Fix creds-in-URL fetch guard on all 3 gated pages (portal/admin/slideshow) — byte-exact fleet drop-in, portal.html at source in build.mjs (TK-22)

0828386fcf300e7418d2750218f01863a9532a18 · 2026-08-30 13:33:24 -0700 · Steve Abrams
Files touched

M build.mjs
M public/admin/index.html
M public/portal.html
M public/slideshow.html
Diff

commit 0828386fcf300e7418d2750218f01863a9532a18
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Sun Aug 30 13:33:24 2026 -0700

    Fix creds-in-URL fetch guard on all 3 gated pages (portal/admin/slideshow) — byte-exact fleet drop-in, portal.html at source in build.mjs (TK-22)
---
 build.mjs               | 24 ++++++++++++++++++++++++
 public/admin/index.html | 24 ++++++++++++++++++++++++
 public/portal.html      | 24 ++++++++++++++++++++++++
 public/slideshow.html   | 24 ++++++++++++++++++++++++
 4 files changed, 96 insertions(+)

diff --git a/build.mjs b/build.mjs
index fbbf1aa..0f43179 100644
--- a/build.mjs
+++ b/build.mjs
@@ -434,6 +434,30 @@ const navLinks = CATS.map(c=>`<a href="#${c[0]}">${c[1].replace(/&/g,'&amp;')}</
 const heroSlides = HERO_IMGS.map((u,i)=>`<div class="slide${i===0?' on':''}" style="background-image:url('${u}')"></div>`).join('');
 
