Janady13/missionmatch / frontend/src/lib/api.ts

1import type { 2 AdverseImpactReport, 3 CurationProposalView, 4 CandidateListView, 5 ExternalCandidate, 6 FederalAward, 7 MissionCheckModeAResult, 8 MissionCheckModeBResult, 9 OpportunityFilters, 10 OpportunityFitView, 11 RankedCandidateView, 12 RequirementListView, 13 SamOpportunity, 14 SaveCandidateRequest, 15 ScreenView, 16 WageBaseline, 17} from './types' 18 19// opportunityQuery turns the filter object into a query string. Multi valued filters are repeated 20// params (?naics=a&naics=b); the backend also accepts comma lists. 21function opportunityQuery(f: OpportunityFilters): string { 22 const p = new URLSearchParams() 23 f.naics?.forEach((v) => p.append('naics', v)) 24 f.set_aside?.forEach((v) => p.append('set_aside', v)) 25 f.state?.forEach((v) => p.append('state', v)) 26 f.department?.forEach((v) => p.append('department', v)) 27 f.sub_agency?.forEach((v) => p.append('sub_agency', v)) 28 if (f.q) p.set('q', f.q) 29 if (f.active_only === false) p.set('active_only', 'false') 30 if (f.limit) p.set('limit', String(f.limit)) 31 const s = p.toString() 32 return s ? `?${s}` : '' 33} 34 35export class ApiError extends Error { 36 status: number 37 constructor(status: number, message: string) { 38 super(message) 39 this.status = status 40 } 41} 42 43// csrfToken is the signed double submit token issued by GET /auth/csrf. The companion __Host-mm_csrf 44// cookie is set by that response; the __Host-mm_session cookie rides along via credentials include, so 45// the validated session is the tenant source, not a client header. 46let csrfToken: string | null = null 47let csrfInflight: Promise<string> | null = null 48 49async function ensureCsrf(): Promise<string> { 50 if (csrfToken) return csrfToken 51 // De-duplicate concurrent mints behind one shared fetch. Without this, two unsafe requests racing on a 52 // null token each hit GET /auth/csrf, the second response overwrites the __Host-mm_csrf cookie, and the 53 // first request's header no longer matches its cookie, so the double submit check 403s. One mint per 54 // token lifetime keeps the cookie and every header in agreement. 55 if (!csrfInflight) { 56 csrfInflight = fetch('/api/auth/csrf', { credentials: 'include' }) 57 .then(async (res) => { 58 if (!res.ok) { 59 throw new Error(`csrf token request failed: ${res.status}`) 60 } 61 const body = (await res.json()) as { csrf_token?: string } 62 const token = body.csrf_token 63 if (!token) { 64 throw new Error('csrf token request returned an empty token') 65 } 66 csrfToken = token 67 return token 68 }) 69 .finally(() => { 70 // Clear the in flight marker on success and failure so a failed mint is never cached and a 71 // later request can retry rather than sending an empty token into a guaranteed 403 loop. 72 csrfInflight = null 73 }) 74 } 75 return csrfInflight 76} 77 78// normalizeHeaders flattens any HeadersInit form (a plain object, a Headers instance, or a tuple array) 79// to a plain record so the spread below is correct for every caller, not just plain objects. 80function normalizeHeaders(h: HeadersInit | undefined): Record<string, string> { 81 if (!h) return {} 82 if (h instanceof Headers) return Object.fromEntries(h.entries()) 83 if (Array.isArray(h)) return Object.fromEntries(h) 84 return { ...h } 85} 86 87async function doFetch(path: string, init: RequestInit, method: string): Promise<Response> { 88 const headers: Record<string, string> = { 89 'Content-Type': 'application/json', 90 ...normalizeHeaders(init.headers), 91 } 92 if (method !== 'GET' && method !== 'HEAD') { 93 headers['X-CSRF-Token'] = await ensureCsrf() 94 } 95 // credentials include sends the __Host-mm_session cookie; the validated session is the tenant source. 96 return fetch(`/api${path}`, { ...init, credentials: 'include', headers }) 97} 98 99async function rawRequest(path: string, init?: RequestInit): Promise<Response> { 100 const method = (init?.method ?? 'GET').toUpperCase() 101 let res = await doFetch(path, init ?? {}, method) 102 // A stale or rotated CSRF token returns 403; refresh once and retry the unsafe verb. 103 if (res.status === 403 && method !== 'GET' && method !== 'HEAD') { 104 csrfToken = null 105 res = await doFetch(path, init ?? {}, method) 106 } 107 if (!res.ok) { 108 let detail = res.statusText 109 try { 110 // Two error body shapes are in use: a plain string error, and the AI brain's structured envelope 111 // { error: { code, message } } (a 422 refusal, for example). Read the message from whichever is present 112 // so a refusal reason is shown verbatim rather than stringified to an object. 