fix(sdk,api): align SDK auth types with API and fix refresh token flow

[Topmatrixmor2014]

Summary

Closes #527. This PR fixes two critical issues where the SDK's auth surface drifted from the API's wire contract, and the refresh token flow was broken end-to-end.

Problem

1. Type drift — expiresIn does not exist on the wire. AuthTokens in xstreamroll-sdk/src/types.ts declared expiresIn: number, but POST /auth/login and POST /auth/register return { user, accessToken, refreshToken } — no expiresIn. Every consumer reading tokens.expiresIn got undefined, and the user object the server returns was completely missing from the SDK type.

2. refreshToken() could not authenticate. StreamingClient.refreshToken() POSTed to /auth/refresh with no cookie and no credentials. The server's refresh endpoint read the refresh token exclusively from the httpOnly cookie (req.cookies?.refresh_token), and the SDK never set credentials: "include". In Node there is no cookie jar at all; in the browser cross-origin fetches omit cookies. So refreshToken() always threw, and the 401 auto-refresh retry always failed.

Root cause

• The SDK typed its own AuthTokens interface independently of the actual API response shape.
• The server's cookie-only refresh contract was incompatible with the SDK's in-memory token storage model — the SDK cannot read httpOnly cookies.

Solution

SDK (xstreamroll-sdk)

File	Change
src/types.ts	Replaced AuthTokens with AuthResponse — includes user, accessToken, refreshToken. expiresIn removed. AuthTokens kept as deprecated alias.
src/client.ts	All auth methods (login, register, refreshToken) return AuthResponse. refreshToken() sends the stored refreshToken in the request body. 401 interceptor uses the stored token.
src/index.ts	Export AuthResponse.
package.json	Bump to 1.1.0 (minor — expiresIn never worked, AuthTokens alias preserved).

API (api)

File	Change
src/auth/auth.controller.ts	Added POST /auth/refresh endpoint. Accepts refreshToken from request body OR refresh_token httpOnly cookie (backward compatible).
src/auth/auth.service.ts	Added refresh() method — verifies token, looks up user, returns fresh pair. Added signRefreshToken() with 7-day expiry. login()/register() now return refreshToken.
src/auth/users.repository.ts	Added findById() for refresh-token user lookup.
src/main.ts	Added cookie-parser middleware for cookie-based refresh flow.
package.json	Added cookie-parser + @types/cookie-parser. Bump to 1.1.0.

Backward compatibility

• The API still accepts refresh via the httpOnly cookie, so the existing Next.js proxy (app/api/auth/refresh/route.ts) continues working.
• AuthTokens is kept as a deprecated type alias — existing consumers who import it get a deprecation warning but no breakage.

Tests

New tests:

• api/src/auth/auth.controller.spec.ts — 5 tests covering body token, cookie fallback, body preference, and missing-token cases.
• api/src/auth/auth.service.spec.ts — 4 new tests for refresh(): valid token, expired token, missing user, payload structure.

Expanded tests:

• xstreamroll-sdk/__tests__/client.test.ts — 14 new tests covering login/register/refreshToken response shapes, token storage, logout, and the 401 auto-refresh interceptor round-trip.

Test results: 97/97 passing across all packages.

CI verification

✅ Typecheck — api, sdk, processing (all pass)
✅ Lint — api, sdk, processing (all pass)
✅ Tests — api (22), sdk (31), processing (44) (all pass)

Files changed

File	Change
xstreamroll-sdk/src/types.ts	AuthResponse type (replaces AuthTokens)
xstreamroll-sdk/src/client.ts	Fix refresh flow, use AuthResponse
xstreamroll-sdk/src/index.ts	Export AuthResponse
xstreamroll-sdk/__tests__/client.test.ts	Comprehensive auth tests
xstreamroll-sdk/README.md	Update docs
xstreamroll-sdk/package.json	v1.0.0 → v1.1.0
api/src/auth/auth.controller.ts	POST /auth/refresh endpoint
api/src/auth/auth.service.ts	refresh() + signRefreshToken()
api/src/auth/users.repository.ts	findById()
api/src/main.ts	cookie-parser middleware
api/src/auth/auth.service.spec.ts	Refresh service tests
api/src/auth/auth.controller.spec.ts	Refresh controller tests
api/package.json	cookie-parser deps, v1.0.0 → v1.1.0

🤖 Generated with Codebuff

[Xhristin3]

LGTM