@entropy-softworks/ui 2026.8.30 → 2026.8.31

package/lib/utils/api-fetch.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"api-fetch.d.ts","sourceRoot":"","sources":["../../src/utils/api-fetch.ts"],"names":[],"mappings":"AAuBA;;;;;;;;GAQG;AACH,wBAAsB,QAAQ,CAC5B,IAAI,EAAE,MAAM,EACZ,IAAI,GAAE,WAAgB,EACtB,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,QAAQ,CAAC,CAwBnB"}
+{"version":3,"file":"api-fetch.d.ts","sourceRoot":"","sources":["../../src/utils/api-fetch.ts"],"names":[],"mappings":"AAuBA;;;;;;;;GAQG;AACH,wBAAsB,QAAQ,CAC5B,IAAI,EAAE,MAAM,EACZ,IAAI,GAAE,WAAgB,EACtB,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,QAAQ,CAAC,CA0CnB"}

package/lib/utils/api-fetch.js

@@ -47,6 +47,24 @@ export async function apiFetch(path, init = {}, timeoutMs) {
     if (token) {
         headers.set("Authorization", `Bearer ${token}`);
     }
-    return fetchWithTimeout(url, { ...init, headers }, timeoutMs);
+    // Explicit `credentials: "omit"` — native auth is Bearer-only, and the
+    // server's CSRF middleware branches purely on whether a session cookie
+    // is PRESENT on the request (see server/src/auth/middleware.rs's
+    // csrf_protect: any request carrying the session cookie is treated as
+    // cookie-auth and required to also carry a matching X-CSRF-Token +
+    // Origin, neither of which this native branch ever sends). React
+    // Native's Android fetch persists Set-Cookie responses in a shared
+    // CookieManager and reattaches them to matching-origin requests
+    // regardless of the web `credentials` semantics being followed
+    // elsewhere — so if the server ever sets a session cookie as a side
+    // effect for a native client (e.g. during passkey/WebAuthn login,
+    // which can involve a system browser or Credential Manager sheet),
+    // every subsequent native mutation silently starts requiring CSRF
+    // headers it can never provide, failing with "Missing CSRF header".
+    // Reported as folder-creation failing this way, 2026-08-17 — but the
+    // same stray cookie would affect ANY mutating request once present,
+    // not just this one. Omitting credentials here is the actual fix:
+    // native should never send or rely on cookies at all.
+    return fetchWithTimeout(url, { ...init, headers, credentials: "omit" }, timeoutMs);
 }
 //# sourceMappingURL=api-fetch.js.map

