scoped = scopedHeaders.resolveScopedHeaders()\n  const mergedInit = Object.keys(scoped).length\n    ? { ...(init ?? {}), headers: mergeHeaders(init?.headers, scoped) }\n    : init\n  const disableForbiddenRedirect = new Headers(mergedInit?.headers).get('x-om-forbidden-redirect') === '0'\n  const res = await baseFetch(input, mergedInit)\n  const pathname = typeof window !== 'undefined' ? window.location.pathname : ''\n  const onLoginPage = pathname.startsWith('/login')\n  const onPortalRoute = /\\/[^/]+\\/portal(\\/|$)/.test(pathname)\n  if (res.status === 401) {\n    // Trigger same redirect flow as protected pages\n    // Skip for staff login page and all portal routes (portal has its own auth)\n    if (!onLoginPage && !onPortalRoute) {\n      redirectToSessionRefresh()\n      // Throw a typed error for callers that might still handle it\n      throw new UnauthorizedError(await res.text().catch(() => 'Unauthorized'))\n    }\n    return res\n  }\n  if (res.status === 403) {\n    // Try to read requiredRoles from JSON body; ignore if not JSON\n    let roles: string[] | null = null\n    let features: string[] | null = null\n    let payload: unknown = null\n    const aclData = await readJsonSafe<Record<string, unknown>>(res.clone(), null)\n    if (aclData && typeof aclData === 'object') {\n      if (Array.isArray(aclData.requiredRoles)) {\n        roles = aclData.requiredRoles.map((r) => String(r))\n      }\n      if (Array.isArray(aclData.requiredFeatures)) {\n        features = aclData.requiredFeatures.map((f) => String(f))\n      }\n      payload = aclData\n    }\n    // Only redirect if not already on login page or a portal route\n    if (!onLoginPage && !onPortalRoute && !disableForbiddenRedirect) {\n      const target =\n        typeof input === 'string'\n          ? input\n          : input instanceof URL\n            ? input.toString()\n            : (typeof Request !== 'undefined' && input instanceof Request)\n              ? input.url\n              : 'unknown'\n      try {\n        // eslint-disable-next-line no-console\n        console.warn('[apiFetch] Forbidden response', {\n          url: target,\n          status: res.status,\n          requiredRoles: roles,\n          requiredFeatures: features,\n          details: payload,\n        })\n      } catch {}\n      const hasAclHints = Boolean((roles && roles.length) || (features && features.length))\n      if (hasAclHints) {\n        redirectToForbiddenLogin({ requiredRoles: roles, requiredFeatures: features })\n      }\n      let msg = 'Forbidden'\n      if (aclData && typeof aclData === 