Normalize browser API auth helpers to use authedFetch

[itsmiso-ai]

Fixes #311

Replace all plain fetch() calls in browser UI components with authedFetch()
to ensure Basic Auth credentials are included for protected mutating routes.

Changes:

• src/app/automation/page.tsx: Replace 8 fetch() calls with authedFetch()
• src/app/automation/repos/[...repo]/page.tsx: Replace 3 fetch() calls with authedFetch()
• src/components/issue-card.tsx: Replace 5 fetch() calls with authedFetch()
• Add vitest regression tests for client-auth Basic Auth behavior

Problem:
When DISPATCH_AUTH_MODE=basic, plain fetch() calls to protected API routes
do not include the Authorization: Basic ... header, causing 401 errors.
Some UI paths used authedFetch() while others used plain fetch(), leading
to inconsistent behavior depending on which page/component was active.

[its-saffron]

AI Automated Review

Full PR review.

Analysis engine: review@https://litellm.jory.dev/v1 (openai)

Recommendation

Approve. This PR correctly addresses the issue of inconsistent authentication in the browser UI by replacing plain fetch() calls with the project-standard authedFetch() for mutating API routes. It also includes comprehensive regression tests for the authentication logic.

Change-by-Change Findings

• src/app/automation/page.tsx: Replaced multiple fetch() calls (GET and POST/DELETE) with authedFetch() to ensure Authorization headers are included when DISPATCH_AUTH_MODE=basic is enabled.
• src/app/automation/repos/[...repo]/page.tsx: Replaced fetch() calls with authedFetch() for repository details and automation run triggers.
• src/components/issue-card.tsx: Updated issue action triggers (agent assignment, sync, unassign, groom) to use authedFetch().
• src/lib/client-auth.test.ts: Added a new test suite using Vitest to verify authedFetch correctly attaches Basic Auth headers, preserves existing headers, and handles empty credentials.

Standards Compliance

• Authentication: Follows the established pattern of using authedFetch() for protected mutating routes as described in the README.md and AGENTS.md.
• Testing: Adheres to the requirement for meaningful testing by adding a dedicated test file for the client authentication utility.
• Code Quality: The implementation is consistent with the existing codebase and addresses the specific technical debt identified in the linked issue.

Linked Issue Fit

• Issue PR 311: This PR directly implements the recommendation from the audit: "replace protected mutating UI fetch calls with authedFetch or a shared client wrapper and add Basic Auth mode regression tests." It covers all the specific file locations identified in the issue body.

Unknowns or Needs Verification

• None identified. The changes are localized to client-side authentication handling and are well-covered by the new tests.

[its-saffron]

AI Automated Review

Full PR review.

Analysis engine: review@https://litellm.jory.dev/v1 (openai)

Recommendation

Approve. This PR correctly addresses the issue of inconsistent authentication in the browser UI by replacing plain fetch() calls with authedFetch() for mutating API routes. It also includes comprehensive regression tests for the authentication logic.

Change-by-Change Findings

• src/app/automation/page.tsx: Replaced multiple fetch() calls (GET and POST/DELETE) with authedFetch() to ensure Authorization headers are included when DISPATCH_AUTH_MODE=basic is enabled.
• src/app/automation/repos/[...repo]/page.tsx: Replaced fetch() calls with authedFetch() for repository details and automation run triggers.
• src/components/issue-card.tsx: Updated several mutation actions (assigning agents, syncing, unassigning, and grooming) to use authedFetch().
• src/lib/client-auth.test.ts: Added a new test suite using vitest to verify authedFetch correctly attaches Basic Auth headers, preserves existing headers, and handles missing credentials.

Standards Compliance

• Code Standards: Follows the pattern of using authedFetch for protected routes as documented in the repository's README.
• Error Handling: The implementation maintains existing error handling patterns in the UI components.
• Testing: The addition of src/lib/client-auth.test.ts provides necessary coverage for the authentication helper, ensuring no regressions in header injection logic.

Linked Issue Fit

• Issue PR 311: The PR directly implements the recommendation from the linked issue: "Replace protected mutating UI fetch calls with authedFetch or a shared client wrapper and add Basic Auth mode regression tests." The implementation matches the requirements perfectly.

Unknowns or Needs Verification

• None identified. The logic for authedFetch is verified by the new test suite.