Include credentials on client-side dashboard API requests

frontend/src/components/audit-trail-board.tsx

@@ -96,6 +96,7 @@ export function AuditTrailBoard({
 
         const response = await fetch(`/api/audit-trail?${params.toString()}`, {
           method: 'GET',
+          credentials: 'include',
           signal: controller.signal,
           cache: 'no-store',
         });

frontend/src/components/campaign-detail-actions.tsx

@@ -83,6 +83,7 @@ export function CampaignDetailActions({ campaign }: Props) {
               setIsDuplicating(true);
               const response = await fetch(`/api/campaigns/${campaign.id}/duplicate`, {
                 method: 'POST',
+                credentials: 'include',
               });
               const payload = await readPayload(response);
               router.push(`/dashboard/campaigns/${payload.id}`);
@@ -107,6 +108,7 @@ export function CampaignDetailActions({ campaign }: Props) {
               setIsSendingNow(true);
               const response = await fetch(`/api/campaigns/${campaign.id}/send`, {
                 method: 'POST',
+                credentials: 'include',
                 headers: { 'Content-Type': 'application/json' },
                 body: JSON.stringify({ mode: 'now' }),
               });
@@ -133,6 +135,7 @@ export function CampaignDetailActions({ campaign }: Props) {
               setIsScheduling(true);
               const response = await fetch(`/api/campaigns/${campaign.id}/send`, {
                 method: 'POST',
+                credentials: 'include',
                 headers: { 'Content-Type': 'application/json' },
                 body: JSON.stringify({ mode: 'scheduled', scheduledAt: new Date(scheduledAt).toISOString() }),
               });
@@ -180,7 +183,10 @@ export function CampaignDetailActions({ campaign }: Props) {
             try {
               setMessage(null);
               setIsDeleting(true);
-              const response = await fetch(`/api/campaigns/${campaign.id}`, { method: 'DELETE' });
+              const response = await fetch(`/api/campaigns/${campaign.id}`, {
+                method: 'DELETE',
+                credentials: 'include',
+              });
               if (!response.ok && response.status !== 204) {
                 await readPayload(response);
               }
@@ -211,6 +217,7 @@ export function CampaignDetailActions({ campaign }: Props) {
               setIsSaving(true);
               const response = await fetch(`/api/campaigns/${campaign.id}`, {
                 method: 'PATCH',
+                credentials: 'include',
                 headers: { 'Content-Type': 'application/json' },
                 body: JSON.stringify({
                   ...form,

frontend/src/components/campaigns-management-board.tsx

@@ -192,6 +192,7 @@ export function CampaignsManagementBoard({ campaigns, metrics }: Props) {
                 try {
                   const response = await fetch('/api/campaigns', {
                     method: 'POST',
+                    credentials: 'include',
                     headers: { 'Content-Type': 'application/json' },
                     body: JSON.stringify({
                       ...createForm,

frontend/src/components/contact-detail-board.tsx

@@ -237,6 +237,7 @@ export function ContactDetailBoard({ contact }: Props) {
                   setIsSaving(true);
                   const response = await fetch(`/api/contacts/${contact.id}`, {
                     method: 'PATCH',
+                    credentials: 'include',
                     headers: { 'Content-Type': 'application/json' },
                     body: JSON.stringify(form),
                   });
@@ -290,7 +291,10 @@ export function ContactDetailBoard({ contact }: Props) {
                   try {
                     setError(null);
                     setIsDeleting(true);
-                    const response = await fetch(`/api/contacts/${contact.id}`, { method: 'DELETE' });
+                    const response = await fetch(`/api/contacts/${contact.id}`, {
+                      method: 'DELETE',
+                      credentials: 'include',
+                    });
                     const payload = await response.json();
                     if (!response.ok) {
                       throw new Error(typeof payload?.message === 'string' ? payload.message : 'Failed to delete contact');

frontend/src/components/contacts-directory-board.tsx

@@ -110,6 +110,7 @@ export function ContactsDirectoryBoard({ data, filters }: Props) {
     for (const item of items) {
       const response = await fetch('/api/contacts', {
         method: 'POST',
+        credentials: 'include',
         headers: { 'Content-Type': 'application/json' },
         body: JSON.stringify(item),
       });
@@ -350,6 +351,7 @@ export function ContactsDirectoryBoard({ data, filters }: Props) {
                   setIsSubmitting(true);
                   const response = await fetch('/api/contacts', {
                     method: 'POST',
+                    credentials: 'include',
                     headers: { 'Content-Type': 'application/json' },
                     body: JSON.stringify(form),
                   });

