Janady13/missionmatch / frontend/src/lib/api.ts

1import type { 2 AdverseImpactReport, 3 CandidateListView, 4 ExternalCandidate, 5 FederalAward, 6 MissionCheckModeAResult, 7 MissionCheckModeBResult, 8 OpportunityFilters, 9 OpportunityFitView, 10 RankedCandidateView, 11 RequirementListView, 12 SamOpportunity, 13 SaveCandidateRequest, 14 ScreenView, 15 WageBaseline, 16} from './types' 17 18// opportunityQuery turns the filter object into a query string. Multi valued filters are repeated 19// params (?naics=a&naics=b); the backend also accepts comma lists. 20function opportunityQuery(f: OpportunityFilters): string { 21 const p = new URLSearchParams() 22 f.naics?.forEach((v) => p.append('naics', v)) 23 f.set_aside?.forEach((v) => p.append('set_aside', v)) 24 f.state?.forEach((v) => p.append('state', v)) 25 f.department?.forEach((v) => p.append('department', v)) 26 f.sub_agency?.forEach((v) => p.append('sub_agency', v)) 27 if (f.q) p.set('q', f.q) 28 if (f.active_only === false) p.set('active_only', 'false') 29 if (f.limit) p.set('limit', String(f.limit)) 30 const s = p.toString() 31 return s ? `?${s}` : '' 32} 33 34export class ApiError extends Error { 35 status: number 36 constructor(status: number, message: string) { 37 super(message) 38 this.status = status 39 } 40} 41 42// csrfToken is the signed double submit token issued by GET /auth/csrf. The companion __Host-mm_csrf 43// cookie is set by that response; the __Host-mm_session cookie rides along via credentials include, so 44// the validated session is the tenant source, not a client header. 45let csrfToken: string | null = null 46let csrfInflight: Promise<string> | null = null 47 48async function ensureCsrf(): Promise<string> { 49 if (csrfToken) return csrfToken 50 // De-duplicate concurrent mints behind one shared fetch. Without this, two unsafe requests racing on a 51 // null token each hit GET /auth/csrf, the second response overwrites the __Host-mm_csrf cookie, and the 52 // first request's header no longer matches its cookie, so the double submit check 403s. One mint per 53 // token lifetime keeps the cookie and every header in agreement. 54 if (!csrfInflight) { 55 csrfInflight = fetch('/api/auth/csrf', { credentials: 'include' }) 56 .then(async (res) => { 57 if (!res.ok) { 58 throw new Error(`csrf token request failed: ${res.status}`) 59 } 60 const body = (await res.json()) as { csrf_token?: string } 61 const token = body.csrf_token 62 if (!token) { 63 throw new Error('csrf token request returned an empty token') 64 } 65 csrfToken = token 66 return token 67 }) 68 .finally(() => { 69 // Clear the in flight marker on success and failure so a failed mint is never cached and a 70 // later request can retry rather than sending an empty token into a guaranteed 403 loop. 71 csrfInflight = null 72 }) 73 } 74 return csrfInflight 75} 76 77// normalizeHeaders flattens any HeadersInit form (a plain object, a Headers instance, or a tuple array) 78// to a plain record so the spread below is correct for every caller, not just plain objects. 79function normalizeHeaders(h: HeadersInit | undefined): Record<string, string> { 80 if (!h) return {} 81 if (h instanceof Headers) return Object.fromEntries(h.entries()) 82 if (Array.isArray(h)) return Object.fromEntries(h) 83 return { ...h } 84} 85 86async function doFetch(path: string, init: RequestInit, method: string): Promise<Response> { 87 const headers: Record<string, string> = { 88 'Content-Type': 'application/json', 89 ...normalizeHeaders(init.headers), 90 } 91 if (method !== 'GET' && method !== 'HEAD') { 92 headers['X-CSRF-Token'] = await ensureCsrf() 93 } 94 // credentials include sends the __Host-mm_session cookie; the validated session is the tenant source. 95 return fetch(`/api${path}`, { ...init, credentials: 'include', headers }) 96} 97 98async function rawRequest(path: string, init?: RequestInit): Promise<Response> { 99 const method = (init?.method ?? 'GET').toUpperCase() 100 let res = await doFetch(path, init ?? {}, method) 101 // A stale or rotated CSRF token returns 403; refresh once and retry the unsafe verb. 102 if (res.status === 403 && method !