feat(graphql-server): Cookie Lifecycle & CSRF Enforcement

[theothersideofgod]

Summary

Implements server-side cookie management for authentication flows, addressing #749.

• Session cookies: Automatically set constructive_session cookie on successful auth mutations (signIn, signUp, SSO, MFA, etc.)
• Sign out: Clear both session and device token cookies on signOut/revokeSession/revokeAllSessions
• CSRF protection: Integrated with existing CSRF middleware, preserves CSRF token cookies
• Multi-tenant support: Works correctly with both main database and tenant databases

Why grafserv Plugin Instead of Express Middleware?

Initially attempted to implement this using Express middleware, but encountered architectural limitations:

Express middleware approach (doesn't work):

// Attempted to intercept res.json() to set cookies
const originalJson = res.json.bind(res);
res.json = (body) => {
  if (body?.data?.signIn?.accessToken) {
    res.cookie('constructive_session', body.data.signIn.accessToken);
  }
  return originalJson(body);
};

The problem: PostGraphile v5 (grafserv) uses streaming responses. The response is serialized to a buffer internally by grafserv and written directly to the stream — it never passes through res.json(). Express middleware cannot intercept this.

grafserv plugin approach (correct solution):

grafserv: {
  middleware: {
    async processRequest(next, event) {
      const result = await next();  // Get complete response
      // Parse buffer, extract accessToken, set cookies
      return { ...result, headers: { 'set-cookie': [...] } };
    }
  }
}

This allows us to modify headers before grafserv sends the response, correctly setting cookies at the right layer.

Key Changes

New Files

• graphql/server/src/plugins/auth-cookie-plugin.ts - grafserv plugin for cookie lifecycle
• graphql/server/src/plugins/__tests__/auth-cookie-plugin.test.ts - 25 unit tests

Modified Files

• graphql/server/src/middleware/graphile.ts - Wire AuthCookiePreset into PostGraphile
• graphql/server/src/middleware/cookie.ts - Fix rememberMe duration logic
• graphql/server/src/server.ts - Remove old Express middleware

Removed Files

• graphql/server/src/middleware/auth-cookie.ts - Old Express middleware (didn't work with grafserv streaming)
• graphql/server/src/middleware/__tests__/auth-cookie.test.ts - Old tests

Cookie Behavior

Mutation	Action
signIn, signUp, signInSso, signUpSso, signInMagicLink, signUpMagicLink, signInEmailOtp, signInSmsOtp, signUpSms, signInOneTimeToken, signInCrossOrigin, completeMfaChallenge, refreshToken	Set constructive_session cookie (+ constructive_device_token if returned)
signOut, revokeSession, revokeAllSessions	Clear both cookies

Cookie Attributes

• HttpOnly: true (XSS protection)
• SameSite: Lax (CSRF protection)
• Path: /
• MaxAge: 1 hour default, 30 days with rememberMe: true

Test Plan

• Unit tests: 45 tests passing (25 plugin + 11 CSRF + 9 cookie)
• Integration test: Main database (api.localhost:3000)
• Integration test: Tenant database (auth-xxx.localhost:3000)
• Verify CSRF token preserved alongside session cookie
• Verify signOut clears both session and device cookies

Related

Closes #749

---

🤖 Generated with Claude Code

[pyramation]

why are these deleted?

[pyramation]

is this done somewhere else now?

[pyramation]

hey @theothersideofgod I think we may want to look at v5 and see if there's any reason not to upgrade now