fix(achievements): use canonical X-Hermes-Session-Token header

Follow-up to TreyDong's fix: switch the auth header to
`X-Hermes-Session-Token` (the canonical pattern used by the rest of
the dashboard SPA — see `web/src/lib/api.ts` `fetchJSON()`). The
server still accepts both schemes, so the original `Authorization:
Bearer` form would also work; we standardize on X-header to match
every other dashboard fetch and only set the header when a token is
actually present.

Also add scripts/release.py AUTHOR_MAP entry for treydong.zh@gmail.com.
This commit is contained in:
Teknium 2026-05-10 19:40:43 -07:00
parent da2ed478b5
commit 80bb5f2947
2 changed files with 4 additions and 2 deletions

View file

@ -51,8 +51,9 @@
async function api(path, options) {
const url = "/api/plugins/hermes-achievements" + path;
const token = window.__HERMES_SESSION_TOKEN__ || "";
const headers = { ...(options?.headers || {}), Authorization: `Bearer ${token}` };
const res = await fetch(url, { ...options, headers });
const headers = { ...((options && options.headers) || {}) };
if (token) headers["X-Hermes-Session-Token"] = token;
const res = await fetch(url, { ...(options || {}), headers });
if (!res.ok) {
const text = await res.text().catch(function () { return res.statusText; });
throw new Error(res.status + ": " + text);