misc / bugfix: session refresh

src/utils/authFetch.js

@@ -11,7 +11,7 @@ export const authFetch = async (url, options = {}, retry = true) => {
   if (res.status === 401 && retry) {
     // attempt refresh
     try {
-      const refreshRes = await fetch(`${API_URL}/refresh`, {
+      const refreshRes = await fetch(`${API_URL}/auth/refresh`, {
         method: "POST",
         credentials: "include",
       });
@@ -30,22 +30,23 @@ export const authFetch = async (url, options = {}, retry = true) => {
 };
 
 // Refresh token function (HttpOnly cookie flow)
-export async function refreshAccessToken() {
+export async function refreshAccessToken(cookieHeader) {
   try {
-    const res = await fetch(`${API_URL}/refresh`, {
+    const res = await fetch(`${API_URL}/auth/refresh`, {
       method: "POST",
-      credentials: "include", // send HttpOnly cookies
+      headers: {
+        cookie: cookieHeader || "", // forward cookies from the request
+      },
     });
 
     if (!res.ok) {
       throw new Error("Failed to refresh token");
     }
 
-    // Typically the server just updates the cookie
-    // It may return a new access token too, but we don’t store it client-side.
-    return true; 
+    // assume backend responds with new tokens in JSON
+    return await res.json();
   } catch (err) {
     console.error("Refresh token failed:", err);
-    return false;
+    return null;
   }
 }