From f343512ec2b9e283f4cb9c5bce193be579d5837e Mon Sep 17 00:00:00 2001
From: bisco <bisco@autistici.org>
Date: Thu, 30 Apr 2026 12:18:19 +0200
Subject: [PATCH] fix: send staff session credentials for check-in

---
 .../app/pages/check-in-placeholder-page.component.ts |  2 +-
 frontend/src/app/services/shows-api.service.ts       | 12 ++++++++++--
 2 files changed, 11 insertions(+), 3 deletions(-)

diff --git a/frontend/src/app/pages/check-in-placeholder-page.component.ts b/frontend/src/app/pages/check-in-placeholder-page.component.ts
index ca7eddc..a86c582 100644
--- a/frontend/src/app/pages/check-in-placeholder-page.component.ts
+++ b/frontend/src/app/pages/check-in-placeholder-page.component.ts
@@ -170,7 +170,7 @@ type BarcodeDetectorConstructor = new (options?: { formats?: string[] }) => Barc
             <p class="error-message" aria-live="assertive">This reservation is already checked in.</p>
           }
           @if (state() === 'unauthorized') {
-            <p class="error-message" aria-live="assertive">You are not authorized. Staff login is required.</p>
+            <p class="error-message" aria-live="assertive">You are not authorized. Log into <code>/admin</code> with a staff account, then retry this check-in.</p>
           }
           @if (state() === 'error') {
             <p class="error-message" aria-live="assertive">Something went wrong. Please try again.</p>
diff --git a/frontend/src/app/services/shows-api.service.ts b/frontend/src/app/services/shows-api.service.ts
index 7f569d7..328683e 100644
--- a/frontend/src/app/services/shows-api.service.ts
+++ b/frontend/src/app/services/shows-api.service.ts
@@ -115,10 +115,18 @@ export class ShowsApiService {
   }
 
   previewCheckIn(token: string): Observable<CheckInPreviewResponse> {
-    return this.http.post<CheckInPreviewResponse>(`${this.apiBaseUrl}/check-ins/preview/`, { token });
+    return this.http.post<CheckInPreviewResponse>(
+      `${this.apiBaseUrl}/check-ins/preview/`,
+      { token },
+      { withCredentials: true },
+    );
   }
 
   confirmCheckIn(token: string): Observable<CheckInConfirmResponse> {
-    return this.http.post<CheckInConfirmResponse>(`${this.apiBaseUrl}/check-ins/confirm/`, { token });
+    return this.http.post<CheckInConfirmResponse>(
+      `${this.apiBaseUrl}/check-ins/confirm/`,
+      { token },
+      { withCredentials: true },
+    );
   }
 }