@open-mercato/ui 0.6.8-develop.6917.1.af45bc96e2 → 0.6.8-develop.6918.1.7b3f32b0c8

package/dist/backend/utils/api.js

@@ -54,11 +54,31 @@ class UnauthorizedError extends Error {
     this.name = "UnauthorizedError";
   }
 }
+const SESSION_REFRESH_ATTEMPT_KEY_PREFIX = "om:session-refresh-attempt:";
+const SESSION_REFRESH_COOLDOWN_MS = 1e4;
+function recentlyAttemptedSessionRefresh(target) {
+  try {
+    const raw = window.sessionStorage.getItem(SESSION_REFRESH_ATTEMPT_KEY_PREFIX + target);
+    if (!raw) return false;
+    const attemptedAt = Number(raw);
+    return Number.isFinite(attemptedAt) && Date.now() - attemptedAt < SESSION_REFRESH_COOLDOWN_MS;
+  } catch {
+    return false;
+  }
+}
+function recordSessionRefreshAttempt(target) {
+  try {
+    window.sessionStorage.setItem(SESSION_REFRESH_ATTEMPT_KEY_PREFIX + target, String(Date.now()));
+  } catch {
+  }
+}
 function redirectToSessionRefresh() {
   if (typeof window === "undefined") return;
   const current = window.location.pathname + window.location.search;
   if (window.location.pathname.startsWith("/api/auth")) return;
   if (/\/[^/]+\/portal(\/|$)/.test(window.location.pathname)) return;
+  if (recentlyAttemptedSessionRefresh(current)) return;
+  recordSessionRefreshAttempt(current);
   try {
     flash("Session expired. Redirecting to sign in\u2026", "warning");
     setTimeout(() => {

package/dist/backend/utils/api.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/backend/utils/api.ts"],
-  "sourcesContent": ["\"use client\"\n// Simple fetch wrapper that redirects to session refresh on 401 (Unauthorized)\n// Used across UI data utilities to avoid duplication.\nimport { flash } from '../FlashMessages'\nimport { deserializeOperationMetadata } from '@open-mercato/shared/lib/commands/operationMetadata'\nimport { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'\nimport { pushOperation } from '../operations/store'\nimport { pushPartialIndexWarning } from '../indexes/store'\nimport { createScopedHeaderStack } from './scopedHeaderStack'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('ui').child({ component: 'apiFetch' })\n\nconst scopedHeaders = createScopedHeaderStack()\n\nfunction mergeHeaders(base: HeadersInit | undefined, scoped: Record<string, string>): Headers {\n  const headers = new Headers(base ?? {})\n  for (const [key, value] of Object.entries(scoped)) {\n    if (headers.has(key)) continue\n    headers.set(key, value)\n  }\n  return headers\n}\n\nfunction readRedirectOverride(headers: Headers, headerName: string): boolean {\n  return headers.get(headerName) === '0'\n}\n\nfunction isSameOriginRequest(input: RequestInfo | URL): boolean {\n  if (typeof window === 'undefined') return false\n  const host = window.location?.host\n  if (!host) return false\n  let urlString: string\n  if (typeof input === 'string') urlString = input\n  else if (input instanceof URL) urlString = input.toString()\n  else if (typeof Request !== 'undefined' && input instanceof Request) urlString = input.url\n  else return false\n  if (!/^[a-z][a-z0-9+.-]*:/i.test(urlString)) return true\n  try {\n    return new URL(urlString).host === host\n  } catch {\n    return false\n  }\n}\n\nexport async function withScopedApiHeaders<T>(headers: Record<string, string>, run: () => Promise<T>): Promise<T> {\n  return scopedHeaders.withScopedHeaders(headers, run)\n}\n\nfunction readPathname(): string {\n  return typeof window !== 'undefined' ? window.location?.pathname ?? '' : ''\n}\n\nfunction isLoginPathname(pathname: string): boolean {\n  return pathname.startsWith('/login')\n}\n\nfunction isPortalPathname(pathname: string): boolean {\n  return /\\/[^/]+\\/portal(\\/|$)/.test(pathname)\n}\n\nexport class UnauthorizedError extends Error {\n  readonly status = 401\n  constructor(message = 'Unauthorized') {\n    super(message)\n    this.name = 'UnauthorizedError'\n  }\n}\n\nexport function redirectToSessionRefresh() {\n  if (typeof window === 'undefined') return\n  const current = window.location.pathname + window.location.search\n  // Avoid redirect loops if already on an auth/session route\n  if (window.location.pathname.startsWith('/api/auth')) return\n  // Portal routes have their own customer auth \u2014 never redirect to staff login\n  if (/\\/[^/]+\\/portal(\\/|$)/.test(window.location.pathname)) return\n  try {\n    flash('Session expired. Redirecting to sign in\u2026', 'warning')\n    setTimeout(() => {\n      window.location.href = `/api/auth/session/refresh?redirect=${encodeURIComponent(current)}`\n    }, 20)\n  } catch {\n    // no-op\n  }\n}\n\nexport class ForbiddenError extends Error {\n  readonly status = 403\n  readonly requiredFeatures: string[] | null\n  readonly requiredRoles: string[] | null\n\n  constructor(\n    message = 'Forbidden',\n    options?: { requiredFeatures?: string[] | null; requiredRoles?: string[] | null },\n  ) {\n    super(message)\n    this.name = 'ForbiddenError'\n    this.requiredFeatures = options?.requiredFeatures?.length ? [...options.requiredFeatures] : null\n    this.requiredRoles = options?.requiredRoles?.length ? [...options.requiredRoles] : null\n  }\n}\n\nlet DEFAULT_FORBIDDEN_ROLES: string[] = ['admin']\n\nexport function setAuthRedirectConfig(cfg: { defaultForbiddenRoles?: readonly string[] }) {\n  if (cfg?.defaultForbiddenRoles && cfg.defaultForbiddenRoles.length) {\n    DEFAULT_FORBIDDEN_ROLES = [...cfg.defaultForbiddenRoles].map(String)\n  }\n}\n\nfunction formatForbiddenAccessMessage(options?: { requiredRoles?: string[] | null; requiredFeatures?: string[] | null }): string {\n  const features = options?.requiredFeatures?.filter(Boolean) ?? []\n  const roles = options?.requiredRoles?.filter(Boolean) ?? []\n  const effectiveRoles = roles.length ? roles : DEFAULT_FORBIDDEN_ROLES.filter(Boolean)\n  if (features.length) {\n    return `Access denied: you are missing the required permission \"${features.join(', ')}\". Contact your administrator.`\n  }\n  if (effectiveRoles.length) {\n    return `Access denied: this area requires the role \"${effectiveRoles.join(', ')}\". Contact your administrator.`\n  }\n  return 'Access denied: you do not have permission to perform this action.'\n}\n\n/**\n * Signal a forbidden access attempt for an authenticated user via a flash banner.\n *\n * Authenticated 403 responses must never redirect to `/login` \u2014 that creates an\n * infinite loop because the login page detects the active session and bounces\n * the user back to the failing destination (see GH #2070). Pages that need an\n * inline banner should catch `ForbiddenError` and render `AccessDeniedMessage`\n * from `@open-mercato/ui/backend/detail`.\n */\nexport function notifyForbiddenAccess(options?: { requiredRoles?: string[] | null; requiredFeatures?: string[] | null }) {\n  if (typeof window === 'undefined') return\n  // Portal routes have their own customer auth \u2014 keep the existing no-op contract.\n  if (/\\/[^/]+\\/portal(\\/|$)/.test(window.location.pathname)) return\n  try {\n    flash(formatForbiddenAccessMessage(options), 'warning')\n  } catch {\n    // no-op\n  }\n}\n\n/**\n * @deprecated Renamed to {@link notifyForbiddenAccess}. The previous name\n * implied a `/login` redirect that no longer happens (see GH #2070). Kept as an\n * exported alias for one minor version so third-party module imports keep\n * building; update imports to `notifyForbiddenAccess`.\n */\nexport const redirectToForbiddenLogin = notifyForbiddenAccess\n\nexport async function apiFetch(input: RequestInfo | URL, init?: RequestInit): Promise<Response> {\n  type FetchType = (input: RequestInfo | URL, init?: RequestInit) => Promise<Response>\n  const originalFetch =\n    typeof window !== 'undefined'\n      ? (window as Window & { __omOriginalFetch?: FetchType }).__omOriginalFetch\n      : undefined\n  const fallbackFetch = (globalThis as typeof globalThis & { fetch?: FetchType }).fetch\n  const baseFetch = originalFetch ?? fallbackFetch\n  if (!baseFetch) {\n    return new Response(\n      JSON.stringify({ error: 'Fetch API is not available in this runtime' }),\n      { status: 503, headers: { 'content-type': 'application/json' } },\n    )\n  }\n  const scoped = scopedHeaders.resolveScopedHeaders()\n  const baseInit: RequestInit = Object.keys(scoped).length\n    ? { ...(init ?? {}), headers: mergeHeaders(init?.headers, scoped) }\n    : init ?? {}\n  // Only auto-inject credentials: 'include' for same-origin requests so cookies\n  // round-trip across Next.js proxy.ts rewrites (custom-domain portal flows)\n  // without leaking session cookies to third-party hosts.\n  const mergedInit: RequestInit = baseInit.credentials\n    ? baseInit\n    : isSameOriginRequest(input)\n      ? { ...baseInit, credentials: 'include' }\n      : baseInit\n  const requestHeaders = new Headers(mergedInit?.headers)\n  const disableUnauthorizedRedirect = readRedirectOverride(requestHeaders, 'x-om-unauthorized-redirect')\n  const disableForbiddenRedirect = readRedirectOverride(requestHeaders, 'x-om-forbidden-redirect')\n  // Snapshot the pathname BEFORE the request is sent. A 401 for a request that\n  // started on the login page must stay silent even when the response lands after\n  // the post-login client-side navigation to /backend \u2014 otherwise the stale\n  // pre-auth 401 raises a bogus \"Session expired\" banner right after signing in.\n  const requestPathname = readPathname()\n  const res = await baseFetch(input, mergedInit)\n  const responsePathname = readPathname()\n  const onLoginPage = isLoginPathname(requestPathname) || isLoginPathname(responsePathname)\n  const onPortalRoute = isPortalPathname(requestPathname) || isPortalPathname(responsePathname)\n  if (res.status === 401) {\n    // Trigger same redirect flow as protected pages\n    // Skip for staff login page and all portal routes (portal has its own auth)\n    if (!onLoginPage && !onPortalRoute && !disableUnauthorizedRedirect) {\n      redirectToSessionRefresh()\n      // Throw a typed error for callers that might still handle it\n      throw new UnauthorizedError(await res.text().catch(() => 'Unauthorized'))\n    }\n    return res\n  }\n  if (res.status === 403) {\n    // Try to read requiredRoles from JSON body; ignore if not JSON\n    let roles: string[] | null = null\n    let features: string[] | null = null\n    let payload: unknown = null\n    const aclData = await readJsonSafe<Record<string, unknown>>(res.clone(), null)\n    if (aclData && typeof aclData === 'object') {\n      if (Array.isArray(aclData.requiredRoles)) {\n        roles = aclData.requiredRoles.map((r) => String(r))\n      }\n      if (Array.isArray(aclData.requiredFeatures)) {\n        features = aclData.requiredFeatures.map((f) => String(f))\n      }\n      payload = aclData\n    }\n    // Only redirect if not already on login page or a portal route\n    if (!onLoginPage && !onPortalRoute && !disableForbiddenRedirect) {\n      const target =\n        typeof input === 'string'\n          ? input\n          : input instanceof URL\n            ? input.toString()\n            : (typeof Request !