c7ffc2b994
News called /api/v1/client/news through apiGet(), which sends the webtoken Bearer obtained from POST /api/v1/client/user/webtoken. But that route is a defineClientEventHandler -- it verifies the clients own short-lived signed JWT and never consults the webtokens ACLs at all, so it rejected the request outright. Store and Library have always worked because they already use the JWT path. Adds api_get_jwt on the Rust side and apiGetClient() in the composable, and points News at it. Verified working against the live server. Two auth mechanisms coexist here and picking the wrong one yields a clean 403 that looks like a permissions problem: /api/v1/client/* wants the client JWT, while routes gated by aclManager.getUserIdACL want the webtoken plus the right ACL. |
||
|---|---|---|
| .. | ||
| auth | ||
| community | ||
| error | ||
| library | ||
| settings | ||
| setup | ||
| store | ||
| index.vue | ||
| library.vue | ||
| news.vue | ||
| queue.vue | ||
| quit.vue | ||
| settings.vue | ||