ec-web 0.0.21 → 0.0.23

package/dist/static/app.js

@@ -1976,6 +1976,58 @@ async function tryLocalAutoPair() {
   return false;
 }
 
+let authRecoveryPromise = null;
+
+function authenticatedRequestUrl(pathOrUrl) {
+  const raw = String(pathOrUrl || '');
+  const target = raw.startsWith(BASE) ? raw : apiUrl(raw);
+  const parsed = new URL(target, location.origin);
+  const token = localStorage.getItem(TOKEN_KEY);
+  if (token) parsed.searchParams.set('token', token);
+  else parsed.searchParams.delete('token');
+  return parsed.pathname + parsed.search + parsed.hash;
+}
+
+function authenticatedRequestInit(init = {}) {
+  const headers = new Headers(init.headers || {});
+  const token = localStorage.getItem(TOKEN_KEY);
+  if (token) headers.set('Authorization', `Bearer ${token}`);
+  else headers.delete('Authorization');
+  return { ...init, headers };
+}
+
+async function recoverHttpAuthentication() {
+  if (authRecoveryPromise) return authRecoveryPromise;
+  localStorage.removeItem(TOKEN_KEY);
+  authRecoveryPromise = (async () => {
+    if (await tryLocalAutoPair()) return true;
+    showPairPage(t('pair.error.tokenInvalid'));
+    return false;
+  })().finally(() => {
+    authRecoveryPromise = null;
+  });
+  return authRecoveryPromise;
+}
+
+async function authFetch(pathOrUrl, init = {}) {
+  const send = async () => {
+    const token = localStorage.getItem(TOKEN_KEY);
+    const response = await fetch(authenticatedRequestUrl(pathOrUrl), authenticatedRequestInit(init));
+    return { response, token };
+  };
+
+  let attempt = await send();
+  if (attempt.response.status !== 401) return attempt.response;
+
+  const currentToken = localStorage.getItem(TOKEN_KEY);
+  if (currentToken && currentToken !== attempt.token) {
+    return (await send()).response;
+  }
+  if (!(await recoverHttpAuthentication())) return attempt.response;
+  attempt = await send();
+  return attempt.response;
+}
+
 function showPairPage(hint) {
   if (ws) { try { ws.close(); } catch {} ws = null; }
   $('#pair-page').style.display = 'flex';
@@ -2256,6 +2308,12 @@ function subscribeRoleManagementSubview() {
 function setRoleManagementSubview(subview, options = {}) {
   roleManagementSubview = subview === 'assignments' ? 'assignments' : 'definitions';
   localStorage.setItem(ROLE_SUBVIEW_KEY, roleManagementSubview);
+  const newRoleButton = $('#btn-new-role');
+  if (newRoleButton) {
+    const visible = roleManagementSubview === 'definitions';
+    newRoleButton.hidden = !visible;
+    newRoleButton.setAttribute('aria-hidden', String(!visible));
+  }
   document.querySelectorAll('[data-role-subview]').forEach(tab => {
     const active = tab.dataset.roleSubview === roleManagementSubview;
     tab.classList.toggle('active', active);
@@ -3815,7 +3873,7 @@ function renderBlocks(blocks, options = {}) {
         : '';
       out += `<details class="blk blk-tool" open><summary class="tool-head">${icon} <span class="tool-name">${esc(tool)}</span></summary>${toolParams}</details>`;
     } else if (b.kind === 'tool_result') {
-      const rejection = b.rejection?.kind === 'approval_rejected' ? b.rejection : undefined;
+      const rejection = b.rejection && (b.rejection.kind === 'approval_rejected' || b.rejection.kind === 'policy_blocked') ? b.rejection : undefined;
       const cls = b.isError ? `blk-result err${rejection ? ' rejection' : ''}` : 'blk-result';
       const loadFull = b.truncated && b.resultKey
         ? `<button class="ctrl-btn result-load-full" type="button" data-result-key="${esc(b.resultKey)}">${t('sessions.loadFullResult') || '加载完整结果'}</button>`
@@ -3839,7 +3897,7 @@ function renderBlocks(blocks, options = {}) {
             : '';
           return '<div class="result-rejection-meta">' +
           `<span class="result-rejection-badge">⚠ ${t('sessions.block.rejection.title')}</span>` +
-          `<span>${rejection.source === 'evolcore-policy' ? t('sessions.block.rejection.source.policy') : t('sessions.block.rejection.source.approval')}</span>` +
+          `<span>${rejection.kind === 'policy_blocked' || rejection.source === 'evolcore-policy' ? t('sessions.block.rejection.source.policy') : t('sessions.block.rejection.source.approval')}</span>` +
           `<span>${t('sessions.block.rejection.notExecuted')}</span>` +
           `<span>${t(`sessions.block.rejection.evidence.${evidenceKey}`)}</span>` +
           backendReason + auditText +
@@ -4132,12 +4190,7 @@ function agentOpNew() {
   openAgentCreateDrawer();
 }
 
