fix auth refresh request body

frontend/src/api/__tests__/auth-turnstile.spec.ts

@@ -1,12 +1,14 @@
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 
-const { postMock } = vi.hoisted(() => ({
+const { postMock, setTokenMock } = vi.hoisted(() => ({
   postMock: vi.fn(),
+  setTokenMock: vi.fn(),
 }))
 
 vi.mock('@/api/client', () => ({
   default: {
     post: postMock,
+    setToken: setTokenMock,
   },
 }))
 
@@ -15,6 +17,7 @@ import { authApi } from '@/api/auth'
 describe('authApi turnstile payloads', () => {
   beforeEach(() => {
     postMock.mockReset()
+    setTokenMock.mockReset()
     postMock.mockResolvedValue({ data: {} })
   })
 
@@ -42,4 +45,13 @@ describe('authApi turnstile payloads', () => {
       turnstile_token: 'turnstile-token',
     })
   })
+
+  it('refreshes auth token without a request body', async () => {
+    postMock.mockResolvedValue({ data: { access_token: 'new-access-token' } })
+
+    await authApi.refreshToken()
+
+    expect(postMock).toHaveBeenCalledWith('/api/auth/refresh')
+    expect(setTokenMock).toHaveBeenCalledWith('new-access-token')
+  })
 })

frontend/src/api/__tests__/client.spec.ts

@@ -1,7 +1,12 @@
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type { AxiosAdapter, AxiosInstance, InternalAxiosRequestConfig } from 'axios'
 
 import apiClient, { AUTH_STATE_CHANGE_EVENT } from '@/api/client'
 
+type TestableApiClient = typeof apiClient & {
+  client: AxiosInstance
+}
+
 describe('apiClient auth state change event', () => {
   beforeEach(() => {
     localStorage.clear()
@@ -28,4 +33,33 @@ describe('apiClient auth state change event', () => {
 
     window.removeEventListener(AUTH_STATE_CHANGE_EVENT, handler as EventListener)
   })
+
+  it('sends auth refresh without a request body', async () => {
+    const rawClient = apiClient as TestableApiClient
+    const previousAdapter = rawClient.client.defaults.adapter
+    const requests: InternalAxiosRequestConfig[] = []
+
+    rawClient.client.defaults.adapter = (async (config: InternalAxiosRequestConfig) => {
+      requests.push(config)
+      return {
+        data: { access_token: 'new-access-token' },
+        status: 200,
+        statusText: 'OK',
+        headers: {},
+        config,
+      }
+    }) as AxiosAdapter
+
+    try {
+      const response = await apiClient.refreshToken()
+
+      expect(response.data.access_token).toBe('new-access-token')
+      expect(requests).toHaveLength(1)
+      expect(requests[0].url).toBe('/api/auth/refresh')
+      expect(requests[0].method).toBe('post')
+      expect(requests[0].data).toBeUndefined()
+    } finally {
+      rawClient.client.defaults.adapter = previousAdapter
+    }
+  })
 })