From fe9c994b74cce1243ea17ec2038fcb5d99ad49a9 Mon Sep 17 00:00:00 2001
From: Ashwin Kumar Sivakumar <ashwin@traceworks.in>
Date: Sat, 18 Jul 2026 22:59:04 +0530
Subject: [PATCH] fix(admin-verification): attach bearer token to verification
 queue/detail fetches
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Backend's AuthUser extractor only reads the Authorization header — it never
looks at cookies. The verification queue list (index.tsx load()) and every
call in the verification detail page (via the shared adminFetch helper) sent
credentials: 'include' but no Authorization header, so they 401'd right after
a successful login even though the access token was already in sessionStorage.
Matches the pattern already used by the approve/reject actions further down
in index.tsx.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
---
 src/routes/admin/verification/[id].tsx  | 9 ++++++++-
 src/routes/admin/verification/index.tsx | 8 +++++++-
 2 files changed, 15 insertions(+), 2 deletions(-)

diff --git a/src/routes/admin/verification/[id].tsx b/src/routes/admin/verification/[id].tsx
index bdd66c3..3b6f7af 100644
--- a/src/routes/admin/verification/[id].tsx
+++ b/src/routes/admin/verification/[id].tsx
@@ -3,10 +3,17 @@ import { For, Show, createMemo, createSignal, onMount } from 'solid-js';
 
 const API = '';
 async function adminFetch(path: string, opts?: RequestInit) {
+  const accessToken = typeof sessionStorage !== 'undefined'
+    ? sessionStorage.getItem('nxtgauge_admin_access_token') || ''
+    : '';
   return fetch(`${API}${path}`, {
     ...opts,
     credentials: 'include',
-    headers: { 'Content-Type': 'application/json', ...(opts?.headers ?? {}) },
+    headers: {
+      'Content-Type': 'application/json',
+      ...(accessToken ? { Authorization: `Bearer ${accessToken}` } : {}),
+      ...(opts?.headers ?? {}),
+    },
   });
 }
 
diff --git a/src/routes/admin/verification/index.tsx b/src/routes/admin/verification/index.tsx
index 3bb17bb..225f34c 100644
--- a/src/routes/admin/verification/index.tsx
+++ b/src/routes/admin/verification/index.tsx
@@ -157,8 +157,14 @@ export default function VerificationManagementPage() {
   const load = async () => {
     try {
       setError('');
+      const accessToken = typeof sessionStorage !== 'undefined'
+        ? sessionStorage.getItem('nxtgauge_admin_access_token') || ''
+        : '';
       const res = await fetch(`${API}/api/admin/verifications?page=1&limit=200`, {
-        headers: { Accept: 'application/json' },
+        headers: {
+          Accept: 'application/json',
+          ...(accessToken ? { Authorization: `Bearer ${accessToken}` } : {}),
+        },
         credentials: 'include',
       });
       if (!res.ok) throw new Error(`Failed to load verification queue (${res.status})`);