-const AGENT_BASEAGENT_TYPES = ['claude', 'codex', 'gemini'];
-const AGENT_EFFORT_FALLBACK = {
-  claude: ['low', 'medium', 'high', 'xhigh', 'max'],
-  codex: ['low', 'medium', 'high'],
-  gemini: [],
-};
+const AGENT_BASEAGENT_TYPES = ['claude', 'codex', 'gemini', 'ecagent'];
 const AGENT_AID_RE = /^[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?(?:\.[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?){2,}$/;
 let _agentEdit = null;
 let _agentCreate = null;
@@ -4588,7 +4641,7 @@ async function agentFetchCreateModelOptions(baseagent) {
   const catalog = await fetchModelCatalogData(baseagent);
   return (catalog?.models || []).map(model => ({
     value: model.id,
-    label: model.id,
+    label: `${model.id}${model.verification === 'unverified' ? ' [unverified]' : ''}`,
   }));
 }
 
@@ -4678,7 +4731,8 @@ async function syncAgentCreateOptionFields(ctx, values) {
 async function syncAgentCreateEffortOptions(ctx, baseagent, model, currentEffort, token) {
   const effortSelect = ctx.backdrop.querySelector('#ag-create-effort');
   if (!effortSelect) return;
-  const efforts = AGENT_EFFORT_FALLBACK[baseagent] || [];
+  const catalog = await fetchModelCatalogData(baseagent);
+  const efforts = catalog.models.find(entry => entry.id === model)?.reasoningLevels || [];
   if (_agentCreate !== ctx || ctx.optionLoadToken !== token) return;
   effortSelect.innerHTML = agentSelectOptions(efforts, currentEffort, t('common.default'));
   effortSelect.disabled = Boolean(ctx.saving);
@@ -5079,12 +5133,11 @@ async function syncAgentEffortOptions(ctx, baseagent, model, currentEffort, toke
   setAgentSelectLoading(effortSelect, currentEffort, currentEffort ? `${currentEffort} (${t('common.loadingSuffix')})` : t('common.loading'));
   try {
     let efforts = await agentFetchOptions('effort', ctx.aid, { baseagent, model, effort: currentEffort || 'auto' });
-    if (!efforts.length && AGENT_EFFORT_FALLBACK[baseagent]) efforts = AGENT_EFFORT_FALLBACK[baseagent];
     if (_agentEdit !== ctx || ctx.optionLoadToken !== token) return;
     effortSelect.innerHTML = agentSelectOptions(efforts, currentEffort, t('common.default'));
   } catch (e) {
     if (_agentEdit === ctx && ctx.optionLoadToken === token) {
-      const fallback = AGENT_EFFORT_FALLBACK[baseagent] || [];
+      const fallback = [];
       effortSelect.innerHTML = agentSelectOptions(fallback, currentEffort, t('common.default'));
       toast(e.message || String(e), true);
     }
@@ -6877,12 +6930,11 @@ async function syncTriggerEffortOptions(ctx, baseagent, model, currentEffort, to
   setAgentSelectLoading(effortSelect, currentEffort, currentEffort ? `${currentEffort} (${t('common.loadingSuffix')})` : t('common.loading'));
   try {
     let efforts = await agentFetchOptions('effort', ctx.original.agentAid, { baseagent, model, effort: currentEffort || 'auto' });
-    if (!efforts.length && AGENT_EFFORT_FALLBACK[baseagent]) efforts = AGENT_EFFORT_FALLBACK[baseagent];
     if (_triggerEdit !== ctx || ctx.optionLoadToken !== token) return;
     effortSelect.innerHTML = agentSelectOptions(efforts, currentEffort, t('common.inherited'));
   } catch (e) {
     if (_triggerEdit === ctx && ctx.optionLoadToken === token) {
-      const fallback = AGENT_EFFORT_FALLBACK[baseagent] || [];
+      const fallback = [];
       effortSelect.innerHTML = agentSelectOptions(fallback, currentEffort, t('common.inherited'));
       toast(e.message || String(e), true);
     }
@@ -7805,7 +7857,7 @@ async function loadUsageOverview(rangeType, customFrom, customTo) {
     if (fromTs) params.set('from', String(fromTs));
     if (toTs) params.set('to', String(toTs));
 
