fixed thumbnails

app/lib/data/services/api_client.dart

@@ -5,6 +5,7 @@ library;
 import 'dart:async';
 import 'dart:convert';
 
+import 'package:flutter/foundation.dart' show kIsWeb;
 import 'package:http/http.dart' as http;
 
 import '../../domain/models/artifact.dart';
@@ -202,7 +203,14 @@ class ApiClient {
   String resolveMedia(String ref) {
     if (ref.startsWith('http://') || ref.startsWith('https://')) return ref;
     final path = ref.startsWith('/') ? ref : '/$ref';
-    return '$baseUrl$path';
+    final url = '$baseUrl$path';
+    // Web <img> tags can't send an Authorization header, so the auth-gated
+    // /media proxy is reached with the token as a query param instead. (Mobile
+    // uses mediaHeaders.) The token is URL-safe (base64url JWT); no encoding.
+    if (kIsWeb && path.startsWith('/media/') && _lastToken != null) {
+      return '$url?token=$_lastToken';
+    }
+    return url;
   }
 
   // ------------------------------------------------------------------------- //

app/lib/data/services/auth_service.dart

@@ -42,10 +42,12 @@ abstract class AuthService {
 class FirebaseAuthService implements AuthService {
   FirebaseAuthService({fb.FirebaseAuth? auth, GoogleSignIn? google})
       : _auth = auth ?? fb.FirebaseAuth.instance,
-        _google = google ?? GoogleSignIn();
+        // On web, `google_sign_in` asserts a client-id at construction and web
+        // sign-in goes through Firebase's popup instead — so never build it there.
+        _google = google ?? (kIsWeb ? null : GoogleSignIn());
 
   final fb.FirebaseAuth _auth;
-  final GoogleSignIn _google;
+  final GoogleSignIn? _google;
 
   AuthUser? _map(fb.User? u) => u == null
       ? null
@@ -77,7 +79,7 @@ class FirebaseAuthService implements AuthService {
     // (throws UnimplementedError); Firebase's popup flow handles Google there.
     if (kIsWeb) return _signInWithGoogleWeb(mergeGuestData: mergeGuestData);
 
-    final account = await _google.signIn();
+    final account = await _google!.signIn(); // non-null: web returns above
     if (account == null) throw fb.FirebaseAuthException(code: 'canceled');
     final gAuth = await account.authentication;
     final credential = fb.GoogleAuthProvider.credential(
@@ -150,7 +152,7 @@ class FirebaseAuthService implements AuthService {
 
   @override
   Future<void> signOut() async {
-    await _google.signOut();
+    await _google?.signOut();
     await _auth.signOut();
   }
 }

backend/app/api/media.py

@@ -15,7 +15,7 @@ from typing import Any
 from fastapi import APIRouter, HTTPException
 from fastapi.responses import FileResponse
 
-from app.auth import OwnerDep
+from app.auth import MediaOwnerDep
 from app.config import get_settings
 from app.store import db
 
@@ -25,7 +25,7 @@ router = APIRouter(prefix="/media", tags=["media"])
 
 
 @router.get("/{card_id}/{filename}")
-async def get_media(card_id: str, filename: str, owner_id: OwnerDep) -> Any:
+async def get_media(card_id: str, filename: str, owner_id: MediaOwnerDep) -> Any:
     """Stream one media file for a card the caller owns.
 
     404 for unknown or non-owned cards (never reveal another owner's media);

backend/app/auth.py

@@ -13,7 +13,7 @@ import asyncio
 import logging
 from typing import Annotated
 
-from fastapi import Depends, Header, HTTPException
+from fastapi import Depends, Header, HTTPException, Query
 from google.auth.transport import requests as google_requests
 from google.oauth2 import id_token as google_id_token
 
@@ -68,3 +68,34 @@ async def get_owner(authorization: str | None = Header(None)) -> str:
 
 
 OwnerDep = Annotated[str, Depends(get_owner)]
+
+
+async def get_owner_query_or_header(
+    authorization: str | None = Header(None),
+    token: str | None = Query(None),
+) -> str:
+    """Like [get_owner] but also accepts the token as a `?token=` query param.
+
+    Browser `<img>` tags can't send an Authorization header, so web thumbnails
+    fetch the auth-gated /media proxy with the token in the query string."""
+    if not get_settings().firebase_project_id:
+        raise HTTPException(status_code=503, detail="auth not configured")
+    raw: str | None = None
+    if authorization and authorization.startswith("Bearer "):
+        raw = authorization.removeprefix("Bearer ").strip()
+    elif token:
+        raw = token.strip()
+    if not raw:
+        raise HTTPException(status_code=401, detail="missing bearer token")
+    try:
+        decoded = await verify_async(raw)
+    except Exception as exc:
+        log.info("token verification failed: %s: %s", type(exc).__name__, exc)
+        raise HTTPException(status_code=401, detail="invalid or expired token")
+    uid = uid_of(decoded)
+    if not uid:
+        raise HTTPException(status_code=401, detail="token missing subject")
+    return uid
+
+
+MediaOwnerDep = Annotated[str, Depends(get_owner_query_or_header)]