semantic update

frontend/src/services/storageService.js

@@ -1,5 +1,6 @@
 // [DEF:storageService:Module]
 /**
+ * @TIER:   STANDARD
  * @purpose Frontend API client for file storage management.
  * @layer   Service
  * @relation DEPENDS_ON -> backend.api.storage
@@ -8,6 +9,25 @@
 
 const API_BASE = '/api/storage';
 
+// [DEF:getStorageAuthHeaders:Function]
+/**
+ * @purpose Returns headers with Authorization for storage API calls.
+ * @returns {Object} Headers object with Authorization if token exists.
+ * @NOTE    Unlike api.js getAuthHeaders, this doesn't set Content-Type
+ *          to allow FormData to set its own multipart boundary.
+ */
+function getStorageAuthHeaders() {
+    const headers = {};
+    if (typeof window !== 'undefined') {
+        const token = localStorage.getItem('auth_token');
+        if (token) {
+            headers['Authorization'] = `Bearer ${token}`;
+        }
+    }
+    return headers;
+}
+// [/DEF:getStorageAuthHeaders:Function]
+
 // [DEF:listFiles:Function]
 /**
  * @purpose Fetches the list of files for a given category and subpath.
@@ -25,7 +45,9 @@ export async function listFiles(category, path) {
     if (path) {
         params.append('path', path);
     }
-    const response = await fetch(`${API_BASE}/files?${params.toString()}`);
+    const response = await fetch(`${API_BASE}/files?${params.toString()}`, {
+        headers: getStorageAuthHeaders()
+    });
     if (!response.ok) {
         throw new Error(`Failed to fetch files: ${response.statusText}`);
     }
@@ -53,6 +75,7 @@ export async function uploadFile(file, category, path) {
 
     const response = await fetch(`${API_BASE}/upload`, {
         method: 'POST',
+        headers: getStorageAuthHeaders(),
         body: formData
     });
 
@@ -75,7 +98,8 @@ export async function uploadFile(file, category, path) {
  */
 export async function deleteFile(category, path) {
     const response = await fetch(`${API_BASE}/files/${category}/${path}`, {
-        method: 'DELETE'
+        method: 'DELETE',
+        headers: getStorageAuthHeaders()
     });
 
     if (!response.ok) {
@@ -93,6 +117,8 @@ export async function deleteFile(category, path) {
  * @returns {string}
  * @PRE     category and path must identify an existing file.
  * @POST    Returns a valid API URL for file download.
+ * @NOTE    Downloads use browser navigation, so auth is handled via cookies
+ *          or the backend must allow unauthenticated downloads for valid paths.
  */
 export function downloadFileUrl(category, path) {
     return `${API_BASE}/download/${category}/${path}`;