Auth-Aware Fetch

import { fetchWithCache } from "./fetch-wrapper.js";
import { getAuth, clearAuth } from "./auth-store.js";

function withAuthHeaders(headers, auth) {
  // CLI generates this based on config: features.auth.type
  // "cookie": return headers (no-op)
  // "bearer": if (auth?.token) headers.set("Authorization", `Bearer ${auth.token}`)
  // "custom": // EDIT THIS — implement your custom header logic
  return headers;
}

function isAuthUrl(url) {
  const authPaths = [
    "/login", "/logout", "/register",
    "/api/login", "/api/logout", "/api/register",
    "/api/refresh", "/api/me",
  ];
  return authPaths.some((path) => url.includes(path));
}

export async function authenticatedFetch(input, options = {}) {
  const auth = await getAuth();
  const headers = new Headers(options.headers);
  withAuthHeaders(headers, auth);

  const url = typeof input === "string" ? input : input.url;
  if (isAuthUrl(url) && !headers.has("X-SW-Cache-Strategy")) {
    headers.set("X-SW-Cache-Strategy", "mutation");
  }

  const response = await fetchWithCache(input, { ...options, headers });

  if (response.status === 401) {
    await clearAuth();
    window.dispatchEvent(new CustomEvent("sw-auth-unauthorized"));
  }

  return response;
}

import { authenticatedFetch } from "./swoff/auth-fetch.js";

// Authenticated read — cached by SW for offline
const profile = await authenticatedFetch("/api/me").then((r) => r.json());

// Authenticated mutation — passes through to server
await authenticatedFetch("/api/posts", {
  method: "POST",
  headers: { "Content-Type": "application/json" },
  body: JSON.stringify({ title: "Hello" }),
});

// Login — bypasses SW cache entirely
await authenticatedFetch("/api/login", {
  method: "POST",
  body: JSON.stringify({ email, password }),
});

import { ensureValidAuth } from "./swoff/auth-fetch.js";

const auth = await ensureValidAuth();
if (!auth) {
  // Token refresh failed, redirect to login
  return;
}
const data = await authenticatedFetch("/api/sensitive").then((r) => r.json());