05/24 Fix bugs

static/js/app.js

@@ -173,7 +173,7 @@ document.addEventListener('DOMContentLoaded', () => {
     clearTimeout(expireTimer);
     warningTimer = setTimeout(() => {
       if (confirm('Your session will expire in 5 minutes. Click OK to stay logged in.')) {
-        fetch('/auth/ping', { credentials: 'same-origin' }).catch(() => {});
+        fetch('/ping', { credentials: 'same-origin' }).catch(() => {});
         resetTimers();
       }
     }, SESSION_MS - WARN_BEFORE_MS);
@@ -191,19 +191,38 @@ document.addEventListener('DOMContentLoaded', () => {
   resetTimers();
 })();
 
-/* ── Generic fetch-based form submit (JSON response) ───────── */
-async function submitJson(url, data, method = 'POST') {
-  const res = await fetch(url, {
-    method,
-    headers: { 'Content-Type': 'application/json', 'X-Requested-With': 'XMLHttpRequest' },
-    body: JSON.stringify(data),
-    credentials: 'same-origin',
-  });
-  return res.json();
-}
-
 /* ── CSRF helper (reads meta tag set by Flask) ─────────────── */
 function getCsrfToken() {
   const meta = document.querySelector('meta[name="csrf-token"]');
   return meta ? meta.content : '';
 }
+
+/* ── Auto-inject CSRF token into every static POST form ─────── */
+document.addEventListener('DOMContentLoaded', () => {
+  const token = getCsrfToken();
+  if (!token) return;
+  document.querySelectorAll('form').forEach(form => {
+    if ((form.getAttribute('method') || '').toLowerCase() !== 'post') return;
+    if (form.querySelector('input[name="csrf_token"]')) return;
+    const input = document.createElement('input');
+    input.type  = 'hidden';
+    input.name  = 'csrf_token';
+    input.value = token;
+    form.appendChild(input);
+  });
+});
+
+/* ── Generic fetch-based form submit (JSON response) ───────── */
+async function submitJson(url, data, method = 'POST') {
+  const res = await fetch(url, {
+    method,
+    headers: {
+      'Content-Type': 'application/json',
+      'X-Requested-With': 'XMLHttpRequest',
+      'X-CSRFToken': getCsrfToken(),
+    },
+    body: JSON.stringify(data),
+    credentials: 'same-origin',
+  });
+  return res.json();
+}