Fix auth: no Content-Type on GET (mobile/HF); jsonAuthHeaders for POST; remove fetch monkey-patch

static/index.html

@@ -324,17 +324,6 @@
 <script>
 (function(){
 
-  /* Ensure cookies (session) are sent on /api/* — HF proxy may strip Authorization on GET. */
-  const _nativeFetch = window.fetch;
-  window.fetch = function(input, init) {
-    init = init ? {...init} : {};
-    const u = typeof input === "string" ? input : (input && input.url) || "";
-    if (u.startsWith("/api") && init.credentials === undefined) {
-      init.credentials = "include";
-    }
-    return _nativeFetch.call(window, input, init);
-  };
-
   /* ── i18n ───────────────────────────────────────────────────────────── */
   const I18N = {
     en: {
@@ -897,7 +886,10 @@
     saveBtn.disabled = true; skipBtn.disabled = true;
     try {
       const username = usernameInput.value.trim() || "anonymous";
-      const resp = await fetch(`/api/next_sheet?labeler=${encodeURIComponent(username)}`, {headers: authHeaders()});
+      const resp = await fetch(`/api/next_sheet?labeler=${encodeURIComponent(username)}`, {
+        headers: authHeaders(),
+        credentials: "include",
+      });
       const data = await safeJson(resp);
       if (!resp.ok) throw new Error(data.detail || `HTTP ${resp.status}`);
       if (data.done) {
@@ -1484,7 +1476,8 @@
     try {
       const resp = await fetch("/api/skip", {
         method: "POST",
-        headers: authHeaders(),
+        headers: jsonAuthHeaders(),
+        credentials: "include",
         body: JSON.stringify({
           drive_file_id: currentSheet.drive_file_id || "",
           meta_row_index: currentSheet.meta_row_index || 0,
@@ -1584,7 +1577,8 @@
     try {
       const resp = await fetch("/api/save_and_next", {
         method: "POST",
-        headers: authHeaders(),
+        headers: jsonAuthHeaders(),
+        credentials: "include",
         body: JSON.stringify({
           spreadsheet_id: currentSheet.spreadsheet_id,
           sheet_name: currentSheet.sheet_name,
@@ -1818,7 +1812,8 @@
     try {
       const resp = await fetch("/api/rag_label/save", {
         method: "POST",
-        headers: authHeaders(),
+        headers: jsonAuthHeaders(),
+        credentials: "include",
         body: JSON.stringify({
           sheet_id: currentSheet.rag_sheet_id,
           spreadsheet_id: currentSheet.spreadsheet_id,
@@ -1975,7 +1970,8 @@
     try {
       const resp = await fetch("/api/save_review", {
         method: "POST",
-        headers: authHeaders(),
+        headers: jsonAuthHeaders(),
+        credentials: "include",
         body: JSON.stringify({
           spreadsheet_id: currentSheet.spreadsheet_id,
           sheet_name: currentSheet.sheet_name,
@@ -2011,12 +2007,19 @@
 
   let authToken = localStorage.getItem("labeler_token") || "";
 
+  /** Only Authorization — never send ``Content-Type: application/json`` on GET (breaks some proxies / mobile). */
   function authHeaders() {
-    const h = {"Content-Type": "application/json"};
+    const h = {};
     if (authToken) h["Authorization"] = `Bearer ${authToken}`;
     return h;
   }
 
+  function jsonAuthHeaders() {
+    const h = authHeaders();
+    h["Content-Type"] = "application/json";
+    return h;
+  }
+
   async function safeJson(resp) {
     const text = await resp.text();
     try { return JSON.parse(text); }
@@ -2040,7 +2043,7 @@
     }
 
     try {
-      const r = await fetch("/api/auth/check", {headers: authHeaders()});
+      const r = await fetch("/api/auth/check", {headers: authHeaders(), credentials: "include"});
       const ct = r.headers.get("content-type") || "";
       if (!r.ok || !ct.includes("application/json")) {
         authToken = "";
@@ -2071,6 +2074,7 @@
       const r = await fetch("/api/auth", {
         method: "POST",
         headers: {"Content-Type": "application/json"},
+        credentials: "include",
         body: JSON.stringify({password: loginPwd.value}),
       });
       if (r.ok) {