47 lines
1.6 KiB
JavaScript
47 lines
1.6 KiB
JavaScript
/* Public auth endpoints. All are unauthenticated (`auth: false`) — attaching a
|
|
stale bearer to a login request would be harmless but misleading in the
|
|
network log, and the reset flow must never trigger a refresh. */
|
|
import { request } from '../lib/apiClient'
|
|
|
|
const pub = { auth: false }
|
|
|
|
export function login(email, password) {
|
|
return request('/users/login', { ...pub, method: 'POST', body: { email, password } })
|
|
}
|
|
|
|
export function signup(name, email, password) {
|
|
return request('/users/signup', { ...pub, method: 'POST', body: { name, email, password } })
|
|
}
|
|
|
|
export function confirmEmail(token) {
|
|
return request('/users/confirm-email', { ...pub, method: 'POST', body: { token } })
|
|
}
|
|
|
|
export function resendConfirmEmail(email) {
|
|
return request('/users/confirm-email/resend', { ...pub, method: 'POST', body: { email } })
|
|
}
|
|
|
|
export function forgetPassword(email) {
|
|
return request('/users/forget-password', { ...pub, method: 'POST', body: { email } })
|
|
}
|
|
|
|
export function verifyForgetCode(email, code) {
|
|
return request('/users/forget-password/verify-code', {
|
|
...pub,
|
|
method: 'POST',
|
|
body: { email, code },
|
|
})
|
|
}
|
|
|
|
export function setNewPassword(password, resetToken) {
|
|
// `token` is the 10-minute reset JWT, carried in its own Authorization header
|
|
// and checked by forget_password/permissions.py's HTTPBearer. Passing `token`
|
|
// explicitly also suppresses the refresh path, which is what we want: a reset
|
|
// token is not a session.
|
|
return request('/users/forget-password/new-password', {
|
|
method: 'POST',
|
|
body: { password },
|
|
token: resetToken,
|
|
})
|
|
}
|