fix(auth): require CSRF validation for cookie mutations

[IvGolovach]

Summary

• Require cookie-authenticated mutation routes to pass the shared Origin allowlist gate before using the browser session.
• Keep token-based clients on explicit Bearer-token paths instead of letting Authorization headers bypass browser CSRF checks on settings routes.
• Add focused regression coverage for device authorization, personal token management, submitted-data deletion, and device rename behavior.

Why

Several browser-facing mutation routes were using cookie session helpers directly or accepted Authorization headers through the shared request-session helper. That made the CSRF boundary inconsistent across settings and device routes. This change centralizes request-session handling so cookie-authenticated mutations require a trusted Origin, while non-browser Bearer-token flows remain explicit and intentional.

Diff scope

• packages/frontend/src/lib/auth/requestSession.ts: adds an option to disable Authorization header session resolution for routes that should only use cookie sessions behind the CSRF gate.
• Settings token and device mutation routes now use the request-aware session helper with Bearer headers disabled.
• Device authorization and submitted-data deletion now use the same request-aware CSRF session behavior while preserving the submitted-data Bearer token deletion path used by API clients.
• Tests cover missing, hostile, allowed Origin, and rejected Authorization-header session-auth cases for the changed mutation routes.

Branch integrity

• Base branch: main
• Validated base SHA: 715fddf6db88258c50eb20a5cc8d698e442f35b9
• Ahead/behind: 0 behind / 1 ahead
• Merge-base: 715fddf6db88258c50eb20a5cc8d698e442f35b9
• Branch was rebased onto the fetched base before push.

Commit integrity

• Introduced commit: c72e2859ba471055ef86e992cdb58bc71c204080 fix(auth): apply CSRF gate to cookie mutations
• One logical change: align cookie-authenticated mutation routes with the shared CSRF request-session gate.
• Final diff contains only intended frontend auth route and API test changes.
• Ledger: not applicable - not required for selected validation mode/change family.
• Version: not applicable - not required for selected validation mode/change family.

Diff hygiene

• git diff --name-status origin/main...HEAD: expected route/helper/test files only.
• git diff --check origin/main...HEAD: PASS, no output.
• No .env files, credentials, local environment files, caches, build outputs, or unrelated generated files are included.
• DB migration: not applicable - no DB migration changed.

Validation mode and proof

• Validation mode: Mode 3 - security-sensitive auth mutation behavior.
• bun --cwd packages/frontend test __tests__/api/settingsTokensDelete.test.ts: PASS, 6 tests passed.
• bun --cwd packages/frontend test __tests__/api/settingsTokensList.test.ts __tests__/api/settingsTokensDelete.test.ts __tests__/api/settingsSubmittedDataDelete.test.ts __tests__/api/deviceAuthorizeCsrf.test.ts __tests__/api/settingsDeviceRenameCsrf.test.ts __tests__/lib/requestSessionCsrf.test.ts: PASS, 37 tests passed.
• git diff --check origin/main...HEAD: PASS, no output.
• Not run: full frontend suite - not required locally because targeted API and auth CSRF tests cover the changed security-sensitive routes; required remote CI should validate the final PR SHA before merge.

CI context confirmation

• Pending - required CI has not completed on the updated PR SHA yet.
• CI workflow/context names unchanged.

Runtime safety

• No new blocking locks, queues, migrations, or background jobs.
• Non-browser submitted-data deletion through personal Bearer tokens remains supported through the existing explicit token-auth path.
• No invariant regression introduced.

Documentation integrity

• Not applicable - no docs, runbooks, commands, or operational procedures changed.

Rollback plan

• Rollback: revert this PR.
• DB downgrade: not applicable.
• Data repair: not applicable.
• Operational caveats: none known.

Known residual risks

• Remote CI is still pending on the updated SHA.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
tokscale	Ready	Preview, Comment	May 31, 2026 10:38pm

[cubic-dev-ai]

1 issue found across 11 files

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>