Janady13/missionmatch / frontend/src/lib/api.ts

1import type { 2 AdverseImpactReport, 3 CandidateIntelligence, 4 CandidateListView, 5 AdoptForecastInput, 6 AdoptForecastResult, 7 CommandCenterView, 8 ExternalCandidate, 9 FederalAward, 10 MissionCheckModeAResult, 11 MissionCheckModeBResult, 12 OpportunityFilters, 13 OpportunityFitView, 14 RankedCandidateView, 15 RequirementListView, 16 SamOpportunity, 17 SaveCandidateRequest, 18 ScreenView, 19 SlateResult, 20 WageBaseline, 21} from './types' 22 23// opportunityQuery turns the filter object into a query string. Multi valued filters are repeated 24// params (?naics=a&naics=b); the backend also accepts comma lists. 25function opportunityQuery(f: OpportunityFilters): string { 26 const p = new URLSearchParams() 27 f.naics?.forEach((v) => p.append('naics', v)) 28 f.set_aside?.forEach((v) => p.append('set_aside', v)) 29 f.state?.forEach((v) => p.append('state', v)) 30 f.department?.forEach((v) => p.append('department', v)) 31 f.sub_agency?.forEach((v) => p.append('sub_agency', v)) 32 if (f.q) p.set('q', f.q) 33 if (f.active_only === false) p.set('active_only', 'false') 34 if (f.limit) p.set('limit', String(f.limit)) 35 const s = p.toString() 36 return s ? `?${s}` : '' 37} 38 39export class ApiError extends Error { 40 status: number 41 constructor(status: number, message: string) { 42 super(message) 43 this.status = status 44 } 45} 46 47// csrfToken is the signed double submit token issued by GET /auth/csrf. The companion __Host-mm_csrf 48// cookie is set by that response; the __Host-mm_session cookie rides along via credentials include, so 49// the validated session is the tenant source, not a client header. 50let csrfToken: string | null = null 51let csrfInflight: Promise<string> | null = null 52 53async function ensureCsrf(): Promise<string> { 54 if (csrfToken) return csrfToken 55 // De-duplicate concurrent mints behind one shared fetch. Without this, two unsafe requests racing on a 56 // null token each hit GET /auth/csrf, the second response overwrites the __Host-mm_csrf cookie, and the 57 // first request's header no longer matches its cookie, so the double submit check 403s. One mint per 58 // token lifetime keeps the cookie and every header in agreement. 59 if (!csrfInflight) { 60 csrfInflight = fetch('/api/auth/csrf', { credentials: 'include' }) 61 .then(async (res) => { 62 if (res.ok) { 63 const body = (await res.json()) as { csrf_token?: string } 64 csrfToken = body.csrf_token ?? null 65 } 66 return csrfToken ?? '' 67 }) 68 .finally(() => { 69 csrfInflight = null 70 }) 71 } 72 return csrfInflight 73} 74 75async function doFetch(path: string, init: RequestInit, method: string): Promise<Response> { 76 const headers: Record<string, string> = { 77 'Content-Type': 'application/json', 78 ...((init.headers as Record<string, string>) ?? {}), 79 } 80 if (method !== 'GET' && method !== 'HEAD') { 81 headers['X-CSRF-Token'] = await ensureCsrf() 82 } 83 // credentials include sends the __Host-mm_session cookie; the validated session is the tenant source. 84 return fetch(`/api${path}`, { ...init, credentials: 'include', headers }) 85} 86 87async function rawRequest(path: string, init?: RequestInit): Promise<Response> { 88 const method = (init?.method ?? 'GET').toUpperCase() 89 let res = await doFetch(path, init ?? {}, method) 90 // A stale or rotated CSRF token returns 403; refresh once and retry the unsafe verb. 91 if (res.status === 403 && method !== 'GET' && method !== 'HEAD') { 92 csrfToken = null 93 res = await doFetch(path, init ?? {}, method) 94 } 95 if (!res.ok) { 96 let detail = res.statusText 97 try { 98 const body = (await res.clone().json()) as { error?: string } 99 if (body.error) detail = body.error 100 } catch { 101 /* ignore non-JSON error bodies */ 102 } 103 throw new ApiError(res.status, detail) 104 } 105 return res 106} 107 108export async function request<T>(path: string, init?: RequestInit): Promise<T> { 109 const res = await rawRequest(path, init) 110 return (await res.json()) as T 111} 112 113async function requestText(path: string): Promise<string> { 114 const res = await rawRequest(path) 115 return res.text() 116} 117 118export const api = { 119 candidates: () => request<CandidateListView[]>('/candidates?limit=200'), 120 candidateIntelligence: (limit = 250) => 121 request<CandidateIntelligence[]>(`/candidates/intelligence?limit=${limit}`), 122 // Fetch one candidate or requirement by id so a deep linked evaluation works even when the row is 123 // not inside the first list page; the list scan would silently render a blank evaluation otherwise. 