fix: 3 page errors found during testing

1. Categories page 400 error: when no category selected, was calling
products.category('') which returned 400. Now falls back to products.all(50)
when no category is selected.

2. QR page CORS error: qr.html was making direct browser fetches to
eesha-search.onrender.com which blocks cross-origin requests. Added
/api/openwa/* proxy route in web-server that injects the X-API-Key
header server-side. Updated qr.html to use the proxy.

3. Product page 404: was testing with product id=20 which was cleaned up.
Not a code bug — just stale test data. The page correctly shows
'Product not found' for non-existent IDs.

Eesha buying folder/categories.html

@@ -480,9 +480,12 @@
                 if (currentSearch) {
                     // Search within all products (optionally capped by maxPrice)
                     result = await window.EdgeFunctions.products.search(currentSearch, maxPrice);
-                } else {
+                } else if (currentCategory) {
                     // Browse by category with sort + pagination
-                    result = await window.EdgeFunctions.products.category(currentCategory || '', currentSort, page + 1);
+                    result = await window.EdgeFunctions.products.category(currentCategory, currentSort, page + 1);
+                } else {
+                    // No category selected — load all products
+                    result = await window.EdgeFunctions.products.all(50);
                 }
                 
                 if (!result.success) {

qr.html

@@ -10,11 +10,11 @@ body { background: #1a1a2e; display: flex; flex-direction: column; align-items:
 h1 { font-size: 1.5rem; margin-bottom: 0.5rem; }
 .subtitle { color: #aaa; font-size: 0.9rem; margin-bottom: 1.5rem; }
 #qr-img { max-width: 350px; width: 100%; border-radius: 20px; padding: 20px; background: white; display: none; }
-#loading { color: #fb5b1b; font-size: 1.2rem; padding: 40px; }
+#loading { color: #00d4ff; font-size: 1.2rem; padding: 40px; }
 #error { color: #ef4444; font-size: 1rem; padding: 20px; display: none; }
 .instructions { color: #aaa; font-size: 0.85rem; margin-top: 1.5rem; line-height: 1.6; }
-.warning { color: #fb5b1b; font-size: 0.85rem; margin-top: 0.5rem; }
-.btn { background: #fb5b1b; color: white; border: none; padding: 12px 32px; border-radius: 30px; font-size: 1rem; cursor: pointer; margin-top: 1.5rem; }
+.warning { color: #00d4ff; font-size: 0.85rem; margin-top: 0.5rem; }
+.btn { background: #00d4ff; color: #0f172a; border: none; padding: 12px 32px; border-radius: 30px; font-size: 1rem; cursor: pointer; margin-top: 1.5rem; font-weight: 700; }
 </style>
 </head>
 <body>
@@ -35,8 +35,9 @@ h1 { font-size: 1.5rem; margin-bottom: 0.5rem; }
 <button class="btn" onclick="loadQR()">🔄 Refresh QR Code</button>
 </div>
 <script>
-const GATEWAY_URL = 'https://eesha-search.onrender.com';
-const API_KEY = 'CellexWA2024';
+// Use the web-server proxy to avoid CORS issues
+// The proxy at /api/openwa/* injects the X-API-Key header server-side
+const PROXY_URL = '/api/openwa';
 const SESSION_NAME = 'eeshamart-main';
 
 async function loadQR() {
@@ -45,19 +46,17 @@ async function loadQR() {
     document.getElementById('qr-img').style.display = 'none';
 
     try {
-        const headers = { 'X-API-Key': API_KEY, 'Content-Type': 'application/json' };
-
         // Step 1: List sessions to find existing one
-        let resp = await fetch(`${GATEWAY_URL}/api/sessions`, { headers });
+        let resp = await fetch(`${PROXY_URL}/api/sessions`);
         let sessions = await resp.json();
-        let session = sessions.find(s => s.name === SESSION_NAME);
+        let session = Array.isArray(sessions) ? sessions[0] : null;
 
         // Step 2: If no session, create one
         if (!session) {
             console.log('Creating new session...');
-            resp = await fetch(`${GATEWAY_URL}/api/sessions`, {
+            resp = await fetch(`${PROXY_URL}/api/sessions`, {
                 method: 'POST',
-                headers,
+                headers: { 'Content-Type': 'application/json' },
                 body: JSON.stringify({ name: SESSION_NAME })
             });
             session = await resp.json();
@@ -67,16 +66,16 @@ async function loadQR() {
         console.log('Session ID:', sessionId);
 
