mcc: credential-safe fetch guard in shell (inoculate root-relative /api/* fetches)

37ff9a8ab0ceb04bcaac1360ea434763365e4e42 · 2026-08-25 10:12:33 -0700 · Steve

Same creds-in-URL trap as the reels fix: opening the command center with
credentials in the URL poisons document.baseURI, so root-relative fetches
(/api/social/*, /api/calendar/*, /api/templates/*, /api/segments, /api/send-times)
throw synchronously. location.origin-prefixed calls were already safe; this guards
the rest by resolving every non-absolute request URL against the creds-free location.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Files touched

M public/index.html

Diff

commit 37ff9a8ab0ceb04bcaac1360ea434763365e4e42
Author: Steve <steve@designerwallcoverings.com>
Date:   Tue Aug 25 10:12:33 2026 -0700

    mcc: credential-safe fetch guard in shell (inoculate root-relative /api/* fetches)
    
    Same creds-in-URL trap as the reels fix: opening the command center with
    credentials in the URL poisons document.baseURI, so root-relative fetches
    (/api/social/*, /api/calendar/*, /api/templates/*, /api/segments, /api/send-times)
    throw synchronously. location.origin-prefixed calls were already safe; this guards
    the rest by resolving every non-absolute request URL against the creds-free location.
    
    Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 public/index.html | 23 +++++++++++++++++++++++
 1 file changed, 23 insertions(+)

diff --git a/public/index.html b/public/index.html
index 2743cfa..720a483 100644
--- a/public/index.html
+++ b/public/index.html
@@ -5,6 +5,29 @@
 <link rel="preconnect" href="https://fonts.googleapis.com">
 <link href="https://fonts.googleapis.com/css2?family=Cormorant+Garamond:wght@500;600;700&family=Inter:wght@400;500;600;700&display=swap" rel="stylesheet">
 <link rel="stylesheet" href="/style.css">
+<script>
+// Credential-safe fetch guard — if this SPA is opened with credentials in the URL
+// (saved bookmark / Chrome-remembered basic-auth: https://user:pass@host/…), the
+// browser poisons document.baseURI, so any relative or root-relative fetch('/api/…')
+// throws "Request cannot be constructed from a URL that includes credentials". Most
+// calls here use location.origin (already creds-free), but several are root-relative
+// (/api/social/*, /api/calendar/*, /api/templates/*, /api/segments…). Resolve every
+// non-absolute request URL against the credential-free location. (Same fix as reels.)
+(function () {
+  var _fetch = window.fetch.bind(window);
+  var cleanBase = function () { return location.origin + location.pathname; };
+  window.fetch = function (input, init) {
+    try {
+      if (typeof input === 'string' && !/^[a-z]+:\/\//i.test(input) && input.indexOf('//') !== 0) {
+        input = new URL(input, cleanBase()).href;
+      } else if (input instanceof Request && !/^[a-z]+:\/\//i.test(input.url)) {
+        input = new Request(new URL(input.url, cleanBase()).href, input);
+      }
+    } catch (_) { /* fall through to native */ }
+    return _fetch(input, init);
+  };
+})();
+</script>
 </head>
 <body>
 <div id="scrim"></div>

← 3b784fd Guard: suppress amplify controls for never-front-facing bran · back to Marketing Command Center · Show last 6 posts per owned account in the #vendors Owned·DW c12730b →