archetecture security fix

apps/api/src/security/sessionCookies.ts

@@ -0,0 +1,31 @@
+import type { Response } from 'express'
+import type { ActorType } from './tokens'
+
+const COOKIE_NAMES: Record<ActorType, string> = {
+  admin: 'admin_session',
+  employee: 'employee_session',
+  renter: 'renter_session',
+}
+
+export function getSessionCookieName(actorType: ActorType) {
+  return COOKIE_NAMES[actorType]
+}
+
+export function setSessionCookie(res: Response, actorType: ActorType, token: string, maxAgeMs?: number) {
+  res.cookie(getSessionCookieName(actorType), token, {
+    httpOnly: true,
+    secure: process.env.NODE_ENV === 'production',
+    sameSite: actorType === 'admin' ? 'strict' : 'lax',
+    path: '/',
+    maxAge: maxAgeMs,
+  })
+}
+
+export function clearSessionCookie(res: Response, actorType: ActorType) {
+  res.clearCookie(getSessionCookieName(actorType), {
+    httpOnly: true,
+    secure: process.env.NODE_ENV === 'production',
+    sameSite: actorType === 'admin' ? 'strict' : 'lax',
+    path: '/',
+  })
+}