[FEATURE] - PR2 : Web api

[pulk17]

[FEATURE]

In raising this pull request, I confirm the following (please check boxes):

• I have read and understood the contributors guide.
• I have checked that another pull request for this purpose does not exist.
• I have considered, and confirmed that this submission will be valuable to others.
• I accept that this submission may not be used, and the pull request closed at the will of the maintainer.
• I give this submission freely, and claim no ownership to its content.

My familiarity with the project is as follows (check one):

• I have never used the project.
• I have used the project briefly.
• I have used the project extensively, but have not contributed previously.
• I am an active contributor to the project.

---

The typed client for the existing mod_api endpoints. Depends on #1196.

What's here
lib/api.ts is four small fetch helpers (apiGet, apiSend, apiDelete, fetchAll for paginated collections) and then one TanStack Query hook per resource on top - runs, samples, regression tests, artifacts, users, tokens, queue, health, categories, maintenance, tags.

lib/auth.ts is session handling, and it's the part most worth reviewing.

The scope decision
Signing in mints a token via POST /auth/tokens. Rather than always asking for everything, it mints a base set - runs:read, runs:write, results:read, system:read - and only requests the elevated scopes (baselines:write, tokens:manage, system:write) once /auth/me confirms a role that can use them.

That's belt and braces, not a security boundary: the API already rejects those scopes at mint time for anyone else, and the endpoints behind them are admin-only regardless. The point is that a normal user's stored token is boring if it leaks.

The role in the session gates what the UI shows. Every mutation is checked again server-side.

Error handling
apiError() deliberately does not pass server messages through for 401/403/5xx - those get generic copy so backend internals never reach the screen. 4xx validation messages do pass through, because those are written for users. The raw message always goes to the console.

A 401 on any query drops the stored session and returns to sign-in, rather than erroring every query in flight.

Review notes
This is the only file in the console that makes HTTP requests, apart from auth.ts. If it isn't in these two files, it isn't talking to the backend - which makes the API surface easy to audit in one place.

It adds no endpoints and changes no backend behaviour.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud