fix: change browsers fetch to get 401s and redirect

[lucaseduoli]

This pull request introduces a global override for window.fetch in the browser to handle authentication errors more gracefully. Now, if a fetch request receives a 401 Unauthorized response with a redirect URL in the response payload, the client will automatically redirect the user to that URL.

Authentication and error handling improvements:

• Added a global wrapper around window.fetch in providers.tsx to detect 401 responses, parse the response body for possible redirect URLs (redirect_url, redirectUrl, or redirect), and redirect the browser if a URL is found. Errors during parsing are logged to the console.

Summary by CodeRabbit

• Bug Fixes
  • Improved handling of authentication failures (401 responses) with automatic browser redirection when a valid redirect URL is provided by the server.
  • Added validation to ensure redirects are safe and prevent open-redirect scenarios.
  • Robust error handling and logging for redirect parsing issues while preserving original responses.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: a7022d16-e103-4c17-9361-5f3430d88ed4

📥 Commits

Reviewing files that changed from the base of the PR and between 13aa7c3 and 8f86048.

⛔ Files ignored due to path filters (1)

• frontend/package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (1)

• frontend/app/providers.tsx

🚧 Files skipped from review as they are similar to previous changes (1)

• frontend/app/providers.tsx

---

Walkthrough

Adds a client-side fetch interceptor in the root provider that detects HTTP 401 responses, parses the response body for a redirect URL (three field name variants), validates it for safe relative or same-origin targets with a /login fallback, navigates the browser when valid, and returns the original Response.

Changes

401 Redirect Handling

Layer / File(s)	Summary
Fetch interceptor for 401 responses frontend/app/providers.tsx	Monkey-patches window.fetch on the client to intercept 401 responses, clone and JSON-parse the response body to extract redirect_url, redirectUrl, or redirect, validate the redirect target (safe relative or same-origin, default /login), set window.location.href when valid, log parse errors, and return the original response in all cases.

sequenceDiagram
  participant Browser
  participant FetchWrapper
  participant Server
  Browser->>FetchWrapper: window.fetch(request)
  FetchWrapper->>Server: network request
  Server-->>FetchWrapper: 401 response with JSON { redirect_url / redirectUrl / redirect }
  FetchWrapper->>FetchWrapper: clone() → parse JSON → validate redirect
  FetchWrapper->>Browser: window.location.href = validatedRedirect (if valid)
  FetchWrapper-->>Browser: return original Response

Loading

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Suggested reviewers

• edwinjosechittilappilly
• mfortman11

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately describes the main change: intercepting browser fetch requests to detect 401 responses and redirect based on server-provided URLs.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/redirect_401_main

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@frontend/app/providers.tsx`:
- Around line 15-18: The code sets window.location.href directly from the
untrusted redirectUrl variable, creating an open-redirect risk; fix by
validating redirectUrl before assigning it to window.location.href in the same
block where redirectUrl is determined: allow only relative paths (e.g., strings
that start with "/" but not "//") or same-origin absolute URLs (use the URL
constructor with location.origin as base and verify url.origin ===
location.origin), and fall back to a safe default like "/" or "/login" if
validation fails; replace the direct assignment to window.location.href with the
validated URL.
- Around line 6-10: The module-level replacement of window.fetch in
providers.tsx is re-applied on each HMR causing nested wrappers; modify the
logic that captures originalFetch and assigns window.fetch to first check for a
marker (e.g., a Symbol or reserved property) on window.fetch to skip re-wrapping
if already patched, store the true original fetch once (use originalFetch
variable only when marker is absent), set the marker on the patched function,
and keep the existing 401 handling behavior in the patched fetch wrapper so
subsequent hot reloads do not wrap it again.

🪄 Autofix (Beta)

✅ Autofix completed

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 42043fd4-6b82-4631-9658-aae1c8a63f5c

📥 Commits

Reviewing files that changed from the base of the PR and between 8530ab0 and 13aa7c3.

📒 Files selected for processing (1)

• frontend/app/providers.tsx

[coderabbitai]

Note

Autofix is a beta feature. Expect some limitations and changes as we gather feedback and continue to improve it.

Fixes Applied Successfully

Fixed 2 file(s) based on 2 unresolved review comments.

Files modified:

• frontend/app/providers.tsx
• frontend/package-lock.json

Commit: be5cbbccd284df689f67fd10173154c951c8cf02

The changes have been pushed to the fix/redirect_401_main branch.

Time taken: 6m 30s