package/lib/utils/api-fetch.js.map

@@ -1 +1 @@
-{"version":3,"file":"api-fetch.js","sourceRoot":"","sources":["../../src/utils/api-fetch.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AACxC,OAAO,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAErE,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;AAEzD,MAAM,gBAAgB,GAAG,YAAY,CAAC;AACtC,MAAM,gBAAgB,GAAG,cAAc,CAAC;AAExC,SAAS,UAAU,CAAC,IAAY;IAC9B,IAAI,OAAO,QAAQ,KAAK,WAAW,EAAE,CAAC;QACpC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC;IAC1B,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QAC9C,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YAC/B,OAAO,kBAAkB,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,IAAY,EACZ,OAAoB,EAAE,EACtB,SAAkB;IAElB,MAAM,GAAG,GAAG,GAAG,UAAU,EAAE,GAAG,IAAI,EAAE,CAAC;IACrC,MAAM,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;IACpD,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAE1C,IAAI,QAAQ,CAAC,EAAE,KAAK,KAAK,EAAE,CAAC;QAC1B,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,GAAG,UAAU,CAAC,gBAAgB,CAAC,CAAC;YAC1C,IAAI,IAAI,EAAE,CAAC;gBACT,OAAO,CAAC,GAAG,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC;YACtC,CAAC;QACH,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,eAAe,EAAE,CAAC;QACzC,IAAI,QAAQ,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC;YAC9C,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,QAAQ,EAAE,CAAC,CAAC;QACrD,CAAC;QACD,OAAO,gBAAgB,CAAC,GAAG,EAAE,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,EAAE,SAAS,CAAC,CAAC;IACxF,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,eAAe,EAAE,CAAC;IACtC,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,KAAK,EAAE,CAAC,CAAC;IAClD,CAAC;IACD,OAAO,gBAAgB,CAAC,GAAG,EAAE,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,EAAE,SAAS,CAAC,CAAC;AAChE,CAAC"}
+{"version":3,"file":"api-fetch.js","sourceRoot":"","sources":["../../src/utils/api-fetch.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AACxC,OAAO,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAErE,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;AAEzD,MAAM,gBAAgB,GAAG,YAAY,CAAC;AACtC,MAAM,gBAAgB,GAAG,cAAc,CAAC;AAExC,SAAS,UAAU,CAAC,IAAY;IAC9B,IAAI,OAAO,QAAQ,KAAK,WAAW,EAAE,CAAC;QACpC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC;IAC1B,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QAC9C,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YAC/B,OAAO,kBAAkB,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,IAAY,EACZ,OAAoB,EAAE,EACtB,SAAkB;IAElB,MAAM,GAAG,GAAG,GAAG,UAAU,EAAE,GAAG,IAAI,EAAE,CAAC;IACrC,MAAM,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;IACpD,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAE1C,IAAI,QAAQ,CAAC,EAAE,KAAK,KAAK,EAAE,CAAC;QAC1B,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,GAAG,UAAU,CAAC,gBAAgB,CAAC,CAAC;YAC1C,IAAI,IAAI,EAAE,CAAC;gBACT,OAAO,CAAC,GAAG,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC;YACtC,CAAC;QACH,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,eAAe,EAAE,CAAC;QACzC,IAAI,QAAQ,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC;YAC9C,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,QAAQ,EAAE,CAAC,CAAC;QACrD,CAAC;QACD,OAAO,gBAAgB,CAAC,GAAG,EAAE,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,EAAE,SAAS,CAAC,CAAC;IACxF,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,eAAe,EAAE,CAAC;IACtC,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,KAAK,EAAE,CAAC,CAAC;IAClD,CAAC;IACD,uEAAuE;IACvE,uEAAuE;IACvE,iEAAiE;IACjE,sEAAsE;IACtE,mEAAmE;IACnE,iEAAiE;IACjE,mEAAmE;IACnE,gEAAgE;IAChE,+DAA+D;IAC/D,oEAAoE;IACpE,kEAAkE;IAClE,mEAAmE;IACnE,kEAAkE;IAClE,oEAAoE;IACpE,qEAAqE;IACrE,oEAAoE;IACpE,kEAAkE;IAClE,sDAAsD;IACtD,OAAO,gBAAgB,CAAC,GAAG,EAAE,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE,SAAS,CAAC,CAAC;AACrF,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@entropy-softworks/ui",
-  "version": "2026.8.30",
+  "version": "2026.8.31",
   "private": false,
   "description": "Shared React Native UI primitives, auth screens, hooks, and services for Entropy Softworks Expo apps",
   "license": "MIT",

package/src/utils/api-fetch.ts

@@ -57,5 +57,23 @@ export async function apiFetch(
   if (token) {
     headers.set("Authorization", `Bearer ${token}`);
   }
-  return fetchWithTimeout(url, { ...init, headers }, timeoutMs);
+  // Explicit `credentials: "omit"` — native auth is Bearer-only, and the
+  // server's CSRF middleware branches purely on whether a session cookie
+  // is PRESENT on the request (see server/src/auth/middleware.rs's
+  // csrf_protect: any request carrying the session cookie is treated as
+  // cookie-auth and required to also carry a matching X-CSRF-Token +
+  // Origin, neither of which this native branch ever sends). React
+  // Native's Android fetch persists Set-Cookie responses in a shared
+  // CookieManager and reattaches them to matching-origin requests
+  // regardless of the web `credentials` semantics being followed
+  // elsewhere — so if the server ever sets a session cookie as a side
+  // effect for a native client (e.g. during passkey/WebAuthn login,
+  // which can involve a system browser or Credential Manager sheet),
+  // every subsequent native mutation silently starts requiring CSRF
+  // headers it can never provide, failing with "Missing CSRF header".
+  // Reported as folder-creation failing this way, 2026-08-17 — but the
+  // same stray cookie would affect ANY mutating request once present,
+  // not just this one. Omitting credentials here is the actual fix:
+  // native should never send or rely on cookies at all.
+  return fetchWithTimeout(url, { ...init, headers, credentials: "omit" }, timeoutMs);
 }