feat: enhance security by implementing HttpOnly refresh tokens and in-memory access token management

- Added isomorphic-dompurify for improved XSS protection
- Refactored token storage to use in-memory management for access tokens
- Implemented server-side route handlers for OAuth token management
- Introduced security headers in next.config.js
- Removed client-side exposure of client_secret and sensitive tokens
- Updated API interceptors to handle token refresh logic
- Cleaned up cookie management for refresh tokens

components/appointment/detail/SubmitData.js

@@ -4,6 +4,7 @@ import { Button } from "@mui/material";
 import ArrowLeftB from "@/components/icons/ArrowLeftB";
 import { request } from "@/services/response";
 import Cookies from "js-cookie";
+import { setAccessToken } from "@/lib/tokenStore";
 
 function SubmitData({ setStep, data, prevData, setErrors, doctor, isForAnother, selectedSlot, selectedDate, setAppointmentId, setAppointmentExpiresAt }) {
   const [loading, setLoading] = useState(false);
@@ -11,21 +12,12 @@ function SubmitData({ setStep, data, prevData, setErrors, doctor, isForAnother,
 
   const refreshAccessToken = async () => {
     try {
-      const refreshToken = Cookies.get("refresh_token");
-      if (!refreshToken) return false;
-
-      const res = await fetch("/api/auth/refresh", {
-        method: "POST",
-        headers: { "Content-Type": "application/json" },
-        body: JSON.stringify({ refresh_token: refreshToken }),
-      });
+      const res = await fetch("/api/auth/refresh", { method: "POST" });
+      if (!res.ok) return false;
       const response = await res.json();
 
       if (response?.access_token) {
-        Cookies.set("access_token", response.access_token, { expires: 7 });
-        if (response.refresh_token) {
-          Cookies.set("refresh_token", response.refresh_token, { expires: 7 });
-        }
+        setAccessToken(response.access_token);
         return true;
       }
       return false;