@openmrs/esm-api 10.0.1-pre.5598 → 10.0.1-pre.5605

package/.turbo/turbo-build.log

@@ -1,3 +1,3 @@
-[0] Successfully compiled: 14 files with swc (89.34ms)
+[0] Successfully compiled: 14 files with swc (61.75ms)
 [0] swc --strip-leading-paths src -d dist exited with code 0
 [1] tsc --project tsconfig.build.json exited with code 0

package/dist/openmrs-fetch.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"openmrs-fetch.d.ts","sourceRoot":"","sources":["../src/openmrs-fetch.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAG7C,mEAAmE;AACnE,eAAO,MAAM,WAAW,gBAAgB,CAAC;AACzC,uEAAuE;AACvE,eAAO,MAAM,WAAW,iBAAiB,CAAC;AAC1C,sDAAsD;AACtD,eAAO,MAAM,eAAe,wBAA2B,CAAC;AAExD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,OAAO,CAAC,IAAI,EAAE,MAAM,UASnC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AACH,wBAAgB,YAAY,CAAC,CAAC,GAAG,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,GAAE,WAAgB,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAuK1G;AAED,qBAAa,iBAAkB,SAAQ,KAAM,YAAW,UAAU;gBACpD,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,YAAY,EAAE,YAAY,GAAG,IAAI,EAAE,iBAAiB,EAAE,KAAK;IAQxG,QAAQ,EAAE,QAAQ,CAAC;IACnB,YAAY,EAAE,MAAM,GAAG,iBAAiB,GAAG,IAAI,CAAC;CACjD;AAED,MAAM,WAAW,WAAY,SAAQ,IAAI,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IACxE,OAAO,CAAC,EAAE,YAAY,CAAC;IACvB,IAAI,CAAC,EAAE,SAAS,GAAG,MAAM,CAAC;CAC3B;AAED,KAAK,YAAY,GAAG,MAAM,GAAG,iBAAiB,CAAC;AAE/C,MAAM,WAAW,YAAY;IAC3B,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;CAC9B;AAED,UAAU,SAAS;IACjB,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAC;CACpB;AAED,MAAM,WAAW,iBAAiB;IAChC,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAC;CACpB;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE,QAAQ,CAAC;IACnB,YAAY,EAAE,YAAY,GAAG,IAAI,CAAC;CACnC"}
+{"version":3,"file":"openmrs-fetch.d.ts","sourceRoot":"","sources":["../src/openmrs-fetch.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAG7C,mEAAmE;AACnE,eAAO,MAAM,WAAW,gBAAgB,CAAC;AACzC,uEAAuE;AACvE,eAAO,MAAM,WAAW,iBAAiB,CAAC;AAC1C,sDAAsD;AACtD,eAAO,MAAM,eAAe,wBAA2B,CAAC;AAExD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,OAAO,CAAC,IAAI,EAAE,MAAM,UASnC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AACH,wBAAgB,YAAY,CAAC,CAAC,GAAG,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,GAAE,WAAgB,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAkM1G;AAED,qBAAa,iBAAkB,SAAQ,KAAM,YAAW,UAAU;gBACpD,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,YAAY,EAAE,YAAY,GAAG,IAAI,EAAE,iBAAiB,EAAE,KAAK;IAQxG,QAAQ,EAAE,QAAQ,CAAC;IACnB,YAAY,EAAE,MAAM,GAAG,iBAAiB,GAAG,IAAI,CAAC;CACjD;AAED,MAAM,WAAW,WAAY,SAAQ,IAAI,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IACxE,OAAO,CAAC,EAAE,YAAY,CAAC;IACvB,IAAI,CAAC,EAAE,SAAS,GAAG,MAAM,CAAC;CAC3B;AAED,KAAK,YAAY,GAAG,MAAM,GAAG,iBAAiB,CAAC;AAE/C,MAAM,WAAW,YAAY;IAC3B,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;CAC9B;AAED,UAAU,SAAS;IACjB,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAC;CACpB;AAED,MAAM,WAAW,iBAAiB;IAChC,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAC;CACpB;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE,QAAQ,CAAC;IACnB,YAAY,EAAE,YAAY,GAAG,IAAI,CAAC;CACnC"}

