feat(graphql-server): Cookie Lifecycle & CSRF Enforcement

[theothersideofgod]

Summary

Implements server-side cookie management for authentication flows, addressing #749.

• Session cookies: Automatically set constructive_session cookie on successful auth mutations (signIn, signUp, SSO, MFA, etc.)
• Sign out: Clear both session and device token cookies on signOut/revokeSession/revokeAllSessions
• CSRF protection: Integrated with existing CSRF middleware, preserves CSRF token cookies
• Multi-tenant support: Works correctly with both main database and tenant databases

Why grafserv Plugin Instead of Express Middleware?

Initially attempted to implement this using Express middleware, but encountered architectural limitations:

Express middleware approach (doesn't work):

// Attempted to intercept res.json() to set cookies
const originalJson = res.json.bind(res);
res.json = (body) => {
  if (body?.data?.signIn?.accessToken) {
    res.cookie('constructive_session', body.data.signIn.accessToken);
  }
  return originalJson(body);
};

The problem: PostGraphile v5 (grafserv) uses streaming responses. The response is serialized to a buffer internally by grafserv and written directly to the stream — it never passes through res.json(). Express middleware cannot intercept this.

grafserv plugin approach (correct solution):

grafserv: {
  middleware: {
    async processRequest(next, event) {
      const result = await next();  // Get complete response
      // Parse buffer, extract accessToken, set cookies
      return { ...result, headers: { 'set-cookie': [...] } };
    }
  }
}

This allows us to modify headers before grafserv sends the response, correctly setting cookies at the right layer.

Key Changes

New Files

• graphql/server/src/plugins/auth-cookie-plugin.ts - grafserv plugin for cookie lifecycle
• graphql/server/src/plugins/__tests__/auth-cookie-plugin.test.ts - 25 unit tests

Modified Files

• graphql/server/src/middleware/graphile.ts - Wire AuthCookiePreset into PostGraphile
• graphql/server/src/middleware/cookie.ts - Fix rememberMe duration logic
• graphql/server/src/server.ts - Remove old Express middleware

Removed Files

• graphql/server/src/middleware/auth-cookie.ts - Old Express middleware (didn't work with grafserv streaming)
• graphql/server/src/middleware/__tests__/auth-cookie.test.ts - Old tests

Cookie Behavior

Mutation	Action
signIn, signUp, signInSso, signUpSso, signInMagicLink, signUpMagicLink, signInEmailOtp, signInSmsOtp, signUpSms, signInOneTimeToken, signInCrossOrigin, completeMfaChallenge, refreshToken	Set constructive_session cookie (+ constructive_device_token if returned)
signOut, revokeSession, revokeAllSessions	Clear both cookies

Cookie Attributes

• HttpOnly: true (XSS protection)
• SameSite: Lax (CSRF protection)
• Path: /
• MaxAge: 1 hour default, 30 days with rememberMe: true

Test Plan

• Unit tests: 45 tests passing (25 plugin + 11 CSRF + 9 cookie)
• Integration test: Main database (api.localhost:3000)
• Integration test: Tenant database (auth-xxx.localhost:3000)
• Verify CSRF token preserved alongside session cookie
• Verify signOut clears both session and device cookies

Related

Closes #749

---

🤖 Generated with Claude Code

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​pgpm/​metaschema-schema@​0.18.0
	@​pgpm/​metaschema-modules@​0.21.1
	@​pgpm/​database-jobs@​0.18.0
	@​pgpm/​inflection@​0.18.0
	@​pgpm/​types@​0.18.0
	@​pgpm/​verify@​0.18.0
	@​launchql/​styled-email@​0.1.0
	@​pgpm/​services@​0.18.0
	@​jest/​test-sequencer@​30.3.0
	@​launchql/​mjml@​0.1.1
	@​types/​babel__generator@​7.27.0
	@​inquirerer/​utils@​3.3.5
	@​agentic-kit/​ollama@​1.0.3
	@​inquirerer/​test@​1.3.5
	@​dataplan/​json@​1.0.0
	@​0no-co/​graphql.web@​1.2.0
	@​dataplan/​pg@​1.0.0
	@​aws-sdk/​lib-storage@​3.1009.0
	@​testing-library/​react@​11.2.5
	@​tanstack/​react-query@​5.90.21
	@​testing-library/​jest-dom@​5.11.10
	@​pgsql/​traverse@​17.2.5
	@​graphile/​simplify-inflection@​8.0.0
	@​graphile-contrib/​pg-many-to-many@​2.0.0-rc.2
	@​pgsql/​utils@​17.8.15
	@​aws-sdk/​client-s3@​3.1009.0
	@​aws-sdk/​s3-request-presigner@​3.1017.0
	@​playwright/​test@​1.58.2

View full report