feat: enhance security by implementing HttpOnly refresh tokens and in-memory access token management

- Added isomorphic-dompurify for improved XSS protection
- Refactored token storage to use in-memory management for access tokens
- Implemented server-side route handlers for OAuth token management
- Introduced security headers in next.config.js
- Removed client-side exposure of client_secret and sensitive tokens
- Updated API interceptors to handle token refresh logic
- Cleaned up cookie management for refresh tokens

components/dashboard/userAccount/detailUser/information/ButtonSendData.js

@@ -1,14 +1,13 @@
 import ArrowLeftWhiteD from "@/components/icons/ArrowLeftWhiteD";
 import {
   changeDateType,
-  handleTimeExpiresToken,
   isValidIranNationalCode,
   removeAdditionalKeysDashboard,
 } from "@/helper";
 import { request } from "@/services/response";
 import { Button, CircularProgress } from "@mui/material";
-import Cookies from "js-cookie";
 import { toast } from "react-toastify";
+import { setAccessToken } from "@/lib/tokenStore";
 
 function ButtonSendData({
   loading,
@@ -31,21 +30,11 @@ function ButtonSendData({
       .postUserProfile(changeDateType(information, true))
       .then((response) => {
         if (response.uuid) {
-          fetch("/api/auth/refresh", {
-            method: "POST",
-            headers: { "Content-Type": "application/json" },
-            body: JSON.stringify({ refresh_token: Cookies.get("refresh_token") }),
-          })
-            .then((r) => r.json())
+          fetch("/api/auth/refresh", { method: "POST" })
+            .then((r) => (r.ok ? r.json() : null))
             .then((res) => {
               if (res?.access_token) {
-                const expiresTime = handleTimeExpiresToken(res.expires_in);
-                Cookies.set("access_token", res.access_token, {
-                  expires: expiresTime.accessTokenExpires,
-                  path: "/",
-                  secure: true,
-                  sameSite: "strict",
-                });
+                setAccessToken(res.access_token);
               }
               setInformation({
                 ...information,
@@ -69,11 +58,7 @@ function ButtonSendData({
     const usedKays = removeAdditionalKeysDashboard(information);
 
     request
-      .patchUserProfile(
-        changeDateType(usedKays, true),
-        information?.uuid,
-        Cookies.get("access_token")
-      )
+      .patchUserProfile(changeDateType(usedKays, true), information?.uuid)
       .then(() => {
         setLoading(false);
         toast.success("اطلاعات با موفقیت ثبت شد");