From 11714ecbe4bffe4a3acb5b17ff0e70b523a40740 Mon Sep 17 00:00:00 2001
From: Aaron Wood <aaron.wood@mac.lan>
Date: Sat, 11 Apr 2026 00:35:01 -0400
Subject: [PATCH] feat: add credentials:include to all API calls and
 withCredentials to socket

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 client/src/api.ts    | 44 +++++++++++++++++++++++++++++++++-----------
 client/src/socket.ts |  1 +
 2 files changed, 34 insertions(+), 11 deletions(-)

diff --git a/client/src/api.ts b/client/src/api.ts
index 8ed0d99..926468a 100644
--- a/client/src/api.ts
+++ b/client/src/api.ts
@@ -13,6 +13,7 @@ const BASE = "/api";
 async function request<T>(path: string, options?: RequestInit): Promise<T> {
   const res = await fetch(`${BASE}${path}`, {
     headers: { "Content-Type": "application/json" },
+    credentials: "include",
     ...options,
   });
   if (!res.ok) {
@@ -23,6 +24,27 @@ async function request<T>(path: string, options?: RequestInit): Promise<T> {
   return res.json();
 }
 
+// Auth
+export interface AuthUser {
+  userId: number;
+  email: string;
+  username: string;
+}
+
+export const getMe = () => request<AuthUser>("/auth/me");
+export const login = (email: string, password: string) =>
+  request<AuthUser>("/auth/login", {
+    method: "POST",
+    body: JSON.stringify({ email, password }),
+  });
+export const register = (email: string, username: string, password: string) =>
+  request<AuthUser>("/auth/register", {
+    method: "POST",
+    body: JSON.stringify({ email, username, password }),
+  });
+export const logout = () =>
+  request<{ ok: boolean }>("/auth/logout", { method: "POST" });
+
 // Campaigns
 export const getCampaigns = () => request<Campaign[]>("/campaigns");
 export const createCampaign = (name: string) =>
@@ -32,6 +54,14 @@ export const createCampaign = (name: string) =>
   });
 export const deleteCampaign = (id: number) =>
   request<void>(`/campaigns/${id}`, { method: "DELETE" });
+export const getMyCampaignRole = (campaignId: number) =>
+  request<{ role: "dm" | "player" }>(`/campaigns/${campaignId}/my-role`);
+export const generateInvite = (campaignId: number) =>
+  request<{ url: string }>(`/campaigns/${campaignId}/invite`, { method: "POST" });
+export const joinCampaign = (token: string) =>
+  request<{ campaignId: number; role: string }>(`/campaigns/join/${token}`, {
+    method: "POST",
+  });
 
 // Characters
 export const getCharacters = (campaignId: number) =>
@@ -53,11 +83,7 @@ export const deleteCharacter = (id: number) =>
   request<void>(`/characters/${id}`, { method: "DELETE" });
 
 // Stats
-export const updateStat = (
-  characterId: number,
-  statName: string,
-  value: number,
-) =>
+export const updateStat = (characterId: number, statName: string, value: number) =>
   request<{ characterId: number; statName: string; value: number }>(
     `/characters/${characterId}/stats/${statName}`,
     { method: "PATCH", body: JSON.stringify({ value }) },
@@ -80,9 +106,7 @@ export const addGear = (
     body: JSON.stringify(data),
   });
 export const removeGear = (characterId: number, gearId: number) =>
-  request<void>(`/characters/${characterId}/gear/${gearId}`, {
-    method: "DELETE",
-  });
+  request<void>(`/characters/${characterId}/gear/${gearId}`, { method: "DELETE" });
 
 // Talents
 export const addTalent = (
@@ -99,9 +123,7 @@ export const addTalent = (
     body: JSON.stringify(data),
   });
 export const removeTalent = (characterId: number, talentId: number) =>
-  request<void>(`/characters/${characterId}/talents/${talentId}`, {
-    method: "DELETE",
-  });
+  request<void>(`/characters/${characterId}/talents/${talentId}`, { method: "DELETE" });
 
 // Game Items
 export const getGameItems = () => request<GameItem[]>("/game-items");
diff --git a/client/src/socket.ts b/client/src/socket.ts
index dc43d90..156cb12 100644
--- a/client/src/socket.ts
+++ b/client/src/socket.ts
@@ -3,6 +3,7 @@ import { io } from "socket.io-client";
 const socket = io("/", {
   autoConnect: true,
   reconnection: true,
+  withCredentials: true,
 });
 
 export default socket;