feat: update authentication storage to use cookies and improve token retrieval

libs/auth/src/lib/utils/auth-storage.ts

@@ -1,7 +1,37 @@
-let _prefix = 'ema-auth';
+const MAX_AGE = 60 * 60 * 24 * 7; // ponytail: cookie lifetime knob; JWT expiry + refresh govern real auth
 
-export function configureAuthStorage(prefix: string) {
+interface Backend {
+  get(k: string): string | null;
+  set(k: string, v: string): void;
+  remove(k: string): void;
+}
+
+const localBackend: Backend = {
+  get: (k) => localStorage.getItem(k),
+  set: (k, v) => localStorage.setItem(k, v),
+  remove: (k) => localStorage.removeItem(k),
+};
+
+const cookieBackend: Backend = {
+  get: (k) => {
+    const m = document.cookie.match(new RegExp('(?:^|;\\s*)' + k + '=([^;]*)'));
+    return m ? decodeURIComponent(m[1]) : null;
+  },
+  // ponytail: 4KB/cookie cap — auth-user/current-profile JSON must stay under it
+  set: (k, v) => {
+    document.cookie = `${k}=${encodeURIComponent(v)}; path=/; Secure; SameSite=Strict; Max-Age=${MAX_AGE}`;
+  },
+  remove: (k) => {
+    document.cookie = `${k}=; path=/; Secure; SameSite=Strict; Max-Age=0`;
+  },
+};
+
+let _prefix = 'ema-auth';
+let backend: Backend = localBackend;
+
+export function configureAuthStorage(prefix: string, useCookies = false) {
   _prefix = prefix;
+  backend = useCookies ? cookieBackend : localBackend;
 }
 
 function key(k: string) {
@@ -9,32 +39,32 @@ function key(k: string) {
 }
 
 export const authStorage = {
-  getToken: () => localStorage.getItem(key('auth-token')) ?? undefined,
-  setToken: (token: string) => localStorage.setItem(key('auth-token'), token),
-  getRefreshToken: () => localStorage.getItem(key('refresh-token')) ?? undefined,
-  setRefreshToken: (t: string) => localStorage.setItem(key('refresh-token'), t),
+  getToken: () => backend.get(key('auth-token')) ?? undefined,
+  setToken: (token: string) => backend.set(key('auth-token'), token),
+  getRefreshToken: () => backend.get(key('refresh-token')) ?? undefined,
+  setRefreshToken: (t: string) => backend.set(key('refresh-token'), t),
   getUser: <T = unknown>(): T | null => {
     try {
-      return JSON.parse(localStorage.getItem(key('auth-user')) ?? 'null') as T | null;
+      return JSON.parse(backend.get(key('auth-user')) ?? 'null') as T | null;
     } catch {
       return null;
     }
   },
-  setUser: <T>(u: T) => localStorage.setItem(key('auth-user'), JSON.stringify(u)),
-  getProfileId: () => localStorage.getItem(key('profile-id')) ?? undefined,
-  setProfileId: (id: string) => localStorage.setItem(key('profile-id'), id),
+  setUser: <T>(u: T) => backend.set(key('auth-user'), JSON.stringify(u)),
+  getProfileId: () => backend.get(key('profile-id')) ?? undefined,
+  setProfileId: (id: string) => backend.set(key('profile-id'), id),
   getProfile: <T = unknown>(): T | null => {
     try {
-      return JSON.parse(localStorage.getItem(key('current-profile')) ?? 'null') as T | null;
+      return JSON.parse(backend.get(key('current-profile')) ?? 'null') as T | null;
     } catch {
       return null;
     }
   },
-  setProfile: <T>(p: T) => localStorage.setItem(key('current-profile'), JSON.stringify(p)),
-  removeProfile: () => localStorage.removeItem(key('current-profile')),
+  setProfile: <T>(p: T) => backend.set(key('current-profile'), JSON.stringify(p)),
+  removeProfile: () => backend.remove(key('current-profile')),
   clear: () => {
     [key('auth-token'), key('refresh-token'), key('auth-user'), key('profile-id'), key('current-profile')].forEach((k) =>
-      localStorage.removeItem(k),
+      backend.remove(k),
     );
     document.cookie =
       'auth-token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 UTC; SameSite=Lax';