Connecting

A store needs the API's address and a token. A TokenSession gets the token and keeps it fresh:

const session = new db.TokenSession('/relatude.cms/api');
await session.signIn(userName, password);                // checked by the site's VerifyLogin
const store = db.createStore({ baseUrl: '/relatude.cms/api', token: () => session.token() });

const me = await store.whoami();                         // { userId, anonymous, name, email, groups, admin }

`TokenSession`	Does
`signIn(userName, password)`	signs in through `auth/login`; the site's `VerifyLogin` checks the password
`fromSiteSession()`	a token for the user signed in to the site itself (its cookie), for a page on the same site
`token()`	the token to send, renewed when less than ten minutes are left; null when signed out or expired
`signOut()`	forgets the token
`onChange(handler)`	called when the token changes: signed in, renewed or signed out
`current`, `signedIn`	the token as `{ token, expires, userId }`, and whether it is still valid

The store calls token() for every request, so a renewed token needs no new store. The session keeps the token in memory only. To survive a page reload, keep it yourself:

const kept = sessionStorage.getItem('my-app.token');
const session = new db.TokenSession('/relatude.cms/api', { initial: kept ? JSON.parse(kept) : null });
session.onChange(info => info
  ? sessionStorage.setItem('my-app.token', JSON.stringify(info))
  : sessionStorage.removeItem('my-app.token'));

For a base URL on another origin, such as https://www.example.com/relatude.cms/api, the site must allow that origin with ASP.NET Core's CORS middleware. The API sets no CORS headers itself.