113 const body = (await res.clone().json()) as { error?: string | { message?: string; code?: string } } 114 if (typeof body.error === 'string') { 115 detail = body.error 116 } else if (body.error) { 117 detail = body.error.message || body.error.code || detail 118 } 119 } catch { 120 /* ignore non-JSON error bodies */ 121 } 122 throw new ApiError(res.status, detail) 123 } 124 return res 125} 126 127export async function request<T>(path: string, init?: RequestInit): Promise<T> { 128 const res = await rawRequest(path, init) 129 return (await res.json()) as T 130} 131 132async function requestText(path: string): Promise<string> { 133 const res = await rawRequest(path) 134 return res.text() 135} 136 137export const api = { 138 candidates: () => request<CandidateListView[]>('/candidates?limit=200'), 139 // Fetch one candidate or requirement by id so a deep linked evaluation works even when the row is 140 // not inside the first list page; the list scan would silently render a blank evaluation otherwise. 141 candidate: (id: string) => 142 request<CandidateListView>(`/candidates/${encodeURIComponent(id)}`), 143 requirements: () => request<RequirementListView[]>('/requirements?limit=200'), 144 requirement: (id: string) => 145 request<RequirementListView>(`/requirements/${encodeURIComponent(id)}`), 146 screen: (candidate_id: string, requirement_id: string) => 147 request<ScreenView>('/screen', { 148 method: 'POST', 149 body: JSON.stringify({ candidate_id, requirement_id }), 150 }), 151 opportunities: (candidateId: string) => 152 request<OpportunityFitView[]>(`/candidates/${candidateId}/opportunities?limit=10`), 153 rankCandidates: (requirementId: string) => 154 request<RankedCandidateView[]>(`/requirements/${requirementId}/candidates`), 155 // Cached SAM.gov opportunities (the requirement feed). The frontend NEVER calls SAM live. 156 samOpportunities: (f: OpportunityFilters = {}) => 157 request<SamOpportunity[]>(`/opportunities${opportunityQuery(f)}`), 158 samOpportunity: (noticeId: string) => 159 request<SamOpportunity>(`/opportunities/${encodeURIComponent(noticeId)}`), 160 // USASpending awards (cache only): incumbents by NAICS and Galapagos own past performance. 161 incumbents: (naics: string) => 162 request<FederalAward[]>(`/awards?naics=${encodeURIComponent(naics)}&limit=6`), 163 galapagosAwards: () => request<FederalAward[]>('/awards/galapagos?limit=8'), 164 // BLS OEWS regional wage baseline (cache only). 165 wages: () => request<WageBaseline[]>('/wages'), 166 // Externally sourced candidates (People Data Labs) plus the delete path. 167 externalCandidates: () => request<ExternalCandidate[]>('/sourcing/candidates'), 168 deleteExternalCandidate: (id: string) => 169 request<{ status: string }>(`/sourcing/candidates/${encodeURIComponent(id)}`, { method: 'DELETE' }), 170 // Compliance: the adverse impact report (compliance role only) and its publication ready export. 171 adverseImpact: () => request<AdverseImpactReport>('/compliance/adverse-impact'), 172 adverseImpactExport: () => requestText('/compliance/adverse-impact/export'), 173 // WS8 curation: the pending teaching proposals and the two step human gate (compliance or operator role). 174 // Approve stages an inert ontology edge; Verify (a separate action) activates it for future scores. 175 curationProposals: () => request<CurationProposalView[]>('/compliance/curation/proposals'), 176 approveCurationProposal: (id: string) => 177 request<CurationProposalView>(`/compliance/curation/proposals/${encodeURIComponent(id)}/approve`, { method: 'POST' }), 178 verifyCurationProposal: (id: string) => 179 request<CurationProposalView>(`/compliance/curation/proposals/${encodeURIComponent(id)}/verify`, { method: 'POST' }), 180 // Mission Check (W1): the resume is parsed to text in the browser; only the text crosses the wire. 181 // Mode A scores it against every open opportunity, Mode B against one pasted job description. 182 missionCheckOpportunities: (resume_text: string, limit = 10) => 183 request<MissionCheckModeAResult>('/mission-check/opportunities', { 184 method: 'POST', 185 body: JSON.stringify({ resume_text, limit }), 186 }), 187 missionCheckJD: (resume_text: string, job_description_text: string) => 188 request<MissionCheckModeBResult>('/mission-check/screen', { 189 method: 'POST', 190 body: JSON.stringify({ resume_text, job_description_text }), 191 }), 192 // Save Candidate: persist a reviewed Mission Check result as an audited candidate (recruiter capability). 193 saveCandidate: (body: SaveCandidateRequest) => 194 request<{ id: string }>('/candidates', { method: 'POST', body: JSON.stringify(body) }), 195} 196