UN-2946 [MISC] Restore Prompt Studio public sharing after lookups V2 wiring (#1963)

* UN-2946 [FIX] Restore Prompt Studio public sharing after lookups V2 wiring

Three issues broke /promptStudio/share/* after the lookups V2 PR:

- The global useAxiosPrivate response interceptor calls logout() on any
  401. An authenticated probe leaking into the anonymous share viewer
  (e.g. the new useLookupDirtySeed hook on first mount) returned 401 and
  redirected the share page through /api/v1/logout. Skip the logout when
  the current path is /promptStudio/share/* — the viewer has no session
  to expire.

- The local Traefik router only forwarded /api/v1 and /deployment to the
  backend; /public/share/* fell through to the Vite dev server and the
  share endpoints returned the SPA index instead of JSON. Add /public to
  the backend rule (and to the frontend negative match) in both the
  compose labels and the sample proxy override.

- The Combined Output JSON view defaulted to the Raw tab even when an
  enriched lookup output existed. For anonymous share viewers the
  enriched value is the point of the project; default activeView to
  Enriched when isPublicSource. The existing useEffect already falls
  back to Raw when no enriched data is present, so projects without
  lookups are unaffected.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* UN-2946 [DOCS] Tighten public-share guard comments

Drop incident/context references; keep one-line WHYs.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* UN-2946 [FIX] Tighten path match and re-sync enriched default (review)

- useAxiosPrivate: trailing slash so the prefix doesn't match unintended
  siblings of /promptStudio/share/.
- JsonView: re-sync activeView when isPublicSource or enrichedOutput
  changes, not just on first mount, to survive store hydration order.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* UN-2946 [FIX] Use globalThis over window in axios 401 guard

Resolves SonarCloud S7764 findings on useAxiosPrivate.js.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* UN-2946 [FIX] Address review on public-share 401 + Enriched default

- Log a console.warn breadcrumb when a 401 is suppressed on the public
  share route so stray authenticated probes don't go silent.
- Gate the JsonView Enriched default behind a first-load ref so the
  default fires once and a manual Raw toggle isn't stomped on
  re-renders.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: chandrasekharan-zipstack

docker/docker-compose.yaml

@@ -32,7 +32,7 @@ services:
       - APPLICATION_NAME=unstract-backend
     labels:
       - traefik.enable=true
-      - traefik.http.routers.backend.rule=Host(`frontend.unstract.localhost`) && (PathPrefix(`/api/v1`) || PathPrefix(`/deployment`))
+      - traefik.http.routers.backend.rule=Host(`frontend.unstract.localhost`) && (PathPrefix(`/api/v1`) || PathPrefix(`/deployment`) || PathPrefix(`/public`))
       - traefik.http.services.backend.loadbalancer.server.port=8000
     extra_hosts:
       # "host-gateway" is a special string that translates to host docker0 i/f IP.
@@ -134,7 +134,7 @@ services:
       - ENVIRONMENT=development
     labels:
       - traefik.enable=true
-      - traefik.http.routers.frontend.rule=Host(`frontend.unstract.localhost`) && !PathPrefix(`/api/v1`) && !PathPrefix(`/deployment`)
+      - traefik.http.routers.frontend.rule=Host(`frontend.unstract.localhost`) && !PathPrefix(`/api/v1`) && !PathPrefix(`/deployment`) && !PathPrefix(`/public`)
       - traefik.http.services.frontend.loadbalancer.server.port=80
 
   platform-service:

docker/sample.proxy_overrides.yaml

@@ -5,7 +5,7 @@ http:
       rule: Host(`frontend.unstract.localhost`)
     backend:
       service: backend
-      rule: Host(`frontend.unstract.localhost`) && (PathPrefix(`/api/v1`) || PathPrefix(`/deployment`))
+      rule: Host(`frontend.unstract.localhost`) && (PathPrefix(`/api/v1`) || PathPrefix(`/deployment`) || PathPrefix(`/public`))
 
   services:
     frontend:

frontend/src/components/custom-tools/combined-output/JsonView.jsx

@@ -2,8 +2,9 @@ import { Tabs } from "antd";
 import TabPane from "antd/es/tabs/TabPane";
 import Prism from "prismjs";
 import PropTypes from "prop-types";
-import { useEffect, useState } from "react";
+import { useEffect, useRef, useState } from "react";
 
+import { useCustomToolStore } from "../../../store/custom-tool-store";
 import { JsonViewBody } from "./JsonViewBody";
 
 let EnrichedOutputToggle;
@@ -27,17 +28,31 @@ function JsonView({
   isSinglePass,
   isLoading,
 }) {
-  const [activeView, setActiveView] = useState("Raw");
+  // Read-only viewers default to the enriched value.
+  const isPublicSource = useCustomToolStore((s) => s.isPublicSource);
+  const [activeView, setActiveView] = useState(
+    isPublicSource ? "Enriched" : "Raw",
+  );
+  const didInitTab = useRef(false);
 
   useEffect(() => {
     Prism.highlightAll();
   }, [combinedOutput, enrichedOutput, activeView]);
 
   useEffect(() => {
-    if (!enrichedOutput || Object.keys(enrichedOutput).length === 0) {
+    const hasEnriched =
+      enrichedOutput && Object.keys(enrichedOutput).length > 0;
+    if (!hasEnriched) {
       setActiveView("Raw");
+      didInitTab.current = false;
+      return;
+    }
+    // Public viewer default fires once so a manual Raw toggle isn't stomped on re-renders.
+    if (isPublicSource && !didInitTab.current) {
+      setActiveView("Enriched");
+      didInitTab.current = true;
     }
-  }, [enrichedOutput]);
+  }, [enrichedOutput, isPublicSource]);
 
   const displayOutput =
     activeView === "Enriched" &&

frontend/src/hooks/useAxiosPrivate.js

@@ -14,8 +14,20 @@ function useAxiosPrivate() {
       },
       async (error) => {
         if (error?.response?.status === 401) {
-          // TODO: Implement Session Expired Modal
-          logout();
+          // Skip logout on routes that intentionally render without a session.
+          const onPublicShare =
+            typeof globalThis !== "undefined" &&
+            globalThis.location?.pathname.startsWith("/promptStudio/share/");
+          if (onPublicShare) {
+            // Keep a breadcrumb so a stray authenticated probe doesn't go silent.
+            console.warn("[useAxiosPrivate] Suppressed 401 on public share", {
+              url: error?.config?.url,
+              path: globalThis.location?.pathname,
+            });
+          } else {
+            // TODO: Implement Session Expired Modal
+            logout();
+          }
         }
         return Promise.reject(error);
       },