fix billing and 2fa admin

apps/dashboard/src/lib/api.test.ts

@@ -164,7 +164,29 @@ describe('dashboard apiFetch', () => {
     process.env.NEXT_PUBLIC_API_URL = 'http://localhost:4000/api/v1'
 
     api = await import('./api')
-    expect(api.resolveApiOrigin()).toBe('http://localhost:4000')
+    expect(api.resolveApiOrigin()).toBe('http://localhost')
+  })
+
+  it('uses the dashboard proxy for local browser requests to a different local API port', async () => {
+    installBrowser()
+    ;(globalThis.window as any).location.origin = 'http://localhost:3000'
+    process.env.NEXT_PUBLIC_API_URL = 'http://localhost:4000/api/v1'
+    const fetchMock = vi.fn(async () => ({
+      ok: true,
+      json: async () => ({ data: { ok: true } }),
+    }))
+    Object.defineProperty(globalThis, 'fetch', { configurable: true, value: fetchMock })
+
+    const { apiFetch, resolveRealtimeSocketTarget } = await import('./api')
+    await apiFetch('/auth/employee/me')
+
+    expect(fetchMock).toHaveBeenCalledWith('/dashboard/api/v1/auth/employee/me', expect.objectContaining({
+      credentials: 'include',
+    }))
+    expect(resolveRealtimeSocketTarget()).toEqual({
+      origin: 'http://localhost:3000',
+      path: '/dashboard/socket.io',
+    })
   })
 
   it('routes proxied realtime connections through the dashboard socket path', async () => {

apps/dashboard/src/lib/api.ts

@@ -15,11 +15,19 @@ function shouldUseDashboardProxy(configuredApiBase?: string): boolean {
   if (!configuredApiBase) return true
   if (configuredApiBase.startsWith('/')) return false
 
-  const currentHostname = window.location?.hostname
-  if (!currentHostname || isLocalBrowserHost(currentHostname)) return false
-
   try {
-    return new URL(configuredApiBase).hostname !== currentHostname
+    const apiUrl = new URL(configuredApiBase)
+    const currentOrigin = window.location?.origin
+    const currentHostname = window.location?.hostname
+    if (!currentOrigin || !currentHostname) return false
+
+    if (isLocalBrowserHost(currentHostname) && isLocalBrowserHost(apiUrl.hostname)) {
+      return apiUrl.origin !== currentOrigin
+    }
+
+    if (isLocalBrowserHost(currentHostname)) return false
+
+    return apiUrl.origin !== currentOrigin
   } catch {
     return false
   }
@@ -87,9 +95,21 @@ export async function apiFetch<T>(path: string, options?: RequestInit): Promise<
   }
 
   if (!res.ok) {
-    const err = new Error(json?.message ?? json?.error ?? `Request failed with status ${res.status}`) as any
+    const issues = Array.isArray(json?.issues)
+      ? json.issues
+        .map((issue: any) => {
+          const path = Array.isArray(issue?.path) && issue.path.length ? `${issue.path.join('.')}: ` : ''
+          return issue?.message ? `${path}${issue.message}` : null
+        })
+        .filter(Boolean)
+      : []
+    const message = issues.length
+      ? `${json?.message ?? 'Invalid request'}: ${issues.join('; ')}`
+      : (json?.message ?? json?.error ?? `Request failed with status ${res.status}`)
+    const err = new Error(message) as any
     err.code = json?.error
     err.statusCode = res.status
+    err.issues = json?.issues
     throw err
   }