-    const resp = await fetch(authApiUrl('api/stats/overview?' + params.toString()), {
+    const resp = await authFetch('api/stats/overview?' + params.toString(), {
       headers: { Authorization: 'Bearer ' + localStorage.getItem(TOKEN_KEY) }
     });
     data = resp.ok ? await resp.json() : null;
@@ -8010,7 +8062,7 @@ function initDetailQuery() {
 
 async function loadDetailAgentList() {
   try {
-    const resp = await fetch(authApiUrl('api/stats/agents'), {
+    const resp = await authFetch('api/stats/agents', {
       headers: { Authorization: 'Bearer ' + localStorage.getItem(TOKEN_KEY) }
     });
     if (!resp.ok) return;
@@ -8050,7 +8102,7 @@ async function loadDetailModelList() {
     if (timeRange.fromTs) params.set('from', String(timeRange.fromTs));
     if (timeRange.toTs) params.set('to', String(timeRange.toTs));
 
-    const resp = await fetch(authApiUrl('api/stats/models?' + params.toString()), {
+    const resp = await authFetch('api/stats/models?' + params.toString(), {
       headers: { Authorization: 'Bearer ' + localStorage.getItem(TOKEN_KEY) }
     });
     if (!resp.ok) return;
@@ -8103,7 +8155,7 @@ async function queryDetailUsage() {
   params.set('offset', String(offset));
 
   try {
-    const resp = await fetch(authApiUrl('api/stats/detail?' + params.toString()), {
+    const resp = await authFetch('api/stats/detail?' + params.toString(), {
       headers: { Authorization: 'Bearer ' + localStorage.getItem(TOKEN_KEY) }
     });
     if (seq !== _detailQuerySeq) return; // 已有更新的查询发出，丢弃本次结果
@@ -8424,7 +8476,7 @@ async function loadExplorerModels() {
   if (_expTimeRange.toTs) params.set('to', String(_expTimeRange.toTs));
 
   try {
-    const resp = await fetch(authApiUrl('api/stats/models?' + params.toString()), {
+    const resp = await authFetch('api/stats/models?' + params.toString(), {
       headers: { Authorization: 'Bearer ' + localStorage.getItem(TOKEN_KEY) }
     });
     if (!resp.ok) return;
@@ -8461,7 +8513,7 @@ async function fetchExplorerOverviewData(filterParams) {
       if (filterParams.peer) params.set('peer', filterParams.peer);
     }
 
-    const resp = await fetch(authApiUrl('api/stats/overview?' + params.toString()), {
+    const resp = await authFetch('api/stats/overview?' + params.toString(), {
       headers: { Authorization: 'Bearer ' + localStorage.getItem(TOKEN_KEY) }
     });
     const data = resp.ok ? await resp.json() : null;
@@ -8493,7 +8545,7 @@ async function loadExplorerSidebar() {
   var token = localStorage.getItem(TOKEN_KEY);
   var headers = { Authorization: 'Bearer ' + token };
   try {
-    var agentsResp = await fetch(authApiUrl('api/stats/agents'), { headers });
+    var agentsResp = await authFetch('api/stats/agents', { headers });
     var agents = agentsResp.ok ? await agentsResp.json() : [];
     renderExplorerAgentList(agents);
 
@@ -8554,7 +8606,7 @@ async function loadPeersForAgent(agentAid) {
     params.set('agent', agentAid);
     // 不传递时间范围，获取该 agent 的所有 peers
 
