Jared Wolff 6db4e07538 fix(auth): apply auth middleware to /me, /change-password, /logout and add credentials to admin.js ...

The protected auth routes (/me, /change-password, /logout) were merged
with public routes in auth_handler.rs but never had auth middleware
applied in main.rs — so the CurrentUserId extractor always failed with
401. Split auth_routes() into auth_public_routes() and
auth_protected_routes(), applying auth + CSRF middleware to the latter.

Also added credentials: 'same-origin' to all 13 fetch calls in admin.js
so the browser sends HttpOnly auth cookies with requests.

2026-03-05 13:43:06 -05:00

..

admin.js

fix(auth): apply auth middleware to /me, /change-password, /logout and add credentials to admin.js

2026-03-05 13:43:06 -05:00