fix(auth): persist csrf_token cookie for the access_token lifetime

[ajayr]

Problem

The csrf_token double-submit cookie is set as a session cookie (no max_age), while the access_token cookie is persistent over HTTPS (max_age = token_expiry_days, see _set_session_cookie). The two cookies represent one session but had different lifetimes.

This breaks iOS Safari home-screen PWAs (sites added to the Home Screen). When iOS terminates the standalone web app (background memory pressure, reboot, idle), it evicts session cookies but keeps persistent ones. On reopen:

• access_token (persistent) survives → GET /api/v1/auth/me is CSRF-exempt → the user still appears logged in.
• csrf_token (session-only) is gone → the frontend's readCsrfCookie() returns null and sends no X-CSRF-Token header.
• The first state-changing request (e.g. sending a chat message) fails:

  HTTP 403: {"detail":"CSRF token missing. Include X-CSRF-Token header."}
  

• Only logging out and back in (which re-mints the cookie) restores it — until the next eviction.

Only manifests over HTTPS, which is why plain-HTTP local dev never reproduces it.

Fix

Give csrf_token the same max_age as access_token at both places it is minted:

• CSRFMiddleware — auth POST responses (csrf_middleware.py)
• _set_csrf_cookie — OIDC GET callback (routers/auth.py)

Both mirror _set_session_cookie's ... if is_https else None guard, so the double-submit pair always shares a lifetime: persistent together over HTTPS, session-only together over plain HTTP. CSRF-token lifetime is not a security boundary (double-submit security comes from same-origin reads), so persisting it is safe.

Tests

Added to backend/tests/test_auth_type_system.py:

• test_csrf_cookie_persistent_on_https — HTTPS register sets csrf_token with max_age, paired with the persistent access_token.
• test_csrf_cookie_session_only_on_http — plain HTTP keeps it a session cookie (dev behavior unchanged).
• test_oidc_callback_csrf_cookie_persistent_on_https — the OIDC-callback helper is persistent over HTTPS too.

🤖 Generated with Claude Code