fix(backend): Refresh-Token als httpOnly-Cookie statt Response-Body

ARCHITECTURE.md §3 legt fest: Access-Token im Memory/Context, Refresh-Token
als httpOnly-Cookie. Vorherige Implementierung gab beide Tokens im JSON-Body
zurueck - vor dem Frontend-Aufbau (das genau gegen diesen Vertrag baut)
korrigiert.

/api/v1/auth/login und /refresh setzen jetzt ein httpOnly-Cookie
(Path /api/v1/auth, SameSite=Lax, secure in production) und liefern nur
noch { accessToken } im Body. /refresh und /logout lesen den Refresh-Token
aus dem Cookie statt aus dem Request-Body.

e2e-Tests und Live-Smoke-Test (curl mit Cookie-Jar) verifizieren
Login/Rotation/Logout-Invalidierung. 12 e2e- + 26 Unit-Tests, Lint,
Typecheck und Build gruen.

ApiCore-Backend/test/auth.e2e-spec.ts

@@ -4,7 +4,7 @@ import request from 'supertest';
 import { App } from 'supertest/types';
 import { PrismaService } from '../src/prisma/prisma.service';
 import { createTestApp } from './utils/create-test-app';
-import { AuthTokensBody, login } from './utils/api';
+import { AccessTokenBody, extractCookie, login } from './utils/api';
 
 describe('Auth (e2e)', () => {
   let app: INestApplication<App>;
@@ -38,11 +38,11 @@ describe('Auth (e2e)', () => {
       .expect(401);
   });
 
-  it('logs in and returns access + refresh tokens', async () => {
+  it('logs in, returns an access token, and sets an httpOnly refresh-token cookie', async () => {
     const tokens = await login(app, email, password);
 
     expect(tokens.accessToken).toEqual(expect.any(String));
-    expect(tokens.refreshToken).toEqual(expect.any(String));
+    expect(tokens.refreshTokenCookie).toMatch(/^refreshToken=/);
   });
 
   it('rejects a protected route without a token', () => {
@@ -58,34 +58,43 @@ describe('Auth (e2e)', () => {
       .expect(200);
   });
 
-  it('rotates the refresh token and rejects reuse of the old one', async () => {
+  it('rejects refresh when no refresh-token cookie is present', () => {
+    return request(app.getHttpServer())
+      .post('/api/v1/auth/refresh')
+      .expect(401);
+  });
+
+  it('rotates the refresh-token cookie and rejects reuse of the old one', async () => {
     const tokens = await login(app, email, password);
 
     const refreshResponse = await request(app.getHttpServer())
       .post('/api/v1/auth/refresh')
-      .send({ refreshToken: tokens.refreshToken })
+      .set('Cookie', tokens.refreshTokenCookie)
       .expect(200);
-    const refreshed = refreshResponse.body as AuthTokensBody;
+    const rotatedCookie = extractCookie(refreshResponse, 'refreshToken');
 
-    expect(refreshed.refreshToken).not.toEqual(tokens.refreshToken);
+    expect(rotatedCookie).not.toEqual(tokens.refreshTokenCookie);
+    expect((refreshResponse.body as AccessTokenBody).accessToken).toEqual(
+      expect.any(String),
+    );
 
     await request(app.getHttpServer())
       .post('/api/v1/auth/refresh')
-      .send({ refreshToken: tokens.refreshToken })
+      .set('Cookie', tokens.refreshTokenCookie)
       .expect(401);
   });
 
-  it('logs out and invalidates the refresh token', async () => {
+  it('logs out and invalidates the refresh-token cookie', async () => {
     const tokens = await login(app, email, password);
 
     await request(app.getHttpServer())
       .post('/api/v1/auth/logout')
-      .send({ refreshToken: tokens.refreshToken })
+      .set('Cookie', tokens.refreshTokenCookie)
       .expect(204);
 
     await request(app.getHttpServer())
       .post('/api/v1/auth/refresh')
-      .send({ refreshToken: tokens.refreshToken })
+      .set('Cookie', tokens.refreshTokenCookie)
       .expect(401);
   });
 });

ApiCore-Backend/test/utils/api.ts

@@ -1,10 +1,10 @@
 import { INestApplication } from '@nestjs/common';
 import request from 'supertest';
 import { App } from 'supertest/types';
+import type { Response } from 'supertest';
 
-export interface AuthTokensBody {
+export interface AccessTokenBody {
   accessToken: string;
-  refreshToken: string;
 }
 
 export interface UserBody {
@@ -17,14 +17,32 @@ export interface UserBody {
   deactivatedAt: string | null;
 }
 
+export interface LoginResult {
+  accessToken: string;
+  refreshTokenCookie: string;
+}
+
+export function extractCookie(response: Response, name: string): string {
+  const setCookie =
+    (response.headers['set-cookie'] as unknown as string[] | undefined) ?? [];
+  const raw = setCookie.find((cookie) => cookie.startsWith(`${name}=`));
+  if (!raw) {
+    throw new Error(`Expected a Set-Cookie header for "${name}"`);
+  }
+  return raw.split(';')[0];
+}
+
 export async function login(
   app: INestApplication<App>,
   email: string,
   password: string,
-): Promise<AuthTokensBody> {
+): Promise<LoginResult> {
   const response = await request(app.getHttpServer())
     .post('/api/v1/auth/login')
     .send({ email, password })
     .expect(200);
-  return response.body as AuthTokensBody;
+  return {
+    accessToken: (response.body as AccessTokenBody).accessToken,
+    refreshTokenCookie: extractCookie(response, 'refreshToken'),
+  };
 }