-    var resp = await fetch(authApiUrl('api/stats/peers?' + params.toString()), { headers });
+    var resp = await authFetch('api/stats/peers?' + params.toString(), { headers });
     var peers = resp.ok ? await resp.json() : [];
     renderExplorerPeerList(peers);
   } catch {
@@ -8636,7 +8688,7 @@ async function runExplorerQuery() {
 
   var data;
   try {
-    var resp = await fetch(authApiUrl('api/stats/explorer?' + params.toString()), {
+    var resp = await authFetch('api/stats/explorer?' + params.toString(), {
       headers: { Authorization: 'Bearer ' + localStorage.getItem(TOKEN_KEY) }
     });
     if (!resp.ok) return;
@@ -9092,11 +9144,39 @@ function monDualLine(elId, varKey, times, isDark, title, series, fmtY, yRange) {
 }
 
 function renderRoles(data) {
-  if (!data) return;
-
   const agentSelect = $('#roles-agent-select');
+  const tbody = document.querySelector('#relations-table tbody');
+  if (!data) {
+    if (tbody) {
+      tbody.innerHTML = '';
+      const row = tbody.insertRow();
+      const cell = row.insertCell();
+      cell.colSpan = 7;
+      cell.textContent = t('common.loading');
+      cell.style.textAlign = 'center';
+      cell.style.color = 'var(--dim)';
+      cell.style.padding = '40px';
+    }
+    return;
+  }
   if (!agentSelect) return;
 
+  if (data.error) {
+    agentSelect.innerHTML = `<option value="">${esc(t('roles.selectAgentPlaceholder'))}</option>`;
+    rolesCurrentAgent = null;
+    if (tbody) {
+      tbody.innerHTML = '';
+      const row = tbody.insertRow();
+      const cell = row.insertCell();
+      cell.colSpan = 7;
+      cell.textContent = `${t('common.error')}: ${String(data.error)}`;
+      cell.style.textAlign = 'center';
+      cell.style.color = 'var(--red)';
+      cell.style.padding = '40px';
+    }
+    return;
+  }
+
   agentSelect.innerHTML = '';
   const placeholderOption = document.createElement('option');
   placeholderOption.value = '';
@@ -9152,6 +9232,34 @@ function peerTypeText(peerType) {
   return '-';
 }
 
+function roleVerificationStatus(item) {
+  const status = String(item?.verifyStatus || 'unknown').toLowerCase();
+  if (status === 'agentmd' || status === 'verified') return 'verified';
+  if (status === 'agentmd-unverified' || status === 'unverified') return 'agentmd-unverified';
+  if (status === 'invalid') return 'invalid';
+  return 'unknown';
+}
+
+function roleVerificationMatches(item, filter) {
+  if (!filter) return true;
+  const status = roleVerificationStatus(item);
+  return filter === 'verified' ? status === 'verified' : status === filter;
+}
+
+function roleVerificationBadge(item) {
+  const status = roleVerificationStatus(item);
+  if (status === 'invalid') {
+    return ` <span class="verify-badge verify-invalid" title="${esc(t('roles.verify.invalid'))}">⚠️ ${esc(t('roles.verify.invalidShort'))}</span>`;
+  }
+  if (status === 'agentmd-unverified') {
+    return ` <span class="verify-badge verify-unverified" title="${esc(t('roles.verify.unverified'))}">⚠️</span>`;
+  }
+  if (status === 'unknown') {
+    return ` <span class="verify-badge verify-unknown" title="${esc(t('roles.verify.unknown'))}">❓</span>`;
+  }
+  return '';
+}
+
 function roleClass(role) {
   return String(role || 'none').replace(/[^a-z0-9_-]/gi, '-');
 }
@@ -9188,6 +9296,16 @@ function renderRelationsTable(data, filterAid = null) {
   if (!tbody) return;
 
   tbody.innerHTML = '';
+  if (data?.error) {
+    const row = tbody.insertRow();
+    const cell = row.insertCell();
+    cell.colSpan = 7;
+    cell.textContent = `${t('common.error')}: ${String(data.error)}`;
+    cell.style.textAlign = 'center';
+    cell.style.color = 'var(--red)';
+    cell.style.padding = '40px';
+    return;
+  }
   let conversations = data.conversations || [];
 
   if (filterAid) {
@@ -9215,6 +9333,16 @@ function renderRelationsTable(data, filterAid = null) {
     conversations = conversations.filter(conv => conv.chatType === rolesChatTypeFilter);
   }
 
