From 2746971962ed7d95907ad7a8d93c685d7377feaa Mon Sep 17 00:00:00 2001 From: Yoav Farhi Date: Tue, 12 May 2026 14:40:17 +0300 Subject: [PATCH] fix(client): apply access token before analytics module init MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Analytics fires an initialization event during createAnalyticsModule construction. Its flush calls auth.me(), which builds an axios request synchronously using the current defaults.headers. Because setToken ran *after* createAnalyticsModule, the first User/me request went out with no Authorization header — returning 401/403 on apps that require auth. Move the localStorage/URL token application to right after the auth module is built, so all module constructions see an authenticated axios client. Co-Authored-By: Claude Opus 4.7 (1M context) --- src/client.ts | 20 +++++++++++--------- 1 file changed, 11 insertions(+), 9 deletions(-) diff --git a/src/client.ts b/src/client.ts index c5416795..a028f337 100644 --- a/src/client.ts +++ b/src/client.ts @@ -151,6 +151,17 @@ export function createClient(config: CreateClientConfig): Base44Client { } ); + // Apply the access token before any module that may issue authenticated + // requests during construction (notably analytics, which fires an init + // event whose flush calls auth.me()). Without this, the first User/me + // request is built before setToken runs and goes out unauthenticated. + if (typeof window !== "undefined") { + const accessToken = token || getAccessToken(); + if (accessToken) { + userAuthModule.setToken(accessToken); + } + } + const userModules = { entities: createEntitiesModule({ axios: axiosClient, @@ -230,15 +241,6 @@ export function createClient(config: CreateClientConfig): Base44Client { }, }; - // Always try to get token from localStorage or URL parameters - if (typeof window !== "undefined") { - // Get token from URL or localStorage - const accessToken = token || getAccessToken(); - if (accessToken) { - userModules.auth.setToken(accessToken); - } - } - // If authentication is required, verify token and redirect to login if needed if (requiresAuth && typeof window !== "undefined") { // We perform this check asynchronously to not block client creation