// Global authentication validation script - Simple group-level access control (function() { 'use strict'; // Configuration const AUTH_CONFIG = { tokenKey: 'access_token', timestampKey: 'token_timestamp', groupsKey: 'accessible_objects', maxAge: 60 * 60 * 1000, // 1 hour loginPath: '/login', loaderPaths: ['/', '/api-reference'], // Simple group access control - add all endpoints here endpointGroups: { '/api-reference/endpoint/auth': null, '/bulk-data-pagination': null, '/api-reference/endpoint/accounts': 'account', '/api-reference/endpoint/account-history': 'accounthistory', '/api-reference/endpoint/insurance-additional-information': 'insurance_additional_information__c', '/api-reference/endpoint/contacts': 'contact', '/api-reference/endpoint/contact-history': 'contacthistory', '/api-reference/endpoint/education': 'education__c', '/api-reference/endpoint/university-alumni': 'university_alumni__c', '/api-reference/endpoint/metro-area': 'metro_area__c', '/api-reference/endpoint/marketplace-searches': 'marketplace_searches__c', '/api-reference/endpoint/conference': 'conference__c', '/api-reference/endpoint/investment': 'investment__c', '/api-reference/endpoint/investment-holdings': 'investment_holdings', '/api-reference/endpoint/investment-strategy': 'investment_strategy__c', '/api-reference/endpoint/manager-presentation': 'manager_presentation__c', '/api-reference/endpoint/public-plan-minutes': 'public_plan_minute__c', '/api-reference/endpoint/member-comments': 'member_comments__c', '/api-reference/endpoint/dakota-content': 'dakota_content__c', '/api-reference/endpoint/dakota-news': 'dakota_news__c', '/api-reference/endpoint/updates': 'updates', '/api-reference/endpoint/custom-account-contact-relation': 'custom_accountcontactrelation', '/api-reference/endpoint/performance': 'performance', '/api-reference/endpoint/fund-memo': 'fund_memo', '/api-reference/endpoint/transaction': 'transaction__c', '/api-reference/endpoint/transaction-account': 'transaction_account__c', '/api-reference/endpoint/location': 'location', '/api-reference/endpoint/city-guide': 'city_guide', '/api-reference/endpoint/fund-news': 'fund_news', // Field page restrictions - similar to API endpoints '/fields/Account': 'account', '/fields/AccountHistory': 'accounthistory', '/fields/InsuranceAdditionalInformation': 'insurance_additional_information__c', '/fields/Contact': 'contact', '/fields/ContactHistory': 'contacthistory', '/fields/Education': 'education__c', '/fields/UniversityAlumni': 'university_alumni__c', '/fields/MetroArea': 'metro_area__c', '/fields/MarketplaceSearches': 'marketplace_searches__c', '/fields/Investment': 'investment__c', '/fields/InvestmentHoldings': 'investment_holdings', '/fields/InvestmentStrategy': 'investment_strategy__c', '/fields/PublicPlanMinutes': 'public_plan_minute__c', '/fields/Conference': 'conference__c', '/fields/ManagerPresentation': 'manager_presentation__c', '/fields/Performance': 'performance', '/fields/FundMemo': 'fund_memo', '/fields/Transaction': 'transaction__c', '/fields/TransactionAccount': 'transaction_account__c', '/fields/Location': 'location', '/fields/CityGuide': 'city_guide', '/fields/FundNews': 'fund_news', '/fields/DakotaNews': 'dakota_news__c', '/fields/Updates': 'updates' } }; // Restricted users for API Reference access const API_RESTRICTED_USERS = ['nb-snowflake']; let ACCESSIBLE_OBJECTS = null; // Global Loader Functions function createGlobalLoader() { if (document.getElementById('auth-global-loader')) return; const loaderHTML = `

