fix: pass auth token to browser WebSocket connection

When the server is started with --auth-token, the browser client now
passes the token via query parameter (?token=...) when connecting to
the ORPC WebSocket endpoint. The token is read from VITE_AUTH_TOKEN
environment variable at build time.

Change-Id: Ic0e253cf128cae361af5032b0dbc0decb92dbd5f
Signed-off-by: Thomas Kosiewski <tk@coder.com>

Author: ThomasK33

src/browser/orpc/react.tsx

@@ -57,7 +57,15 @@ export const ORPCProvider = (props: ORPCProviderProps) => {
       const API_BASE = import.meta.env.VITE_BACKEND_URL ?? window.location.origin;
       const WS_BASE = API_BASE.replace("http://", "ws://").replace("https://", "wss://");
 
-      const ws = new WebSocket(`${WS_BASE}/orpc/ws`);
+      // Build WebSocket URL, including auth token if provided via env var
+      // eslint-disable-next-line @typescript-eslint/ban-ts-comment, @typescript-eslint/prefer-ts-expect-error
+      // @ts-ignore - import.meta is available in Vite
+      const authToken: string | undefined = import.meta.env.VITE_AUTH_TOKEN;
+      const wsUrl = authToken
+        ? `${WS_BASE}/orpc/ws?token=${encodeURIComponent(authToken)}`
+        : `${WS_BASE}/orpc/ws`;
+
+      const ws = new WebSocket(wsUrl);
       const link = new WebSocketLink({
         websocket: ws,
       });