package/dist/openmrs-fetch.js

@@ -123,8 +123,33 @@ import { defaultRedirectAuthFailureUrl } from "./config-schema.js";
     /* This tells the OpenMRS REST API not to return a WWW-Authenticate
    * header. Returning that header is useful when using the API, but
    * not from a UI.
-   */ if (path.startsWith(restBaseUrl) && typeof fetchInit.headers['Disable-WWW-Authenticate'] === 'undefined') {
-        fetchInit.headers['Disable-WWW-Authenticate'] = 'true';
+   */ let isRestRequest = false;
+    try {
+        const requestUrl = new URL(url, window.location.href);
+        const restUrl = new URL(makeUrl(restBaseUrl), window.location.href);
+        // Compare normalized paths without changing the outgoing URL. Pagination links
+        // may omit the extra slash introduced by an openmrsBase with a trailing slash.
+        const requestPath = requestUrl.pathname.replace(/\/{2,}/g, '/');
+        const restPath = restUrl.pathname.replace(/\/{2,}/g, '/');
+        isRestRequest = requestUrl.origin === restUrl.origin && (requestPath === restPath || requestPath.startsWith(`${restPath}/`));
+    } catch  {
+    // Let native fetch reject malformed URLs instead of throwing synchronously here.
+    }
+    if (isRestRequest) {
+        let hasAuthHeader = false;
+        for (const [name, value] of Object.entries(fetchInit.headers)){
+            if (name.toLowerCase() === 'disable-www-authenticate') {
+                if (value === undefined) {
+                    // Remove every casing so fetch cannot combine "undefined" with the default.
+                    delete fetchInit.headers[name];
+                } else {
+                    hasAuthHeader = true;
+                }
+            }
+        }
+        if (!hasAuthHeader) {
+            fetchInit.headers['Disable-WWW-Authenticate'] = 'true';
+        }
     }
     if (path.startsWith(fhirBaseUrl)) {
         const urlUrl = new URL(url, window.location.toString());

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openmrs/esm-api",
-  "version": "10.0.1-pre.5598",
+  "version": "10.0.1-pre.5605",
   "license": "MPL-2.0",
   "description": "The javascript module for interacting with the OpenMRS API",
   "type": "module",
@@ -57,16 +57,16 @@
     "lodash-es": "^4.17.21"
   },
   "peerDependencies": {
-    "@openmrs/esm-config": "^10.0.1-pre.5598",
-    "@openmrs/esm-error-handling": "^10.0.1-pre.5598",
-    "@openmrs/esm-globals": "^10.0.1-pre.5598",
-    "@openmrs/esm-navigation": "^10.0.1-pre.5598"
+    "@openmrs/esm-config": "^10.0.1-pre.5605",
+    "@openmrs/esm-error-handling": "^10.0.1-pre.5605",
+    "@openmrs/esm-globals": "^10.0.1-pre.5605",
+    "@openmrs/esm-navigation": "^10.0.1-pre.5605"
   },
   "devDependencies": {
-    "@openmrs/esm-config": "10.0.1-pre.5598",
-    "@openmrs/esm-error-handling": "10.0.1-pre.5598",
-    "@openmrs/esm-globals": "10.0.1-pre.5598",
-    "@openmrs/esm-navigation": "10.0.1-pre.5598",
+    "@openmrs/esm-config": "10.0.1-pre.5605",
+    "@openmrs/esm-error-handling": "10.0.1-pre.5605",
+    "@openmrs/esm-globals": "10.0.1-pre.5605",
+    "@openmrs/esm-navigation": "10.0.1-pre.5605",
     "@swc/cli": "0.8.1",
     "@swc/core": "1.15.21",
     "@vitest/coverage-v8": "^4.1.2",