`; document.body.insertAdjacentHTML('afterbegin', loaderHTML); } function showGlobalLoader() { createGlobalLoader(); const loader = document.getElementById('auth-global-loader'); if (loader) { loader.style.display = 'flex'; // Hide the main content to prevent flicker document.body.style.visibility = 'hidden'; // Make loader visible const loaderElement = document.getElementById('auth-global-loader'); if (loaderElement) { loaderElement.style.visibility = 'visible'; } // Record the start time for minimum display duration loader.startTime = Date.now(); } } function hideGlobalLoader() { const loader = document.getElementById('auth-global-loader'); if (!loader) return; const minMs = 800; // keep your global minimum display time const start = loader.startTime || Date.now(); const remaining = Math.max(0, minMs - (Date.now() - start)); clearTimeout(loader._hideTid); loader._hideTid = setTimeout(() => { document.body.style.visibility = 'visible'; loader.style.transition = 'opacity 0.3s ease-out'; loader.style.opacity = '0'; clearTimeout(loader._removeTid); loader._removeTid = setTimeout(() => { if (loader.parentNode) loader.parentNode.removeChild(loader); }, 300); }, remaining); } function shouldShowLoaderForPath(pathname) { try { function normalize(p) { if (!p) return '/'; if (p.length > 1 && p.endsWith('/')) return p.slice(0, -1); return p; } const current = normalize(pathname); return AUTH_CONFIG.loaderPaths.some(function(path) { return normalize(path) === current; }); } catch (_) { return false; } } function getPathnameFromArg(arg) { try { if (!arg) return window.location.pathname; const url = new URL(arg, window.location.origin); return url.pathname; } catch (_) { return window.location.pathname; } } // Watermark visibility based on ?playground=open function getUrlFromArg(arg) { try { if (!arg) return window.location.href; const url = new URL(arg, window.location.origin); return url.href; } catch (_) { return window.location.href; } } function isPlaygroundOpenFromHref(href) { try { const url = new URL(href, window.location.origin); return url.searchParams.get('playground') === 'open'; } catch (_) { return false; } } function setWatermarkVisibility(visible) { try { let styleEl = document.getElementById('watermark-visibility-style'); if (!styleEl) { styleEl = document.createElement('style'); styleEl.id = 'watermark-visibility-style'; document.head.appendChild(styleEl); } styleEl.textContent = visible ? 'body::after{display:block !important;}' : 'body::after{display:none !important;}'; } catch (_) {} } function updateWatermarkVisibilityForUrl(href) { const isOpen = isPlaygroundOpenFromHref(href); setWatermarkVisibility(!isOpen); } function isRestrictedUser() { try { const username = (localStorage.getItem('username') || '')?.trim()?.toLowerCase(); if (!username) return false; return API_RESTRICTED_USERS.some(function(u) { return String(u).toLowerCase() === username; }); } catch (_) { return false; } } function hideApiReferenceLinksIfRestricted() { try { if (!isRestrictedUser()) return; showGlobalLoader(); const links = document.querySelectorAll("a[href='/api-reference']"); links.forEach(function(link) { if (link && link.style) link.style.display = 'none'; }); hideGlobalLoader(); } catch (_) {} } function blockApiReferenceForRestricted() { try { if (!isRestrictedUser()) return false; const currentPath = window.location.pathname || ''; if (currentPath === '/api-reference' || currentPath.startsWith('/api-reference/')) { showGlobalLoader(); document.body.style.visibility = 'visible'; document.body.innerHTML = `

🔒

Access Denied

You don't have permission to access this page.

