First commit, phased 1 and 2 created but untested

public/js/auth.js

@@ -0,0 +1,48 @@
+const API_BASE = '/api';
+
+const api = {
+  async post(path, body) {
+    const res = await fetch(`${API_BASE}${path}`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      credentials: 'include',
+      body: JSON.stringify(body),
+    });
+    const data = await res.json();
+    if (!res.ok) {
+      const msg = data.error ? data.error.message : 'Request failed.';
+      const errorEl = document.getElementById('error');
+      if (errorEl) {
+        errorEl.textContent = msg;
+        errorEl.style.display = 'block';
+      }
+      throw new Error(msg);
+    }
+    return data.data;
+  },
+
+  async get(path) {
+    const res = await fetch(`${API_BASE}${path}`, {
+      credentials: 'include',
+    });
+    const data = await res.json();
+    if (!res.ok) {
+      const msg = data.error ? data.error.message : 'Request failed.';
+      const errorEl = document.getElementById('error');
+      if (errorEl) {
+        errorEl.textContent = msg;
+        errorEl.style.display = 'block';
+      }
+      throw new Error(msg);
+    }
+    return data.data;
+  },
+};
+
+function showError(msg) {
+  const errorEl = document.getElementById('error');
+  if (errorEl) {
+    errorEl.textContent = msg;
+    errorEl.style.display = 'block';
+  }
+}