From 9ecf3c317932fc57232ba9eeea102451d59ea996 Mon Sep 17 00:00:00 2001
From: Chever John <cheverjonathan@gmail.com>
Date: Tue, 30 Jun 2026 01:28:45 +0800
Subject: [PATCH] fix: pass refresh_token in body when calling /auth/refresh

The refresh endpoint expects {"refresh_token":"..."} in the POST body,
but the frontend was sending an empty body (EOF error). Now stores the
refresh_token from login response and sends it on refresh requests.

Co-Authored-By: Claude <noreply@anthropic.com>
---
 src/api/auth.ts   | 4 +++-
 src/api/client.ts | 7 +++++++
 2 files changed, 10 insertions(+), 1 deletion(-)

diff --git a/src/api/auth.ts b/src/api/auth.ts
index eef2a3e..4a151e8 100644
--- a/src/api/auth.ts
+++ b/src/api/auth.ts
@@ -1,4 +1,4 @@
-import { http, setAccessToken } from './client';
+import { http, setAccessToken, setRefreshToken } from './client';
 import type { Profile, Company, UserRole } from '../types';
 
 export interface LoginRequest {
@@ -31,6 +31,7 @@ export const authApi = {
   login: async (data: LoginRequest) => {
     const res = await http.post<LoginResponse>('/auth/login', data);
     setAccessToken(res.data.access_token);
+    setRefreshToken(res.data.refresh_token);
     return res.data;
   },
 
@@ -40,6 +41,7 @@ export const authApi = {
   logout: async () => {
     await http.post('/auth/logout');
     setAccessToken(null);
+    setRefreshToken(null);
   },
 
   refresh: async () => {
diff --git a/src/api/client.ts b/src/api/client.ts
index ac87954..8f09b2c 100644
--- a/src/api/client.ts
+++ b/src/api/client.ts
@@ -13,12 +13,17 @@ export interface PaginationParams {
 const API_BASE = '/api/v1';
 
 let accessToken: string | null = null;
+let refreshTokenValue: string | null = null;
 let refreshPromise: Promise<boolean> | null = null;
 
 export function setAccessToken(token: string | null) {
   accessToken = token;
 }
 
+export function setRefreshToken(token: string | null) {
+  refreshTokenValue = token;
+}
+
 export function getAccessToken(): string | null {
   return accessToken;
 }
@@ -27,6 +32,8 @@ async function refreshToken(): Promise<boolean> {
   try {
     const res = await fetch(`${API_BASE}/auth/refresh`, {
       method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ refresh_token: refreshTokenValue }),
       credentials: 'include',
     });
     if (!res.ok) return false;