feat: enhance security by implementing HttpOnly refresh tokens and in-memory access token management

- Added isomorphic-dompurify for improved XSS protection
- Refactored token storage to use in-memory management for access tokens
- Implemented server-side route handlers for OAuth token management
- Introduced security headers in next.config.js
- Removed client-side exposure of client_secret and sensitive tokens
- Updated API interceptors to handle token refresh logic
- Cleaned up cookie management for refresh tokens

app/api/auth/logout/route.js

@@ -0,0 +1,25 @@
+import { NextResponse } from "next/server";
+import { axiosInstance } from "@/lib/req";
+import { clearRefreshCookie, COOKIE_NAME } from "@/lib/refreshCookie";
+
+export async function POST(request) {
+  const API_URL = process.env.NEXT_PUBLIC_API_URL;
+  const host = request.headers.get("host");
+  const refreshToken = request.cookies.get(COOKIE_NAME)?.value;
+
+  if (refreshToken) {
+    try {
+      await axiosInstance.post(
+        `${API_URL}/oauth/logout`,
+        { refresh_token: refreshToken },
+        { headers: { "Content-Type": "application/json", Authorization: "" } }
+      );
+    } catch {
+      // revoke best-effort; clearing the cookie below is what matters
+    }
+  }
+
+  const response = NextResponse.json({ success: true }, { status: 200 });
+  clearRefreshCookie(response, host);
+  return response;
+}

app/api/auth/refresh/route.js

@@ -1,28 +1,34 @@
 import { NextResponse } from "next/server";
 import { axiosInstance } from "@/lib/req";
+import { setRefreshCookie, clearRefreshCookie, COOKIE_NAME } from "@/lib/refreshCookie";
 
 export async function POST(request) {
-  const { refresh_token } = await request.json();
-
   const API_URL = process.env.NEXT_PUBLIC_API_URL;
+  const host = request.headers.get("host");
+  const refreshToken = request.cookies.get(COOKIE_NAME)?.value;
 
-  if (!refresh_token) {
-    return NextResponse.json({ error: "refresh_token is required" }, { status: 400 });
+  if (!refreshToken) {
+    return NextResponse.json({ error: "no refresh token" }, { status: 401 });
   }
 
   try {
     const res = await axiosInstance.post(
       `${API_URL}/oauth/token/refresh`,
-      { refresh_token },
-      {
-        headers: { "Content-Type": "application/json", Authorization: "" },
-      }
+      { refresh_token: refreshToken },
+      { headers: { "Content-Type": "application/json", Authorization: "" } }
     );
-    return NextResponse.json(res.data, { status: res.status });
+
+    const { access_token, refresh_token, expires_in } = res.data;
+
+    const response = NextResponse.json({ access_token, expires_in }, { status: 200 });
+    setRefreshCookie(response, refresh_token, host);
+    return response;
   } catch (error) {
-    if (error.response) {
-      return NextResponse.json(error.response.data, { status: error.response.status });
-    }
-    return NextResponse.json({ error: "Refresh request failed" }, { status: 500 });
+    const response = NextResponse.json(
+      error.response?.data ?? { error: "Refresh request failed" },
+      { status: 401 }
+    );
+    clearRefreshCookie(response, host);
+    return response;
   }
 }

app/api/auth/token/route.js

@@ -1,9 +1,9 @@
 import { NextResponse } from "next/server";
 import { axiosInstance } from "@/lib/req";
+import { setRefreshCookie } from "@/lib/refreshCookie";
 
 export async function POST(request) {
   const { uuid, code } = await request.json();
-
   const API_URL = process.env.NEXT_PUBLIC_API_URL;
 
   if (!uuid || !code) {
@@ -13,20 +13,28 @@ export async function POST(request) {
   const jsonHeaders = { "Content-Type": "application/json", Authorization: "" };
 
   try {
-    // مرحله ۱: تأیید OTP — بدون این، oauth/token کد را verified نمی‌بیند
-    await axiosInstance.post(
+    const verify = await axiosInstance.post(
       `${API_URL}/api/v1/user/verify-code`,
       { uuid, code },
       { headers: jsonHeaders }
     );
 
-    // مرحله ۲: تبدیل uuid تأییدشده به توکن
-    const res = await axiosInstance.post(
+    const grant = verify.data?.data?.grant;
+    if (!grant) {
+      return NextResponse.json({ error: "grant not issued" }, { status: 400 });
+    }
+
+    const token = await axiosInstance.post(
       `${API_URL}/oauth/token`,
-      { grant_type: "mobile", uuid },
+      { grant_type: "mobile", grant },
       { headers: jsonHeaders }
     );
-    return NextResponse.json(res.data, { status: res.status });
+
+    const { access_token, refresh_token, expires_in } = token.data;
+
+    const response = NextResponse.json({ access_token, expires_in }, { status: 200 });
+    setRefreshCookie(response, refresh_token, request.headers.get("host"));
+    return response;
   } catch (error) {
     if (error.response) {
       return NextResponse.json(error.response.data, { status: error.response.status });