phase 3 initial completion

frontend/src/api/client.ts

@@ -2,12 +2,20 @@ import { z } from 'zod'
 
 let csrfToken: string | null = null
 
+// Called once on app bootstrap. Fetches the CSRF token and sets the cookie.
+export async function bootstrapCSRF(): Promise<void> {
+  const res = await fetch('/api/v1/csrf', { credentials: 'include' })
+  if (!res.ok) return
+  const data = await res.json()
+  if (typeof data.token === 'string') {
+    csrfToken = data.token
+  }
+}
+
 async function getCSRFToken(): Promise<string> {
   if (csrfToken) return csrfToken
-  const res = await fetch('/api/v1/csrf', { credentials: 'include' })
-  if (!res.ok) throw new Error('Failed to fetch CSRF token')
-  csrfToken = res.headers.get('X-CSRF-Token') ?? ''
-  return csrfToken
+  await bootstrapCSRF()
+  return csrfToken ?? ''
 }
 
 export class ApiError extends Error {

frontend/src/api/queries/repos.ts

@@ -3,6 +3,16 @@ import { z } from 'zod'
 import { api } from '../client'
 import type { Repository, TreeEntry } from '../../types/api'
 
+const fileDiffSchema = z.object({
+  path: z.string(),
+  oldPath: z.string().optional(),
+  additions: z.number(),
+  deletions: z.number(),
+  patch: z.string(),
+})
+
+const fileDiffsSchema = z.array(fileDiffSchema)
+
 const repositorySchema = z.object({
   id: z.number(),
   ownerId: z.number(),
@@ -53,6 +63,15 @@ export function useRepoTree(owner: string, name: string, ref: string, path = '')
   })
 }
 
+export function useRepoDiff(owner: string, name: string, base: string, head: string) {
+  return useQuery({
+    queryKey: ['repos', owner, name, 'diff', base, head],
+    queryFn: () =>
+      api.get(`/api/v1/repos/${owner}/${name}/diff?base=${base}&head=${head}`, fileDiffsSchema),
+    enabled: Boolean(owner && name && base && head),
+  })
+}
+
 export function useCreateRepo() {
   const queryClient = useQueryClient()
   return useMutation({