== 'undefined' && input instanceof Request)\n              ? input.url\n              : 'unknown'\n      try {\n        logger.warn('Forbidden response', {\n          url: target,\n          status: res.status,\n          requiredRoles: roles,\n          requiredFeatures: features,\n          details: payload,\n        })\n      } catch {}\n      const hasAclHints = Boolean((roles && roles.length) || (features && features.length))\n      if (hasAclHints) {\n        notifyForbiddenAccess({ requiredRoles: roles, requiredFeatures: features })\n      }\n      let msg = 'Forbidden'\n      if (aclData && typeof aclData === 'object') {\n        if (typeof aclData.error === 'string') {\n          msg = aclData.error\n        } else if (typeof aclData.message === 'string') {\n          msg = aclData.message\n        }\n      } else {\n        msg = await res.clone().text().catch(() => 'Forbidden')\n      }\n      // Attach ACL hints so callers (e.g. flashMutationError) can name the\n      // missing permission instead of surfacing a bare \"Forbidden\" toast.\n      throw new ForbiddenError(msg, { requiredFeatures: features, requiredRoles: roles })\n    }\n    // If already on login, just return the response for the caller to handle\n  }\n  try {\n    const header = res.headers.get('x-om-operation')\n    const metadata = deserializeOperationMetadata(header)\n    if (metadata) pushOperation(metadata)\n  } catch {\n    // ignore malformed headers\n  }\n  try {\n    const warningRaw = res.headers.get('x-om-partial-index')\n    if (warningRaw) {\n      const parsed = JSON.parse(warningRaw) as Record<string, unknown>\n      if (parsed && typeof parsed === 'object' && parsed.type === 'partial_index') {\n        const entity = typeof parsed.entity === 'string' ? parsed.entity : String(parsed.entity ?? '')\n        if (entity) {\n          const baseCount = typeof parsed.baseCount === 'number' ? parsed.baseCount : null\n          const indexedCount = typeof parsed.indexedCount === 'number' ? parsed.indexedCount : null\n          const scope = parsed.scope === 'global' ? 'global' : 'scoped'\n          const entityLabel =\n            typeof parsed.entityLabel === 'string' && parsed.entityLabel.trim()\n              ? parsed.entityLabel.trim()\n              : entity\n          pushPartialIndexWarning({ entity, entityLabel, baseCount, indexedCount, scope })\n        }\n      }\n    }\n  } catch {\n    // ignore malformed headers\n  }\n  return res\n}\n"],
-  "mappings": ";AAGA,SAAS,aAAa;AACtB,SAAS,oCAAoC;AAC7C,SAAS,oBAAoB;AAC7B,SAAS,qBAAqB;AAC9B,SAAS,+BAA+B;AACxC,SAAS,+BAA+B;AACxC,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,IAAI,EAAE,MAAM,EAAE,WAAW,WAAW,CAAC;AAEjE,MAAM,gBAAgB,wBAAwB;AAE9C,SAAS,aAAa,MAA+B,QAAyC;AAC5F,QAAM,UAAU,IAAI,QAAQ,QAAQ,CAAC,CAAC;AACtC,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,MAAM,GAAG;AACjD,QAAI,QAAQ,IAAI,GAAG,EAAG;AACtB,YAAQ,IAAI,KAAK,KAAK;AAAA,EACxB;AACA,SAAO;AACT;AAEA,SAAS,qBAAqB,SAAkB,YAA6B;AAC3E,SAAO,QAAQ,IAAI,UAAU,MAAM;AACrC;AAEA,SAAS,oBAAoB,OAAmC;AAC9D,MAAI,OAAO,WAAW,YAAa,QAAO;AAC1C,QAAM,OAAO,OAAO,UAAU;AAC9B,MAAI,CAAC,KAAM,QAAO;AAClB,MAAI;AACJ,MAAI,OAAO,UAAU,SAAU,aAAY;AAAA,WAClC,iBAAiB,IAAK,aAAY,MAAM,SAAS;AAAA,WACjD,OAAO,YAAY,eAAe,iBAAiB,QAAS,aAAY,MAAM;AAAA,MAClF,QAAO;AACZ,MAAI,CAAC,uBAAuB,KAAK,SAAS,EAAG,QAAO;AACpD,MAAI;AACF,WAAO,IAAI,IAAI,SAAS,EAAE,SAAS;AAAA,EACrC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAsB,qBAAwB,SAAiC,KAAmC;AAChH,SAAO,cAAc,kBAAkB,SAAS,GAAG;AACrD;AAEA,SAAS,eAAuB;AAC9B,SAAO,OAAO,WAAW,cAAc,OAAO,UAAU,YAAY,KAAK;AAC3E;AAEA,SAAS,gBAAgB,UAA2B;AAClD,SAAO,SAAS,WAAW,QAAQ;AACrC;AAEA,SAAS,iBAAiB,UAA2B;AACnD,SAAO,wBAAwB,KAAK,QAAQ;AAC9C;AAEO,MAAM,0BAA0B,MAAM;AAAA,EAE3C,YAAY,UAAU,gBAAgB;AACpC,UAAM,OAAO;AAFf,SAAS,SAAS;AAGhB,SAAK,OAAO;AAAA,EACd;AACF;AAEO,SAAS,2BAA2B;AACzC,MAAI,OAAO,WAAW,YAAa;AACnC,QAAM,UAAU,OAAO,SAAS,WAAW,OAAO,SAAS;AAE3D,MAAI,OAAO,SAAS,SAAS,WAAW,WAAW,EAAG;AAEtD,MAAI,wBAAwB,KAAK,OAAO,SAAS,QAAQ,EAAG;AAC5D,MAAI;AACF,UAAM,iDAA4C,SAAS;AAC3D,eAAW,MAAM;AACf,aAAO,SAAS,OAAO,sCAAsC,mBAAmB,OAAO,CAAC;AAAA,IAC1F,GAAG,EAAE;AAAA,EACP,QAAQ;AAAA,EAER;AACF;AAEO,MAAM,uBAAuB,MAAM;AAAA,EAKxC,YACE,UAAU,aACV,SACA;AACA,UAAM,OAAO;AARf,SAAS,SAAS;AAShB,SAAK,OAAO;AACZ,SAAK,mBAAmB,SAAS,kBAAkB,SAAS,CAAC,GAAG,QAAQ,gBAAgB,IAAI;AAC5F,SAAK,gBAAgB,SAAS,eAAe,SAAS,CAAC,GAAG,QAAQ,aAAa,IAAI;AAAA,EACrF;AACF;AAEA,IAAI,0BAAoC,CAAC,OAAO;AAEzC,SAAS,sBAAsB,KAAoD;AACxF,MAAI,KAAK,yBAAyB,IAAI,sBAAsB,QAAQ;AAClE,8BAA0B,CAAC,GAAG,IAAI,qBAAqB,EAAE,IAAI,MAAM;AAAA,EACrE;AACF;AAEA,SAAS,6BAA6B,SAA2F;AAC/H,QAAM,WAAW,SAAS,kBAAkB,OAAO,OAAO,KAAK,CAAC;AAChE,QAAM,QAAQ,SAAS,eAAe,OAAO,OAAO,KAAK,CAAC;AAC1D,QAAM,iBAAiB,MAAM,SAAS,QAAQ,wBAAwB,OAAO,OAAO;AACpF,MAAI,SAAS,QAAQ;AACnB,WAAO,2DAA2D,SAAS,KAAK,IAAI,CAAC;AAAA,EACvF;AACA,MAAI,eAAe,QAAQ;AACzB,WAAO,+CAA+C,eAAe,KAAK,IAAI,CAAC;AAAA,EACjF;AACA,SAAO;AACT;AAWO,SAAS,sBAAsB,SAAmF;AACvH,MAAI,OAAO,WAAW,YAAa;AAEnC,MAAI,wBAAwB,KAAK,OAAO,SAAS,QAAQ,EAAG;AAC5D,MAAI;AACF,UAAM,6BAA6B,OAAO,GAAG,SAAS;AAAA,EACxD,QAAQ;AAAA,EAER;AACF;AAQO,MAAM,2BAA2B;AAExC,eAAsB,SAAS,OAA0B,MAAuC;AAE9F,QAAM,gBACJ,OAAO,WAAW,cACb,OAAsD,oBACvD;AACN,QAAM,gBAAiB,WAAyD;AAChF,QAAM,YAAY,iBAAiB;AACnC,MAAI,CAAC,WAAW;AACd,WAAO,IAAI;AAAA,MACT,KAAK,UAAU,EAAE,OAAO,6CAA6C,CAAC;AAAA,MACtE,EAAE,QAAQ,KAAK,SAAS,EAAE,gBAAgB,mBAAmB,EAAE;AAAA,IACjE;AAAA,EACF;AACA,QAAM,SAAS,cAAc,qBAAqB;AAClD,QAAM,WAAwB,OAAO,KAAK,MAAM,EAAE,SAC9C,EAAE,GAAI,QAAQ,CAAC,GAAI,SAAS,aAAa,MAAM,SAAS,MAAM,EAAE,IAChE,QAAQ,CAAC;AAIb,QAAM,aAA0B,SAAS,cACrC,WACA,oBAAoB,KAAK,IACvB,EAAE,GAAG,UAAU,aAAa,UAAU,IACtC;AACN,QAAM,iBAAiB,IAAI,QAAQ,YAAY,OAAO;AACtD,QAAM,8BAA8B,qBAAqB,gBAAgB,4BAA4B;AACrG,QAAM,2BAA2B,qBAAqB,gBAAgB,yBAAyB;AAK/F,QAAM,kBAAkB,aAAa;AACrC,QAAM,MAAM,MAAM,UAAU,OAAO,UAAU;AAC7C,QAAM,mBAAmB,aAAa;AACtC,QAAM,cAAc,gBAAgB,eAAe,KAAK,gBAAgB,gBAAgB;AACxF,QAAM,gBAAgB,iBAAiB,eAAe,KAAK,iBAAiB,gBAAgB;AAC5F,MAAI,IAAI,WAAW,KAAK;AAGtB,QAAI,CAAC,eAAe,CAAC,iBAAiB,CAAC,6BAA6B;AAClE,+BAAyB;AAEzB,YAAM,IAAI,kBAAkB,MAAM,IAAI,KAAK,EAAE,MAAM,MAAM,cAAc,CAAC;AAAA,IAC1E;AACA,WAAO;AAAA,EACT;AACA,MAAI,IAAI,WAAW,KAAK;AAEtB,QAAI,QAAyB;AAC7B,QAAI,WAA4B;AAChC,QAAI,UAAmB;AACvB,UAAM,UAAU,MAAM,aAAsC,IAAI,MAAM,GAAG,IAAI;AAC7E,QAAI,WAAW,OAAO,YAAY,UAAU;AAC1C,UAAI,MAAM,QAAQ,QAAQ,aAAa,GAAG;AACxC,gBAAQ,QAAQ,cAAc,IAAI,CAAC,MAAM,OAAO,CAAC,CAAC;AAAA,MACpD;AACA,UAAI,MAAM,QAAQ,QAAQ,gBAAgB,GAAG;AAC3C,mBAAW,QAAQ,iBAAiB,IAAI,CAAC,MAAM,OAAO,CAAC,CAAC;AAAA,MAC1D;AACA,gBAAU;AAAA,IACZ;AAEA,QAAI,CAAC,eAAe,CAAC,iBAAiB,CAAC,0BAA0B;AAC/D,YAAM,SACJ,OAAO,UAAU,WACb,QACA,iBAAiB,MACf,MAAM,SAAS,IACd,OAAO,YAAY,eAAe,iBAAiB,UAClD,MAAM,MACN;AACV,UAAI;AACF,eAAO,KAAK,sBAAsB;AAAA,UAChC,KAAK;AAAA,UACL,QAAQ,IAAI;AAAA,UACZ,eAAe;AAAA,UACf,kBAAkB;AAAA,UAClB,SAAS;AAAA,QACX,CAAC;AAAA,MACH,QAAQ;AAAA,MAAC;AACT,YAAM,cAAc,QAAS,SAAS,MAAM,UAAY,YAAY,SAAS,MAAO;AACpF,UAAI,aAAa;AACf,8BAAsB,EAAE,eAAe,OAAO,kBAAkB,SAAS,CAAC;AAAA,MAC5E;AACA,UAAI,MAAM;AACV,UAAI,WAAW,OAAO,YAAY,UAAU;AAC1C,YAAI,OAAO,QAAQ,UAAU,UAAU;AACrC,gBAAM,QAAQ;AAAA,QAChB,WAAW,OAAO,QAAQ,YAAY,UAAU;AAC9C,gBAAM,QAAQ;AAAA,QAChB;AAAA,MACF,OAAO;AACL,cAAM,MAAM,IAAI,MAAM,EAAE,KAAK,EAAE,MAAM,MAAM,WAAW;AAAA,MACxD;AAGA,YAAM,IAAI,eAAe,KAAK,EAAE,kBAAkB,UAAU,eAAe,MAAM,CAAC;AAAA,IACpF;AAAA,EAEF;AACA,MAAI;AACF,UAAM,SAAS,IAAI,QAAQ,IAAI,gBAAgB;AAC/C,UAAM,WAAW,6BAA6B,MAAM;AACpD,QAAI,SAAU,eAAc,QAAQ;AAAA,EACtC,QAAQ;AAAA,EAER;AACA,MAAI;AACF,UAAM,aAAa,IAAI,QAAQ,IAAI,oBAAoB;AACvD,QAAI,YAAY;AACd,YAAM,SAAS,KAAK,MAAM,UAAU;AACpC,UAAI,UAAU,OAAO,WAAW,YAAY,OAAO,SAAS,iBAAiB;AAC3E,cAAM,SAAS,OAAO,OAAO,WAAW,WAAW,OAAO,SAAS,OAAO,OAAO,UAAU,EAAE;AAC7F,YAAI,QAAQ;AACV,gBAAM,YAAY,OAAO,OAAO,cAAc,WAAW,OAAO,YAAY;AAC5E,gBAAM,eAAe,OAAO,OAAO,iBAAiB,WAAW,OAAO,eAAe;AACrF,gBAAM,QAAQ,OAAO,UAAU,WAAW,WAAW;AACrD,gBAAM,cACJ,OAAO,OAAO,gBAAgB,YAAY,OAAO,YAAY,KAAK,IAC9D,OAAO,YAAY,KAAK,IACxB;AACN,kCAAwB,EAAE,QAAQ,aAAa,WAAW,cAAc,MAAM,CAAC;AAAA,QACjF;AAAA,MACF;AAAA,IACF;AAAA,EACF,QAAQ;AAAA,EAER;AACA,SAAO;AACT;",
+  "sourcesContent": ["\"use client\"\n// Simple fetch wrapper that redirects to session refresh on 401 (Unauthorized)\n// Used across UI data utilities to avoid duplication.\nimport { flash } from '../FlashMessages'\nimport { deserializeOperationMetadata } from '@open-mercato/shared/lib/commands/operationMetadata'\nimport { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'\nimport { pushOperation } from '../operations/store'\nimport { pushPartialIndexWarning } from '../indexes/store'\nimport { createScopedHeaderStack } from './scopedHeaderStack'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('ui').child({ component: 'apiFetch' })\n\nconst scopedHeaders = createScopedHeaderStack()\n\nfunction mergeHeaders(base: HeadersInit | undefined, scoped: Record<string, string>): Headers {\n  const headers = new Headers(base ?? {})\n  for (const [key, value] of Object.entries(scoped)) {\n    if (headers.has(key)) continue\n    headers.set(key, value)\n  }\n  return headers\n}\n\nfunction readRedirectOverride(headers: Headers, headerName: string): boolean {\n  return headers.get(headerName) === '0'\n}\n\nfunction isSameOriginRequest(input: RequestInfo | URL): boolean {\n  if (typeof window === 'undefined') return false\n  const host = window.location?.host\n  if (!host) return false\n  let urlString: string\n  if (typeof input === 'string') urlString = input\n  else if (input instanceof URL) urlString = input.toString()\n  else if (typeof Request !== 'undefined' && input instanceof Request) urlString = input.url\n  else return false\n  if (!/^[a-z][a-z0-9+.-]*:/i.test(urlString)) return true\n  try {\n    return new URL(urlString).host === host\n  } catch {\n    return false\n  }\n}\n\nexport async function withScopedApiHeaders<T>(headers: Record<string, string>, run: () => Promise<T>): Promise<T> {\n  return scopedHeaders.withScopedHeaders(headers, run)\n}\n\nfunction readPathname(): string {\n  return typeof window !