From 6abe5bd33782f9fcd3ac819a6ea9445a71e83c38 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Andr=C3=A9=20Padez?= Date: Sat, 29 Aug 2026 21:18:53 +0100 Subject: [PATCH] use the context's client to expand a folder A bare fetch was returning 401: Officer's API authenticates with a bearer token, not a cookie, and only the hook holds it. The browser now supplies an authenticated client in the action's context. --- web/file-actions.ts | 17 +++++++++++------ 1 file changed, 11 insertions(+), 6 deletions(-) diff --git a/web/file-actions.ts b/web/file-actions.ts index 39b3d0d..538f5e6 100644 --- a/web/file-actions.ts +++ b/web/file-actions.ts @@ -43,7 +43,7 @@ export const fileActions: FileAction[] = [ const directories = entries.filter((entry) => entry.type === 'directory').length; return directories === 0 || (directories === 1 && entries.length === 1); }, - run: async (entries) => { + run: async (entries, context) => { /* A folder is expanded into the files inside it. @@ -59,12 +59,17 @@ export const fileActions: FileAction[] = [ let paths = chosen; if (entries.length === 1 && entries[0]!.type === 'directory') { - const response = await fetch( - `/api/fofos-admin/_config/media/files?path=${encodeURIComponent(chosen[0] ?? '')}`, - { credentials: 'same-origin' }, - ).catch(() => null); + /* + The context's client, not `fetch`. + + A bare fetch returns 401: this API authenticates with a bearer token rather than a cookie, and + only the hook holds it — which `run` cannot call, being an event handler outside React. So the + browser hands one over. + */ + const body = await context.client + .get<{ files?: string[] }>(`/fofos-admin/_config/media/files?path=${encodeURIComponent(chosen[0] ?? '')}`) + .catch(() => null); - const body = response?.ok ? ((await response.json()) as { files?: string[] }) : null; // Falling back to the folder itself would create the wrong gallery quietly. Nothing is better. if (!body?.files?.length) return; paths = body.files;