+  if (rolesVerifyFilter) {
+    conversations = conversations
+      .map(conv => conv.chatType === 'group'
+        ? { ...conv, members: (conv.members || []).filter(member => roleVerificationMatches(member, rolesVerifyFilter)) }
+        : conv)
+      .filter(conv => conv.chatType === 'group'
+        ? (conv.members || []).length > 0
+        : roleVerificationMatches(conv, rolesVerifyFilter));
+  }
+
   conversations.sort((a, b) => {
     const lastDiff = (b.lastAt || 0) - (a.lastAt || 0);
     if (lastDiff !== 0) return lastDiff;
@@ -9244,10 +9372,12 @@ function renderPrivateConversationRow(tbody, conv) {
   const peerId = conv.peerId || conv.peerAid || conv.peerKey || conv.conversationId;
   const name = conv.peerName || conv.name || shortAid(peerId);
   const assignedRole = assignedRoleFor('private', conv);
+  const verifyBadge = roleVerificationBadge(conv);
+  const verifyClass = roleVerificationStatus(conv) === 'verified' ? '' : ` peer-${roleVerificationStatus(conv) === 'unknown' ? 'unknown' : 'unverified'}`;
   const row = tbody.insertRow();
   row.innerHTML = `
     <td><span class="chat-tag chat-tag-private">${esc(t('roles.chatType.private') || 'Private')}</span></td>
-    <td><strong>${esc(name)}</strong></td>
+    <td class="${verifyClass.trim()}"><strong>${esc(name)}</strong>${verifyBadge}</td>
     <td><code>${esc(peerId)}</code></td>
     <td>${esc(peerTypeText(conv.peerType))}</td>
     <td><span class="role-badge role-${esc(roleClass(conv.role))}">${esc(displayRole(conv.role))}</span></td>
@@ -9312,11 +9442,13 @@ function renderGroupMemberRow(tbody, conv, member) {
   const peerId = member.peerId || member.peerAid || member.peerKey;
   const name = member.peerName || shortAid(peerId);
   const assignedRole = assignedRoleFor('group-member', member);
+  const verifyBadge = roleVerificationBadge(member);
+  const verifyClass = roleVerificationStatus(member) === 'verified' ? '' : ` peer-${roleVerificationStatus(member) === 'unknown' ? 'unknown' : 'unverified'}`;
   const row = tbody.insertRow();
   row.className = 'group-member-row';
   row.innerHTML = `
     <td></td>
-    <td><span class="group-member-indent">${esc(name)}</span></td>
+    <td class="${verifyClass.trim()}"><span class="group-member-indent">${esc(name)}</span>${verifyBadge}</td>
     <td><code>${esc(peerId)}</code></td>
     <td>${esc(peerTypeText(member.peerType))}</td>
     <td><span class="role-badge role-${esc(roleClass(member.role))}">${esc(displayRole(member.role))}</span></td>
@@ -9344,7 +9476,7 @@ async function updatePeerRoleOverride(agentAid, scope, targetId, role, groupId,
     if (peerId) body.peerId = peerId;
     if (role) body.role = role;
 
-    const res = await fetch(authApiUrl(`api/assignments/peer/${encodeURIComponent(agentAid)}/${encodeURIComponent(targetId)}`), {
+    const res = await authFetch(`api/assignments/peer/${encodeURIComponent(agentAid)}/${encodeURIComponent(targetId)}`, {
       method: role ? 'PUT' : 'DELETE',
       headers: {
         'Content-Type': 'application/json',
@@ -9639,7 +9771,7 @@ function renderDefaultRoleSelector(data) {
     const next = { private: privateSelect.value || null, group: groupSelect.value || null };
     try {
       const token = localStorage.getItem(TOKEN_KEY);
-      const writeRes = await fetch(roleDefinitionsApi('api/role-definitions'), {
+      const writeRes = await authFetch(roleDefinitionsApi('api/role-definitions'), {
         method: 'PUT',
         headers: {
           'Content-Type': 'application/json',
@@ -9707,7 +9839,7 @@ function formatCommandPermissions(commandPermissions) {
 async function fetchRoleOperationsCatalog() {
   if (roleOperationsCache) return roleOperationsCache;
   const token = localStorage.getItem(TOKEN_KEY);
-  const res = await fetch(authApiUrl('api/role-definitions/operations'), {
+  const res = await authFetch('api/role-definitions/operations', {
     headers: { 'Authorization': `Bearer ${token}` }
   });
   if (!res.ok) throw new Error('Failed to load CLI operation catalog');
@@ -10229,8 +10361,9 @@ function createRoleCard(roleName, roleDef) {
   const model = roleDef.permissions?.['baseagents.claude.model']?.default || '—';
   const commandStats = getCommandPermissionStats(roleDef.commandPermissions);
 