== 'GET' && method !== 'HEAD') { 103 csrfToken = null 104 res = await doFetch(path, init ?? {}, method) 105 } 106 if (!res.ok) { 107 let detail = res.statusText 108 try { 109 const body = (await res.clone().json()) as { error?: string } 110 if (body.error) detail = body.error 111 } catch { 112 /* ignore non-JSON error bodies */ 113 } 114 throw new ApiError(res.status, detail) 115 } 116 return res 117} 118 119export async function request<T>(path: string, init?: RequestInit): Promise<T> { 120 const res = await rawRequest(path, init) 121 return (await res.json()) as T 122} 123 124async function requestText(path: string): Promise<string> { 125 const res = await rawRequest(path) 126 return res.text() 127} 128 129export const api = { 130 candidates: () => request<CandidateListView[]>('/candidates?limit=200'), 131 // Fetch one candidate or requirement by id so a deep linked evaluation works even when the row is 132 // not inside the first list page; the list scan would silently render a blank evaluation otherwise. 133 candidate: (id: string) => 134 request<CandidateListView>(`/candidates/${encodeURIComponent(id)}`), 135 requirements: () => request<RequirementListView[]>('/requirements?limit=200'), 136 requirement: (id: string) => 137 request<RequirementListView>(`/requirements/${encodeURIComponent(id)}`), 138 screen: (candidate_id: string, requirement_id: string) => 139 request<ScreenView>('/screen', { 140 method: 'POST', 141 body: JSON.stringify({ candidate_id, requirement_id }), 142 }), 143 opportunities: (candidateId: string) => 144 request<OpportunityFitView[]>(`/candidates/${candidateId}/opportunities?limit=10`), 145 rankCandidates: (requirementId: string) => 146 request<RankedCandidateView[]>(`/requirements/${requirementId}/candidates`), 147 // Cached SAM.gov opportunities (the requirement feed). The frontend NEVER calls SAM live. 148 samOpportunities: (f: OpportunityFilters = {}) => 149 request<SamOpportunity[]>(`/opportunities${opportunityQuery(f)}`), 150 samOpportunity: (noticeId: string) => 151 request<SamOpportunity>(`/opportunities/${encodeURIComponent(noticeId)}`), 152 // USASpending awards (cache only): incumbents by NAICS and Galapagos own past performance. 153 incumbents: (naics: string) => 154 request<FederalAward[]>(`/awards?naics=${encodeURIComponent(naics)}&limit=6`), 155 galapagosAwards: () => request<FederalAward[]>('/awards/galapagos?limit=8'), 156 // BLS OEWS regional wage baseline (cache only). 157 wages: () => request<WageBaseline[]>('/wages'), 158 // Externally sourced candidates (People Data Labs) plus the delete path. 159 externalCandidates: () => request<ExternalCandidate[]>('/sourcing/candidates'), 160 deleteExternalCandidate: (id: string) => 161 request<{ status: string }>(`/sourcing/candidates/${encodeURIComponent(id)}`, { method: 'DELETE' }), 162 // Compliance: the adverse impact report (compliance role only) and its publication ready export. 163 adverseImpact: () => request<AdverseImpactReport>('/compliance/adverse-impact'), 164 adverseImpactExport: () => requestText('/compliance/adverse-impact/export'), 165 // Mission Check (W1): the resume is parsed to text in the browser; only the text crosses the wire. 166 // Mode A scores it against every open opportunity, Mode B against one pasted job description. 167 missionCheckOpportunities: (resume_text: string, limit = 10) => 168 request<MissionCheckModeAResult>('/mission-check/opportunities', { 169 method: 'POST', 170 body: JSON.stringify({ resume_text, limit }), 171 }), 172 missionCheckJD: (resume_text: string, job_description_text: string) => 173 request<MissionCheckModeBResult>('/mission-check/screen', { 174 method: 'POST', 175 body: JSON.stringify({ resume_text, job_description_text }), 176 }), 177 // Save Candidate: persist a reviewed Mission Check result as an audited candidate (recruiter capability). 178 saveCandidate: (body: SaveCandidateRequest) => 179 request<{ id: string }>('/candidates', { method: 'POST', body: JSON.stringify(body) }), 180} 181