`; hideGlobalLoader(); return true; } return false; } catch (_) { return false; } } // Remove all elements with class 'invisible' (used to hide the right panel on /login) function removeAllInvisibleElements() { try { function sweep() { const nodes = document.querySelectorAll('.invisible'); nodes.forEach(function(node) { if (node && node.parentNode) node.parentNode.removeChild(node); }); } // Initial sweep sweep(); // Briefly sweep for late insertions let attempts = 0; const maxAttempts = 50; // ~5s const timer = setInterval(function() { attempts += 1; sweep(); if (attempts >= maxAttempts) clearInterval(timer); }, 100); } catch (_) {} } // Generate login HTML function generateLoginHTML() { return ` Login - Dakota `; } // External login generator no longer needed; using inline generateLoginHTML // Check if we're on login page function checkIfLoginPage() { return window.location.pathname.includes('/login') || window.location.href.includes('/login') || document.title.includes('Login'); } // Fetch user groups from API async function fetchUserGroups() { const token = localStorage.getItem(AUTH_CONFIG.tokenKey); if (!token) { ACCESSIBLE_OBJECTS = null; return []; } try { const response = await fetch('https://marketplace-as-a-service.herokuapp.com/api/accessibilityObjects', { method: 'POST', headers: { 'Oauth-Token': token }, redirect: 'follow' }); if (!response.ok) { // Handle unauthorized/invalid token if (response.status === 401 || response.status === 403) { ACCESSIBLE_OBJECTS = null; localStorage.clear(); window.location.href = AUTH_CONFIG.loginPath; return []; } // Try to read error body for logging let errorText = ''; try { errorText = await response.text(); } catch (_) {} console.error('Permissions fetch failed:', response.status, errorText); ACCESSIBLE_OBJECTS = null; return []; } // Try to parse JSON; API might return text on success let data; const text = await response.text(); try { data = JSON.parse(text); } catch (e) { // If API returns plain text, try to derive array or fail gracefully console.warn('Non-JSON group response, received text:', text); data = {}; } const accessibleObjects = Array.isArray(data?.accessible_objects) ? data.accessible_objects : Array.isArray(data) ? data : []; ACCESSIBLE_OBJECTS = accessibleObjects; // in-memory only return accessibleObjects; } catch (error) { console.error('Error fetching permissions:', error); // On network or unexpected errors, clear and redirect per requirement ACCESSIBLE_OBJECTS = null; localStorage.clear(); window.location.href = AUTH_CONFIG.loginPath; return []; } } // Get user groups async function getUserGroups() { if (Array.isArray(ACCESSIBLE_OBJECTS)) { return ACCESSIBLE_OBJECTS; } return await fetchUserGroups(); } // Check if user has access to endpoint async function hasAccess(endpoint) { const requiredPermissions = AUTH_CONFIG.endpointGroups[endpoint]; if (!requiredPermissions || requiredPermissions === null) { return true; // No restrictions } const userPermissions = await getUserGroups(); if (!userPermissions || userPermissions.length === 0) return false; return userPermissions.includes(requiredPermissions); } // Hide restricted API cards async function hideRestrictedCards() { try { // Ensure loader visible during DOM updates showGlobalLoader(); const removeCardAndEmptyWrapper = function(cardEl) { if (!cardEl || !cardEl.parentElement) return; let nodeToRemove = cardEl; // Mintlify Cards in Columns are often wrapped in one or more single-child containers. // Bubble up through empty wrappers so no visual placeholder remains. while ( nodeToRemove.parentElement && nodeToRemove.parentElement.children.length === 1 && !['MAIN', 'BODY', 'HTML'].includes(nodeToRemove.parentElement.tagName) ) { nodeToRemove = nodeToRemove.parentElement; } nodeToRemove.remove(); }; const cards = document.querySelectorAll('main [href*="/api-reference/endpoint/"]'); for (const card of cards) { const href = card.getAttribute('href'); if (href && !(await hasAccess(href))) { removeCardAndEmptyWrapper(card); } } // Hide field page cards const fieldCards = document.querySelectorAll('main [href*="/fields/"]'); for (const card of fieldCards) { const href = card.getAttribute('href'); if (href && !(await hasAccess(href))) { removeCardAndEmptyWrapper(card); } } // Hide navigation sidebar items (works for all screen sizes) const navLinks = document.querySelectorAll('a[href*="/api-reference/endpoint/"], a[href*="/fields/"]'); for (const link of navLinks) { const href = link.getAttribute('href'); if (href && !(await hasAccess(href))) { // Find the parent navigation item container let parent = link.closest('li') || link.closest('[role="menuitem"]') || link.closest('.nav-item') || link.closest('[data-testid]') || link.parentElement; if (parent) { // Check if this is part of a navigation group const groupContainer = parent.closest('[role="group"]') || parent.closest('.nav-group') || parent.closest('[data-group]'); if (groupContainer) { // Check if this is the only visible item in the group const groupItems = groupContainer.querySelectorAll('a[href*="/api-reference/endpoint/"]:not([style*="display: none"]), a[href*="/fields/"]:not([style*="display: none"])'); if (groupItems.length === 1) { // Hide the entire group if it has only one item groupContainer.style.display = 'none'; } else { // Just hide this specific item parent.style.display = 'none'; } } else { // Hide the parent element parent.style.display = 'none'; } } } } // Clean up empty navigation groups const navGroups = document.querySelectorAll('[role="group"], .nav-group, [data-group]'); for (const group of navGroups) { const visibleItems = group.querySelectorAll('a[href*="/api-reference/endpoint/"]:not([style*="display: none"]), a[href*="/fields/"]:not([style*="display: none"])'); if (visibleItems.length === 0) { group.style.display = 'none'; } } } finally { // Hide the loader after all cards are processed hideGlobalLoader(); } } // Block access to restricted endpoint async function blockRestrictedAccess() { showGlobalLoader(); const currentPath = window.location.pathname; const requiredGroups = AUTH_CONFIG.endpointGroups[currentPath]; if (requiredGroups && requiredGroups !== null) { const userGroups = await getUserGroups(); const hasRequiredGroup = userGroups && userGroups.some(group => group === requiredGroups); if (!hasRequiredGroup) { document.body.style.visibility = 'visible'; document.body.innerHTML = `

