Ajit/fix fetch auth config

[deadlyjack]

No description provided.

[greptile-apps]

Greptile Summary

This PR refactors the auth system from a custom-header XHR flow to a cookie-based scheme: a new Authenticator.java injects the auth token into Android's CookieManager with HttpOnly; Secure; SameSite=None, and a local ajax.js replaces the @deadlyjack/ajax package with withCredentials = true configured globally in main.js for XHR calls. A new config.js consolidates the old constants.js.

• P1 — Core login fetch lacks credentials: 'include': getLoggedInUser() in auth.js fetches GET /api/login without credentials: \"include\", so the auth cookie is never sent; the server always returns 401 and the user appears permanently logged out.
• P1 — Server-side logout not invalidated: logout() sends DELETE /login without credentials, leaving the server-side session alive after local logout.
• P1 — Sponsor purchase fetch unauthenticated: The POST to /api/sponsor in sponsor.js also lacks credentials: \"include\".

Confidence Score: 3/5

Not safe to merge — multiple P1 issues mean the new cookie-based auth flow is broken end-to-end in the Cordova WebView.

Three independent P1 findings across the core login check, logout, and sponsor purchase all using fetch without credentials:include, making the new cookie auth scheme non-functional for critical paths.

src/lib/auth.js (core login/logout fetch calls), src/pages/sponsor/sponsor.js (purchase POST), and previously-flagged plugin purchase/refund fetch calls.

Security Review

• Stale server-side session on logout (src/lib/auth.js): logout() sends DELETE /login without credentials: \"include\", so the auth cookie is never forwarded to the server. The server-side session is not invalidated; only the local cookie/cache is cleared.
• Unauthenticated core API calls (src/lib/auth.js, src/pages/sponsor/sponsor.js): getLoggedInUser(), logout(), and the sponsor purchase POST all use fetch without credentials: \"include\", breaking the intended cookie-based auth scheme.

Important Files Changed

Filename	Overview
src/lib/auth.js	Core auth refactored to cookie-based flow via fetch; both getLoggedInUser() and logout() fetch calls are missing credentials: 'include', breaking login detection and server-side logout.
src/lib/ajax.js	New local XHR-based ajax utility replacing @deadlyjack/ajax; withCredentials is wired up via ajax.configure in main.js.
src/lib/config.js	New config module consolidating constants.js; includes HAS_PRO getter/setter replacing IS_FREE_VERSION global.
src/lib/adRewards.js	getRewardIdentity references undefined user variable (previously flagged); canShowAds/isRewardedSupported correctly migrated to config.HAS_PRO.
src/plugins/auth/src/android/Authenticator.java	Refactored to inject auth cookie via CookieManager with HttpOnly; Secure; SameSite=None — addresses previous HttpOnly finding.
src/pages/plugin/plugin.js	Migrated from ajax to fetch for order/refund calls; credentials: 'include' still missing (previously flagged).
src/main.js	Correctly wires ajax.configure with withCredentials=true for API XHR calls; migrates IS_FREE_VERSION to config.HAS_PRO.
src/pages/sponsor/sponsor.js	POST to /api/sponsor is missing credentials: 'include', so the server receives an unauthenticated purchase confirmation.
src/lib/checkPluginsUpdate.js	Correctly migrated from ajax to fetch with proper res.ok check and JSON parsing; previous options-object bug is fixed.

Sequence Diagram

sequenceDiagram
    participant App as JS WebView
    participant CM as CookieManager
    participant Server as API Server

    Note over App,CM: Login
    App->>CM: saveToken via cordova.exec
    CM->>CM: setCookie with HttpOnly Secure SameSite=None
    CM-->>App: success

    Note over App,Server: Auth check - getLoggedInUser
    App->>Server: fetch GET /login - no credentials include
    Server-->>App: 401 Unauthorized - cookie not forwarded

    Note over App,Server: XHR path via ajax utility
    App->>Server: XHR with withCredentials true
    Server-->>App: 200 OK - cookie forwarded correctly

    Note over App,Server: Logout
    App->>Server: fetch DELETE /login - no credentials include
    Server-->>App: request without session - session NOT cleared
    App->>CM: clearTokenCookie via cordova.exec
    CM-->>App: local cookie cleared only

Loading

_{Reviews (2): Last reviewed commit: "fix: update cookie settings to include H..." | Re-trigger Greptile}

[RohitKushvaha01]

LGTM!

[github-actions]

Preview Release for this, has been built.

Click here to view that github actions build