frontend/src/components/conversations-inbox.tsx

@@ -119,6 +119,7 @@ export function ConversationsInbox({
         const params = new URLSearchParams({ filter: normalizeFilter(filter) });
         if (searchTerm) params.set('search', searchTerm);
         const response = await fetch(`/api/conversations?${params.toString()}`, {
+          credentials: 'include',
           signal: controller.signal,
           cache: 'no-store',
         });
@@ -168,6 +169,7 @@ export function ConversationsInbox({
       try {
         setIsThreadLoading(true);
         const response = await fetch(`/api/conversations/${activeConversationId}`, {
+          credentials: 'include',
           signal: controller.signal,
           cache: 'no-store',
         });
@@ -201,6 +203,7 @@ export function ConversationsInbox({
     const params = new URLSearchParams({ filter: normalizeFilter(filter) });
     if (searchTerm) params.set('search', searchTerm);
     const response = await fetch(`/api/conversations?${params.toString()}`, {
+      credentials: 'include',
       cache: 'no-store',
     });
 
@@ -224,6 +227,7 @@ export function ConversationsInbox({
       setIsAssigning(true);
       const response = await fetch(`/api/conversations/${activeConversation.id}/assign`, {
         method: 'POST',
+        credentials: 'include',
       });
       if (!response.ok) {
         return;
@@ -231,6 +235,7 @@ export function ConversationsInbox({
 
       await refreshSummaries(activeConversation.id);
       const detailResponse = await fetch(`/api/conversations/${activeConversation.id}`, {
+        credentials: 'include',
         cache: 'no-store',
       });
       if (!detailResponse.ok) {
@@ -265,6 +270,7 @@ export function ConversationsInbox({
       setIsSending(true);
       const response = await fetch(`/api/conversations/${activeConversation.id}/messages`, {
         method: 'POST',
+        credentials: 'include',
         headers: {
           'Content-Type': 'application/json',
         },

frontend/src/components/roles-permissions-board.tsx

@@ -134,6 +134,7 @@ export function RolesPermissionsBoard({ initialRoles, initialAuditHighlights }:
     try {
       const response = await fetch(`/api/roles/${selectedRole.id}`, {
         method: 'PATCH',
+        credentials: 'include',
         headers: { 'Content-Type': 'application/json' },
         body: JSON.stringify({
           permissions: selectedRole.permissionRows,
@@ -219,6 +220,7 @@ export function RolesPermissionsBoard({ initialRoles, initialAuditHighlights }:
     try {
       const response = await fetch('/api/roles', {
         method: 'POST',
+        credentials: 'include',
         headers: { 'Content-Type': 'application/json' },
         body: JSON.stringify({
           name: trimmedName,

frontend/src/components/users-management-board.tsx

@@ -164,6 +164,7 @@ export function UsersManagementBoard({
         if (roleFilter !== 'all') params.set('roleId', roleFilter);
 
         const response = await fetch(`/api/users?${params.toString()}`, {
+          credentials: 'include',
           signal: controller.signal,
           cache: 'no-store',
         });
@@ -215,6 +216,7 @@ export function UsersManagementBoard({
     try {
       const response = await fetch('/api/users', {
         method: 'POST',
+        credentials: 'include',
         headers: { 'Content-Type': 'application/json' },
         body: JSON.stringify({
           name: inviteName,
@@ -251,6 +253,7 @@ export function UsersManagementBoard({
     try {
       const response = await fetch(`/api/users/${editingUser.id}`, {
         method: 'PATCH',
+        credentials: 'include',
         headers: { 'Content-Type': 'application/json' },
         body: JSON.stringify({
           name: editName,
@@ -293,6 +296,7 @@ export function UsersManagementBoard({
     try {
       const response = await fetch('/api/users', {
         method: 'POST',
+        credentials: 'include',
         headers: { 'Content-Type': 'application/json' },
         body: JSON.stringify({
           name: user.name,