@xeplr/ui-account 1.0.8 → 1.0.9

package/README.md

@@ -164,7 +164,14 @@ const saved = await authFetch('/api/tasks', { method: 'POST', body: JSON.stringi
 
 **It returns the parsed JSON body, not a `Response`** — there is no `.json()` to call. It:
 
-- prefixes the `configure()` base URL (a URL starting with `http` is used as is) and sends `Content-Type: application/json` unless you pass your own;
+- prefixes the `configure()` base URL (a URL starting with `http` is used as is) and sends `Content-Type: application/json` unless you pass your own — **except for a `FormData` body**, which describes itself (multipart, with a boundary), so an upload can go through `authFetch` like anything else:
+
+  ```js
+  const form = new FormData()
+  form.append('file', file)
+  const saved = await authFetch('/factory/files/task_edit/brief', { method: 'POST', body: form })
+  ```
+
 - attaches `Authorization: Bearer <token>`;
 - attaches one header per registered multi-tenant level whose active scope has an `id` (see [Multi-tenancy](#multi-tenancy));
 - stores the token from an `X-New-Token` response header — `@xeplr/auth`'s sliding refresh, so most expiries never become a 401;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xeplr/ui-account",
-  "version": "1.0.8",
+  "version": "1.0.9",
   "description": "Account UI: auth, profile, RBAC admin, tenant management — React controller hooks and designs",
   "type": "module",
   "main": "src/index.js",

package/src/api.js

@@ -319,8 +319,12 @@ function absorbNewToken(res) {
 export async function authFetch(endpoint, options = {}) {
   const url = endpoint.startsWith('http') ? endpoint : `${getBaseUrl()}${endpoint}`;
 
+  // A FormData body sets its own Content-Type, boundary and all. Declaring
+  // JSON over it makes the server read the upload as an empty JSON body, so a
+  // multipart request keeps the browser's own header.
+  const isForm = typeof FormData !== 'undefined' && options.body instanceof FormData;
   const headers = {
-    'Content-Type': 'application/json',
+    ...(isForm ? {} : { 'Content-Type': 'application/json' }),
     ...options.headers,
   };