'object') {\n        if (typeof aclData.error === 'string') {\n          msg = aclData.error\n        } else if (typeof aclData.message === 'string') {\n          msg = aclData.message\n        }\n      } else {\n        msg = await res.clone().text().catch(() => 'Forbidden')\n      }\n      throw new ForbiddenError(msg)\n    }\n    // If already on login, just return the response for the caller to handle\n  }\n  try {\n    const header = res.headers.get('x-om-operation')\n    const metadata = deserializeOperationMetadata(header)\n    if (metadata) pushOperation(metadata)\n  } catch {\n    // ignore malformed headers\n  }\n  try {\n    const warningRaw = res.headers.get('x-om-partial-index')\n    if (warningRaw) {\n      const parsed = JSON.parse(warningRaw) as Record<string, unknown>\n      if (parsed && typeof parsed === 'object' && parsed.type === 'partial_index') {\n        const entity = typeof parsed.entity === 'string' ? parsed.entity : String(parsed.entity ?? '')\n        if (entity) {\n          const baseCount = typeof parsed.baseCount === 'number' ? parsed.baseCount : null\n          const indexedCount = typeof parsed.indexedCount === 'number' ? parsed.indexedCount : null\n          const scope = parsed.scope === 'global' ? 'global' : 'scoped'\n          const entityLabel =\n            typeof parsed.entityLabel === 'string' && parsed.entityLabel.trim()\n              ? parsed.entityLabel.trim()\n              : entity\n          pushPartialIndexWarning({ entity, entityLabel, baseCount, indexedCount, scope })\n        }\n      }\n    }\n  } catch {\n    // ignore malformed headers\n  }\n  return res\n}\n"],
+  "mappings": ";AAGA,SAAS,aAAa;AACtB,SAAS,oCAAoC;AAC7C,SAAS,oBAAoB;AAC7B,SAAS,qBAAqB;AAC9B,SAAS,+BAA+B;AACxC,SAAS,+BAA+B;AAExC,MAAM,gBAAgB,wBAAwB;AAE9C,SAAS,aAAa,MAA+B,QAAyC;AAC5F,QAAM,UAAU,IAAI,QAAQ,QAAQ,CAAC,CAAC;AACtC,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,MAAM,GAAG;AACjD,QAAI,QAAQ,IAAI,GAAG,EAAG;AACtB,YAAQ,IAAI,KAAK,KAAK;AAAA,EACxB;AACA,SAAO;AACT;AAEA,eAAsB,qBAAwB,SAAiC,KAAmC;AAChH,SAAO,cAAc,kBAAkB,SAAS,GAAG;AACrD;AAEO,MAAM,0BAA0B,MAAM;AAAA,EAE3C,YAAY,UAAU,gBAAgB;AACpC,UAAM,OAAO;AAFf,SAAS,SAAS;AAGhB,SAAK,OAAO;AAAA,EACd;AACF;AAEO,SAAS,2BAA2B;AACzC,MAAI,OAAO,WAAW,YAAa;AACnC,QAAM,UAAU,OAAO,SAAS,WAAW,OAAO,SAAS;AAE3D,MAAI,OAAO,SAAS,SAAS,WAAW,WAAW,EAAG;AAEtD,MAAI,wBAAwB,KAAK,OAAO,SAAS,QAAQ,EAAG;AAC5D,MAAI;AACF,UAAM,iDAA4C,SAAS;AAC3D,eAAW,MAAM;AACf,aAAO,SAAS,OAAO,sCAAsC,mBAAmB,OAAO,CAAC;AAAA,IAC1F,GAAG,EAAE;AAAA,EACP,QAAQ;AAAA,EAER;AACF;AAEO,MAAM,uBAAuB,MAAM;AAAA,EAExC,YAAY,UAAU,aAAa;AACjC,UAAM,OAAO;AAFf,SAAS,SAAS;AAGhB,SAAK,OAAO;AAAA,EACd;AACF;AAEA,IAAI,0BAAoC,CAAC,OAAO;AAEzC,SAAS,sBAAsB,KAAoD;AACxF,MAAI,KAAK,yBAAyB,IAAI,sBAAsB,QAAQ;AAClE,8BAA0B,CAAC,GAAG,IAAI,qBAAqB,EAAE,IAAI,MAAM;AAAA,EACrE;AACF;AAEO,SAAS,yBAAyB,SAAmF;AAC1H,MAAI,OAAO,WAAW,YAAa;AACnC,MAAI,OAAO,SAAS,SAAS,WAAW,QAAQ,EAAG;AAEnD,MAAI,wBAAwB,KAAK,OAAO,SAAS,QAAQ,EAAG;AAC5D,MAAI;AACF,UAAM,UAAU,OAAO,SAAS,WAAW,OAAO,SAAS;AAC3D,UAAM,WAAW,SAAS,kBAAkB,OAAO,OAAO,KAAK,CAAC;AAChE,UAAM,QAAQ,SAAS,eAAe,OAAO,OAAO,KAAK,CAAC;AAC1D,UAAM,gBAAgB,wBAAwB,OAAO,OAAO;AAC5D,UAAM,iBAAiB,MAAM,SAAS,QAAQ;AAC9C,UAAM,QAAQ,SAAS,SACnB,kBAAkB,mBAAmB,SAAS,KAAK,GAAG,CAAC,CAAC,KACxD,eAAe,SACb,eAAe,mBAAmB,eAAe,IAAI,MAAM,EAAE,KAAK,GAAG,CAAC,CAAC,KACvE;AACN,UAAM,MAAM,QACR,UAAU,KAAK,aAAa,mBAAmB,OAAO,CAAC,KACvD,mBAAmB,mBAAmB,OAAO,CAAC;AAClD,UAAM,wDAAmD,SAAS;AAClE,eAAW,MAAM;AAAE,aAAO,SAAS,OAAO;AAAA,IAAI,GAAG,EAAE;AAAA,EACrD,QAAQ;AAAA,EAER;AACF;AAEA,eAAsB,SAAS,OAA0B,MAAuC;AAE9F,QAAM,gBACJ,OAAO,WAAW,cACb,OAAsD,oBACvD;AACN,QAAM,gBAAiB,WAAyD;AAChF,QAAM,YAAY,iBAAiB;AACnC,MAAI,CAAC,WAAW;AACd,WAAO,IAAI;AAAA,MACT,KAAK,UAAU,EAAE,OAAO,6CAA6C,CAAC;AAAA,MACtE,EAAE,QAAQ,KAAK,SAAS,EAAE,gBAAgB,mBAAmB,EAAE;AAAA,IACjE;AAAA,EACF;AACA,QAAM,SAAS,cAAc,qBAAqB;AAClD,QAAM,aAAa,OAAO,KAAK,MAAM,EAAE,SACnC,EAAE,GAAI,QAAQ,CAAC,GAAI,SAAS,aAAa,MAAM,SAAS,MAAM,EAAE,IAChE;AACJ,QAAM,2BAA2B,IAAI,QAAQ,YAAY,OAAO,EAAE,IAAI,yBAAyB,MAAM;AACrG,QAAM,MAAM,MAAM,UAAU,OAAO,UAAU;AAC7C,QAAM,WAAW,OAAO,WAAW,cAAc,OAAO,SAAS,WAAW;AAC5E,QAAM,cAAc,SAAS,WAAW,QAAQ;AAChD,QAAM,gBAAgB,wBAAwB,KAAK,QAAQ;AAC3D,MAAI,IAAI,WAAW,KAAK;AAGtB,QAAI,CAAC,eAAe,CAAC,eAAe;AAClC,+BAAyB;AAEzB,YAAM,IAAI,kBAAkB,MAAM,IAAI,KAAK,EAAE,MAAM,MAAM,cAAc,CAAC;AAAA,IAC1E;AACA,WAAO;AAAA,EACT;AACA,MAAI,IAAI,WAAW,KAAK;AAEtB,QAAI,QAAyB;AAC7B,QAAI,WAA4B;AAChC,QAAI,UAAmB;AACvB,UAAM,UAAU,MAAM,aAAsC,IAAI,MAAM,GAAG,IAAI;AAC7E,QAAI,WAAW,OAAO,YAAY,UAAU;AAC1C,UAAI,MAAM,QAAQ,QAAQ,aAAa,GAAG;AACxC,gBAAQ,QAAQ,cAAc,IAAI,CAAC,MAAM,OAAO,CAAC,CAAC;AAAA,MACpD;AACA,UAAI,MAAM,QAAQ,QAAQ,gBAAgB,GAAG;AAC3C,mBAAW,QAAQ,iBAAiB,IAAI,CAAC,MAAM,OAAO,CAAC,CAAC;AAAA,MAC1D;AACA,gBAAU;AAAA,IACZ;AAEA,QAAI,CAAC,eAAe,CAAC,iBAAiB,CAAC,0BAA0B;AAC/D,YAAM,SACJ,OAAO,UAAU,WACb,QACA,iBAAiB,MACf,MAAM,SAAS,IACd,OAAO,YAAY,eAAe,iBAAiB,UAClD,MAAM,MACN;AACV,UAAI;AAEF,gBAAQ,KAAK,iCAAiC;AAAA,UAC5C,KAAK;AAAA,UACL,QAAQ,IAAI;AAAA,UACZ,eAAe;AAAA,UACf,kBAAkB;AAAA,UAClB,SAAS;AAAA,QACX,CAAC;AAAA,MACH,QAAQ;AAAA,MAAC;AACT,YAAM,cAAc,QAAS,SAAS,MAAM,UAAY,YAAY,SAAS,MAAO;AACpF,UAAI,aAAa;AACf,iCAAyB,EAAE,eAAe,OAAO,kBAAkB,SAAS,CAAC;AAAA,MAC/E;AACA,UAAI,MAAM;AACV,UAAI,WAAW,OAAO,YAAY,UAAU;AAC1C,YAAI,OAAO,QAAQ,UAAU,UAAU;AACrC,gBAAM,QAAQ;AAAA,QAChB,WAAW,OAAO,QAAQ,YAAY,UAAU;AAC9C,gBAAM,QAAQ;AAAA,QAChB;AAAA,MACF,OAAO