package/src/openmrs-fetch.rest.test.ts

@@ -0,0 +1,121 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+import { getConfig } from '@openmrs/esm-config';
+import { openmrsFetch } from './openmrs-fetch';
+
+vi.mock('@openmrs/esm-navigation', () => ({ clearHistory: vi.fn(), navigate: vi.fn() }));
+
+const mockFetch = vi.fn<typeof fetch>();
+
+beforeEach(() => {
+  window.openmrsBase = '/openmrs';
+  vi.stubGlobal('location', new URL('https://frontend.example/openmrs/spa/'));
+  vi.stubGlobal('fetch', mockFetch);
+  mockFetch.mockResolvedValue(new Response('{}'));
+  vi.mocked(getConfig).mockResolvedValue({
+    redirectAuthFailure: { enabled: false, url: '', errors: [401], resolvePromise: false },
+    followRedirects: true,
+  });
+});
+
+afterEach(() => vi.unstubAllGlobals());
+
+describe('REST authentication challenge suppression', () => {
+  it('leaves malformed URLs to native fetch so callers can catch the rejected promise', async () => {
+    const error = new TypeError('Invalid URL');
+    mockFetch.mockRejectedValueOnce(error);
+
+    const request = openmrsFetch('http://[');
+
+    expect(request).toBeInstanceOf(Promise);
+    await expect(request.catch((reason) => reason)).resolves.toBe(error);
+    expect(mockFetch).toHaveBeenCalledWith('http://[', expect.any(Object));
+  });
+
+  it.each([
+    ['/openmrs', '/ws/rest/v1/patient', '/openmrs/ws/rest/v1/patient'],
+    ['/openmrs', 'ws/rest/v1/patient', '/openmrs/ws/rest/v1/patient'],
+    [
+      '/openmrs',
+      'https://frontend.example/openmrs/ws/rest/v1/patient?startIndex=10',
+      'https://frontend.example/openmrs/ws/rest/v1/patient?startIndex=10',
+    ],
+    ['/openmrs', '/ws/rest/v1', '/openmrs/ws/rest/v1'],
+    ['/openmrs/', '/ws/rest/v1/patient', '/openmrs//ws/rest/v1/patient'],
+    [
+      '/openmrs/',
+      'https://frontend.example/openmrs/ws/rest/v1/patient',
+      'https://frontend.example/openmrs/ws/rest/v1/patient',
+    ],
+    ['https://api.example/openmrs', '/ws/rest/v1/patient', 'https://api.example/openmrs/ws/rest/v1/patient'],
+    [
+      'https://api.example/openmrs/',
+      'https://api.example/openmrs/ws/rest/v1/patient',
+      'https://api.example/openmrs/ws/rest/v1/patient',
+    ],
+  ])('adds the header for base %s and path %s without rewriting the request URL', async (base, path, expectedUrl) => {
+    window.openmrsBase = base;
+
+    await openmrsFetch(path);
+
+    expect(mockFetch).toHaveBeenCalledWith(expectedUrl, {
+      headers: { Accept: 'application/json', 'Disable-WWW-Authenticate': 'true' },
+    });
+  });
+
+  it.each([
+    ['/openmrs', 'https://other.example/openmrs/ws/rest/v1/patient'],
+    ['https://api.example/openmrs', 'https://frontend.example/openmrs/ws/rest/v1/patient'],
+    ['/openmrs', 'http://frontend.example/openmrs/ws/rest/v1/patient'],
+    ['/openmrs', 'https://frontend.example:8443/openmrs/ws/rest/v1/patient'],
+    ['/openmrs', 'https://frontend.example/another/ws/rest/v1/patient'],
+    ['/openmrs', '/ws/rest/v10/patient'],
+    ['/openmrs', '/ws/rest/v1relationship'],
+    ['/openmrs', '/ws/fhir2/R4/Patient'],
+  ])('does not add the header outside the configured REST API: %s, %s', async (base, path) => {
+    window.openmrsBase = base;
+
+    await openmrsFetch(path);
+
+    expect(new Headers(mockFetch.mock.calls[0][1]?.headers).has('Disable-WWW-Authenticate')).toBe(false);
+  });
+
+  it.each(['Disable-WWW-Authenticate', 'disable-www-authenticate', 'DISABLE-WWW-AUTHENTICATE'])(
+    'preserves an explicit %s override, including null',
+    async (name) => {
+      for (const value of ['true', 'false', null]) {
+        // null retains legacy pass-through behavior, unlike Accept: null which removes the header.
+        const headers = { [name]: value };
+        await openmrsFetch('/ws/rest/v1/patient', { headers });
+        expect(mockFetch.mock.lastCall?.[1]?.headers).toEqual({ [name]: value, Accept: 'application/json' });
+      }
+    },
+  );
+
+  it.each([
+    { 'Disable-WWW-Authenticate': undefined },
+    { 'disable-www-authenticate': undefined },
+    { 'DISABLE-WWW-AUTHENTICATE': undefined },
+    { 'Disable-WWW-Authenticate': undefined, 'disable-www-authenticate': undefined },
+  ])('defaults undefined overrides without combining header values: %j', async (headers) => {
+    // @ts-expect-error JavaScript callers can supply undefined despite the FetchHeaders type.
+    await openmrsFetch('/ws/rest/v1/patient', { headers });
+
+    expect(mockFetch.mock.lastCall?.[1]?.headers).toEqual({
+      Accept: 'application/json',
+      'Disable-WWW-Authenticate': 'true',
+    });
+    expect(new Headers(mockFetch.mock.lastCall?.[1]?.headers).get('Disable-WWW-Authenticate')).toBe('true');
+  });
+
+  it('preserves a defined override when another casing has an undefined value', async () => {
+    const headers = { 'Disable-WWW-Authenticate': undefined, 'disable-www-authenticate': 'false' };
+    // @ts-expect-error JavaScript callers can supply undefined despite the FetchHeaders type.
+    await openmrsFetch('/ws/rest/v1/patient', { headers });
+
+    expect(mockFetch.mock.lastCall?.[1]?.headers).toEqual({
+      Accept: 'application/json',
+      'disable-www-authenticate': 'false',
+    });
+    expect(new Headers(mockFetch.mock.lastCall?.[1]?.headers).get('Disable-WWW-Authenticate')).toBe('false');
+  });
+});

