feat(server): cookie lifecycle & CSRF enforcement (#749)#1117

Merged

pyramation merged 9 commits into

mainfrom

feat/cookie-lifecycle-csrf-749

May 12, 2026

Commits on May 11, 2026

feat(server): add cookie utility module for auth cookie management

theothersideofgod
and
claude
committed
feat(server): add CSRF protection for cookie-authenticated requests

theothersideofgod
and
claude
committed
feat(server): add rememberMeDuration to AuthSettings

theothersideofgod
and
claude
committed
feat(server): add AuthCookiePlugin for grafserv response interception

theothersideofgod
and
claude
committed
feat(server): wire AuthCookiePlugin and CSRF into middleware chain

theothersideofgod
and
claude
committed
fix(server): return 403 for CSRF errors instead of 500

theothersideofgod
and
claude
committed
fix(auth-cookie): parse grafserv body and set cookies correctly

theothersideofgod
and
claude
committed
feat(server): read device token cookie and pass to GraphQL context

theothersideofgod
and
claude
committed
test(server): add unit tests for device token reading

theothersideofgod
and
claude
committed