Fix: Linked CORS Bypass to UI-LOGIN

src/core/auth.ts

@@ -9,12 +9,13 @@ export class AuthRequiredError extends Error {
   }
 }
 
-let _accessToken: string | null = null;
+const TOKEN_KEY = "moku_access_token";
+let _accessToken: string | null = sessionStorage.getItem(TOKEN_KEY);
 
 export const uiAuth = {
   getToken:   () => _accessToken,
-  setToken:   (t: string) => { _accessToken = t; },
-  clearToken: () => { _accessToken = null; },
+  setToken:   (t: string) => { _accessToken = t; sessionStorage.setItem(TOKEN_KEY, t); },
+  clearToken: () => { _accessToken = null; sessionStorage.removeItem(TOKEN_KEY); },
 };
 
 export const authSession = {

src/core/cache/imageCache.ts

@@ -1,5 +1,6 @@
 import { fetch as tauriFetch } from "@tauri-apps/plugin-http";
 import { store } from "@store/state.svelte";
+import { uiAuth } from "@core/auth";
 
 const cache    = new Map<string, string>();
 const inflight = new Map<string, Promise<string>>();
@@ -17,9 +18,17 @@ interface QueueEntry {
 const queue: QueueEntry[] = [];
 
 function getAuthHeaders(): Record<string, string> {
-  const user = store.settings.serverAuthUser?.trim() ?? "";
-  const pass = store.settings.serverAuthPass?.trim() ?? "";
-  return user && pass ? { Authorization: `Basic ${btoa(`${user}:${pass}`)}` } : {};
+  const mode = store.settings.serverAuthMode ?? "NONE";
+  if (mode === "UI_LOGIN") {
+    const token = uiAuth.getToken();
+    return token ? { Authorization: `Bearer ${token}` } : {};
+  }
+  if (mode === "BASIC_AUTH") {
+    const user = store.settings.serverAuthUser?.trim() ?? "";
+    const pass = store.settings.serverAuthPass?.trim() ?? "";
+    return user && pass ? { Authorization: `Basic ${btoa(`${user}:${pass}`)}` } : {};
+  }
+  return {};
 }
 
 async function doFetch(url: string): Promise<string> {

src/core/cache/pageCache.ts

@@ -1,4 +1,4 @@
-import { gql, plainThumbUrl }         from "@api/client";
+import { gql, getServerUrl }           from "@api/client";
 import { getBlobUrl, preloadBlobUrls } from "@core/cache/imageCache";
 import { dedupeRequest }               from "@core/async/batchRequests";
 import { FETCH_CHAPTER_PAGES }         from "@api/mutations/chapters";
@@ -29,7 +29,7 @@ export function fetchPages(
     const p = dedupeRequest(`chapter-pages:${chapterId}`, () =>
       gql<{ fetchChapterPages: { pages: string[] } }>(FETCH_CHAPTER_PAGES, { chapterId })
         .then(d => {
-          const urls = d.fetchChapterPages.pages.map(p => plainThumbUrl(p));
+          const urls = d.fetchChapterPages.pages.map(p => p.startsWith("http") ? p : `${getServerUrl()}${p}`);
           if (useBlob) {
             if (urls[priorityPage]) getBlobUrl(urls[priorityPage], urls.length + 999);
             preloadBlobUrls(urls.filter((_, i) => i !== priorityPage), urls.length);