pediatric-ai-scribe-v3/public/js/authFetch.js

// Account-bound requests cannot outlive the document's verified owner.
if (!window.__fetchAuthIntercepted) {
  window.__fetchAuthIntercepted = true;
  var rawFetch = window.fetch.bind(window);
  var boundary = window.AccountBoundary;
  var authPaths = new Set([
    '/api/auth/login', '/api/auth/register', '/api/auth/logout',
    '/api/auth/forgot-password', '/api/auth/reset-password',
    '/api/auth/verify-email', '/api/auth/resend-verification',
    '/api/auth/oidc', '/api/auth/oidc-status', '/api/auth/registration-status'
  ]);
  // The signed-out preview. Same four paths the server allow-lists; nothing
  // else may leave the browser without an account. Until these were here the
  // status call was rejected before it was ever sent, so the server-side
  // preview could never be reached from the page.
  var previewPaths = new Set([
    '/api/clinical-assistant/status', '/api/clinical-assistant/examples',
    '/api/clinical-assistant/chat', '/api/clinical-assistant/chat/stream'
  ]);
  function inPreview() { return document.body && document.body.classList.contains('assistant-preview'); }

  // Narrow transition requests bypass the frozen clinical transport. Logout
  // headers are captured before freezing; its verification is cookie-only.
  boundary.logoutRequest = function(headers) {
    return rawFetch('/api/auth/logout', {
      method: 'POST', headers: headers, credentials: 'same-origin', keepalive: true
    });
  };
  boundary.cookieSessionRequest = function() {
    return rawFetch('/api/auth/me', { credentials: 'same-origin', cache: 'no-store' });
  };

  if (navigator.sendBeacon) {
    var sendBeacon = navigator.sendBeacon.bind(navigator);
    navigator.sendBeacon = function(input, data) {
      var url = new URL(input, window.location.href);
      if (url.origin === window.location.origin && url.pathname.startsWith('/api/') && !boundary.active()) return false;
      return sendBeacon(input, data);
    };
  }

  window.fetch = function(input, init) {
    var url;
    try { url = new URL(typeof input === 'string' || input instanceof URL ? input : input.url, window.location.href); }
    catch (e) { return rawFetch(input, init); }
    if (url.origin !== window.location.origin || !url.pathname.startsWith('/api/')) return rawFetch(input, init);
    if (boundary.blocked()) return Promise.reject(boundary.error());
    var ticket = boundary.capture(); // Also detects shared-cookie changes before storage events arrive.
    if (boundary.blocked()) return Promise.reject(boundary.error());
    // No clinical module may preload a previous cookie's data on the login screen.
    if (!ticket && !authPaths.has(url.pathname) && url.pathname !== '/api/auth/me' && url.pathname !== '/api/models') {
      if (previewPaths.has(url.pathname)) return rawFetch(input, Object.assign({}, init, { credentials: 'same-origin' }));
      // A preview visitor reaching for anything else is exactly the moment to
      // ask them to sign in — one hook here, not a check on every button. Only
      // for something the visitor did, though: the page also fetches saved
      // chats and config in the background on load, and raising the sign-in
      // screen for those buried the assistant under it before a word was typed.
      var gesture = navigator.userActivation ? navigator.userActivation.isActive : false;
      if (inPreview() && gesture) document.dispatchEvent(new CustomEvent('preview-needs-account', { detail: { path: url.pathname } }));
      return Promise.reject(boundary.error());
    }
    var login = (url.pathname === '/api/auth/login' || url.pathname === '/api/auth/register')
      && String((init && init.method) || (input && input.method) || 'GET').toUpperCase() === 'POST';
    try { if (login) boundary.startLogin(); } catch (e) { return Promise.reject(e); }
    var revision = boundary.revision();
    var shared = boundary.read();
    var generation = shared && shared.generation;
    var abort = new AbortController();
    var callerSignal = (init && init.signal) || (input && input.signal);
    var accountSignal = boundary.signal();
    function cancel() { abort.abort(); }
    if (callerSignal) {
      if (callerSignal.aborted) cancel();
      else callerSignal.addEventListener('abort', cancel, { once: true });
    }
    if (!login) accountSignal.addEventListener('abort', cancel, { once: true });
    function check() {
      var now = boundary.read();
      if (revision !== boundary.revision() || generation !== (now && now.generation)
          || (!login && (boundary.blocked() || (ticket && !boundary.valid(ticket))))) throw boundary.error();
    }
    function guardResponse(resp) {
      check();
      if (resp.status === 401 && ticket && !authPaths.has(url.pathname)) {
        boundary.end();
        boundary.reload();
        throw boundary.error();
      }
      // Body parsing can finish after fetch itself; gate those continuations too.
      ['json', 'text', 'blob', 'arrayBuffer', 'formData'].forEach(function(method) {
        if (!resp[method]) return;
        var original = resp[method].bind(resp);
        resp[method] = function() { check(); return original().then(function(value) { check(); return value; }); };
      });
      if (resp.clone) {
        var clone = resp.clone.bind(resp);
        resp.clone = function() { check(); return guardResponse(clone()); };
      }
      return resp;
    }
    return rawFetch(input, Object.assign({}, init, { signal: abort.signal }))
      .then(guardResponse).finally(function() {
        if (callerSignal) callerSignal.removeEventListener('abort', cancel);
        // Keep the account abort listener until document disposal: it also
        // cancels a response body that has not finished streaming yet.
      });
  };
}