package/src/openmrs-fetch.test.ts

@@ -10,36 +10,35 @@ vi.mock('@openmrs/esm-navigation', () => ({
 
 const mockGetConfig = vi.mocked(getConfig);
 const mockNavigate = vi.mocked(navigate);
+const mockFetch = vi.fn<typeof fetch>();
 
-describe('openmrsFetch', () => {
-  beforeEach(() => {
-    mockGetConfig.mockReturnValue(
-      Promise.resolve({
-        redirectAuthFailure: {
-          enabled: true,
-          url: '${openmrsSpaBase}/login',
-          errors: [401],
-          resolvePromise: false,
-        },
-        followRedirects: true,
-      }),
-    );
-    window.openmrsBase = '/openmrs';
-    window.getOpenmrsSpaBase = () => '/openmrs/spa/';
-    window.fetch = vi.fn();
-    Object.defineProperty(window, 'location', {
-      writable: true,
-      value: { assign: vi.fn() },
-    });
-  });
+beforeEach(() => {
+  mockGetConfig.mockReturnValue(
+    Promise.resolve({
+      redirectAuthFailure: {
+        enabled: true,
+        url: '${openmrsSpaBase}/login',
+        errors: [401],
+        resolvePromise: false,
+      },
+      followRedirects: true,
+    }),
+  );
+  window.openmrsBase = '/openmrs';
+  window.getOpenmrsSpaBase = () => '/openmrs/spa/';
+  vi.stubGlobal('fetch', mockFetch);
+  vi.stubGlobal('location', new URL('https://frontend.example/openmrs/spa/'));
+});
 
