2 Commits

Include renames

Author	SHA1	Message	Date
lobo	d9a39dda22	feat(auth): use the cookie session and refresh on 401 ... The token is no longer stored; a tbp_session flag remembers the login. apiFetch renews the session once on a 401 and sends the request again. Parallel requests and other tabs share one refresh, because Auth revokes the session when a refresh token is used twice. Only a 401 from the refresh ends the session; a 502 or no network shows the normal error.	2026-09-25 13:45:08 +02:00
lobo	5ff8d48c53	refactor(auth): send login token through apiFetch ... All authenticated calls now use apiFetch, and only utils/auth.js touches the stored token. The cookie login can then change these two files instead of every page.	2026-09-25 11:29:14 +02:00