🔒

Access Denied

You don't have permission to access this page.

`; } } hideGlobalLoader(); // Hide loader before showing access denied } // Shared logout button builder function createLogoutButtonElement(id) { const btn = document.createElement('button'); if (id) btn.id = id; btn.type = 'button'; btn.innerHTML = 'Logout'; btn.style.backgroundColor = '#dc2626'; btn.style.color = '#ffffff'; btn.style.border = 'none'; btn.style.padding = '8px 12px'; btn.style.borderRadius = '9999px'; btn.style.fontSize = '0.875rem'; btn.style.fontWeight = '500'; btn.style.cursor = 'pointer'; btn.addEventListener('click', function(e) { e.preventDefault(); logout(); }); return btn; } // Add logout button function addLogoutButton() { const addButton = () => { const navbar = document.querySelector('nav') || document.querySelector('header') || document.querySelector('[role="navigation"]') || document.querySelector('.navbar') || document.querySelector('.nav'); if (!navbar) { setTimeout(addButton, 100); return; } if (document.getElementById('logout-btn')) return; const logoutBtn = createLogoutButtonElement('logout-btn'); logoutBtn.style.marginLeft = '1rem'; navbar.appendChild(logoutBtn); navbar.style.setProperty('display', 'flex', 'important'); }; addButton(); } // Logout function function logout() { ACCESSIBLE_OBJECTS = null; localStorage.removeItem(AUTH_CONFIG.tokenKey); localStorage.removeItem(AUTH_CONFIG.timestampKey); localStorage.removeItem(AUTH_CONFIG.groupsKey); document.body.classList.remove('authenticated'); window.location.href = AUTH_CONFIG.loginPath; } // Load login page async function createCleanLoginPage() { try { const loginHTML = generateLoginHTML(); document.open(); document.write(loginHTML); document.close(); } catch (error) { console.error('Error generating login page:', error); window.location.href = AUTH_CONFIG.loginPath; } } // Main authentication check async function checkAuthentication() { const currentPath = window.location.pathname; if (checkIfLoginPage()) { // Remove any elements marked as invisible on login try { removeAllInvisibleElements(); } catch (_) {} await createCleanLoginPage(); return; } // Conditionally show loader based on route whitelist if (shouldShowLoaderForPath(currentPath)) { showGlobalLoader(); } // Update watermark based on current URL updateWatermarkVisibilityForUrl(window.location.href); const token = localStorage.getItem(AUTH_CONFIG.tokenKey); if (!token) { hideGlobalLoader(); window.location.href = AUTH_CONFIG.loginPath; return; } const tokenTimestamp = localStorage.getItem(AUTH_CONFIG.timestampKey); if (tokenTimestamp) { const tokenAge = Date.now() - parseInt(tokenTimestamp); if (tokenAge > AUTH_CONFIG.maxAge) { localStorage.removeItem(AUTH_CONFIG.tokenKey); localStorage.removeItem(AUTH_CONFIG.timestampKey); localStorage.removeItem(AUTH_CONFIG.groupsKey); ACCESSIBLE_OBJECTS = null; hideGlobalLoader(); window.location.href = AUTH_CONFIG.loginPath; return; } } document.body.classList.add('authenticated'); // If restricted user, block API Reference pages and hide API Reference links if (blockApiReferenceForRestricted()) return; hideApiReferenceLinksIfRestricted(); addLogoutButton(); // Check endpoint access for both API endpoints and field pages if (currentPath.includes('/api-reference/endpoint/') || currentPath.includes('/fields/')) { await