/designs grid bulk-action: scrub URL creds on fetch — same fix as 4b8026f5's unpublish patch, but for the grid's bulk-action handler

223088a4457c339b28479b386a35b7c1d6aa7aa6 · 2026-05-28 11:07:47 -0700 · Steve Abrams

Steve hit 'Network error: Failed to execute fetch on Window: Request
cannot be constructed from a URL that includes credentials' when
clicking Delete on the bulk-select bar (Tag/Publish/Unpublish/Delete).

The /designs page (server.js line 5453) renders a bulk-action handler
that calls fetch('/api/designs/bulk-action', ...). When the admin loads
the page via http://admin:pwd@wallco.ai/... the relative URL inherits
the userinfo and Chrome refuses the fetch.

4b8026f5 fixed this for the design page's unpublish handler by building
the URL via location.protocol + '//' + location.host. Mirroring that
here for bulk-action. Doesn't touch the page <head>, so no risk of
breaking the render.

Files touched

M server.js

Diff

commit 223088a4457c339b28479b386a35b7c1d6aa7aa6
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Thu May 28 11:07:47 2026 -0700

    /designs grid bulk-action: scrub URL creds on fetch — same fix as 4b8026f5's unpublish patch, but for the grid's bulk-action handler
    
    Steve hit 'Network error: Failed to execute fetch on Window: Request
    cannot be constructed from a URL that includes credentials' when
    clicking Delete on the bulk-select bar (Tag/Publish/Unpublish/Delete).
    
    The /designs page (server.js line 5453) renders a bulk-action handler
    that calls fetch('/api/designs/bulk-action', ...). When the admin loads
    the page via http://admin:pwd@wallco.ai/... the relative URL inherits
    the userinfo and Chrome refuses the fetch.
    
    4b8026f5 fixed this for the design page's unpublish handler by building
    the URL via location.protocol + '//' + location.host. Mirroring that
    here for bulk-action. Doesn't touch the page <head>, so no risk of
    breaking the render.
---
 server.js | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/server.js b/server.js
index e0315ce..699ed1b 100644
--- a/server.js
+++ b/server.js
@@ -6539,7 +6539,13 @@ ${(req.query.source === 'all') ? `
       var labels = { tag:'Tag', publish:'Publish', unpublish:'Unpublish', 'delete':'Delete' };
       if (!confirm(labels[action] + ' ' + ids.length + ' design(s)?')) return;
       btn.disabled = true; btn.style.opacity = '.6';
-      fetch('/api/designs/bulk-action', {
+      // Build absolute URL via origin-without-credentials so Chrome doesn't refuse:
+      //   "Request cannot be constructed from a URL that includes credentials".
+      // Happens when admin loaded the page through user:pass@host (basic auth)
+      // and the relative-fetch URL inherits those creds. Same pattern 382f03d7
+      // applied to the unpublish fetch on the design page.
+      var _o = location.protocol + '//' + location.host;
+      fetch(_o + '/api/designs/bulk-action', {
         method:'POST', credentials:'same-origin', headers:{'Content-Type':'application/json'},
         body: JSON.stringify({ ids: ids, action: action })
       }).then(function(r){ return r.json(); }).then(function(j){

← 46eb294 homepage hero: prefer photoreal room-mockup over flat tile w · back to Wallco Ai · homepage cards: 'second position' room-setting inset chip — fa813e7 →