fix: persist refresh cookie across browser restarts (WealthLedger/backend#123)

The refresh cookie had no Max-Age, so browsers dropped it on close while the Session stayed valid for 7 days. Set maxAge from REFRESH_TTL_MS, the same constant behind Session.expiresAt.

src/modules/auth/application/auth.service.ts

@@ -17,7 +17,7 @@ import { AuthenticationResult, AuthUser, RefreshPayload } from './auth.types';
 const EXPECTED_ROTATED_SESSIONS = 1;
 
 const PASSWORD_HASH_ROUNDS = 12;
-const REFRESH_TTL_MS = 604_800_000;
+export const REFRESH_TTL_MS = 604_800_000;
 
 const ACCESS_TTL = '15m';
 const REFRESH_TTL = '7d';

src/modules/auth/presentation/auth.controller.ts

@@ -22,7 +22,7 @@ import {
 
 import { ApiProblemResponses } from '../../../common/decorators/api-safe-error-response.decorator';
 import { HttpErrorCode } from '../../../common/error-code';
-import { AuthService } from '../application/auth.service';
+import { AuthService, REFRESH_TTL_MS } from '../application/auth.service';
 import { AccessPayload, AuthenticationResult } from '../application/auth.types';
 import { LoginDto, RegisterDto } from './auth.dto';
 import { JwtAuthGuard } from './jwt-auth.guard';
@@ -134,6 +134,7 @@ export class AuthController {
       sameSite: 'lax' as const,
       secure: process.env['NODE_ENV'] !== 'development',
       path: COOKIE_PATH,
+      maxAge: REFRESH_TTL_MS,
     };
   }
 }

test/app.e2e-spec.ts

@@ -131,6 +131,9 @@ describe('Authentication (e2e)', () => {
         .filter((attribute) => !attribute.startsWith('Expires='))
         .sort((a, b) => a.localeCompare(b));
     const host = ['HttpOnly', 'Path=/api/v1/auth', 'SameSite=Lax'];
+    // Persistent for the Session lifetime (7 days), otherwise the browser drops it on restart.
+    const persistent = [...host, 'Max-Age=604800'];
+    const sorted = (items: string[]) => [...items].sort((a, b) => a.localeCompare(b));
     const login = async () => {
       const registration = await request(app.getHttpServer())
         .post('/api/v1/auth/register')
@@ -150,7 +153,7 @@ describe('Authentication (e2e)', () => {
       }
     };
 
-    it('issues, rotates and clears it HttpOnly, Lax, path-scoped, host-only and Secure in production', async () => {
+    it('issues and rotates it persistent (Max-Age) HttpOnly, Lax, path-scoped, host-only and Secure in production, and clears it', async () => {
       await inEnvironment('production', async () => {
         const issued = await login();
         const rotated = await request(app.getHttpServer())
@@ -162,16 +165,20 @@ describe('Authentication (e2e)', () => {
           .set('Cookie', rotated.headers['set-cookie'][0])
           .expect(204);
 
-        // Exact set: any added Domain/Max-Age or a dropped flag fails.
-        for (const cookie of [issued, rotated.headers['set-cookie'][0], cleared.headers['set-cookie'][0]]) {
-          expect(attributes(cookie)).toEqual([...host, 'Secure'].sort((a, b) => a.localeCompare(b)));
+        // Exact set: any added Domain, changed Max-Age or dropped flag fails.
+        for (const cookie of [issued, rotated.headers['set-cookie'][0]]) {
+          expect(attributes(cookie)).toEqual(sorted([...persistent, 'Secure']));
         }
+        // Clearing must not carry Max-Age; Express expires it with a past Expires.
+        const clearedCookie = cleared.headers['set-cookie'][0];
+        expect(attributes(clearedCookie)).toEqual(sorted([...host, 'Secure']));
+        expect(clearedCookie).toContain('Expires=Thu, 01 Jan 1970');
       });
     });
 
     it('drops only Secure in development and keeps every other attribute', async () => {
       await inEnvironment('development', async () => {
-        expect(attributes(await login())).toEqual(host);
+        expect(attributes(await login())).toEqual(sorted(persistent));
       });
     });
   });