fix: switch auth tokens to httpOnly cookies

[GitAddRemote]

Summary

• Moves access and refresh tokens from the response body into httpOnly cookies to protect against XSS-based token theft
• JwtStrategy now extracts the access token from req.cookies.access_token
• RefreshTokenAuthGuard rewritten as a simple CanActivate guard reading refresh_token from cookies — removes the passport-http-bearer dependency entirely
• login sets both cookies (access: 15m, refresh: 7d); refresh rotates both; logout clears both
• cookie-parser registered in main.ts; CORS configured with credentials: true

Test plan

• POST /auth/login — response body no longer contains tokens; cookies access_token and refresh_token are set with httpOnly flag
• Protected routes work using the access_token cookie (no Authorization header needed)
• POST /auth/refresh — rotates both cookies; old refresh token is revoked
• POST /auth/logout — both cookies are cleared; refresh token revoked in DB
• pnpm typecheck passes with zero errors
• pnpm lint passes clean

Closes #93

[Copilot]

Pull request overview

This PR migrates authentication from returning JWTs in JSON responses to using httpOnly cookies, updates JWT extraction to read from cookies, and simplifies refresh-token handling by removing the bearer strategy dependency.

Changes:

• Set access_token and refresh_token as httpOnly cookies on login/refresh; clear cookies on logout.
• Update JwtStrategy to extract the access token from req.cookies.access_token; replace refresh-token Passport strategy/guard with a cookie-reading CanActivate guard.
• Register cookie-parser and enable CORS with credentials: true; remove passport-http-bearer dependency.

Reviewed changes

Copilot reviewed 8 out of 9 changed files in this pull request and generated 10 comments.

Show a summary per file

File	Description
pnpm-lock.yaml	Adds cookie-parser (+ types) and removes passport-http-bearer from the lockfile.
backend/package.json	Adds cookie-parser (+ types) and removes passport-http-bearer (+ types).
backend/src/main.ts	Registers cookie-parser, configures credentialed CORS, and updates Swagger auth configuration (partially).
backend/src/modules/auth/jwt.strategy.ts	Switches JWT extraction from bearer header to cookie extractor.
backend/src/modules/auth/refresh-token-auth.guard.ts	Rewrites refresh guard to read refresh_token from cookies and attach it to request.user.
backend/src/modules/auth/auth.controller.ts	Sets/rotates/clears auth cookies in login/refresh/logout handlers.
backend/src/modules/auth/auth.service.ts	Renames returned token fields to { accessToken, refreshToken } for internal cookie-setting use.
backend/src/modules/auth/auth.module.ts	Removes the deleted refresh-token strategy from providers.
backend/src/modules/auth/refresh-token.strategy.ts	Deletes the old passport-http-bearer refresh token strategy.

Files not reviewed (1)

• pnpm-lock.yaml: Language not supported

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 12 out of 13 changed files in this pull request and generated 2 comments.

Files not reviewed (1)

• pnpm-lock.yaml: Language not supported

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 12 out of 13 changed files in this pull request and generated 2 comments.

Files not reviewed (1)

• pnpm-lock.yaml: Language not supported

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 12 out of 13 changed files in this pull request and generated 6 comments.

Files not reviewed (1)

• pnpm-lock.yaml: Language not supported

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 12 out of 13 changed files in this pull request and generated 3 comments.

Files not reviewed (1)

• pnpm-lock.yaml: Language not supported

Comments suppressed due to low confidence (1)

backend/src/modules/auth/auth.controller.ts:80

• This PR is marked as closing #93, but the acceptance criteria for #93 includes adding a GET /auth/me endpoint and removing frontend localStorage token usage. I couldn’t find an /auth/me handler in this controller, and the frontend still references localStorage.getItem('access_token') (e.g., frontend/src/components/ProtectedRoute.tsx). Either implement the remaining parts or update the PR description/linked issue status to reflect the actual scope.

  @ApiOperation({ summary: 'Register new user' })
  @ApiResponse({ status: 201, description: 'User successfully registered' })
  @ApiResponse({ status: 400, description: 'Invalid input data' })
  // Registration Route: No guards required
  @Post('register')

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 12 out of 13 changed files in this pull request and generated 3 comments.

Files not reviewed (1)

• pnpm-lock.yaml: Language not supported

Comments suppressed due to low confidence (2)

backend/test/user-organization-roles.e2e-spec.ts:149

• This role-creation request is awaited but doesn’t assert a successful status. If role creation fails (e.g., validation/authorization), role2Response.body.id can be undefined and the test will fail later in a less obvious place. Add .expect(201) (and optionally assert role2Response.body.id is defined) here.

      const role2Response = await request(app.getHttpServer())
        .post('/roles')
        .set('Cookie', authCookie)
        .send({
          name: 'Developer Role',
          permissions: { canDeploy: true },
        });

backend/test/user-organization-roles.e2e-spec.ts:157

• This second role-creation request is also missing a status assertion. Add .expect(201) (and optionally verify the response body contains an id) so failures surface at the correct step before using role3Response.body.id.

      const role3Response = await request(app.getHttpServer())
        .post('/roles')
        .set('Cookie', authCookie)
        .send({
          name: 'Viewer Role',
          permissions: { canView: true },
        });

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 13 out of 14 changed files in this pull request and generated 1 comment.

Files not reviewed (1)

• pnpm-lock.yaml: Language not supported

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 13 out of 14 changed files in this pull request and generated no new comments.

Files not reviewed (1)

• pnpm-lock.yaml: Language not supported

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.