== 'undefined' ? window.location?.pathname ?? '' : ''\n}\n\nfunction isLoginPathname(pathname: string): boolean {\n  return pathname.startsWith('/login')\n}\n\nfunction isPortalPathname(pathname: string): boolean {\n  return /\\/[^/]+\\/portal(\\/|$)/.test(pathname)\n}\n\nexport class UnauthorizedError extends Error {\n  readonly status = 401\n  constructor(message = 'Unauthorized') {\n    super(message)\n    this.name = 'UnauthorizedError'\n  }\n}\n\nconst SESSION_REFRESH_ATTEMPT_KEY_PREFIX = 'om:session-refresh-attempt:'\nconst SESSION_REFRESH_COOLDOWN_MS = 10_000\n\n// A genuinely expired session redirects once per target, then goes quiet: the\n// refresh always succeeds (the session cookie is fine), bounces back to the\n// same URL, and re-triggers the same 401 for any non-session cause \u2014 without\n// this guard that bounce repeats forever (GH #5186).\nfunction recentlyAttemptedSessionRefresh(target: string): boolean {\n  try {\n    const raw = window.sessionStorage.getItem(SESSION_REFRESH_ATTEMPT_KEY_PREFIX + target)\n    if (!raw) return false\n    const attemptedAt = Number(raw)\n    return Number.isFinite(attemptedAt) && Date.now() - attemptedAt < SESSION_REFRESH_COOLDOWN_MS\n  } catch {\n    return false\n  }\n}\n\nfunction recordSessionRefreshAttempt(target: string): void {\n  try {\n    window.sessionStorage.setItem(SESSION_REFRESH_ATTEMPT_KEY_PREFIX + target, String(Date.now()))\n  } catch {\n    // no-op\n  }\n}\n\nexport function redirectToSessionRefresh() {\n  if (typeof window === 'undefined') return\n  const current = window.location.pathname + window.location.search\n  // Avoid redirect loops if already on an auth/session route\n  if (window.location.pathname.startsWith('/api/auth')) return\n  // Portal routes have their own customer auth \u2014 never redirect to staff login\n  if (/\\/[^/]+\\/portal(\\/|$)/.test(window.location.pathname)) return\n  if (recentlyAttemptedSessionRefresh(current)) return\n  recordSessionRefreshAttempt(current)\n  try {\n    flash('Session expired. Redirecting to sign in\u2026', 'warning')\n    setTimeout(() => {\n      window.location.href = `/api/auth/session/refresh?redirect=${encodeURIComponent(current)}`\n    }, 20)\n  } catch {\n    // no-op\n  }\n}\n\nexport class ForbiddenError extends Error {\n  readonly status = 403\n  readonly requiredFeatures: string[] | null\n  readonly requiredRoles: string[] | null\n\n  constructor(\n    message = 'Forbidden',\n    options?: { requiredFeatures?: string[] | null; requiredRoles?: string[] | null },\n  ) {\n    super(message)\n    this.name = 'ForbiddenError'\n    this.requiredFeatures = options?.requiredFeatures?.length ? [...options.requiredFeatures] : null\n    this.requiredRoles = options?.requiredRoles?.length ? [...options.requiredRoles] : null\n  }\n}\n\nlet DEFAULT_FORBIDDEN_ROLES: string[] = ['admin']\n\nexport function setAuthRedirectConfig(cfg: { defaultForbiddenRoles?: readonly string[] }) {\n  if (cfg?.defaultForbiddenRoles && cfg.defaultForbiddenRoles.length) {\n    DEFAULT_FORBIDDEN_ROLES = [...cfg.defaultForbiddenRoles].map(String)\n  }\n}\n\nfunction formatForbiddenAccessMessage(options?: { requiredRoles?: string[] | null; requiredFeatures?: string[] | null }): string {\n  const features = options?.requiredFeatures?.filter(Boolean) ?? []\n  const roles = options?.requiredRoles?.filter(Boolean) ?? []\n  const effectiveRoles = roles.length ? roles : DEFAULT_FORBIDDEN_ROLES.filter(Boolean)\n  if (features.length) {\n    return `Access denied: you are missing the required permission \"${features.join(', ')}\". Contact your administrator.`\n  }\n  if (effectiveRoles.length) {\n    return `Access denied: this area requires the role \"${effectiveRoles.join(', ')}\". Contact your administrator.`\n  }\n  return 'Access denied: you do not have permission to perform this action.'\n}\n\n/**\n * Signal a forbidden access attempt for an authenticated user via a flash banner.\n *\n * Authenticated 403 responses must never redirect to `/login` \u2014 that creates an\n * infinite loop because the login page detects the active session and bounces\n * the user back to the failing destination (see GH #2070). Pages that need an\n * inline banner should catch `ForbiddenError` and render `AccessDeniedMessage`\n * from `@open-mercato/ui/backend/detail`.\n */\nexport function notifyForbiddenAccess(options?: { requiredRoles?: string[] | null; requiredFeatures?: string[] | null }) {\n  if (typeof window === 'undefined') return\n  // Portal routes have their own customer auth \u2014 keep the existing no-op contract.\n  if (/\\/[^/]+\\/portal(\\/|$)/.test(window.location.pathname)) return\n  try {\n    flash(formatForbiddenAccessMessage(options), 'warning')\n  } catch {\n    // no-op\n  }\n}\n\n/**\n * @deprecated Renamed to {@link notifyForbiddenAccess}. The previous name\n * implied a `/login` redirect that no longer happens (see GH #2070). Kept as an\n * exported alias for one minor version so third-party module imports keep\n * building; update imports to `notifyForbiddenAccess`.