-  // 判断是否为内置角色
-  const builtinRoles = ['admin', 'member', 'visitor'];
+  // Management identities and built-in user roles are both protected from
+  // deletion; their local policy overrides can be reset instead.
+  const builtinRoles = ['owner', 'admin', 'member', 'visitor'];
   const isBuiltin = builtinRoles.includes(roleName);
 
   card.innerHTML = `
@@ -10316,7 +10449,7 @@ function initRoleDefinitionsTab() {
 
       try {
         const token = localStorage.getItem(TOKEN_KEY);
-        const res = await fetch(roleDefinitionsApi(`api/role-definitions/${roleName}/reset`), {
+        const res = await authFetch(roleDefinitionsApi(`api/role-definitions/${roleName}/reset`), {
           method: 'POST',
           headers: { 'Authorization': `Bearer ${token}` }
         });
@@ -10361,7 +10494,7 @@ function initRoleDefinitionsTab() {
           : replacement
             ? `?replacementRoleId=${encodeURIComponent(replacement)}`
             : '';
-        const res = await fetch(roleDefinitionsApi(`api/role-definitions/${roleName}${replacementQuery}`), {
+        const res = await authFetch(roleDefinitionsApi(`api/role-definitions/${roleName}${replacementQuery}`), {
           method: 'DELETE',
           headers: { 'Authorization': `Bearer ${token}` }
         });
@@ -10514,7 +10647,7 @@ function renderRoleModelPermissionSection(roleDef) {
 
 async function fetchRoleModelPermissionData(roleName) {
   const token = localStorage.getItem(TOKEN_KEY);
-  const res = await fetch(roleDefinitionsApi(`api/role-definitions/${encodeURIComponent(roleName)}/configurable-models`), {
+  const res = await authFetch(roleDefinitionsApi(`api/role-definitions/${encodeURIComponent(roleName)}/configurable-models`), {
     headers: { 'Authorization': `Bearer ${token}` }
   });
   if (!res.ok) throw new Error('Failed to load role model permissions');
@@ -10522,13 +10655,14 @@ async function fetchRoleModelPermissionData(roleName) {
   return json.data;
 }
 
-async function fetchModelCatalogData(baseagent = 'claude') {
+async function fetchModelCatalogData(baseagent = 'claude', aid = '') {
   const token = localStorage.getItem(TOKEN_KEY);
-  const res = await fetch(authApiUrl(`api/models/catalog?baseagent=${encodeURIComponent(baseagent)}`), {
+  const res = await authFetch(`api/models/catalog?baseagent=${encodeURIComponent(baseagent)}${aid ? `&aid=${encodeURIComponent(aid)}` : ''}`, {
     headers: { 'Authorization': `Bearer ${token}` }
   });
   if (!res.ok) throw new Error('Failed to load model catalog');
   const json = await res.json();
+  if (json.data?.diagnostics?.some(d => d.code === 'AUTH_FAILED')) throw new Error('Model gateway authentication failed');
   return json.data;
 }
 
@@ -10691,7 +10825,7 @@ async function initRoleModelPermissionEditor(container, roleName, roleDef) {
   try {
     const data = roleName && roleName !== '__new__'
       ? await fetchRoleModelPermissionData(roleName)
-      : await fetchModelCatalogData();
+      : await fetchModelCatalogData('claude', roleDefinitionsCurrentAgent || state.roleDefinitions?.aid || '');
     catalogModels = data?.catalog?.models || data?.models || [];
   } catch (err) {
     console.warn('[roleDefinitions] Failed to load model catalog:', err);
@@ -11488,7 +11622,7 @@ async function saveRoleDefinition() {
     const method = isNew ? 'POST' : 'PUT';
     const url = isNew ? roleDefinitionsApi('api/role-definitions') : roleDefinitionsApi(`api/role-definitions/${encodeURIComponent(actualRoleName)}`);
 
-    const res = await fetch(url, {
+    const res = await authFetch(url, {
       method,
       headers: {
         'Content-Type': 'application/json',