Send credentials on authed requests so login persists in dev

[jenul-ferdinand]

What

• In local dev the frontend (localhost:4200) and API (localhost:8080) are different origins, so the browser only attaches auth cookies to requests that set withCredentials.
• Three authed requests omitted it: getByUser, me, and updateUsername.
• This adds withCredentials: true to all three, matching the per-call convention the other services already use.

Why it logged you out

• The notifications popup calls getByUser the moment login populates currentUser$.
• In dev that request carried no cookie and returned 401.
• The auth interceptor refreshed, retried without credentials, hit another 401, and its catchError ran clearSession(), dropping the user right after login.

Why prod was unaffected

• Prod serves the API same-origin (relative /api/v2), so cookies ride along without the flag. The gap only shows on dev's cross-origin setup.

Tests

• New assertions that getByUser, me, and updateUsername each send withCredentials. They fail without the fix.

Closes #297

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
monstar	Ready	Preview, Comment	Jul 14, 2026 1:29am

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.