archetecture security fix

apps/dashboard/src/lib/api.ts

@@ -0,0 +1,68 @@
+export const API_BASE =
+  typeof window === 'undefined'
+    ? (process.env.API_INTERNAL_URL || 'http://localhost:4000/api/v1')
+    : (process.env.NEXT_PUBLIC_API_URL || '/dashboard/api/v1')
+
+export const EMPLOYEE_PROFILE_KEY = 'employee_profile'
+
+export async function apiFetch<T>(path: string, options?: RequestInit): Promise<T> {
+  const isFormData = typeof FormData !== 'undefined' && options?.body instanceof FormData
+
+  const headers: Record<string, string> = {
+    ...(options?.headers as Record<string, string> ?? {}),
+  }
+
+  if (!isFormData) {
+    headers['Content-Type'] = 'application/json'
+  }
+
+  const res = await fetch(`${API_BASE}${path}`, {
+    ...options,
+    headers,
+    credentials: 'include',
+  })
+
+  let json: any
+  try {
+    json = await res.json()
+  } catch {
+    throw new Error(`HTTP ${res.status}: ${res.statusText}`)
+  }
+
+  if (!res.ok) {
+    const err = new Error(json?.message ?? json?.error ?? `Request failed with status ${res.status}`) as any
+    err.code = json?.error
+    err.statusCode = res.status
+    throw err
+  }
+
+  return (json?.data ?? json) as T
+}
+
+export async function apiFetchServer<T>(path: string, token: string, options?: RequestInit): Promise<T> {
+  const isFormData = typeof FormData !== 'undefined' && options?.body instanceof FormData
+  const res = await fetch(`${API_BASE}${path}`, {
+    ...options,
+    headers: {
+      ...(isFormData ? {} : { 'Content-Type': 'application/json' }),
+      'Authorization': `Bearer ${token}`,
+      ...(options?.headers as Record<string, string> ?? {}),
+    },
+    cache: 'no-store',
+  })
+
+  let json: any
+  try {
+    json = await res.json()
+  } catch {
+    throw new Error(`HTTP ${res.status}: ${res.statusText}`)
+  }
+
+  if (!res.ok) {
+    const err = new Error(json?.message ?? `Request failed with status ${res.status}`) as any
+    err.statusCode = res.status
+    throw err
+  }
+
+  return (json?.data ?? json) as T
+}