Aedis UI

api

Same-origin JSON client for the app's own backend.

const approvals = await api<Approval[]>("/api/approvals");
await api("/api/approvals/42/approve", { body: {}, csrfCookie: "XSRF-TOKEN" });

Installation

Once per app, set up Aedis UI. The CLI verifies the signed release before writing anything and pins every dependency:

npx @aedis/cli@0.1.0 init

Import the theme once in your global CSS, after Tailwind:

app/globals.css
@import "tailwindcss";@import "./styles/aedis-theme.css";

Then add the component:

npx @aedis/cli@0.1.0 add api# pnpm dlx @aedis/cli@0.1.0 add api · yarn dlx @aedis/cli@0.1.0 add api · bunx @aedis/cli@0.1.0 add api

Props

PropTypeDefaultDescription
pathstring—Relative path on this origin; absolute URLs are refused.
bodyunknown—JSON body; defaults the method to POST.
timeoutMsnumber30000Abort after this long.
csrfCookiestring—Cookie whose value is echoed in X-CSRF-Token.

Security

  • Only relative paths: the session cookie never travels to another host, and redirects are refused.
  • Sends X-Requested-With, which a cross-site form cannot; require it on the server with SameSite cookies.
  • Responses that are not application/json are refused; 401 and 403 surface as ApiError with the status.
  • Keep the session in an HttpOnly cookie. Never store a token in localStorage or sessionStorage.