From 4af525c7b8fb7cdb4b6ee0e639df34968216c22f Mon Sep 17 00:00:00 2001
From: root <root@alpnaxnwas.local>
Date: Thu, 20 Aug 2026 21:44:59 +0000
Subject: [PATCH] =?UTF-8?q?Fix=20CORS=20preflight=20hang:=20GET=20=D1=82?=
 =?UTF-8?q?=D0=BE=D0=BA=D0=B5=D0=BD=20=D1=87=D0=B5=D1=80=D0=B5=D0=B7=20=3F?=
 =?UTF-8?q?=5Ft=20query=20(=D0=B1=D0=B5=D0=B7=20Authorization)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 public/js/api.js | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/public/js/api.js b/public/js/api.js
index 95a1ac0..ab10d6e 100644
--- a/public/js/api.js
+++ b/public/js/api.js
@@ -43,9 +43,16 @@ const Store = {
 async function api(path, opts = {}, _retry = 0) {
   // rebuild opts on every retry (body may be already stringified)
   const o = { ...opts, headers: { ...(opts.headers || {}) } };
-  if (Store.access && !o.headers.Authorization) {
+  // для GET — передаём токен через query (избегаем CORS preflight на Authorization)
+  // для POST/PUT/DELETE — оставляем в headers
+  const isGet = !o.method || o.method === 'GET' || o.method === 'HEAD';
+  if (Store.access && !o.headers.Authorization && !isGet) {
     o.headers.Authorization = `Bearer ${Store.access}`;
   }
+  if (Store.access && isGet) {
+    const sep = path.includes('?') ? '&' : '?';
+    path = path + sep + '_t=' + encodeURIComponent(Store.access);
+  }
   if (o.body && typeof o.body === 'object' && !(o.body instanceof FormData)) {
     o.headers['Content-Type'] = 'application/json';
     o.body = JSON.stringify(o.body);