124 candidate: (id: string) => 125 request<CandidateListView>(`/candidates/${encodeURIComponent(id)}`), 126 requirements: () => request<RequirementListView[]>('/requirements?limit=200'), 127 requirement: (id: string) => 128 request<RequirementListView>(`/requirements/${encodeURIComponent(id)}`), 129 screen: (candidate_id: string, requirement_id: string) => 130 request<ScreenView>('/screen', { 131 method: 'POST', 132 body: JSON.stringify({ candidate_id, requirement_id }), 133 }), 134 generateSlate: (requirement_id: string, name: string) => 135 request<SlateResult>('/slates/generate', { 136 method: 'POST', 137 body: JSON.stringify({ requirement_id, name }), 138 }), 139 opportunities: (candidateId: string) => 140 request<OpportunityFitView[]>(`/candidates/${candidateId}/opportunities?limit=10`), 141 rankCandidates: (requirementId: string) => 142 request<RankedCandidateView[]>(`/requirements/${requirementId}/candidates`), 143 commandCenter: () => request<CommandCenterView>('/command-center'), 144 // Adopt a planning stage forecast into a real requirement the shared engine then scores. 145 adoptForecast: (recordID: string, input: AdoptForecastInput) => 146 request<AdoptForecastResult>(`/command-center/upcoming/${encodeURIComponent(recordID)}/adopt`, { 147 method: 'POST', 148 body: JSON.stringify(input), 149 }), 150 // Cached SAM.gov opportunities (the requirement feed). The frontend NEVER calls SAM live. 151 samOpportunities: (f: OpportunityFilters = {}) => 152 request<SamOpportunity[]>(`/opportunities${opportunityQuery(f)}`), 153 samOpportunity: (noticeId: string) => 154 request<SamOpportunity>(`/opportunities/${encodeURIComponent(noticeId)}`), 155 // USASpending awards (cache only): incumbents by NAICS and Galapagos own past performance. 156 incumbents: (naics: string) => 157 request<FederalAward[]>(`/awards?naics=${encodeURIComponent(naics)}&limit=6`), 158 galapagosAwards: () => request<FederalAward[]>('/awards/galapagos?limit=8'), 159 // BLS OEWS regional wage baseline (cache only). 160 wages: () => request<WageBaseline[]>('/wages'), 161 // Externally sourced candidates (People Data Labs) plus the delete path. 162 externalCandidates: () => request<ExternalCandidate[]>('/sourcing/candidates'), 163 deleteExternalCandidate: (id: string) => 164 request<{ status: string }>(`/sourcing/candidates/${encodeURIComponent(id)}`, { method: 'DELETE' }), 165 // AEDT: the human in the loop decision on a slate member (approved or rejected). 166 decideSlateMember: (slateId: string, candidateId: string, decision: 'approved' | 'rejected') => 167 request<{ status: string }>( 168 `/slates/${encodeURIComponent(slateId)}/members/${encodeURIComponent(candidateId)}/decision`, 169 { method: 'PATCH', body: JSON.stringify({ decision }) }, 170 ), 171 // Compliance: the adverse impact report (compliance role only) and its publication ready export. 172 adverseImpact: () => request<AdverseImpactReport>('/compliance/adverse-impact'), 173 adverseImpactExport: () => requestText('/compliance/adverse-impact/export'), 174 // Mission Check (W1): the resume is parsed to text in the browser; only the text crosses the wire. 175 // Mode A scores it against every open opportunity, Mode B against one pasted job description. 176 missionCheckOpportunities: (resume_text: string, limit = 10) => 177 request<MissionCheckModeAResult>('/mission-check/opportunities', { 178 method: 'POST', 179 body: JSON.stringify({ resume_text, limit }), 180 }), 181 missionCheckJD: (resume_text: string, job_description_text: string) => 182 request<MissionCheckModeBResult>('/mission-check/screen', { 183 method: 'POST', 184 body: JSON.stringify({ resume_text, job_description_text }), 185 }), 186 // Save Candidate: persist a reviewed Mission Check result as an audited candidate (recruiter capability). 187 saveCandidate: (body: SaveCandidateRequest) => 188 request<{ id: string }>('/candidates', { method: 'POST', body: JSON.stringify(body) }), 189} 190