[Bug] fetchAPI spreads ...options after headers, dropping Content-Type/Authorization

[ionfwsrijan]

Description

In src/lib/api.js, fetchAPI builds a merged headers object (Content-Type + auth + caller headers) but then spreads ...options after it. If any caller passes an options.headers object, that later spread overwrites the entire headers object, discarding the Content-Type and Authorization (Bearer) headers.

const res = await fetch(url, {
  headers: {
    "Content-Type": "application/json",
    ...getAuthHeader(),
    ...options.headers,
  },
  ...options,            // <-- overwrites `headers` if options.headers exists
});

Expected Behavior

Per-request options.headers should be merged on top of the defaults, never replace them.

Actual Behavior

Today no caller passes options.headers, so it is latent — but the central API wrapper is structurally unsafe. The first caller that supplies custom headers (e.g. a multipart upload, CSRF token, or Idempotency-Key) will lose authentication on every request, causing hard-to-trace 401s.

Proposed Fix

const { headers: optHeaders, ...rest } = options;
const res = await fetch(url, {
  ...rest,
  headers: {
    "Content-Type": "application/json",
    ...getAuthHeader(),
    ...(optHeaders || {}),
  },
});

References

• src/lib/api.js:9-19