-  afterEach(() => {
-    // @ts-expect-error Not normally deletable
-    delete window.openmrsBase;
-    // @ts-expect-error Not normally deletable
-    delete window.getOpenmrsSpaBase;
-  });
+afterEach(() => {
+  vi.unstubAllGlobals();
+  // @ts-expect-error Not normally deletable
+  delete window.openmrsBase;
+  // @ts-expect-error Not normally deletable
+  delete window.getOpenmrsSpaBase;
+});
 
+describe('openmrsFetch', () => {
   it(`throws an error if you don't pass in a url string`, () => {
     // @ts-expect-error
     expect(() => openmrsFetch()).toThrow(/first argument/);
@@ -63,8 +62,7 @@ describe('openmrsFetch', () => {
   });
 
   it('calls window.fetch with the correct arguments for a basic GET request', () => {
-    // @ts-expect-error
-    window.fetch.mockReturnValue(new Promise(() => {}));
+    mockFetch.mockReturnValue(new Promise(() => {}));
     openmrsFetch('/ws/rest/v1/session');
     expect(window.fetch).toHaveBeenCalledWith('/openmrs/ws/rest/v1/session', {
       headers: {
@@ -75,8 +73,7 @@ describe('openmrsFetch', () => {
   });
 
   it('calls window.fetch correctly for requests that have a request body', () => {
-    // @ts-expect-error
-    window.fetch.mockReturnValue(new Promise(() => {}));
+    mockFetch.mockReturnValue(new Promise(() => {}));
     const requestBody = { some: 'json' };
     openmrsFetch('/ws/rest/v1/session', {
       method: 'POST',
@@ -93,8 +90,7 @@ describe('openmrsFetch', () => {
   });
 
   it('allows you to specify your own Accept request header', () => {
-    // @ts-expect-error mockReturnValue only exists on the mock, not on the raw type
-    window.fetch.mockReturnValue(new Promise(() => {}));
+    mockFetch.mockReturnValue(new Promise(() => {}));
     openmrsFetch('/ws/rest/v1/session', {
       headers: {
         Accept: 'application/xml',
@@ -109,8 +105,7 @@ describe('openmrsFetch', () => {
   });
 
   it('allows you to specify no Accept request header to be sent', () => {
-    // @ts-expect-error
-    window.fetch.mockReturnValue(new Promise(() => {}));
+    mockFetch.mockReturnValue(new Promise(() => {}));
     openmrsFetch('/ws/rest/v1/session', {
       headers: {
         // specifically null on purpose
@@ -126,20 +121,7 @@ describe('openmrsFetch', () => {
   });
 
   it('returns a promise that resolves with a json object when the request succeeds', async () => {
-    // @ts-expect-error
-    window.fetch.mockReturnValue(
-      Promise.resolve({
-        ok: true,
-        status: 200,
-        headers: {
-          has: () => false,
-          get: () => null,
-        },
-        clone: () => ({
-          text: () => Promise.resolve('{ "value": "hi" }'),
-        }),
-      }),
-    );
+    mockFetch.mockResolvedValue(new Response('{"value":"hi"}'));
 
     const response = await openmrsFetch('/ws/rest/v1/session');
     expect(response.status).toBe(200);
@@ -147,18 +129,7 @@ describe('openmrsFetch', () => {
   });
 
   it('returns a promise that resolves with null when the request succeeds with HTTP 204', async () => {
-    // @ts-expect-error
-    window.fetch.mockReturnValue(
-      Promise.resolve({
-        ok: true,
-        status: 204,
-        headers: {
-          has: () => false,
-          get: () => null,
-        },
-        json: () => Promise.reject(Error("No json for HTTP 204's!!")),
-      }),
-    );
+    mockFetch.mockResolvedValue(new Response(null, { status: 204 }));
 
