admin

mnemo_cards_admin/src/api/client.ts

@@ -24,8 +24,20 @@ export const adminApiClient = axios.create({
 // Request interceptor to add auth token
 const addAuthToken = (config: any) => {
   const token = localStorage.getItem('admin_token')
-  if (token) {
+  if (token && token.trim()) {
-    config.headers.Authorization = `Bearer ${token}`
+    // Ensure headers object exists
+    if (!config.headers) {
+      config.headers = {}
+    }
+    config.headers.Authorization = `Bearer ${token.trim()}`
+  } else {
+    // Log warning if token is missing (except for public auth endpoints)
+    const isPublicAuthEndpoint = 
+      config.url?.includes('/admin/auth/request-code') ||
+      config.url?.includes('/admin/auth/verify-code')
+    if (!isPublicAuthEndpoint) {
+      console.warn('No admin token found in localStorage for request:', config.url)
+    }
   }
   return config
 }

mnemo_cards_backend/lib/api/v2/authorize_v2.dart

@@ -10,6 +10,7 @@ const _publicAuthPaths = {
   '/auth/telegram/claim-code', // Bot endpoint for claiming web codes
   '/auth/refresh',
   '/admin/auth/request-code', // Admin login code request (public)
+  '/admin/auth/verify-code', // Admin login code verification (public)
   '/tests',
   '/test',
 };
@@ -49,7 +50,7 @@ Middleware authorizeV2(UserManager userManager, JwtService jwtService) {
       }
 
       // Check if this is a public auth endpoint - always allow for all HTTP methods
-      if (normalizedPath.startsWith('/auth/')) {
+      if (normalizedPath.startsWith('/auth/') || normalizedPath.startsWith('/admin/auth/')) {
         if (_publicAuthPaths.contains(normalizedPath)) {
           // Auth endpoints in public list are accessible without token
           return await innerHandler(request);