blockRestrictedAccess(); } // Hide restricted cards on all pages (navigation sidebar is always visible) // Keep loader visible until DOM updates are finished inside hideRestrictedCards await hideRestrictedCards(); } // Run authentication check checkAuthentication(); if (document.readyState === 'loading') { document.addEventListener('DOMContentLoaded', checkAuthentication); } else { checkAuthentication(); } // Listen for navigation changes const originalPushState = history.pushState; const originalReplaceState = history.replaceState; history.pushState = function() { originalPushState.apply(history, arguments); setTimeout(() => { const nextPath = getPathnameFromArg(arguments[2]); const nextHref = getUrlFromArg(arguments[2]); updateWatermarkVisibilityForUrl(nextHref); if (shouldShowLoaderForPath(nextPath)) { showGlobalLoader(); } setTimeout(checkAuthentication, 50); }, 0); }; history.replaceState = function() { originalReplaceState.apply(history, arguments); setTimeout(() => { const nextPath = getPathnameFromArg(arguments[2]); const nextHref = getUrlFromArg(arguments[2]); updateWatermarkVisibilityForUrl(nextHref); if (shouldShowLoaderForPath(nextPath)) { showGlobalLoader(); } setTimeout(checkAuthentication, 50); }, 0); }; // Listen for storage changes window.addEventListener('storage', function(e) { if (e.key === AUTH_CONFIG.tokenKey && !e.newValue) { ACCESSIBLE_OBJECTS = null; document.body.classList.remove('authenticated'); hideGlobalLoader(); window.location.href = AUTH_CONFIG.loginPath; } }); // Handle browser navigation (back/forward) window.addEventListener('popstate', function() { updateWatermarkVisibilityForUrl(window.location.href); }); // Listen for window resize events to handle responsive navigation window.addEventListener('resize', function() { setTimeout(() => { if (shouldShowLoaderForPath(window.location.pathname)) { showGlobalLoader(); } setTimeout(() => { hideRestrictedCards(); }, 100); }, 0); }); // Set up mutation observer to handle navigation reopening const observer = new MutationObserver(function(mutations) { let shouldRehide = false; mutations.forEach(function(mutation) { if (mutation.type === 'childList' && mutation.addedNodes.length > 0) { for (let node of mutation.addedNodes) { if (node && node.nodeType === Node.ELEMENT_NODE) { // If any newly added subtree includes an API Reference anchor, hide it immediately try { if ((node.matches && node.matches("a[href='/api-reference']")) || (node.querySelector && node.querySelector("a[href='/api-reference']"))) { hideApiReferenceLinksIfRestricted(); } } catch (_) {} if ((node.id === 'headlessui-portal-root') || (node.matches && node.matches('#headlessui-portal-root'))) { const dialogEl = node.querySelector('[role="dialog"][id^="headlessui-dialog-_r"]'); if (dialogEl) { shouldRehide = true; break; } } } } } }); if (shouldRehide) { showGlobalLoader(); setTimeout(function() { try { hideApiReferenceLinksIfRestricted(); } catch (_) {} hideRestrictedCards(); }, 100); } }); observer.observe(document.body, { childList: true, subtree: true }); // Bind 'More actions' button to logout (reuse shared creator) function bindMoreActionsLogout(root) { try { const scope = (root && root.querySelector) ? root : document; const buttons = scope.querySelectorAll('button[aria-label="More actions"]'); buttons.forEach(function(btn) { if (!btn) return; // Replace