add logger

src/modules/auth/auth.controller.ts

@@ -1,8 +1,10 @@
 
-import { Controller, Get, Post, Query, Res, Req, Body, HttpCode, HttpStatus, Logger } from '@nestjs/common';
+import { Controller, Get, Post, Query, Res, Req, Body, HttpCode, HttpStatus, Logger, UseGuards } from '@nestjs/common';
 import { ApiTags, ApiOperation } from '@nestjs/swagger';
 import { AuthService } from './auth.service';
 import { Response, Request } from 'express';
+import { JwtGuard } from '../../../core/auth/guards/jwt.guard';
+import { RefreshGuard } from '../../../core/auth/guards/refresh.guard';
 import { ConfigService } from '@nestjs/config';
 
 @ApiTags('Auth')
@@ -56,21 +58,43 @@ export class AuthController {
   }
 
   @Post('refresh')
+  @UseGuards(RefreshGuard)
   @ApiOperation({ summary: 'Refresh internal JWT using internal refresh token' })
-  async refresh(@Req() req: Request) {
-    const refreshToken = req.cookies?.raylab_refresh || req.body?.refreshToken;
-    this.logger.debug(`Refresh called. cookies present=${!!req.cookies} refreshTokenProvided=${!!refreshToken}`);
+  async refresh(@Req() req: Request, @Res() res: Response) {
+    // req.authInfo should contain { refreshToken }
+    const refreshToken = (req as any).authInfo?.refreshToken || (req.cookies?.raylab_refresh) || (req.body?.refreshToken);
+    this.logger.debug(`Refresh called (guarded). cookies=${JSON.stringify((req as any).cookies)} authInfo=${JSON.stringify((req as any).authInfo)}`);
+
     const result = await this.authService.refresh(refreshToken);
-    this.logger.debug(`Refresh result for user. expiresIn=${result.expiresIn}`);
-    return { success: true, data: result };
+
+    // set cookies with environment-aware options
+    const isProd = this.config.get<string>('NODE_ENV') === 'production' || process.env.NODE_ENV === 'production';
+    const cookieDomain = this.config.get<string>('RAYLAB_COOKIE_DOMAIN') || (isProd ? '.raylab.site' : undefined);
+
+    const cookieOptions: any = {
+      httpOnly: true,
+      secure: isProd,
+      sameSite: isProd ? 'none' : 'lax',
+      path: '/',
+    };
+    if (cookieDomain) cookieOptions.domain = cookieDomain;
+
+    // set new cookies (rotate)
+    res.cookie('raylab_jwt', result.accessToken, { ...cookieOptions, maxAge: result.expiresIn * 1000 });
+    res.cookie('raylab_refresh', result.refreshToken, { ...cookieOptions, maxAge: result.refreshTtl * 1000 });
+
+    this.logger.debug(`Refresh complete. set new cookies for user`);
+    return res.json({ success: true, data: result });
   }
 
   @Get('me')
+  @UseGuards(JwtGuard)
   @ApiOperation({ summary: 'Get current user from internal JWT (cookie or Authorization header)' })
   async me(@Req() req: Request) {
-    const token = (req.cookies?.raylab_jwt) || (req.headers.authorization && (req.headers.authorization as string).replace(/^Bearer\s+/i, ''));
-    this.logger.debug(`Me called. cookies present=${!!req.cookies} tokenProvided=${!!token}`);
-    const user = await this.authService.me(token);
+    // With JwtGuard, req.user should be payload from token
+    this.logger.debug(`Me called (guarded). cookies=${JSON.stringify((req as any).cookies)} user=${JSON.stringify((req as any).user)}`);
+    const payload = (req as any).user;
+    const user = await this.authService.me((req.cookies?.raylab_jwt) || (req.headers.authorization && (req.headers.authorization as string).replace(/^Bearer\s+/i, '')));
     this.logger.debug(`Me returning user id=${user?.id}`);
     return { success: true, data: user };
   }