ehoandClaude Sonnet 5
dd11eafe50
204 WP-NN/RB-NN comments named a closed ticket instead of the code they sit next to. git blame already records history and stays correct when code moves; the comment does not. This sweep removes the reference and keeps the sentence, across 95 files in apps/ and libs/ plus the behaviour-spec generator's header text. Eleven references stay: five story files justify an a11y disable per the README's rule, and one line in a11y.mdx documents that convention. Two sentences needed a rewrite, not a deletion, so the reference's meaning survives its removal. behaviour-spec.mdx is regenerated, not hand-edited. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
70 lines
3.6 KiB
TypeScript
70 lines
3.6 KiB
TypeScript
import { Injectable, isDevMode } from '@angular/core';
|
|
import { Result, ok, err } from '@shared/kernel/fp';
|
|
import { currentRole } from '@shared/infrastructure/role';
|
|
import { currentSubject } from '@shared/infrastructure/subject';
|
|
import { problemDetail } from '@shared/infrastructure/api-error';
|
|
import { environment } from '@shared/environments/environment';
|
|
|
|
/** Exported so specs can assert against the same message id instead of retyping the
|
|
Dutch sentence (see `brief.store.spec.ts`'s `previewLetter` failure test). */
|
|
export const PREVIEW_FAILED = $localize`:@@brief.preview.failed:De voorvertoning kon niet worden geopend.`;
|
|
|
|
/**
|
|
* `/brief/preview` returns `text/html`, not JSON, and is `.ExcludeFromDescription()`'d
|
|
* to keep the NSwag-generated client JSON-only (same seam as uploads) — so this is a
|
|
* hand-written fetch, not the `ApiClient`. That also means it bypasses `HttpClient`'s
|
|
* `roleInterceptor` AND `subjectInterceptor`, so both `X-Role` and `X-Subject` are set
|
|
* here explicitly (without `X-Subject` this always previewed
|
|
* `DocumentStore.DemoOwner`'s letter regardless of who was actually logged in). Both are
|
|
* dev-only identity stand-ins (`role.ts`/`subject.ts`) and are sent only under
|
|
* `isDevMode()`, mirroring how the interceptors themselves are only registered in dev
|
|
* (`app.config.ts`) — a production build sends neither header from this call (BIO-012).
|
|
*
|
|
* `cache: 'no-store'`: the endpoint has no `Cache-Control`, only a CORS-driven
|
|
* `Vary: Origin`, and its content changes at the SAME URL as the letter moves
|
|
* draft → sent. Explicitly bypassing the HTTP cache is the correct default for any
|
|
* mutable resource served under one unversioned URL — independent of the
|
|
* identity work above, and not a complete fix by itself: see the KNOWN GAP note below.
|
|
*
|
|
* KNOWN GAP (not fixed here): under a non-`DocumentStore.DemoOwner` `X-Subject`,
|
|
* this repo's own e2e run against a real backend observed this endpoint's SENT
|
|
* response still carrying the draft watermark, even though (a) the outgoing request
|
|
* carried the correct `X-Subject`, and (b) `curl` against the same backend at the
|
|
* same moment correctly returned the frozen, unwatermarked archive. `cache: 'no-store'`
|
|
* did not change the outcome, so it is very unlikely a client-side caching artifact —
|
|
* it looks like a genuine backend-side staleness/race in `BriefStore`'s SQLite-backed
|
|
* read path, reproducible for MULTIPLE distinct owners and NOT reproducible for
|
|
* `DemoOwner`, which needs backend-side investigation (out of this file's scope —
|
|
* see `e2e/brief-v2.spec.ts`'s header comment, which keeps that spec on the shared
|
|
* `zorgverlener` identity until this is root-caused).
|
|
*/
|
|
@Injectable({ providedIn: 'root' })
|
|
export class LetterPreviewAdapter {
|
|
async preview(): Promise<Result<string, Blob>> {
|
|
let res: Response;
|
|
try {
|
|
const subject = currentSubject();
|
|
res = await fetch(`${environment.apiBaseUrl}/api/v1/brief/preview`, {
|
|
cache: 'no-store',
|
|
headers: isDevMode()
|
|
? { 'X-Role': currentRole(), ...(subject ? { 'X-Subject': subject } : {}) }
|
|
: {},
|
|
});
|
|
} catch {
|
|
return err(PREVIEW_FAILED);
|
|
}
|
|
if (!res.ok) return err(await errorMessage(res));
|
|
return ok(await res.blob());
|
|
}
|
|
}
|
|
|
|
/** Trust boundary (TE-002): maps a non-OK response to a message. Exported so a spec
|
|
can call it directly instead of stubbing `globalThis.fetch`. */
|
|
export async function errorMessage(res: Response): Promise<string> {
|
|
try {
|
|
return problemDetail(await res.json(), PREVIEW_FAILED);
|
|
} catch {
|
|
return PREVIEW_FAILED;
|
|
}
|
|
}
|