feat: implement access and refresh token handling in authentication flow

[HermanPlay]

This pull request introduces a significant refactor to the authentication system, replacing the use of session-based cookies with access and refresh tokens for improved security and scalability. The changes primarily focus on updating authentication flows, token management, and API request headers across the application.

Authentication System Refactor

• Token-based Authentication: Replaced SESSION_COOKIE_NAME with ACCESS_TOKEN_COOKIE_NAME and REFRESH_TOKEN_COOKIE_NAME. Added logic to handle token refresh and validation, ensuring tokens are updated and invalidated as needed (src/hooks.server.ts). [1] [2]
• New Utility Function: Introduced refreshTokens to handle token refresh requests to the backend (src/lib/server/utils.ts).
• Updated API Response Schema: Updated AuthUserResponse to include accessToken, refreshToken, and expiresAt. Added a new AuthRefreshResponse interface for token refresh responses (src/lib/backendSchemas.ts).

API Request Header Updates

• Authorization Header: Replaced session-based headers with Authorization: Bearer <accessToken> across all API requests in multiple routes, ensuring compatibility with the new token-based system. [1] [2] [3] src/routes/dashboard/tasks/[taskId]/+page.server.tsL38-R44, src/routes/dashboard/users/[userId]/+page.server.tsL106-R106)

Token Management in Routes

• Login and Logout: Updated login flow to set both access and refresh tokens in cookies. Enhanced logout flow to invalidate tokens on the server and clear cookies locally (src/routes/auth/+page.server.ts, src/routes/dashboard/+page.server.ts). [1] [2]
• Dashboard Access: Modified dashboard route protection to check for accessToken instead of sessionId (src/hooks.server.ts).

Miscellaneous Fixes

• Task Description URL: Fixed a typo in the query parameter name from taskId to taskID in the task description fetch request (src/routes/dashboard/tasks/[taskId]/+page.server.ts). (src/routes/dashboard/tasks/[taskId]/+page.server.tsL25-R25)

[Copilot]

Pull Request Overview

This pull request implements a token-based authentication system to replace the session-based approach. Key changes include updating the authentication flow (in hooks and middleware) to validate and refresh tokens, refactoring API calls to include bearer tokens in request headers, and adjusting data structures and constants for access and refresh tokens.

Reviewed Changes

Copilot reviewed 15 out of 15 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
src/routes/dashboard/users/[userId]/+page.server.ts	Replaces session references with access tokens in API calls
src/routes/dashboard/users/+page.server.ts	Updates API header to use bearer tokens
src/routes/dashboard/tasks/new/+page.server.ts	Updates API header to use bearer tokens in task creation actions
src/routes/dashboard/tasks/[taskId]/submissions/+page.server.ts	Uses bearer token for submission API calls
src/routes/dashboard/tasks/[taskId]/+page.server.ts	Updates API calls and fixes the query param typo for task description
src/routes/dashboard/tasks/[taskId]/+layout.server.ts	Uses bearer tokens for task detail fetching
src/routes/dashboard/tasks/+page.server.ts	Updates bearer token usage in API calls
src/routes/dashboard/groups/[groupId]/+page.server.ts	Updates API header to use bearer tokens in group details fetching
src/routes/dashboard/groups/+page.server.ts	Uses bearer tokens in group list loading
src/routes/dashboard/+page.server.ts	Refactors logout action and token cookie management
src/routes/auth/+page.server.ts	Handles setting access and refresh token cookies on user authentication
src/lib/server/utils.ts	Adds refreshTokens function and updates cookie name constants
src/lib/backendSchemas.ts	Updates interface definitions to include access and refresh token fields
src/hooks.server.ts	Implements token validation with refresh logic and cookie management

[Copilot]

[nitpick] Consider using a backend-provided refresh token expiration value if available instead of hardcoding the 7-day period, to allow for flexibility in token lifetimes.

Suggested change

	expires: new Date(Date.now() + 7 * 24 * 60 * 60 * 1000), // 7 days
	expires: refreshResponse.data.refreshExpiresAt
	? new Date(refreshResponse.data.refreshExpiresAt)
	: new Date(Date.now() + 7 * 24 * 60 * 60 * 1000), // Fallback to 7 days