restore creds-in-URL fetch guard on flyers page (regression from 1ac8ff5 prod-snapshot; TK-11773 / TK-10984)

3484f65e7bab3760049a535059b15e78f8097d42 · 2026-09-15 17:52:42 -0700 · Steve

The 2026-09-15 'commit code deployed in fleet push' snapshot reverted flyers/index.html
byte-for-byte to its pre-guard state, dropping the window.fetch credential-safe wrapper.
The page does a relative fetch('flyers.json') behind a global Basic-Auth wall with no
.catch(), so a user:pass@host bookmark throws and the grid silently renders empty.
Restores the exact guard block matching the 8 sibling viewer pages.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GHzse5aKM9vgbEhXxho7B3

Files touched

M public/flyers/index.html

Diff

commit 3484f65e7bab3760049a535059b15e78f8097d42
Author: Steve <steve@designerwallcoverings.com>
Date:   Tue Sep 15 17:52:42 2026 -0700

    restore creds-in-URL fetch guard on flyers page (regression from 1ac8ff5 prod-snapshot; TK-11773 / TK-10984)
    
    The 2026-09-15 'commit code deployed in fleet push' snapshot reverted flyers/index.html
    byte-for-byte to its pre-guard state, dropping the window.fetch credential-safe wrapper.
    The page does a relative fetch('flyers.json') behind a global Basic-Auth wall with no
    .catch(), so a user:pass@host bookmark throws and the grid silently renders empty.
    Restores the exact guard block matching the 8 sibling viewer pages.
    
    Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
    Claude-Session: https://claude.ai/code/session_01GHzse5aKM9vgbEhXxho7B3
---
 public/flyers/index.html | 26 +++++++++++++++++++++++++-
 1 file changed, 25 insertions(+), 1 deletion(-)

diff --git a/public/flyers/index.html b/public/flyers/index.html
index 6be2a9d..22ee681 100644
--- a/public/flyers/index.html
+++ b/public/flyers/index.html
@@ -1,4 +1,28 @@
-<!doctype html><html lang="en"><head><meta charset="utf-8">
+<!doctype html><html lang="en"><head>
+<script>
+// Credential-safe fetch guard (fleet drop-in) — if this page is opened with
+// credentials in the URL (a saved bookmark / Chrome-remembered basic-auth:
+// https://user:pass@host/…), the browser poisons document.baseURI, so any
+// relative or root-relative fetch('/api/…') throws "Request cannot be constructed
+// from a URL that includes credentials" and callers silently fall to an empty
+// state. Resolve every non-absolute request URL against the credential-free
+// location instead of baseURI. Placed first so it wraps window.fetch before any
+// app script runs. Ref: creds-in-url-fetch-guard-fleet-pattern.
+(function () {
+  var _fetch = window.fetch.bind(window);
+  var cleanBase = function () { return location.origin + location.pathname; };
+  window.fetch = function (input, init) {
+    try {
+      if (typeof input === 'string' && !/^[a-z]+:\/\//i.test(input) && input.indexOf('//') !== 0) {
+        input = new URL(input, cleanBase()).href;
+      } else if (input instanceof Request && !/^[a-z]+:\/\//i.test(input.url)) {
+        input = new Request(new URL(input.url, cleanBase()).href, input);
+      }
+    } catch (_) { /* fall through to native */ }
+    return _fetch(input, init);
+  };
+})();
+</script><meta charset="utf-8">
 <meta name="viewport" content="width=device-width,initial-scale=1">
 <title>Flyers — Abrams | CRE deal flyers</title>
 <style>

← 357413c auto-data-snapshot: 2026-09-15T16:53:16 (8 data files) — dat · back to Re Flyer Aggregator · flyers: add visible .catch() error state on flyers.json load c51dbfb →