frontend/src/auth.ts

// The per-user session token for the write endpoints (#128). A reviewer gets it by logging in
// (LoginBar.tsx); the backend gates anything that spends the Anthropic key, burns CPU, or mutates
// reviewer state, and attributes every confirmation to the token's account. Reads stay open, so the
// app renders fine before anyone signs in.
//
// localStorage rather than sessionStorage: a reload shouldn't drop a reviewer out of their worklist.
// The corpus is public de-identified TCGA data.
const TOKEN_KEY = "endopath.apiToken";

export function getToken(): string {
  return localStorage.getItem(TOKEN_KEY) ?? "";
}

export function setToken(token: string): void {
  localStorage.setItem(TOKEN_KEY, token);
}

export function clearToken(): void {
  localStorage.removeItem(TOKEN_KEY);
}