fix: security fix

src/application/authentication/AuthApi.ts

@@ -31,7 +31,7 @@ export const authApi = {
       payload,
       { ...withTenantHeader(options?.tenantId), successMessage: "Account created", errorMessage: "Failed to create account" }
     ),
-  logout: () => apiClient.post<LogoutResponse>("/api/auth/logout", { successMessage: "Signed out", errorMessage: "Failed to sign out" }),
+  logout: () => apiClient.post<LogoutResponse>("/api/auth/logout", null, { successMessage: "Signed out", errorMessage: "Failed to sign out" }),
   me: () => apiClient.get<AuthUser>("/api/auth/me"),
   resetPassword: (oldPassword: string, newPassword: string) =>
     apiClient.post<{ message: string }>("/api/auth/reset-password", {

src/application/authentication/Components/SignInForm.tsx

@@ -14,7 +14,7 @@ export default function SignInForm() {
   const [isLoading, setIsLoading] = useState(false);
   const [errorMessage, setErrorMessage] = useState("");
 
-  const { login } = useAuth(); // Retrieve login function from context
+  const { login } = useAuth();
 
   const handleSignIn = async (event: React.FormEvent) => {
     event.preventDefault();
@@ -27,10 +27,8 @@ export default function SignInForm() {
     };
 
     try {
-      // Use the context login function to ensure state is updated
       await login(payload, isChecked);
 
-      // Redirect to the dashboard after successful signin.
       navigate("/dashboard");
     } catch (error) {
       const message =

src/context/AuthContext.tsx

@@ -70,6 +70,10 @@ export const AuthProvider: React.FC<{ children: ReactNode }> = ({
   };
 
   const logout = async () => {
+    try {
+      await authApi.logout();
+    } catch {
+    }
     clearAuthCookies();
     setUser(null);
     window.location.href = "/signin";

src/lib/apiClient.ts

@@ -1,16 +1,13 @@
 import { toast } from "react-toastify";
 import { API_BASE_URL } from "../constant";
-import { AUTH_COOKIE_KEYS, clearAuthCookies, getCookie } from "./authCookies";
+import { AUTH_COOKIE_KEYS, clearAuthCookies, getCookie, setAuthCookies } from "./authCookies";
 import { isTokenExpired } from "./jwt";
 
 type ApiRequestOptions = Omit<RequestInit, "body"> & {
   body?: unknown;
   toast?: boolean;
-  /** Optional custom success message to show in a toast */
   successMessage?: string;
-  /** Optional custom error message to show in a toast */
   errorMessage?: string;
-  /** If true, silences all toast notifications for this request */
   silent?: boolean;
 };
 
@@ -39,7 +36,9 @@ const refreshAccessToken = async () => {
   });
 
   if (!res.ok) throw new Error("Refresh failed");
-  return res.json();
+  const data = await res.json();
+  setAuthCookies(data);
+  return data;
 };
 
 const request = async <T>(
@@ -72,6 +71,9 @@ const request = async <T>(
         await new Promise<void>((resolve) => refreshQueue.push(resolve));
       }
     } catch {
+      isRefreshing = false;
+      refreshQueue.forEach((cb) => cb());
+      refreshQueue = [];
       hardLogout();
       throw new Error("Session expired");
     }