Function buildAppSdkClient

apps/desktop/electron/appSdkClient.ts:17–97

(options: {
  baseURL: string;
  getCookie: () => string;
  onUnauthorized?: () => void;
})

 * before the user signs in. The server decides whether auth is required.
 */
export function buildAppSdkClient(options: {
  baseURL: string;
  getCookie: () => string;
  onUnauthorized?: () => void;
}) {
  const base = createAppClient({
    baseURL: options.baseURL,
    headers: undefined,
  });

  return async <TData, TError = unknown, TVariables = unknown>(
    config: RequestConfig<TVariables>
  ): Promise<ResponseConfig<TData>> => {
    const headers = new Headers();
    headers.set("Accept", "application/json");
    // Do NOT set credentials: "include" — we carry the cookie explicitly and
    // `credentials: include` would trigger Electron's fetch CORS preflight.
    const cookie = options.getCookie();
    if (cookie) {
      headers.set("Cookie", cookie);
    }
    for (const [key, value] of new Headers(
      (config.headers as HeadersInit | undefined) ?? undefined
    ).entries()) {
      headers.set(key, value);
    }

    try {
      return await base<TData, TError, TVariables>({
        ...config,
        headers,
      });
    } catch (error) {
      const status =
        error && typeof error === "object" && "status" in error
          ? (error as { status?: number }).status
          : undefined;
      if (status === 401 || status === 403) {
        options.onUnauthorized?.();
        // Re-throw with a diagnostic message so the caller can tell whether
        // the request was even carrying a cookie. This is the single biggest
        // source of "why am I 401" confusion on the desktop BFF path.
        const hadCookie = cookie.length > 0;
        const diagnostic = hadCookie
          ? `sent Cookie header (${cookie.length} bytes) but server rejected it`
          : "no Cookie header — Better-Auth session missing or expired. Sign in to desktop first.";
        // The SDK base client attaches the parsed response body to `.data`
        // on the error. Surface that so we can see Hono's actual reason.
        let bodyDump = "";
        const errData = (error as { data?: unknown }).data;
        if (errData !== undefined) {
          try {
            bodyDump = ` body=${JSON.stringify(errData)}`;
          } catch {
            bodyDump = ` body=<unserializable>`;
          }
        }
        // Cookie name hint — shows what names are in the cookie header so we