button content/style with a standardized logout button const parent = btn.parentNode; const newBtn = createLogoutButtonElement('logout-btn-inline'); newBtn.style.minWidth = 'fit-content'; newBtn.style.padding = '6px 10px'; if (parent) { parent.replaceChild(newBtn, btn); } }); } catch (err) { console.error('Error binding More actions logout:', err); } } // Initial bind on load bindMoreActionsLogout(document); // Observe for dynamic insertion of the More actions button const moreActionsObserver = new MutationObserver(function(mutations) { mutations.forEach(function(mutation) { if (mutation.type === 'childList' && mutation.addedNodes.length > 0) { for (let node of mutation.addedNodes) { if (node.nodeType === Node.ELEMENT_NODE && ( (node.matches && node.matches('button[aria-label="More actions"]')) || (node.querySelector && node.querySelector('button[aria-label="More actions"]')) )) { setTimeout(function() { bindMoreActionsLogout(node); }, 0); break; } } } }); }); moreActionsObserver.observe(document.body, { childList: true, subtree: true }); })(); /* Intercept XHR requests to /api/oauth2 / *hould save the tokens to local storage */ (function (open, send) { XMLHttpRequest.prototype.open = function (method, url, ...rest) { this._url = url; this._method = method; return open.call(this, method, url, ...rest); }; XMLHttpRequest.prototype.send = function (...args) { this.addEventListener("load", function () { try { // Parse request body if available let body = null; if (args.length > 0 && typeof args[0] === "string") { try { body = JSON.parse(args[0]); } catch (e) { body = null; // Ignore if not valid JSON } } // Skip if not targeting /api/oauth2 if (!body || !body.url || !body.url.includes("/api/oauth2")) return; // Parse response JSON let res; try { res = JSON.parse(this.responseText); } catch (e) { console.warn("Invalid JSON response:", e); return; } // Extract encoded data const returnedData = res?.response?.data; if (!returnedData) return; // Decode Base64 safely let decodedData; try { decodedData = atob(returnedData); } catch (e) { console.warn("Base64 decode failed:", e); return; } // Parse decoded JSON let parsedDecoded; try { parsedDecoded = JSON.parse(decodedData); } catch (e) { console.warn("Decoded data is not valid JSON:", e); return; } // Extract tokens const accessToken = parsedDecoded?.access_token; const refreshToken = parsedDecoded?.refresh_token; if (accessToken && refreshToken) { localStorage.setItem("access_token", accessToken); localStorage.setItem("refresh_token", refreshToken); localStorage.setItem("token_timestamp", Date.now().toString()); } else { console.warn("Tokens not found in decoded data."); } } catch (err) { console.error("Unexpected error while intercepting XHR:", err); } }); return send.apply(this, args); }; })(XMLHttpRequest.prototype.open, XMLHttpRequest.prototype.send);

Field(Payload)	Field(Response)	Label	Type	Length
`isdeleted`	`isdeleted`	Is Deleted	boolean	0
`accountid`	`accountid`	Account ID	reference to: Account	18
`createdbyid`	`createdbyid`	Created By ID	reference to: User	18
`createddate`	`date_entered`	Date Entered	datetime	0
`field`	`field`	Field Name	string	255
`datatype`	`datatype`	Data Type	string	255
`oldvalue`	`oldvalue`	Old Value	string	255
`newvalue`	`newvalue`	New Value	string	255

​Field Reference Table

Field Reference Table