From eaab2cea8996da90086d9b83a74b43724cb2ce1b Mon Sep 17 00:00:00 2001
From: Furqan-14 <furqan076@gmail.com>
Date: Mon, 16 Feb 2026 15:30:33 +0530
Subject: [PATCH] fix: security fix

---
 src/application/authentication/AuthApi.ts            |  2 +-
 .../authentication/Components/SignInForm.tsx         |  4 +---
 src/context/AuthContext.tsx                          |  4 ++++
 src/lib/apiClient.ts                                 | 12 +++++++-----
 4 files changed, 13 insertions(+), 9 deletions(-)

diff --git a/src/application/authentication/AuthApi.ts b/src/application/authentication/AuthApi.ts
index b458210..be0076e 100644
--- a/src/application/authentication/AuthApi.ts
+++ b/src/application/authentication/AuthApi.ts
@@ -31,7 +31,7 @@ export const authApi = {
       payload,
       { ...withTenantHeader(options?.tenantId), successMessage: "Account created", errorMessage: "Failed to create account" }
     ),
-  logout: () => apiClient.post<LogoutResponse>("/api/auth/logout", { successMessage: "Signed out", errorMessage: "Failed to sign out" }),
+  logout: () => apiClient.post<LogoutResponse>("/api/auth/logout", null, { successMessage: "Signed out", errorMessage: "Failed to sign out" }),
   me: () => apiClient.get<AuthUser>("/api/auth/me"),
   resetPassword: (oldPassword: string, newPassword: string) =>
     apiClient.post<{ message: string }>("/api/auth/reset-password", {
diff --git a/src/application/authentication/Components/SignInForm.tsx b/src/application/authentication/Components/SignInForm.tsx
index c7dac0c..d327b17 100644
--- a/src/application/authentication/Components/SignInForm.tsx
+++ b/src/application/authentication/Components/SignInForm.tsx
@@ -14,7 +14,7 @@ export default function SignInForm() {
   const [isLoading, setIsLoading] = useState(false);
   const [errorMessage, setErrorMessage] = useState("");
 
-  const { login } = useAuth(); // Retrieve login function from context
+  const { login } = useAuth();
 
   const handleSignIn = async (event: React.FormEvent) => {
     event.preventDefault();
@@ -27,10 +27,8 @@ export default function SignInForm() {
     };
 
     try {
-      // Use the context login function to ensure state is updated
       await login(payload, isChecked);
 
-      // Redirect to the dashboard after successful signin.
       navigate("/dashboard");
     } catch (error) {
       const message =
diff --git a/src/context/AuthContext.tsx b/src/context/AuthContext.tsx
index 817bd65..3ab930e 100644
--- a/src/context/AuthContext.tsx
+++ b/src/context/AuthContext.tsx
@@ -70,6 +70,10 @@ export const AuthProvider: React.FC<{ children: ReactNode }> = ({
   };
 
   const logout = async () => {
+    try {
+      await authApi.logout();
+    } catch {
+    }
     clearAuthCookies();
     setUser(null);
     window.location.href = "/signin";
diff --git a/src/lib/apiClient.ts b/src/lib/apiClient.ts
index eada2e6..680e8ea 100644
--- a/src/lib/apiClient.ts
+++ b/src/lib/apiClient.ts
@@ -1,16 +1,13 @@
 import { toast } from "react-toastify";
 import { API_BASE_URL } from "../constant";
-import { AUTH_COOKIE_KEYS, clearAuthCookies, getCookie } from "./authCookies";
+import { AUTH_COOKIE_KEYS, clearAuthCookies, getCookie, setAuthCookies } from "./authCookies";
 import { isTokenExpired } from "./jwt";
 
 type ApiRequestOptions = Omit<RequestInit, "body"> & {
   body?: unknown;
   toast?: boolean;
-  /** Optional custom success message to show in a toast */
   successMessage?: string;
-  /** Optional custom error message to show in a toast */
   errorMessage?: string;
-  /** If true, silences all toast notifications for this request */
   silent?: boolean;
 };
 
@@ -39,7 +36,9 @@ const refreshAccessToken = async () => {
   });
 
   if (!res.ok) throw new Error("Refresh failed");
-  return res.json();
+  const data = await res.json();
+  setAuthCookies(data);
+  return data;
 };
 
 const request = async <T>(
@@ -72,6 +71,9 @@ const request = async <T>(
         await new Promise<void>((resolve) => refreshQueue.push(resolve));
       }
     } catch {
+      isRefreshing = false;
+      refreshQueue.forEach((cb) => cb());
+      refreshQueue = [];
       hardLogout();
       throw new Error("Session expired");
     }