fix: persist refresh cookie across browser restarts (WealthLedger/backend#123)

test/app.e2e-spec.ts

@@ -131,6 +131,9 @@ describe('Authentication (e2e)', () => {
         .filter((attribute) => !attribute.startsWith('Expires='))
         .sort((a, b) => a.localeCompare(b));
     const host = ['HttpOnly', 'Path=/api/v1/auth', 'SameSite=Lax'];
+    // Persistent for the Session lifetime (7 days), otherwise the browser drops it on restart.
+    const persistent = [...host, 'Max-Age=604800'];
+    const sorted = (items: string[]) => [...items].sort((a, b) => a.localeCompare(b));
     const login = async () => {
       const registration = await request(app.getHttpServer())
         .post('/api/v1/auth/register')
@@ -150,7 +153,7 @@ describe('Authentication (e2e)', () => {
       }
     };
 
-    it('issues, rotates and clears it HttpOnly, Lax, path-scoped, host-only and Secure in production', async () => {
+    it('issues and rotates it persistent (Max-Age) HttpOnly, Lax, path-scoped, host-only and Secure in production, and clears it', async () => {
       await inEnvironment('production', async () => {
         const issued = await login();
         const rotated = await request(app.getHttpServer())
@@ -162,16 +165,20 @@ describe('Authentication (e2e)', () => {
           .set('Cookie', rotated.headers['set-cookie'][0])
           .expect(204);
 
-        // Exact set: any added Domain/Max-Age or a dropped flag fails.
-        for (const cookie of [issued, rotated.headers['set-cookie'][0], cleared.headers['set-cookie'][0]]) {
-          expect(attributes(cookie)).toEqual([...host, 'Secure'].sort((a, b) => a.localeCompare(b)));
+        // Exact set: any added Domain, changed Max-Age or dropped flag fails.
+        for (const cookie of [issued, rotated.headers['set-cookie'][0]]) {
+          expect(attributes(cookie)).toEqual(sorted([...persistent, 'Secure']));
         }
+        // Clearing must not carry Max-Age; Express expires it with a past Expires.
+        const clearedCookie = cleared.headers['set-cookie'][0];
+        expect(attributes(clearedCookie)).toEqual(sorted([...host, 'Secure']));
+        expect(clearedCookie).toContain('Expires=Thu, 01 Jan 1970');
       });
     });
 
     it('drops only Secure in development and keeps every other attribute', async () => {
       await inEnvironment('development', async () => {
-        expect(attributes(await login())).toEqual(host);
+        expect(attributes(await login())).toEqual(sorted(persistent));
       });
     });
   });