     const response = await openmrsFetch('/ws/rest/v1/session');
     expect(response.status).toBe(204);
@@ -166,56 +137,30 @@ describe('openmrsFetch', () => {
   });
 
   it('gives you an amazing error when the server responds with a 500 that has json', async () => {
-    // @ts-expect-error
-    window.fetch.mockReturnValue(
-      Promise.resolve({
-        ok: false,
+    mockFetch.mockResolvedValue(
+      new Response(JSON.stringify({ error: 'The server is dead' }), {
         status: 500,
         statusText: 'Internal Server Error',
-        clone: () => ({
-          text: () =>
-            Promise.resolve(
-              JSON.stringify({
-                error: 'The server is dead',
-              }),
-            ),
-        }),
       }),
     );
 
-    try {
-      await openmrsFetch('/ws/rest/v1/session');
-      fail("Promise shouldn't resolve when server responds with 500");
-    } catch (err) {
-      expect(err.message).toMatch(/Server responded with 500 \(Internal Server Error\)/);
-      expect(err.message).toMatch(/\/ws\/rest\/v1\/session/);
-      expect(err.responseBody).toEqual({ error: 'The server is dead' });
-      expect(err.response.status).toBe(500);
-    }
+    await expect(openmrsFetch('/ws/rest/v1/session')).rejects.toMatchObject({
+      message: expect.stringContaining(
+        'Server responded with 500 (Internal Server Error) for url /openmrs/ws/rest/v1/session',
+      ),
+      responseBody: { error: 'The server is dead' },
+      response: expect.objectContaining({ status: 500 }),
+    });
   });
 
   it("gives you an amazing error when the server responds with a 400 that doesn't have json", async () => {
-    // @ts-expect-error
-    window.fetch.mockReturnValue(
-      Promise.resolve({
-        ok: false,
-        status: 400,
-        statusText: 'You goofed up',
-        clone: () => ({
-          text: () => Promise.resolve('a string response body'),
-        }),
-      }),
-    );
+    mockFetch.mockResolvedValue(new Response('a string response body', { status: 400, statusText: 'You goofed up' }));
 
-    try {
-      await openmrsFetch('/ws/rest/v1/session');
-      fail("Promise shouldn't resolve when server responds with 400");
-    } catch (err) {
-      expect(err.message).toMatch(/Server responded with 400 \(You goofed up\)/);
-      expect(err.message).toMatch(/\/ws\/rest\/v1\/session/);
-      expect(err.responseBody).toEqual('a string response body');
-      expect(err.response.status).toBe(400);
-    }
+    await expect(openmrsFetch('/ws/rest/v1/session')).rejects.toMatchObject({
+      message: expect.stringContaining('Server responded with 400 (You goofed up) for url /openmrs/ws/rest/v1/session'),
+      responseBody: 'a string response body',
+      response: expect.objectContaining({ status: 400 }),
+    });
   });
 
   it('redirects to the Location header URL when a 401 response contains a Location header (auth-module challenge)', async () => {
@@ -228,18 +173,8 @@ describe('openmrsFetch', () => {
       },
     });
 
-    // @ts-expect-error
-    window.fetch.mockReturnValue(
-      Promise.resolve({
-        ok: false,
-        status: 401,
-        statusText: 'Unauthorized',
-        headers: {
-          has: (name: string) => name.toLowerCase() === 'location',
-          get: (name: string) => (name.toLowerCase() === 'location' ? '/module/authentication/login.form' : null),
-        },
-        text: () => Promise.resolve(''),
-      }),
+    mockFetch.mockResolvedValue(
+      new Response(null, { status: 401, headers: { Location: '/module/authentication/login.form' } }),
     );
 
     await openmrsFetch('/ws/rest/v1/session');
@@ -250,26 +185,9 @@ describe('openmrsFetch', () => {
   });
 
