reels: credential-safe fetch guard so Suggested videos loads when opened with creds-in-URL

973621aeee9b541ab0f21b282b3e576911baa08b · 2026-08-25 09:58:59 -0700 · Steve

Opening /api/reels/ui/ with credentials in the URL (saved bookmark / Chrome-
remembered basic-auth) poisoned document.baseURI, making every bare-relative
fetch('api/...') throw 'Request cannot be constructed from a URL that includes
credentials'. loadSuggestions() swallowed it and fell to the empty state, so
#sec-suggest showed 'No suggestions yet' despite 136 existing ideas. Resolve
relative fetch URLs against the credential-free location instead of baseURI.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Files touched

M public/index.html

Diff

commit 973621aeee9b541ab0f21b282b3e576911baa08b
Author: Steve <steve@designerwallcoverings.com>
Date:   Tue Aug 25 09:58:59 2026 -0700

    reels: credential-safe fetch guard so Suggested videos loads when opened with creds-in-URL
    
    Opening /api/reels/ui/ with credentials in the URL (saved bookmark / Chrome-
    remembered basic-auth) poisoned document.baseURI, making every bare-relative
    fetch('api/...') throw 'Request cannot be constructed from a URL that includes
    credentials'. loadSuggestions() swallowed it and fell to the empty state, so
    #sec-suggest showed 'No suggestions yet' despite 136 existing ideas. Resolve
    relative fetch URLs against the credential-free location instead of baseURI.
    
    Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 public/index.html | 23 +++++++++++++++++++++++
 1 file changed, 23 insertions(+)

diff --git a/public/index.html b/public/index.html
index 57e90fb..d33e139 100644
--- a/public/index.html
+++ b/public/index.html
@@ -224,6 +224,29 @@
 </div>
 
 <script>
+// ── Credential-safe fetch guard ──────────────────────────────────────────────
+// When this page is opened with credentials in the URL (a saved bookmark or a
+// Chrome-remembered basic-auth: https://user:pass@host/api/reels/ui/…), the
+// browser poisons document.baseURI with those credentials. Every bare-relative
+// fetch('api/…') then throws synchronously — "Request cannot be constructed from
+// a URL that includes credentials" — and callers silently fall to an empty state
+// (e.g. Suggested videos shows "No suggestions yet" though 136 exist). We resolve
+// relative request URLs against the credential-free location instead of baseURI,
+// mirroring native resolution but without the poison. (Same class as the CRCP fix.)
+(function () {
+  const _fetch = window.fetch.bind(window);
+  const cleanBase = () => location.origin + location.pathname; // Location omits userinfo
+  window.fetch = function (input, init) {
+    try {
+      if (typeof input === 'string' && !/^[a-z]+:\/\//i.test(input) && !input.startsWith('//')) {
+        input = new URL(input, cleanBase()).href;
+      } else if (input instanceof Request && !/^[a-z]+:\/\//i.test(input.url)) {
+        input = new Request(new URL(input.url, cleanBase()).href, input);
+      }
+    } catch (_) { /* fall through to native behavior */ }
+    return _fetch(input, init);
+  };
+})();
 const $ = s => document.querySelector(s);
 const fmt = iso => { try { return new Date(iso).toLocaleString(undefined,{year:'numeric',month:'short',day:'numeric',hour:'numeric',minute:'2-digit'}); } catch { return iso||''; } };
 const escapeHtml = s => String(s||'').replace(/[&<>]/g,c=>({'&':'&amp;','<':'&lt;','>':'&gt;'}[c]));

← 1dffe68 auto-data-snapshot: 2026-08-25T07:39:06 (3 data files) — dat · back to Dw Marketing Reels · Embed all 35 DW-owned IG accounts in the Reels console (list bc84029 →