From fd8f6b38d0d8f5755d6c40a5a4b2929d2c1f075c Mon Sep 17 00:00:00 2001
From: root <root@alpnaxnwas.local>
Date: Thu, 20 Aug 2026 21:56:02 +0000
Subject: [PATCH] =?UTF-8?q?Min=20fix:=20credentials:'include'=20+=20Author?=
 =?UTF-8?q?ization=20=D1=82=D0=BE=D0=BB=D1=8C=D0=BA=D0=BE=20=D0=B4=D0=BB?=
 =?UTF-8?q?=D1=8F=20=D0=BC=D1=83=D1=82=D0=B0=D1=86=D0=B8=D0=B9?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

GET использует cookie (без preflight), POST/PUT/DELETE — Authorization Bearer
---
 public/js/api.js | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/public/js/api.js b/public/js/api.js
index 78d5321..1cfce87 100644
--- a/public/js/api.js
+++ b/public/js/api.js
@@ -42,14 +42,16 @@ const Store = {
 
 async function api(path, opts = {}) {
   opts.headers = opts.headers || {};
-  if (Store.access && !opts.headers.Authorization) {
+  // для GET используем cookie (без CORS preflight), для мутаций — Authorization
+  const isGet = !opts.method || opts.method === 'GET' || opts.method === 'HEAD';
+  if (Store.access && !opts.headers.Authorization && !isGet) {
     opts.headers.Authorization = `Bearer ${Store.access}`;
   }
   if (opts.body && typeof opts.body === 'object' && !(opts.body instanceof FormData)) {
     opts.headers['Content-Type'] = 'application/json';
     opts.body = JSON.stringify(opts.body);
   }
-  let r = await fetch(API_BASE + path, opts);
+  let r = await fetch(API_BASE + path, { ...opts, credentials: 'include' });
   if (r.status === 401 && Store.refresh) {
     // refresh
     const r2 = await fetch(API_BASE + '/api/v1/auth/refresh', {