 const app = `<!doctype html><html lang="en"><head>
+<script>
+// Credential-safe fetch guard (fleet drop-in) — if this page is opened with
+// credentials in the URL (a saved bookmark / Chrome-remembered basic-auth:
+// https://user:pass@host/…), the browser poisons document.baseURI, so any
+// relative or root-relative fetch('/api/…') throws "Request cannot be constructed
+// from a URL that includes credentials" and callers silently fall to an empty
+// state. Resolve every non-absolute request URL against the credential-free
+// location instead of baseURI. Placed first so it wraps window.fetch before any
+// app script runs. Ref: creds-in-url-fetch-guard-fleet-pattern.
+(function () {
+  var _fetch = window.fetch.bind(window);
+  var cleanBase = function () { return location.origin + location.pathname; };
+  window.fetch = function (input, init) {
+    try {
+      if (typeof input === 'string' && !/^[a-z]+:\\/\\//i.test(input) && input.indexOf('//') !== 0) {
+        input = new URL(input, cleanBase()).href;
+      } else if (input instanceof Request && !/^[a-z]+:\\/\\//i.test(input.url)) {
+        input = new Request(new URL(input.url, cleanBase()).href, input);
+      }
+    } catch (_) { /* fall through to native */ }
+    return _fetch(input, init);
+  };
+})();
+</script>
 <meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1">
 <title>RENTV.com — Growth Strategy</title>
 <link rel="preconnect" href="https://fonts.googleapis.com"><link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
diff --git a/public/admin/index.html b/public/admin/index.html
index 9c64fc8..2d6d989 100644
--- a/public/admin/index.html
+++ b/public/admin/index.html
@@ -1,6 +1,30 @@
 <!doctype html>
 <html lang="en">
 <head>
+<script>
+// Credential-safe fetch guard (fleet drop-in) — if this page is opened with
+// credentials in the URL (a saved bookmark / Chrome-remembered basic-auth:
+// https://user:pass@host/…), the browser poisons document.baseURI, so any
+// relative or root-relative fetch('/api/…') throws "Request cannot be constructed
+// from a URL that includes credentials" and callers silently fall to an empty
+// state. Resolve every non-absolute request URL against the credential-free
+// location instead of baseURI. Placed first so it wraps window.fetch before any
+// app script runs. Ref: creds-in-url-fetch-guard-fleet-pattern.
+(function () {
+  var _fetch = window.fetch.bind(window);
+  var cleanBase = function () { return location.origin + location.pathname; };
+  window.fetch = function (input, init) {
+    try {
+      if (typeof input === 'string' && !/^[a-z]+:\/\//i.test(input) && input.indexOf('//') !== 0) {
+        input = new URL(input, cleanBase()).href;
+      } else if (input instanceof Request && !/^[a-z]+:\/\//i.test(input.url)) {
+        input = new Request(new URL(input.url, cleanBase()).href, input);
+      }
+    } catch (_) { /* fall through to native */ }
+    return _fetch(input, init);
+  };
+})();
+</script>
 <meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1">
 <title>RENTV.com · Growth &amp; Social Command Center</title>
 <style>
diff --git a/public/portal.html b/public/portal.html
index f0a2d4c..a89435a 100644
--- a/public/portal.html
+++ b/public/portal.html
@@ -1,4 +1,28 @@
 <!doctype html><html lang="en"><head>
+<script>
+// Credential-safe fetch guard (fleet drop-in) — if this page is opened with
+// credentials in the URL (a saved bookmark / Chrome-remembered basic-auth:
+// https://user:pass@host/…), the browser poisons document.baseURI, so any
+// relative or root-relative fetch('/api/…') throws "Request cannot be constructed
+// from a URL that includes credentials" and callers silently fall to an empty
+// state. Resolve every non-absolute request URL against the credential-free
+// location instead of baseURI. Placed first so it wraps window.fetch before any
+// app script runs. Ref: creds-in-url-fetch-guard-fleet-pattern.
+(function () {
+  var _fetch = window.fetch.bind(window);
+  var cleanBase = function () { return location.origin + location.pathname; };
+  window.fetch = function (input, init) {
+    try {
+      if (typeof input === 'string' && !/^[a-z]+:\/\//i.test(input) && input.indexOf('//') !== 0) {
+        input = new URL(input, cleanBase()).href;
+      } else if (input instanceof Request && !/^[a-z]+:\/\//i.test(input.url)) {
+        input = new Request(new URL(input.url, cleanBase()).href, input);
+      }
+    } catch (_) { /* fall through to native */ }
+    return _fetch(input, init);
+  };
+})();
+</script>
 <meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1">
 <title>RENTV.com — Growth Strategy</title>
 <link rel="preconnect" href="https://fonts.googleapis.com"><link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
diff --git a/public/slideshow.html b/public/slideshow.html
index 0be5f04..a90513b 100644
--- a/public/slideshow.html
+++ b/public/slideshow.html
@@ -1,6 +1,30 @@
 <!doctype html>
 <html lang="en">
 <head>
+<script>
+// Credential-safe fetch guard (fleet drop-in) — if this page is opened with
+// credentials in the URL (a saved bookmark / Chrome-remembered basic-auth:
+// https://user:pass@host/…), the browser poisons document.baseURI, so any
+// relative or root-relative fetch('/api/…') throws "Request cannot be constructed
+// from a URL that includes credentials" and callers silently fall to an empty
+// state. Resolve every non-absolute request URL against the credential-free
+// location instead of baseURI. Placed first so it wraps window.fetch before any
+// app script runs. Ref: creds-in-url-fetch-guard-fleet-pattern.
+(function () {
+  var _fetch = window.fetch.bind(window);
+  var cleanBase = function () { return location.origin + location.pathname; };
+  window.fetch = function (input, init) {
+    try {
+      if (typeof input === 'string' && !/^[a-z]+:\/\//i.test(input) && input.indexOf('//') !== 0) {
+        input = new URL(input, cleanBase()).href;
+      } else if (input instanceof Request && !/^[a-z]+:\/\//i.test(input.url)) {
+        input = new Request(new URL(input.url, cleanBase()).href, input);
+      }
+    } catch (_) { /* fall through to native */ }
+    return _fetch(input, init);
+  };
+})();
+</script>
 <meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1">
 <title>Slideshow · Consulting Deliverable</title>
 <!-- Canonical consulting Slideshow. Source of truth: ~/.claude/skills/consulting/assets/slideshow.html
← e612f02 creds-safe fetch guard: resolve relative fetch vs credential · back to Consulting Rentv Com · deploy-safety: exclude data/ from rsync so deploys never clo 6d80e05 →