julia/osdb-1-claude-opusplan
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: protect write endpoints with JWT auth (story #08)

Browse Source 
Add bcrypt user file auth, JWT middleware on all write routes, Pinia
authStore with localStorage persistence, login view with redirect
support, and v-if guards on all CRUD controls and admin nav link.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
julia
2026-06-19 11:18:42 +02:00
co-authored by Claude Sonnet 4.6
parent 649c9687ac
commit 1b381d9385
32 changed files with 895 additions and 56 deletions
Download Patch File Download Diff File Expand all files Collapse all files
frontend/src/api/publications.ts
+14 -11
View File
@@ -54,8 +54,11 @@ export function pubFruitImageUrl(pubId: number, imgId: number): string {
return `/api/v1/publications/${pubId}/fruit-images/${imgId}`
}
import { bearerHeader, handleUnauthorized } from './authHeader'
async function checkOk(res: Response): Promise<Response> {
if (!res.ok) {
if (res.status === 401) handleUnauthorized()
let msg = `${res.status}`
try {
const body = await res.json()
@@ -83,7 +86,7 @@ export async function getPublication(id: number): Promise<Publication> {
export async function createPublication(dto: PublicationWriteDTO): Promise<Publication> {
const res = await fetch('/api/v1/publications', {
method: 'POST',
headers: { 'Content-Type': 'application/json' },
headers: { 'Content-Type': 'application/json', ...bearerHeader() },
body: JSON.stringify(dto),
})
return (await checkOk(res)).json()
@@ -92,26 +95,26 @@ export async function createPublication(dto: PublicationWriteDTO): Promise<Publi
export async function updatePublication(id: number, dto: PublicationWriteDTO): Promise<Publication> {
const res = await fetch(`/api/v1/publications/${id}`, {
method: 'PUT',
headers: { 'Content-Type': 'application/json' },
headers: { 'Content-Type': 'application/json', ...bearerHeader() },
body: JSON.stringify(dto),
})
return (await checkOk(res)).json()
}
export async function deletePublication(id: number): Promise<void> {
const res = await fetch(`/api/v1/publications/${id}`, { method: 'DELETE' })
const res = await fetch(`/api/v1/publications/${id}`, { method: 'DELETE', headers: bearerHeader() })
await checkOk(res)
}
export async function uploadCoverImage(pubId: number, file: File): Promise<void> {
const form = new FormData()
form.append('image', file)
const res = await fetch(`/api/v1/publications/${pubId}/image`, { method: 'POST', body: form })
const res = await fetch(`/api/v1/publications/${pubId}/image`, { method: 'POST', body: form, headers: bearerHeader() })
await checkOk(res)
}
export async function deleteCoverImage(pubId: number): Promise<void> {
const res = await fetch(`/api/v1/publications/${pubId}/image`, { method: 'DELETE' })
const res = await fetch(`/api/v1/publications/${pubId}/image`, { method: 'DELETE', headers: bearerHeader() })
await checkOk(res)
}
@@ -123,14 +126,14 @@ export async function listPubFruits(pubId: number): Promise<PublicationFruit[]>
export async function linkFruit(pubId: number, fruitId: number): Promise<void> {
const res = await fetch(`/api/v1/publications/${pubId}/fruits`, {
method: 'POST',
headers: { 'Content-Type': 'application/json' },
headers: { 'Content-Type': 'application/json', ...bearerHeader() },
body: JSON.stringify({ fruit_id: fruitId }),
})
await checkOk(res)
}
export async function unlinkFruit(pubId: number, fruitId: number): Promise<void> {
const res = await fetch(`/api/v1/publications/${pubId}/fruits/${fruitId}`, { method: 'DELETE' })
const res = await fetch(`/api/v1/publications/${pubId}/fruits/${fruitId}`, { method: 'DELETE', headers: bearerHeader() })
await checkOk(res)
}
@@ -143,12 +146,12 @@ export async function uploadDescription(pubId: number, fruitId: number, file: Fi
const form = new FormData()
form.append('pdf', file)
form.append('fruit_id', String(fruitId))
const res = await fetch(`/api/v1/publications/${pubId}/descriptions`, { method: 'POST', body: form })
const res = await fetch(`/api/v1/publications/${pubId}/descriptions`, { method: 'POST', body: form, headers: bearerHeader() })
return (await checkOk(res)).json()
}
export async function deleteDescription(pubId: number, descId: number): Promise<void> {
const res = await fetch(`/api/v1/publications/${pubId}/descriptions/${descId}`, { method: 'DELETE' })
const res = await fetch(`/api/v1/publications/${pubId}/descriptions/${descId}`, { method: 'DELETE', headers: bearerHeader() })
await checkOk(res)
}
@@ -161,12 +164,12 @@ export async function uploadPubFruitImage(pubId: number, fruitId: number, file:
const form = new FormData()
form.append('image', file)
form.append('fruit_id', String(fruitId))
const res = await fetch(`/api/v1/publications/${pubId}/fruit-images`, { method: 'POST', body: form })
const res = await fetch(`/api/v1/publications/${pubId}/fruit-images`, { method: 'POST', body: form, headers: bearerHeader() })
return (await checkOk(res)).json()
}
export async function deletePubFruitImage(pubId: number, imgId: number): Promise<void> {
const res = await fetch(`/api/v1/publications/${pubId}/fruit-images/${imgId}`, { method: 'DELETE' })
const res = await fetch(`/api/v1/publications/${pubId}/fruit-images/${imgId}`, { method: 'DELETE', headers: bearerHeader() })
await checkOk(res)
}