\n */\nexport const redirectToForbiddenLogin = notifyForbiddenAccess\n\nexport async function apiFetch(input: RequestInfo | URL, init?: RequestInit): Promise<Response> {\n  type FetchType = (input: RequestInfo | URL, init?: RequestInit) => Promise<Response>\n  const originalFetch =\n    typeof window !== 'undefined'\n      ? (window as Window & { __omOriginalFetch?: FetchType }).__omOriginalFetch\n      : undefined\n  const fallbackFetch = (globalThis as typeof globalThis & { fetch?: FetchType }).fetch\n  const baseFetch = originalFetch ?? fallbackFetch\n  if (!baseFetch) {\n    return new Response(\n      JSON.stringify({ error: 'Fetch API is not available in this runtime' }),\n      { status: 503, headers: { 'content-type': 'application/json' } },\n    )\n  }\n  const scoped = scopedHeaders.resolveScopedHeaders()\n  const baseInit: RequestInit = Object.keys(scoped).length\n    ? { ...(init ?? {}), headers: mergeHeaders(init?.headers, scoped) }\n    : init ?? {}\n  // Only auto-inject credentials: 'include' for same-origin requests so cookies\n  // round-trip across Next.js proxy.ts rewrites (custom-domain portal flows)\n  // without leaking session cookies to third-party hosts.\n  const mergedInit: RequestInit = baseInit.credentials\n    ? baseInit\n    : isSameOriginRequest(input)\n      ? { ...baseInit, credentials: 'include' }\n      : baseInit\n  const requestHeaders = new Headers(mergedInit?.headers)\n  const disableUnauthorizedRedirect = readRedirectOverride(requestHeaders, 'x-om-unauthorized-redirect')\n  const disableForbiddenRedirect = readRedirectOverride(requestHeaders, 'x-om-forbidden-redirect')\n  // Snapshot the pathname BEFORE the request is sent. A 401 for a request that\n  // started on the login page must stay silent even when the response lands after\n  // the post-login client-side navigation to /backend \u2014 otherwise the stale\n  // pre-auth 401 raises a bogus \"Session expired\" banner right after signing in.\n  const requestPathname = readPathname()\n  const res = await baseFetch(input, mergedInit)\n  const responsePathname = readPathname()\n  const onLoginPage = isLoginPathname(requestPathname) || isLoginPathname(responsePathname)\n  const onPortalRoute = isPortalPathname(requestPathname) || isPortalPathname(responsePathname)\n  if (res.status === 401) {\n    // Trigger same redirect flow as protected pages\n    // Skip for staff login page and all portal routes (portal has its own auth)\n    if (!onLoginPage && !onPortalRoute && !disableUnauthorizedRedirect) {\n      redirectToSessionRefresh()\n      // Throw a typed error for callers that might still handle it\n      throw new UnauthorizedError(await res.text().catch(() => 'Unauthorized'))\n    }\n    return res\n  }\n  if (res.status === 403) {\n    // Try to read requiredRoles from JSON body; ignore if not JSON\n    let roles: string[] | null = null\n    let features: string[] | null = null\n    let payload: unknown = null\n    const aclData = await readJsonSafe<Record<string, unknown>>(res.clone(), null)\n    if (aclData && typeof aclData === 'object') {\n      if (Array.isArray(aclData.requiredRoles)) {\n        roles = aclData.requiredRoles.map((r) => String(r))\n      }\n      if (Array.isArray(aclData.requiredFeatures)) {\n        features = aclData.requiredFeatures.map((f) => String(f))\n      }\n      payload = aclData\n    }\n    // Only redirect if not already on login page or a portal route\n    if (!onLoginPage && !onPortalRoute && !disableForbiddenRedirect) {\n      const target =\n        typeof input === 'string'\n          ? input\n          : input instanceof URL\n            ? input.toString()\n            : (typeof Request !== 'undefined' && input instanceof Request)\n              ? input.url\n              : 'unknown'\n      try {\n        logger.warn('Forbidden response', {\n          url: target,\n          status: res.status,\n          requiredRoles: roles,\n          requiredFeatures: features,\n          details: payload,\n        })\n      } catch {}\n      const hasAclHints = Boolean((roles && roles.length) || (features && features.length))\n      if (hasAclHints) {\n        notifyForbiddenAccess({ requiredRoles: roles, requiredFeatures: features })\n      }\n      let msg = 'Forbidden'\n      if (aclData && typeof aclData === 'object') {\n        if (typeof aclData.error === 'string') {\n          msg = aclData.error\n        } else if (typeof aclData.message === 'string') {\n          msg = aclData.message\n        }\n      } else {\n        msg = await res.clone().text().catch(() => 'Forbidden')\n      }\n      // Attach ACL hints so callers (e.g. flashMutationError) can name the\n      // missing permission instead of surfacing a bare \"Forbidden\" toast.\n      throw new ForbiddenError(msg, { requiredFeatures: features, requiredRoles: roles })\n    }\n    // If already on login, just return the response for the caller to handle\n  }\n  try {\n    const header = res.headers.get('x-om-operation')\n    const metadata = deserializeOperationMetadata(header)\n    if (metadata) pushOperation(metadata)\n  } catch {\n    // ignore malformed headers\n  }\n  try {\n    const warningRaw = res.headers.get('x-om-partial-index')\n    if (warningRaw) {\n      const parsed = JSON.parse(warningRaw) as Record<string, unknown>\n      if (parsed && typeof parsed === 'object' && parsed.type === 'partial_index') {\n        const entity = typeof parsed.entity === 'string' ? parsed.entity : String(parsed.entity ?? '')\n        if (entity) {\n          const baseCount = typeof parsed.baseCount === 'number' ? parsed.baseCount : null\n          const indexedCount = typeof parsed.indexedCount === 'number' ? parsed.indexedCount : null\n          const scope = parsed.scope === 'global' ? 