From 34e7b9dfa8d5c01ded171082a66861ac35b6e7ff Mon Sep 17 00:00:00 2001
From: Jared Wolff <hello@jaredwolff.com>
Date: Wed, 4 Mar 2026 18:53:16 -0500
Subject: [PATCH] fix(profile): add credentials to fetch calls so auth cookies
 are sent

Profile page showed "Not Authenticated" because fetch calls to
/api/auth/me and /api/auth/change-password were missing
credentials: 'same-origin', preventing HttpOnly cookies from being sent.
---
 static/js/views/profile/profile.js | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/static/js/views/profile/profile.js b/static/js/views/profile/profile.js
index 3cfd6547..95809a8a 100644
--- a/static/js/views/profile/profile.js
+++ b/static/js/views/profile/profile.js
@@ -25,7 +25,7 @@ function timeAgo(dateStr) {
 
 async function init() {
   try {
-    const resp = await fetch(API + '/auth/me', { headers: headers() });
+    const resp = await fetch(API + '/auth/me', { headers: headers(), credentials: 'same-origin' });
     if (!resp.ok) { showError(); return; }
     const user = await resp.json();
 
@@ -66,7 +66,7 @@ async function init() {
     }
 
     try {
-      const oidcResp = await fetch(API + '/auth/oidc/providers');
+      const oidcResp = await fetch(API + '/auth/oidc/providers', { credentials: 'same-origin' });
       if (oidcResp.ok) {
         const oidcInfo = await oidcResp.json();
         if (!oidcInfo.password_login_enabled) {
@@ -114,6 +114,7 @@ async function changePassword(e) {
     const resp = await fetch(API + '/auth/change-password', {
       method: 'PUT',
       headers: headers(),
+      credentials: 'same-origin',
       body: JSON.stringify({ current_password: currentPw, new_password: newPw })
     });