feat: add cookie-based authentication support

[pyramation]

feat: add cookie-based authentication support

Summary

This PR adds optional cookie-based authentication to the GraphQL server, with settings loaded dynamically from the database rather than static configuration.

Key changes:

• SuperTestAdapter (graphql-server-test): New adapter that wraps SuperTest for HTTP-based testing with automatic cookie jar support, enabling SDK-based cookie auth testing
• Database-driven auth settings (graphql-server): Auth middleware queries auth_settings() from the RLS module's private schema to determine if cookie auth is enabled, with results cached per service key for 1 hour
• Auth settings cache: New authSettingsCache using LRUCache to avoid per-request database queries
• cookie-parser: Added as a dependency and integrated into the server middleware stack

When cookie auth is enabled in the database, the auth flow is:

1. Check for session cookie → validate via existing authFn
2. If no cookie or invalid, fall back to Bearer token auth
3. If enable_cookie_auth is false or query fails, only Bearer token auth is used

Updates since last revision

• Dynamic schema name: Now uses rlsModule.privateSchema.schemaName instead of hardcoding constructive_auth_private - same pattern as the authenticate function
• Fetch all auth settings: The AuthSettings interface now includes all app_auth_settings columns (CSRF, session durations, password policies, etc.) for future use
• Added DEFAULT_AUTH_SETTINGS constant with sensible fallback values
• Companion PR: Requires constructive-db PR #448 which adds the enable_cookie_auth column to app_auth_settings table

Review & Testing Checklist for Human

• Verify companion PR is merged first: This PR depends on constructive-db PR fix function job, add more logs in middleware #448 adding the enable_cookie_auth column. The server will gracefully default to false if the column doesn't exist, but cookie auth won't work.
• Verify auth_settings() function exists: The middleware queries "${privateSchemaName}".auth_settings() - confirm this function exists in the RLS module's private schema and returns the expected columns
• Review hardcoded cookie name: SESSION_COOKIE_NAME = 'session' is hardcoded - confirm this matches expected cookie name in constructive-db
• Verify cache behavior: Auth settings are cached for 1 hour per service key. Confirm this TTL is acceptable, or if cache invalidation on setting change is needed.

Recommended test plan:

1. Merge constructive-db PR fix function job, add more logs in middleware #448 first
2. Set enable_cookie_auth = true in app_auth_settings for a test database
3. Link this branch to constructive-db using pnpm link
4. Write a test that signs in via SDK mutation and verifies subsequent requests are authenticated via cookie
5. Verify bearer token auth still works when enable_cookie_auth = false

Notes

• The pnpm-lock.yaml has large formatting changes (YAML style normalization) that obscure the actual dependency additions
• Cookie auth silently falls through to bearer auth on failure - this is intentional to support mixed auth scenarios
• If the auth_settings() query fails (e.g., function doesn't exist), the middleware logs a debug message and defaults to enableCookieAuth: false
• All auth settings properties are now fetched and cached, but only enableCookieAuth is currently used - others are available for future middleware enhancements
• There's duplicate buildContext logic between auth.ts and graphile.ts that could be extracted to a shared utility in a follow-up

Link to Devin run: https://app.devin.ai/sessions/15f2361412c346e6af808078720ad575
Requested by: Dan Lynch (@pyramation)

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment and CI monitoring