Mobile App design

apps/frontend-mobile/services/api.ts

@@ -2,32 +2,43 @@ import axios from 'axios';
 import * as SecureStore from 'expo-secure-store';
 import { config } from '../constants/config';
 
+const SESSION_KEY = 'session_id';
+
 export const api = axios.create({
   baseURL: config.API_BASE_URL,
   timeout: 10000,
+  withCredentials: true,
   headers: {
     'Content-Type': 'application/json',
   },
 });
 
-// Request interceptor - add auth token
+// Request interceptor - restore session cookie from SecureStore
 api.interceptors.request.use(
   async (axiosConfig) => {
-    const token = await SecureStore.getItemAsync('auth_token');
-    if (token) {
-      axiosConfig.headers.Authorization = `Bearer ${token}`;
+    const session = await SecureStore.getItemAsync(SESSION_KEY);
+    if (session) {
+      axiosConfig.headers.Cookie = session;
     }
     return axiosConfig;
   },
   (error) => Promise.reject(error)
 );
 
-// Response interceptor - handle errors
+// Response interceptor - capture and persist session cookie from responses
 api.interceptors.response.use(
-  (response) => response,
+  (response) => {
+    const setCookie = response.headers['set-cookie'];
+    if (setCookie) {
+      const cookieStr = Array.isArray(setCookie) ? setCookie[0] : setCookie;
+      const sessionId = cookieStr.split(';')[0];
+      SecureStore.setItemAsync(SESSION_KEY, sessionId);
+    }
+    return response;
+  },
   async (error) => {
     if (error.response?.status === 401) {
-      await SecureStore.deleteItemAsync('auth_token');
+      await SecureStore.deleteItemAsync(SESSION_KEY);
     }
     return Promise.reject(error);
   }

apps/frontend-mobile/services/auth.ts

@@ -2,42 +2,44 @@ import api from './api';
 import * as SecureStore from 'expo-secure-store';
 import { AuthResponse, User } from '../types';
 
+const USER_KEY = 'user_data';
+
 export async function login(username: string, password: string): Promise<AuthResponse> {
   const response = await api.post('/auth/login', { username, password });
-  const { user, token } = response.data;
+  const { user } = response.data;
 
-  await SecureStore.setItemAsync('auth_token', token);
-  await SecureStore.setItemAsync('user', JSON.stringify(user));
+  await SecureStore.setItemAsync(USER_KEY, JSON.stringify(user));
 
   return response.data;
 }
 
 export async function logout(): Promise<void> {
   await api.post('/auth/logout');
-  await SecureStore.deleteItemAsync('auth_token');
-  await SecureStore.deleteItemAsync('user');
+  await SecureStore.deleteItemAsync(USER_KEY);
 }
 
 export async function checkAuth(): Promise<User | null> {
   try {
     const response = await api.get('/auth/check');
-    return response.data.user;
+    if (response.data.authenticated) {
+      return response.data.user;
+    }
+    return null;
   } catch {
     return null;
   }
 }
 
 export async function getStoredUser(): Promise<User | null> {
-  const userStr = await SecureStore.getItemAsync('user');
+  const userStr = await SecureStore.getItemAsync(USER_KEY);
   return userStr ? JSON.parse(userStr) : null;
 }
 
 export async function register(username: string, password: string): Promise<AuthResponse> {
   const response = await api.post('/auth/register', { username, password });
-  const { user, token } = response.data;
+  const { user } = response.data;
 
-  await SecureStore.setItemAsync('auth_token', token);
-  await SecureStore.setItemAsync('user', JSON.stringify(user));
+  await SecureStore.setItemAsync(USER_KEY, JSON.stringify(user));
 
   return response.data;
 }