From 98de0a4675387e1fe1355cdb1de1fa3a578835ea Mon Sep 17 00:00:00 2001 From: MOHAN Date: Thu, 2 Jul 2026 01:01:43 +0530 Subject: [PATCH] Fix Content-Type header silently dropped on every authenticated request MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit req()'s fetch init merged headers as { headers: {Content-Type, ...opts.headers}, ...opts } — spreading ...opts LAST meant opts.headers (e.g. just Authorization) fully overwrote the merged headers object, silently dropping Content-Type: application/json from every call that also passed custom headers (i.e. every authenticated request: addCredential, deleteCredential, createApiKey, revokeApiKey, regenKey, all adminApi mutations). Confirmed via direct reproduction against production: without Content-Type, the request body arrived at the backend re-wrapped as a JSON string instead of parsed as an object, producing "Input should be a valid dictionary or object to extract fields from" on every POST/PATCH/DELETE with a body. Reordered the spread so headers merge correctly. Co-Authored-By: Claude Sonnet 5 --- src/lib/api.ts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/lib/api.ts b/src/lib/api.ts index de58594..e680143 100644 --- a/src/lib/api.ts +++ b/src/lib/api.ts @@ -25,8 +25,8 @@ function errorDetailToMessage(detail: unknown): string { async function req(path: string, opts?: RequestInit): Promise { const res = await fetch(`${BASE}${path}`, { - headers: { 'Content-Type': 'application/json', ...opts?.headers }, ...opts, + headers: { 'Content-Type': 'application/json', ...opts?.headers }, }); let data: unknown; try {