From ae652e37f57878b7649d4ae897dce995b7b90e92 Mon Sep 17 00:00:00 2001
From: root <root@alpnaxnwas.local>
Date: Thu, 20 Aug 2026 21:50:26 +0000
Subject: [PATCH] =?UTF-8?q?Cookie=20auth:=20credentials:'include'=20=D0=B4?=
 =?UTF-8?q?=D0=BB=D1=8F=20=D0=B2=D1=81=D0=B5=D1=85=20fetch?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 public/js/api.js | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/public/js/api.js b/public/js/api.js
index dca2f0b..68bc4cc 100644
--- a/public/js/api.js
+++ b/public/js/api.js
@@ -63,7 +63,8 @@ async function api(path, opts = {}, _retry = 0) {
   const tid = setTimeout(() => controller.abort(), 15000);
   const t0 = Date.now();
   try {
-    r = await fetch(API_BASE + path, { ...o, signal: controller.signal });
+    // credentials:'include' — браузер шлёт cookies (HttpOnly buhapp_at)
+    r = await fetch(API_BASE + path, { ...o, credentials: 'include', signal: controller.signal });
   } catch (networkErr) {
     clearTimeout(tid);
     const ms = Date.now() - t0;