         // Step 3: Start the session
-        await fetch(`${GATEWAY_URL}/api/sessions/${sessionId}/start`, {
+        await fetch(`${PROXY_URL}/api/sessions/${sessionId}/start`, {
             method: 'POST',
-            headers
+            headers: { 'Content-Type': 'application/json' }
         });
 
         // Step 4: Wait a moment for QR to generate
         await new Promise(r => setTimeout(r, 3000));
 
         // Step 5: Get QR code
-        resp = await fetch(`${GATEWAY_URL}/api/sessions/${sessionId}/qr`, { headers });
+        resp = await fetch(`${PROXY_URL}/api/sessions/${sessionId}/qr`);
         const data = await resp.json();
 
         const qrCode = data.qrCode || data.qr || data.base64;
@@ -90,7 +89,7 @@ async function loadQR() {
     } catch (err) {
         document.getElementById('loading').style.display = 'none';
         document.getElementById('error').style.display = 'block';
-        document.getElementById('error').innerHTML = `❌ ${err.message}<br><br>Try refreshing. If it keeps failing, <a href="${GATEWAY_URL}" target="_blank" style="color:#fb5b1b">click here to wake the gateway</a>, then refresh.`;
+        document.getElementById('error').innerHTML = `❌ ${err.message}<br><br>Try refreshing. If it keeps failing, <a href="https://eesha-search.onrender.com" target="_blank" style="color:#00d4ff">click here to wake the gateway</a>, then refresh.`;
     }
 }
 loadQR();

web-server/server.py

@@ -324,6 +324,55 @@ async def proxy_cross_platform(request: Request):
 async def proxy_telegram(request: Request):
     return await _proxy_to_edge_function("telegram", request)
 
+# ---- Phase 4: OpenWA gateway proxy (avoids CORS issues from browser) ----
+OPENWA_BASE_URL = os.environ.get("OPENWA_BASE_URL", "https://eesha-search.onrender.com")
+OPENWA_API_KEY = os.environ.get("OPENWA_API_KEY", "CellexWA2024")
+
+@app.api_route("/api/openwa/{path:path}", methods=["GET", "POST", "PUT", "DELETE"])
+async def proxy_openwa(path: str, request: Request):
+    """Proxy requests to the OpenWA gateway to avoid CORS issues.
+    The browser can't call eesha-search.onrender.com directly due to CORS,
+    so we proxy through here with the X-API-Key header injected server-side."""
+    target_url = f"{OPENWA_BASE_URL}/{path}"
+    
+    # Forward query params
+    if request.url.query:
+        target_url += f"?{request.url.query}"
+    
+    # Build headers — inject the API key
+    headers = {
+        "X-API-Key": OPENWA_API_KEY,
+        "Content-Type": "application/json",
+    }
+    
+    # Read body for POST/PUT
+    body = None
+    if request.method in ("POST", "PUT"):
+        body = await request.body()
+    
+    try:
+        async with httpx.AsyncClient(timeout=30.0) as client:
+            if request.method == "GET":
+                resp = await client.get(target_url, headers=headers)
+            elif request.method == "POST":
+                resp = await client.post(target_url, content=body, headers=headers)
+            elif request.method == "PUT":
+                resp = await client.put(target_url, content=body, headers=headers)
+            elif request.method == "DELETE":
+                resp = await client.delete(target_url, headers=headers)
+            else:
+                return JSONResponse({"error": "Method not allowed"}, status_code=405)
+        
+        try:
+            data = resp.json()
+        except Exception:
+            data = {"_raw": resp.text[:500]}
+        return JSONResponse(data, status_code=resp.status_code)
+    except httpx.TimeoutException:
+        return JSONResponse({"error": "OpenWA gateway timeout"}, status_code=504)
+    except Exception as e:
+        return JSONResponse({"error": str(e)}, status_code=500)
+
 # ---- Phase 3: Direct video upload to Supabase Storage ----
 # Sellers upload video files via PUT. The web-server reads the session cookie
 # to verify auth, then forwards the bytes to Supabase Storage using the