feat: enhance security by implementing HttpOnly refresh tokens and in-memory access token management

- Added isomorphic-dompurify for improved XSS protection
- Refactored token storage to use in-memory management for access tokens
- Implemented server-side route handlers for OAuth token management
- Introduced security headers in next.config.js
- Removed client-side exposure of client_secret and sensitive tokens
- Updated API interceptors to handle token refresh logic
- Cleaned up cookie management for refresh tokens

app/api/auth/token/route.js

@@ -1,9 +1,9 @@
 import { NextResponse } from "next/server";
 import { axiosInstance } from "@/lib/req";
+import { setRefreshCookie } from "@/lib/refreshCookie";
 
 export async function POST(request) {
   const { uuid, code } = await request.json();
-
   const API_URL = process.env.NEXT_PUBLIC_API_URL;
 
   if (!uuid || !code) {
@@ -13,20 +13,28 @@ export async function POST(request) {
   const jsonHeaders = { "Content-Type": "application/json", Authorization: "" };
 
   try {
-    // مرحله ۱: تأیید OTP — بدون این، oauth/token کد را verified نمی‌بیند
-    await axiosInstance.post(
+    const verify = await axiosInstance.post(
       `${API_URL}/api/v1/user/verify-code`,
       { uuid, code },
       { headers: jsonHeaders }
     );
 
-    // مرحله ۲: تبدیل uuid تأییدشده به توکن
-    const res = await axiosInstance.post(
+    const grant = verify.data?.data?.grant;
+    if (!grant) {
+      return NextResponse.json({ error: "grant not issued" }, { status: 400 });
+    }
+
+    const token = await axiosInstance.post(
       `${API_URL}/oauth/token`,
-      { grant_type: "mobile", uuid },
+      { grant_type: "mobile", grant },
       { headers: jsonHeaders }
     );
-    return NextResponse.json(res.data, { status: res.status });
+
+    const { access_token, refresh_token, expires_in } = token.data;
+
+    const response = NextResponse.json({ access_token, expires_in }, { status: 200 });
+    setRefreshCookie(response, refresh_token, request.headers.get("host"));
+    return response;
   } catch (error) {
     if (error.response) {
       return NextResponse.json(error.response.data, { status: error.response.status });