fix(security): harden auth and secret handling (HH-444) (#101)

* fix(security): harden auth and credential handling (HH-444)

* fix(security): address HH-444 review blockers

* fix(security): close remaining HH-444 review blockers

---------

Co-authored-by: Rogee <rogee@ipao.vip>

frontend/app/javascript/dashboard/store/utils/api.js

@@ -1,5 +1,3 @@
-import fromUnixTime from 'date-fns/fromUnixTime';
-import differenceInDays from 'date-fns/differenceInDays';
 import Cookies from 'js-cookie';
 import { LOCAL_STORAGE_KEYS } from 'dashboard/constants/localStorage';
 import { SESSION_STORAGE_KEYS } from 'dashboard/constants/sessionStorage';
@@ -25,21 +23,18 @@ export const setUser = user => {
   emitter.emit(ANALYTICS_IDENTITY, { user });
 };
 
-export const getHeaderExpiry = response =>
-  fromUnixTime(response.headers.expiry);
-
 export const setAuthCredentials = response => {
-  const expiryDate = getHeaderExpiry(response);
-  Cookies.set('cw_d_session_info', JSON.stringify(response.headers), {
-    expires: differenceInDays(expiryDate, new Date()),
-  });
-  setUser(response.data.data, expiryDate);
+  setUser(response.data.data);
 };
 
 export const clearBrowserSessionCookies = () => {
   Cookies.remove('cw_d_session_info');
+  Cookies.remove('cw_d_session_state');
   Cookies.remove('auth_data');
   Cookies.remove('user');
+  ['access-token', 'client', 'uid', 'token-type', 'expiry'].forEach(key =>
+    localStorage.removeItem(key)
+  );
 };
 
 export const clearLocalStorageOnLogout = () => {

frontend/app/javascript/dashboard/store/utils/api.spec.js

@@ -0,0 +1,32 @@
+import Cookies from 'js-cookie';
+import { clearBrowserSessionCookies, setAuthCredentials } from './api';
+
+describe('browser auth storage', () => {
+  it('never persists response auth headers in JavaScript-readable storage', () => {
+    const cookie = vi.spyOn(Cookies, 'set');
+    const storage = vi.spyOn(Storage.prototype, 'setItem');
+
+    setAuthCredentials({
+      data: { data: { id: 1 } },
+      headers: { 'access-token': 'xss-readable-token', client: 'browser' },
+    });
+
+    expect(cookie).not.toHaveBeenCalled();
+    expect(storage).not.toHaveBeenCalledWith(
+      expect.any(String),
+      expect.stringContaining('xss-readable-token')
+    );
+  });
+
+  it('removes legacy auth storage during logout', () => {
+    const removeCookie = vi.spyOn(Cookies, 'remove');
+    const removeStorage = vi.spyOn(Storage.prototype, 'removeItem');
+
+    clearBrowserSessionCookies();
+
+    expect(removeCookie).toHaveBeenCalledWith('cw_d_session_info');
+    expect(removeCookie).toHaveBeenCalledWith('cw_d_session_state');
+    expect(removeStorage).toHaveBeenCalledWith('access-token');
+    expect(removeStorage).toHaveBeenCalledWith('client');
+  });
+});