fix(auth): correct local cookie security configuration

validation-suite/frontend/atlas/components/auth.tsx

@@ -1,15 +1,16 @@
 "use client";
 
 import { useRouter } from "next/navigation";
-import { createContext, useContext, useEffect, useMemo, useState } from "react";
-import { apiGet, User } from "@/lib/api";
+import { createContext, useContext, useEffect, useMemo, useRef, useState } from "react";
+import { User } from "@/lib/api";
 
 type AuthContextValue = {
   token: string | null;
   setToken: (value: string | null) => void;
+  setUser: (value: User | null) => void;
   logout: () => void;
   user: User | null;
-  refreshUser: () => void;
+  refreshUser: () => Promise<User | null>;
 };
 
 const AuthContext = createContext<AuthContextValue | null>(null);
@@ -18,42 +19,67 @@ export function AuthProvider({ children }: { children: React.ReactNode }) {
   const router = useRouter();
   const [token, setTokenState] = useState<string | null>(null);
   const [user, setUser] = useState<User | null>(null);
+  const tokenRef = useRef<string | null>(null);
+  const userRef = useRef<User | null>(null);
 
   useEffect(() => {
-    const stored = window.localStorage.getItem("atlas_token");
-    setTokenState(stored);
-    if (!stored) return;
-    void apiGet<User>("/auth/me", stored).then(setUser).catch(() => setUser(null));
-  }, []);
-
-  useEffect(() => {
-    if (!token) {
-      setUser(null);
-      return;
-    }
-    void apiGet<User>("/auth/me", token).then(setUser).catch(() => setUser(null));
+    tokenRef.current = token;
   }, [token]);
 
+  useEffect(() => {
+    userRef.current = user;
+  }, [user]);
+
+  useEffect(() => {
+    void fetch("/api/me", { credentials: "include", cache: "no-store" })
+      .then(async (response) => {
+        if (!response.ok) {
+          throw new Error(`HTTP ${response.status}`);
+        }
+        return (await response.json()) as User;
+      })
+      .then((current) => {
+        setUser(current);
+        setTokenState("authenticated");
+      })
+      .catch(() => {
+        if (!tokenRef.current && !userRef.current) {
+          setUser(null);
+          setTokenState(null);
+        }
+      });
+  }, []);
+
   const value = useMemo<AuthContextValue>(() => {
     const setToken = (next: string | null) => {
       setTokenState(next);
-      if (next) {
-        window.localStorage.setItem("atlas_token", next);
-      } else {
-        window.localStorage.removeItem("atlas_token");
-      }
     };
     return {
       token,
       setToken,
+      setUser,
       logout: () => {
         setToken(null);
+        void fetch("/api/logout", { method: "POST", credentials: "include" });
         router.push("/login");
       },
       user,
-      refreshUser: () => {
-        if (token) {
-          void apiGet<User>("/auth/me", token).then(setUser).catch(() => setUser(null));
+      refreshUser: async () => {
+        try {
+          const response = await fetch("/api/me", { credentials: "include", cache: "no-store" });
+          if (!response.ok) {
+            throw new Error(`HTTP ${response.status}`);
+          }
+          const current = (await response.json()) as User;
+          setUser(current);
+          setTokenState("authenticated");
+          return current;
+        } catch {
+          if (!userRef.current) {
+            setUser(null);
+            setTokenState(null);
+          }
+          return null;
         }
       }
     };