api doc

src/app/core/admin-auth/admin-auth-headers.interceptor.ts

@@ -2,13 +2,17 @@ import { HttpInterceptorFn } from '@angular/common/http';
 import { inject } from '@angular/core';
 import { AdminAuthService } from './admin-auth.service';
 
+/** Backend paths that require an active AdminWebSessionID per API-REFERENCE.md §0. */
+const ADMIN_GATED_PATH_SEGMENTS = ['/admin/', '/backoffice/', '/builder/', '/media/'];
+
 /**
  * Attaches admin session/token headers only to admin API requests. Mirrors
- * apiHeadersInterceptor's self-guarding pattern but scoped to `/admin` so it
- * never touches customer requests and never reads AuthService's session.
+ * apiHeadersInterceptor's self-guarding pattern but scoped to admin-gated
+ * paths so it never touches customer requests and never reads AuthService's
+ * session.
  */
 export const adminAuthHeadersInterceptor: HttpInterceptorFn = (req, next) => {
-  const isAdminRequest = req.url.includes('/admin/');
+  const isAdminRequest = ADMIN_GATED_PATH_SEGMENTS.some(segment => req.url.includes(segment));
   if (!isAdminRequest) {
     return next(req);
   }