jobtrackingapp/job-tracker-ui/src/api.ts

import axios, { CanceledError, type InternalAxiosRequestConfig } from "axios";
import { clearAuthClientState, getCsrfToken } from "./auth";
import { bindSession, checkSessionCookie, getSessionContext, invalidateSession, isSessionInvalidated, sessionRequestSignal } from "./sessionBoundary";

function looksLikeHtml(value: string) {
  return /<\s*html\b|<\s*body\b|<\s*head\b|<\s*title\b|<\s*!doctype\b/i.test(value);
}

function sanitizeServerMessage(value: string, fallback: string) {
  const text = value.trim();
  if (!text) return fallback;
  if (looksLikeHtml(text)) return fallback;
  return text.length > 300 ? `${text.slice(0, 297).trimEnd()}...` : text;
}

export function getApiErrorMessage(error: any, fallback = "Request failed.") {
  const data = error?.response?.data;
  if (typeof data === "string" && data.trim()) return sanitizeServerMessage(data, fallback);
  if (typeof data?.message === "string" && data.message.trim()) return sanitizeServerMessage(data.message, fallback);
  if (typeof data?.detail === "string" && data.detail.trim()) return sanitizeServerMessage(data.detail, fallback);
  if (typeof data?.title === "string" && data.title.trim()) return sanitizeServerMessage(data.title, fallback);
  if (Array.isArray(data?.errors)) {
    const first = data.errors.find((value: unknown) => typeof value === "string" && value.trim());
    if (first) return sanitizeServerMessage(first, fallback);
  }
  if (data?.errors && typeof data.errors === "object") {
    for (const value of Object.values(data.errors)) {
      if (Array.isArray(value)) {
        const first = value.find((item: unknown) => typeof item === "string" && item.trim());
        if (first) return sanitizeServerMessage(first, fallback);
      }
      if (typeof value === "string" && value.trim()) return sanitizeServerMessage(value, fallback);
    }
  }
  if (axios.isAxiosError(error) && !axios.isCancel(error)) return fallback;
  if (typeof error?.message === "string" && error.message.trim()) return sanitizeServerMessage(error.message, fallback);
  return fallback;
}

const envBaseUrl = process.env.NEXT_PUBLIC_API_BASE_URL;
const defaultBaseUrl =
  window.location.hostname === "localhost"
    ? "http://localhost:5202/api"
    : "/api";

export const api = axios.create({
  baseURL: envBaseUrl && envBaseUrl.trim().length > 0 ? envBaseUrl : defaultBaseUrl,
  withCredentials: true,
  xsrfCookieName: "XSRF-TOKEN",
  xsrfHeaderName: "X-CSRF-TOKEN",
});

const requestCookies = new WeakMap<InternalAxiosRequestConfig, string | null>();

api.interceptors.request.use((config) => {
  checkSessionCookie();
  if (isSessionInvalidated()) throw new CanceledError("This page belongs to an earlier session. Reload it before continuing.");
  const context = getSessionContext();
  const retainedContext = config.headers.get("X-Session-Context");
  if (retainedContext && retainedContext !== context) throw new CanceledError("The request belongs to an earlier session.");
  if (context) config.headers.set("X-Session-Context", context);
  requestCookies.set(config, getCsrfToken());
  config.signal = config.signal instanceof AbortSignal
    ? AbortSignal.any([config.signal, sessionRequestSignal()])
    : sessionRequestSignal();
  const method = (config.method ?? "get").toUpperCase();
  if (["POST", "PUT", "PATCH", "DELETE"].includes(method)) {
    const csrfToken = getCsrfToken();
    if (csrfToken) {
      config.headers = config.headers ?? {};
      config.headers["X-CSRF-TOKEN"] = csrfToken;
    }
  }
  return config;
}, (error) => { throw error; }, { synchronous: true });

api.interceptors.response.use(
  (r) => {
    checkSessionCookie();
    if (isSessionInvalidated()) throw new CanceledError("Discarded a response from an earlier session.");
    if ((r.config.method ?? "get").toLowerCase() === "get" && requestCookies.get(r.config) !== getCsrfToken()) {
      throw new CanceledError("Discarded a read started before the session changed.");
    }
    if (r.config.url === "/auth/me") {
      if (!bindSession(r.data?.id, r.data?.sessionContext)) {
        invalidateSession();
        throw new CanceledError("The session changed while loading this page.");
      }
    }
    return r;
  },
  (err) => {
    checkSessionCookie();
    if (isSessionInvalidated()) return Promise.reject(new CanceledError("Discarded an earlier session's response."));
    if (err?.config && requestCookies.get(err.config) !== getCsrfToken()) {
      return Promise.reject(new CanceledError("Discarded an earlier session's error."));
    }
    const status = err?.response?.status;
    if ([409, 428].includes(status) && ["session_context_required", "session_context_mismatch"].includes(err?.response?.data?.code)) {
      invalidateSession();
    }
    if (status === 401) {
      if (getSessionContext()) invalidateSession();
      clearAuthClientState();
    }
    return Promise.reject(err);
  },
);