fix architecture and write new tests

apps/api/src/middleware/authHelpers.ts

@@ -23,6 +23,19 @@ export function getCookie(req: Request, name: string): string | null {
   return null
 }
 
+export function getBearerToken(req: Request): string | null {
+  const authHeader = req.headers.authorization
+  if (!authHeader?.startsWith('Bearer ')) return null
+  const token = authHeader.slice(7).trim()
+  return token.length > 0 ? token : null
+}
+
+export function getAuthToken(req: Request, cookieName?: string): string | null {
+  // Prefer HttpOnly cookies over bearer tokens so stale script-readable tokens
+  // cannot shadow a valid server-managed session during migration.
+  return (cookieName ? getCookie(req, cookieName) : null) ?? getBearerToken(req)
+}
+
 export function sendForbidden(res: Response, error: string, message: string, extra?: Record<string, unknown>) {
   return res.status(403).json({ error, message, statusCode: 403, ...extra })
 }