feat(server): cookie lifecycle & CSRF enforcement (#749)

[theothersideofgod]

Summary

Implement complete cookie authentication lifecycle and CSRF protection (Issue #749 — Phase 1 of #735)

• ✅ CSRF Middleware — Double-Submit Cookie pattern protection
• ✅ Session Cookie — Set on sign-in, clear on sign-out
• ✅ Device Token — 90-day device token support
• ✅ Remember Me — Configurable extended session duration

Architecture

Request Flow:
┌─────────┐    ┌──────┐    ┌──────┐    ┌───────┐    ┌──────┐    ┌─────────┐
│  CORS   │───▶│  API │───▶│ Auth │───▶│Captcha│───▶│ CSRF │───▶│ Graphile│
└─────────┘    └──────┘    └──────┘    └───────┘    └──────┘    └─────────┘
                                                        │              │
                                          csrf_token ◀──┘   AuthCookie │
                                          cookie set       Plugin sets │
                                                           session     ▼
                                                           cookie    Response

CSRF Protection

Request Type	CSRF Check	Reason
Bearer token	Skip	Not vulnerable to CSRF
Anonymous	Skip	No session to exploit
Cookie auth	Enforce	Browser auto-sends cookies

# Verify CSRF protection
curl -X POST http://api.localhost:3000/graphql \
  -H "Cookie: constructive_session=TOKEN; csrf_token=ABC" \
  -d '{"query":"{ currentUserId }"}'
# → 403 CSRF token validation failed

curl -X POST http://api.localhost:3000/graphql \
  -H "Cookie: constructive_session=TOKEN; csrf_token=ABC" \
  -H "X-CSRF-Token: ABC" \
  -d '{"query":"{ currentUserId }"}'
# → 200 OK

Commits

#	Commit	Description	Tests
1	7f9b7a4	Cookie utility module	279 lines
2	960efce	CSRF middleware integration	170 lines
3	2f1f37b	Add rememberMeDuration to AuthSettings	—
4	d133c29	AuthCookiePlugin (core)	1098 lines
5	e393e6b	Wire into middleware chain	—
6	b1a0c73	Return 403 for CSRF errors	—
7	b1190bc	Fix cookie setting	—
8	c3310d2	Device token reading	—
9	9b0e35f	Device token tests	192 lines

Total test coverage: ~1700 lines

Files Changed

Core Implementation

File	Purpose
middleware/cookie.ts	Cookie serialization & config utilities
plugins/auth-cookie-plugin.ts	Grafserv plugin to intercept auth mutations
server.ts	Middleware chain configuration

Integration

File	Purpose
middleware/auth.ts	Read device token cookie
middleware/graphile.ts	Pass device token to DB context
middleware/api.ts	Load remember_me_duration setting
middleware/error-handler.ts	Return 403 for CSRF errors

Dependencies

+ @constructive-io/csrf
+ cookie-parser
+ @types/cookie-parser

How to Test

# 1. Anonymous sign up (CSRF skipped)
curl -X POST http://api.localhost:3000/graphql \
  -H "Content-Type: application/json" \
  -d '{"query":"mutation { signUp(input: {email: \"test@example.com\", password: \"Test123!\"}) { result { accessToken } } }"}'

# 2. Cookie auth without CSRF (should fail 403)
curl -X POST http://api.localhost:3000/graphql \
  -H "Cookie: constructive_session=<token>; csrf_token=abc" \
  -d '{"query":"{ currentUserId }"}'

# 3. Cookie auth with CSRF (should succeed 200)
curl -X POST http://api.localhost:3000/graphql \
  -H "Cookie: constructive_session=<token>; csrf_token=abc" \
  -H "X-CSRF-Token: abc" \
  -d '{"query":"{ currentUserId }"}'

Not Included (Future Work)

• Anonymous session creation for DB-level CSRF validation
• Cookie auth flow end-to-end (DB sign_in expects session)

---

Closes #749

🤖 Generated with Claude Code