'global' : 'scoped'\n          const entityLabel =\n            typeof parsed.entityLabel === 'string' && parsed.entityLabel.trim()\n              ? parsed.entityLabel.trim()\n              : entity\n          pushPartialIndexWarning({ entity, entityLabel, baseCount, indexedCount, scope })\n        }\n      }\n    }\n  } catch {\n    // ignore malformed headers\n  }\n  return res\n}\n"],
+  "mappings": ";AAGA,SAAS,aAAa;AACtB,SAAS,oCAAoC;AAC7C,SAAS,oBAAoB;AAC7B,SAAS,qBAAqB;AAC9B,SAAS,+BAA+B;AACxC,SAAS,+BAA+B;AACxC,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,IAAI,EAAE,MAAM,EAAE,WAAW,WAAW,CAAC;AAEjE,MAAM,gBAAgB,wBAAwB;AAE9C,SAAS,aAAa,MAA+B,QAAyC;AAC5F,QAAM,UAAU,IAAI,QAAQ,QAAQ,CAAC,CAAC;AACtC,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,MAAM,GAAG;AACjD,QAAI,QAAQ,IAAI,GAAG,EAAG;AACtB,YAAQ,IAAI,KAAK,KAAK;AAAA,EACxB;AACA,SAAO;AACT;AAEA,SAAS,qBAAqB,SAAkB,YAA6B;AAC3E,SAAO,QAAQ,IAAI,UAAU,MAAM;AACrC;AAEA,SAAS,oBAAoB,OAAmC;AAC9D,MAAI,OAAO,WAAW,YAAa,QAAO;AAC1C,QAAM,OAAO,OAAO,UAAU;AAC9B,MAAI,CAAC,KAAM,QAAO;AAClB,MAAI;AACJ,MAAI,OAAO,UAAU,SAAU,aAAY;AAAA,WAClC,iBAAiB,IAAK,aAAY,MAAM,SAAS;AAAA,WACjD,OAAO,YAAY,eAAe,iBAAiB,QAAS,aAAY,MAAM;AAAA,MAClF,QAAO;AACZ,MAAI,CAAC,uBAAuB,KAAK,SAAS,EAAG,QAAO;AACpD,MAAI;AACF,WAAO,IAAI,IAAI,SAAS,EAAE,SAAS;AAAA,EACrC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAsB,qBAAwB,SAAiC,KAAmC;AAChH,SAAO,cAAc,kBAAkB,SAAS,GAAG;AACrD;AAEA,SAAS,eAAuB;AAC9B,SAAO,OAAO,WAAW,cAAc,OAAO,UAAU,YAAY,KAAK;AAC3E;AAEA,SAAS,gBAAgB,UAA2B;AAClD,SAAO,SAAS,WAAW,QAAQ;AACrC;AAEA,SAAS,iBAAiB,UAA2B;AACnD,SAAO,wBAAwB,KAAK,QAAQ;AAC9C;AAEO,MAAM,0BAA0B,MAAM;AAAA,EAE3C,YAAY,UAAU,gBAAgB;AACpC,UAAM,OAAO;AAFf,SAAS,SAAS;AAGhB,SAAK,OAAO;AAAA,EACd;AACF;AAEA,MAAM,qCAAqC;AAC3C,MAAM,8BAA8B;AAMpC,SAAS,gCAAgC,QAAyB;AAChE,MAAI;AACF,UAAM,MAAM,OAAO,eAAe,QAAQ,qCAAqC,MAAM;AACrF,QAAI,CAAC,IAAK,QAAO;AACjB,UAAM,cAAc,OAAO,GAAG;AAC9B,WAAO,OAAO,SAAS,WAAW,KAAK,KAAK,IAAI,IAAI,cAAc;AAAA,EACpE,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,4BAA4B,QAAsB;AACzD,MAAI;AACF,WAAO,eAAe,QAAQ,qCAAqC,QAAQ,OAAO,KAAK,IAAI,CAAC,CAAC;AAAA,EAC/F,QAAQ;AAAA,EAER;AACF;AAEO,SAAS,2BAA2B;AACzC,MAAI,OAAO,WAAW,YAAa;AACnC,QAAM,UAAU,OAAO,SAAS,WAAW,OAAO,SAAS;AAE3D,MAAI,OAAO,SAAS,SAAS,WAAW,WAAW,EAAG;AAEtD,MAAI,wBAAwB,KAAK,OAAO,SAAS,QAAQ,EAAG;AAC5D,MAAI,gCAAgC,OAAO,EAAG;AAC9C,8BAA4B,OAAO;AACnC,MAAI;AACF,UAAM,iDAA4C,SAAS;AAC3D,eAAW,MAAM;AACf,aAAO,SAAS,OAAO,sCAAsC,mBAAmB,OAAO,CAAC;AAAA,IAC1F,GAAG,EAAE;AAAA,EACP,QAAQ;AAAA,EAER;AACF;AAEO,MAAM,uBAAuB,MAAM;AAAA,EAKxC,YACE,UAAU,aACV,SACA;AACA,UAAM,OAAO;AARf,SAAS,SAAS;AAShB,SAAK,OAAO;AACZ,SAAK,mBAAmB,SAAS,kBAAkB,SAAS,CAAC,GAAG,QAAQ,gBAAgB,IAAI;AAC5F,SAAK,gBAAgB,SAAS,eAAe,SAAS,CAAC,GAAG,QAAQ,aAAa,IAAI;AAAA,EACrF;AACF;AAEA,IAAI,0BAAoC,CAAC,OAAO;AAEzC,SAAS,sBAAsB,KAAoD;AACxF,MAAI,KAAK,yBAAyB,IAAI,sBAAsB,QAAQ;AAClE,8BAA0B,CAAC,GAAG,IAAI,qBAAqB,EAAE,IAAI,MAAM;AAAA,EACrE;AACF;AAEA,SAAS,6BAA6B,SAA2F;AAC/H,QAAM,WAAW,SAAS,kBAAkB,OAAO,OAAO,KAAK,CAAC;AAChE,QAAM,QAAQ,SAAS,eAAe,OAAO,OAAO,KAAK,CAAC;AAC1D,QAAM,iBAAiB,MAAM,SAAS,QAAQ,wBAAwB,OAAO,OAAO;AACpF,MAAI,SAAS,QAAQ;AACnB,WAAO,2DAA2D,SAAS,KAAK,IAAI,CAAC;AAAA,EACvF;AACA,MAAI,eAAe,QAAQ;AACzB,WAAO,+CAA+C,eAAe,KAAK,IAAI,CAAC;AAAA,EACjF;AACA,SAAO;AACT;AAWO,SAAS,sBAAsB,SAAmF;AACvH,MAAI,OAAO,WAAW,YAAa;AAEnC,MAAI,wBAAwB,KAAK,OAAO,SAAS,QAAQ,EAAG;AAC5D,MAAI;AACF,UAAM,6BAA6B,OAAO,GAAG,SAAS;AAAA,EACxD,QAAQ;AAAA,EAER;AACF;AAQO,MAAM,2BAA2B;AAExC,eAAsB,SAAS,OAA0B,MAAuC;AAE9F,QAAM,gBACJ,OAAO,WAAW,cACb,OAAsD,oBACvD;AACN,QAAM,gBAAiB,WAAyD;AAChF,QAAM,YAAY,iBAAiB;AACnC,MAAI,CAAC,WAAW;AACd,WAAO,IAAI;AAAA,MACT,KAAK,UAAU,EAAE,OAAO,6CAA6C,CAAC;AAAA,MACtE,EAAE,QAAQ,KAAK,SAAS,EAAE,gBAAgB,mBAAmB,EAAE;AAAA,IACjE;AAAA,EACF;AACA,QAAM,SAAS,cAAc,qBAAqB;AAClD,QAAM,WAAwB,OAAO,KAAK,MAAM,EAAE,SAC9C,EAAE,GAAI,QAAQ,CAAC,GAAI,SAAS,aAAa,MAAM,SAAS,MAAM,EAAE,IAChE,QAAQ,CAAC;AAIb,QAAM,aAA0B,SAAS,cACrC,WACA,oBAAoB,KAAK,IACvB,EAAE,GAAG,UAAU,aAAa,UAAU,IACtC;AACN,QAAM,iBAAiB,IAAI,QAAQ,YAAY,OAAO;AACtD,QAAM,8BAA8B,qBAAqB,gBAAgB,4BAA4B;AACrG,QAAM,2BAA2B,qBAAqB,gBAAgB,yBAAyB;AAK/F,QAAM,kBAAkB,aAAa;AACrC,QAAM,MAAM,MAAM,UAAU,OAAO,UAAU;AAC7C,QAAM,mBAAmB,aAAa;AACtC,QAAM,cAAc,gBAAgB,eAAe,KAAK,gBAAgB,gBAAgB;AACxF,QAAM,gBAAgB,iBAAiB,eAAe,KAAK,iBAAiB,gBAAgB;AAC5F,MAAI,IAAI,WAAW,KAAK;AAGtB,QAAI,CAAC,eAAe,CAAC,iBAAiB,CAAC,6BAA6B;AAClE,+BAAyB;AAEzB,YAAM,IAAI,kBAAkB,MAAM,IAAI,KAAK,EAAE,MAAM,MAAM,cAAc,CAAC;AAAA,IAC1E;AACA,WAAO;AAAA,EACT;AACA,MAAI,IAAI,WAAW,KAAK;AAEtB,QAAI,QAAyB;AAC7B,QAAI,WAA4B;AAChC,QAAI,UAAmB;AACvB,UAAM,UAAU,MAAM,aAAsC,IAAI,MAAM,GAAG,IAAI;AAC7E,QAAI,WAAW,OAAO,YAAY,UAAU;AAC1C,UAAI,MAAM,QAAQ,QAAQ,aAAa,GAAG;AACxC,gBAAQ,QAAQ,cAAc,IAAI,CAAC,MAAM,OAAO,CAAC,CAAC;AAAA,MACpD;AACA,UAAI,MAAM,QAAQ,QAAQ,gBAAgB,GAAG;AAC3C,mBAAW,QAAQ,iBAAiB,IAAI,CAAC,MAAM,OAAO,CAAC,CAAC;AAAA,MAC1D;AACA,gBAAU;AAAA,IACZ;AAEA,QAAI,CAAC,eAAe,CAAC,iBAAiB,CAAC,0BAA0B;AAC/D,YAAM,SACJ,OAAO,UAAU,WACb,QACA,iBAAiB,MACf,MAAM,SAAS,IACd,OAAO,YAAY,eAAe,iBAAiB,UAClD,MAAM,MACN;AACV,UAAI;AACF,eAAO,KAAK,sBAAsB;AAAA,UAChC,KAAK;AAAA,UACL,QAAQ,IAAI;AAAA,UACZ,eAAe;AAAA,UACf,kBAAkB;AAAA,UAClB,SAAS;AAAA,QACX,CAAC;AAAA,MACH,QAAQ;AAAA,MAAC;AACT,YAAM,cAAc,QAAS,SAAS,MAAM,UAAY,YAAY,SAAS,MAAO;AACpF,UAAI,aAAa;AACf,8BAAsB,EAAE,eAAe,OAAO,kBAAkB,SAAS,CAAC;AAAA,MAC5E;AACA,UAAI,MAAM;AACV,UAAI,WAAW,OAAO,YAAY,UAAU;AAC1C,YAAI,OAAO,QAAQ,UAAU,UAAU;AACrC,gBAAM,QAAQ;AAAA,QAChB,WAAW,OAAO,QAAQ,YAAY,UAAU;AAC9C,gBAAM,QAAQ;AAAA,QAChB;AAAA,MACF,OAAO;AACL,cAAM,MAAM,IAAI,MAAM,EAAE,KAAK,EAAE,MAAM,MAAM,WAAW;AAAA,MACxD;AAGA,YAAM,IAAI,eAAe,KAAK,EAAE,kBAAkB,UAAU,eAAe,MAAM,CAAC;AAAA,IACpF;AAAA,EAEF;AACA,MAAI;AACF,UAAM,SAAS,IAAI,QAAQ,IAAI,gBAAgB;AAC/C,UAAM,WAAW,6BAA6B,MAAM;AACpD,QAAI,SAAU,eAAc,QAAQ;AAAA,EACtC,QAAQ;AAAA,EAER;AACA,MAAI;AACF,UAAM,aAAa,IAAI,QAAQ,IAAI,oBAAoB;AACvD,QAAI,YAAY;AACd,YAAM,SAAS,KAAK,MAAM,UAAU;AACpC,UAAI,UAAU,OAAO,WAAW,YAAY,OAAO,SAAS,iBAAiB;AAC3E,cAAM,SAAS,OAAO,OAAO,WAAW,WAAW,OAAO,SAAS,OAAO,OAAO,UAAU,EAAE;AAC7F,YAAI,QAAQ;AACV,gBAAM,YAAY,OAAO,OAAO,cAAc,WAAW,OAAO,YAAY;AAC5E,gBAAM,eAAe,OAAO,OAAO,iBAAiB,WAAW,OAAO,eAAe;AACrF,gBAAM,QAAQ,OAAO,UAAU,WAAW,WAAW;AACrD,gBAAM,cACJ,OAAO,OAAO,gBAAgB,YAAY,OAAO,YAAY,KAAK,IAC9D,OAAO,YAAY,KAAK,IACxB;AACN,kCAAwB,EAAE,QAAQ,aAAa,WAAW,cAAc,MAAM,CAAC;AAAA,QACjF;AAAA,MACF;AAAA,IACF;AAAA,EACF,QAAQ;AAAA,EAER;AACA,SAAO;AACT;",
   "names": []
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-mercato/ui",
-  "version": "0.6.8-develop.6917.1.af45bc96e2",
+  "version": "0.6.8-develop.6918.1.7b3f32b0c8",
   "license": "MIT",
   "type": "module",
   "main": "./dist/index.js",
@@ -155,14 +155,14 @@
     "remark-gfm": "^4.0.1"
   },
   "peerDependencies": {
-    "@open-mercato/shared": "0.6.8-develop.6917.1.af45bc96e2",
+    "@open-mercato/shared": "0.6.8-develop.6918.1.7b3f32b0c8",
     "react": ">=18.0.0",
     "react-dom": ">=18.0.0",
     "react-is": ">=18.0.0"
   },
   "devDependencies": {
     "@figma/code-connect": "^1.3.4",
-    "@open-mercato/shared": "0.6.8-develop.6917.1.af45bc96e2",
+    "@open-mercato/shared": "0.6.8-develop.6918.1.7b3f32b0c8",
     "@testing-library/dom": "^10.4.1",
     "@testing-library/jest-dom": "^7.0.0",
     "@testing-library/react": "^16.3.1",

package/src/backend/utils/__tests__/api.test.ts

@@ -45,6 +45,7 @@ describe('apiFetch', () => {
     jest.spyOn(console, 'warn').mockImplementation(() => undefined)
     jest.useFakeTimers()
     window.history.pushState({}, '', '/backend/sales/documents')
+    window.sessionStorage.clear()
     ;(window as unknown as Record<string, unknown>).__omOriginalFetch = undefined
   })
 
@@ -187,4 +188,18 @@ describe('apiFetch', () => {
       'warning',
     )
   })
+
+  it('guards the session-refresh redirect from looping when a non-session 401 repeats on the same page (GH #5186)', async () => {
+    ;(window as unknown as Record<string, unknown>).__omOriginalFetch = jest.fn(async () =>
+      createMockResponse(401, { error: 'Unauthorized' }),
+    )
+
+    await expect(apiFetch('/api/private')).rejects.toBeInstanceOf(UnauthorizedError)
+    expect(flash).toHaveBeenCalledTimes(1)
+
+    // The refresh bounce lands back on the same page and the same endpoint
+    // answers 401 again — the second attempt must not re-trigger the redirect.
+    await expect(apiFetch('/api/private')).rejects.toBeInstanceOf(UnauthorizedError)
+    expect(flash).toHaveBeenCalledTimes(1)
+  })
 })

package/src/backend/utils/api.ts

@@ -67,6 +67,32 @@ export class UnauthorizedError extends Error {
   }
 }
 
+const SESSION_REFRESH_ATTEMPT_KEY_PREFIX = 'om:session-refresh-attempt:'
+const SESSION_REFRESH_COOLDOWN_MS = 10_000
+
+// A genuinely expired session redirects once per target, then goes quiet: the
+// refresh always succeeds (the session cookie is fine), bounces back to the
+// same URL, and re-triggers the same 401 for any non-session cause — without
+// this guard that bounce repeats forever (GH #5186).
+function recentlyAttemptedSessionRefresh(target: string): boolean {
+  try {
+    const raw = window.sessionStorage.getItem(SESSION_REFRESH_ATTEMPT_KEY_PREFIX + target)
+    if (!raw) return false
+    const attemptedAt = Number(raw)
+    return Number.isFinite(attemptedAt) && Date.now() - attemptedAt < SESSION_REFRESH_COOLDOWN_MS
+  } catch {
+    return false
+  }
+}
+
+function recordSessionRefreshAttempt(target: string): void {
+  try {
+    window.sessionStorage.setItem(SESSION_REFRESH_ATTEMPT_KEY_PREFIX + target, String(Date.now()))
+  } catch {
+    // no-op
+  }
+}
+
 export function redirectToSessionRefresh() {
   if (typeof window === 'undefined') return
   const current = window.location.pathname + window.location.search
@@ -74,6 +100,8 @@ export function redirectToSessionRefresh() {
   if (window.location.pathname.startsWith('/api/auth')) return
   // Portal routes have their own customer auth — never redirect to staff login
   if (/\/[^/]+\/portal(\/|$)/.test(window.location.pathname)) return
+  if (recentlyAttemptedSessionRefresh(current)) return
+  recordSessionRefreshAttempt(current)
   try {
     flash('Session expired. Redirecting to sign in…', 'warning')
     setTimeout(() => {