fix(auth): correct local cookie security configuration

validation-suite/backend/mercury/app/services/auth_service.py

@@ -5,7 +5,9 @@ from datetime import UTC, datetime
 from fastapi import HTTPException, status
 from sqlalchemy.orm import Session
 
+from app.core.config import settings
 from app.core.security import create_access_token, verify_password
+from app.models.user import User
 from app.repositories.domain import UserRepository
 
 
@@ -13,14 +15,16 @@ class AuthService:
     def __init__(self, session: Session) -> None:
         self.users = UserRepository(session)
 
-    def login(self, email: str, password: str) -> str:
+    def login(self, email: str, password: str) -> tuple[str, User]:
         user = self.users.by_email(email)
-        if user is None or not user.is_active or not verify_password(password, user.password_hash):
+        if user is None or not verify_password(password, user.password_hash):
             raise HTTPException(
                 status_code=status.HTTP_401_UNAUTHORIZED,
                 detail="Invalid credentials",
                 headers={"WWW-Authenticate": "Bearer"},
             )
+        if not user.is_active:
+            raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="Inactive user")
         user.last_login_at = datetime.now(UTC)
         self.users.session.commit()
-        return create_access_token(user.id, user.role)
+        return create_access_token(user.id, user.role), user