;AACL,cAAM,MAAM,IAAI,MAAM,EAAE,KAAK,EAAE,MAAM,MAAM,WAAW;AAAA,MACxD;AACA,YAAM,IAAI,eAAe,GAAG;AAAA,IAC9B;AAAA,EAEF;AACA,MAAI;AACF,UAAM,SAAS,IAAI,QAAQ,IAAI,gBAAgB;AAC/C,UAAM,WAAW,6BAA6B,MAAM;AACpD,QAAI,SAAU,eAAc,QAAQ;AAAA,EACtC,QAAQ;AAAA,EAER;AACA,MAAI;AACF,UAAM,aAAa,IAAI,QAAQ,IAAI,oBAAoB;AACvD,QAAI,YAAY;AACd,YAAM,SAAS,KAAK,MAAM,UAAU;AACpC,UAAI,UAAU,OAAO,WAAW,YAAY,OAAO,SAAS,iBAAiB;AAC3E,cAAM,SAAS,OAAO,OAAO,WAAW,WAAW,OAAO,SAAS,OAAO,OAAO,UAAU,EAAE;AAC7F,YAAI,QAAQ;AACV,gBAAM,YAAY,OAAO,OAAO,cAAc,WAAW,OAAO,YAAY;AAC5E,gBAAM,eAAe,OAAO,OAAO,iBAAiB,WAAW,OAAO,eAAe;AACrF,gBAAM,QAAQ,OAAO,UAAU,WAAW,WAAW;AACrD,gBAAM,cACJ,OAAO,OAAO,gBAAgB,YAAY,OAAO,YAAY,KAAK,IAC9D,OAAO,YAAY,KAAK,IACxB;AACN,kCAAwB,EAAE,QAAQ,aAAa,WAAW,cAAc,MAAM,CAAC;AAAA,QACjF;AAAA,MACF;AAAA,IACF;AAAA,EACF,QAAQ;AAAA,EAER;AACA,SAAO;AACT;",
   "names": []
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-mercato/ui",
-  "version": "0.4.9-develop-7120508245",
+  "version": "0.4.9-develop-e55592929f",
   "type": "module",
   "main": "./dist/index.js",
   "scripts": {
@@ -124,12 +124,12 @@
     "recharts": "^2.15.0"
   },
   "peerDependencies": {
-    "@open-mercato/shared": "0.4.9-develop-7120508245",
+    "@open-mercato/shared": "0.4.9-develop-e55592929f",
     "react": ">=18.0.0",
     "react-dom": ">=18.0.0"
   },
   "devDependencies": {
-    "@open-mercato/shared": "0.4.9-develop-7120508245",
+    "@open-mercato/shared": "0.4.9-develop-e55592929f",
     "@testing-library/dom": "^10.4.1",
     "@testing-library/jest-dom": "^6.9.1",
     "@testing-library/react": "^16.3.1",

package/src/backend/utils/api.ts

@@ -162,15 +162,15 @@ export async function apiFetch(input: RequestInfo | URL, init?: RequestInit): Pr
       if (hasAclHints) {
         redirectToForbiddenLogin({ requiredRoles: roles, requiredFeatures: features })
       }
-      const raw = await res.clone().text().catch(() => 'Forbidden')
-      let msg = raw
-      const parsed = await readJsonSafe<Record<string, unknown>>(raw, null)
-      if (parsed && typeof parsed === 'object') {
-        if (typeof parsed.error === 'string') {
-          msg = parsed.error
-        } else if (typeof parsed.message === 'string') {
-          msg = parsed.message
+      let msg = 'Forbidden'
+      if (aclData && typeof aclData === 'object') {
+        if (typeof aclData.error === 'string') {
+          msg = aclData.error
+        } else if (typeof aclData.message === 'string') {
+          msg = aclData.message
         }
+      } else {
+        msg = await res.clone().text().catch(() => 'Forbidden')
       }
       throw new ForbiddenError(msg)
     }