   it('redirects to the Location header URL when session endpoint called and it contains a Location header', async () => {
-    // @ts-expect-error
-    window.fetch.mockReturnValue(
-      Promise.resolve({
-        ok: true,
-        status: 200,
-        statusText: 'OK',
-        headers: {
-          has: (name: string) => name.toLowerCase() === 'location',
-          get: (name: string) => (name.toLowerCase() === 'location' ? '/openmrs/spa/login' : null),
-        },
-        clone() {
-          return this;
-        },
-        text: () => Promise.resolve(''),
-      }),
-    );
-
-    const fetchPromise = openmrsFetch('/ws/rest/v1/session');
+    mockFetch.mockResolvedValue(new Response(null, { status: 200, headers: { Location: '/openmrs/spa/login' } }));
 
-    await new Promise((resolve) => setTimeout(resolve, 0));
+    await openmrsFetch('/ws/rest/v1/session');
 
     expect(mockNavigate).toHaveBeenCalledWith({
       to: '/openmrs/spa/login',
@@ -286,19 +204,7 @@ describe('openmrsFetch', () => {
       },
     });
 
-    // @ts-expect-error
-    window.fetch.mockReturnValue(
-      Promise.resolve({
-        ok: false,
-        status: 401,
-        statusText: 'Unauthorized',
-        headers: {
-          has: (name: string) => false,
-          get: (name: string) => null,
-        },
-        text: () => Promise.resolve(''),
-      }),
-    );
+    mockFetch.mockResolvedValue(new Response(null, { status: 401 }));
 
     await openmrsFetch('/ws/rest/v1/session');
 
@@ -317,15 +223,7 @@ describe('openmrsFetch', () => {
       },
     });
 
-    // @ts-expect-error
-    window.fetch.mockReturnValue(
-      Promise.resolve({
-        ok: false,
-        status: 401,
-        statusText: 'You are not authorized',
-        text: () => Promise.resolve('a string response body'),
-      }),
-    );
+    mockFetch.mockResolvedValue(new Response('a string response body', { status: 401 }));
 
     await openmrsFetch('/ws/rest/v1/session');
 

package/src/openmrs-fetch.ts

@@ -134,8 +134,35 @@ export function openmrsFetch<T = any>(path: string, fetchInit: FetchConfig = {})
    * header. Returning that header is useful when using the API, but
    * not from a UI.
    */
-  if (path.startsWith(restBaseUrl) && typeof fetchInit.headers['Disable-WWW-Authenticate'] === 'undefined') {
-    fetchInit.headers['Disable-WWW-Authenticate'] = 'true';
+  let isRestRequest = false;
+  try {
+    const requestUrl = new URL(url, window.location.href);
+    const restUrl = new URL(makeUrl(restBaseUrl), window.location.href);
+    // Compare normalized paths without changing the outgoing URL. Pagination links
+    // may omit the extra slash introduced by an openmrsBase with a trailing slash.
+    const requestPath = requestUrl.pathname.replace(/\/{2,}/g, '/');
+    const restPath = restUrl.pathname.replace(/\/{2,}/g, '/');
+    isRestRequest =
+      requestUrl.origin === restUrl.origin && (requestPath === restPath || requestPath.startsWith(`${restPath}/`));
+  } catch {
+    // Let native fetch reject malformed URLs instead of throwing synchronously here.
+  }
+
+  if (isRestRequest) {
+    let hasAuthHeader = false;
+    for (const [name, value] of Object.entries(fetchInit.headers)) {
+      if (name.toLowerCase() === 'disable-www-authenticate') {
+        if (value === undefined) {
+          // Remove every casing so fetch cannot combine "undefined" with the default.
+          delete fetchInit.headers[name];
+        } else {
+          hasAuthHeader = true;
+        }
+      }
+    }
+    if (!hasAuthHeader) {
+      fetchInit.headers['Disable-WWW-Authenticate'] = 'true';
+    }
   }
 
   if (path.startsWith(fhirBaseUrl)) {