From bc52a0242f5442c1566af7d9884f6b9956537209 Mon Sep 17 00:00:00 2001
From: John Mizerek <mizerek@gmail.com>
Date: Tue, 10 Mar 2026 20:28:17 -0700
Subject: [PATCH] Fix saveOrderTypes: add X-Business-ID header for auth

Application.cfm requires request.BusinessID from session or header.
The fetch was only sending it in the POST body which the auth layer
doesn't read.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---
 portal/index.html | 2 +-
 portal/portal.js  | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/portal/index.html b/portal/index.html
index afd1671..d924a4c 100644
--- a/portal/index.html
+++ b/portal/index.html
@@ -806,7 +806,7 @@
   <!-- Toast Container -->
   <div class="toast-container" id="toastContainer"></div>
 
-  <script src="portal.js?v=15"></script>
+  <script src="portal.js?v=16"></script>
 
   <!-- Close dropdown when clicking outside -->
   <script>
diff --git a/portal/portal.js b/portal/portal.js
index 993da2b..fe5d5be 100644
--- a/portal/portal.js
+++ b/portal/portal.js
@@ -917,7 +917,7 @@ const Portal = {
     try {
       const response = await fetch(`${this.config.apiBaseUrl}/businesses/saveOrderTypes.cfm`, {
         method: 'POST',
-        headers: { 'Content-Type': 'application/json' },
+        headers: { 'Content-Type': 'application/json', 'X-Business-ID': this.config.businessId },
         body: JSON.stringify({ BusinessID: this.config.businessId, OrderTypes: types.join(',') })
       });
       const data = await response.json();