fix(auth): roll session cookie Max-Age on each authed request

The server session slides its TTL on use but the browser cookie's Max-Age was frozen at login, so it lapsed mid-session and broke cookie-only auth (private image <img>/download loads returned 401) while the SPA still looked logged in via its Bearer token. Re-issue the cookie with a fresh Max-Age whenever an authenticated request carried it.

backend/internal/http/middleware/auth.go

@@ -3,6 +3,7 @@ package middleware
 import (
 	"net/http"
 
+	"backend/internal/config"
 	"backend/internal/service"
 	"github.com/gin-gonic/gin"
 )
@@ -10,12 +11,13 @@ import (
 const currentUserKey = "current_user"
 const currentSessionKey = "current_session"
 
-func RequireSession(auth *service.AuthService) gin.HandlerFunc {
+func RequireSession(auth *service.AuthService, cfg *config.Config) gin.HandlerFunc {
 	return func(c *gin.Context) {
+		cookieToken := readCookie(c, cfg.SessionCookieName)
 		user, session, err := auth.CurrentUserFromRequest(
 			c.Request.Context(),
 			c.GetHeader("Authorization"),
-			readCookie(c, "vivid_session"),
+			cookieToken,
 		)
 		if err != nil {
 			c.JSON(http.StatusInternalServerError, gin.H{"detail": "failed to validate session"})
@@ -27,18 +29,20 @@ func RequireSession(auth *service.AuthService) gin.HandlerFunc {
 			c.Abort()
 			return
 		}
+		refreshSessionCookie(c, cfg, cookieToken)
 		c.Set(currentUserKey, user)
 		c.Set(currentSessionKey, session)
 		c.Next()
 	}
 }
 
-func RequireAdminSession(auth *service.AuthService) gin.HandlerFunc {
+func RequireAdminSession(auth *service.AuthService, cfg *config.Config) gin.HandlerFunc {
 	return func(c *gin.Context) {
+		cookieToken := readCookie(c, cfg.SessionCookieName)
 		user, session, err := auth.CurrentUserFromRequest(
 			c.Request.Context(),
 			c.GetHeader("Authorization"),
-			readCookie(c, "vivid_session"),
+			cookieToken,
 		)
 		if err != nil {
 			c.JSON(http.StatusInternalServerError, gin.H{"detail": "failed to validate session"})
@@ -55,12 +59,28 @@ func RequireAdminSession(auth *service.AuthService) gin.HandlerFunc {
 			c.Abort()
 			return
 		}
+		refreshSessionCookie(c, cfg, cookieToken)
 		c.Set(currentUserKey, user)
 		c.Set(currentSessionKey, session)
 		c.Next()
 	}
 }
 
+// refreshSessionCookie rolls the browser session cookie forward on each
+// authenticated request that carried it. The server-side session already slides
+// its TTL on use, but the cookie's Max-Age was frozen at login — so it would
+// lapse mid-session and break cookie-only auth (e.g. <img> loads of private
+// images) even while the SPA still looks logged in via its Bearer token. Only
+// refresh when the request actually presented the cookie (a pure Bearer/API-key
+// caller has none to roll).
+func refreshSessionCookie(c *gin.Context, cfg *config.Config, cookieToken string) {
+	if cookieToken == "" {
+		return
+	}
+	c.SetSameSite(http.SameSiteLaxMode)
+	c.SetCookie(cfg.SessionCookieName, cookieToken, int(cfg.SessionTTL.Seconds()), "/", "", cfg.CookieSecure, true)
+}
+
 func readCookie(c *gin.Context, name string) string {
 	v, err := c.Cookie(name)
 	if err != nil {

backend/internal/http/router/router.go

@@ -81,7 +81,7 @@ func New(cfg *config.Config, auth *service.AuthService, handlers Handlers) *gin.
 	}
 
 	userAuthed := engine.Group("/admin/api")
-	userAuthed.Use(middleware.RequireSession(auth))
+	userAuthed.Use(middleware.RequireSession(auth, cfg))
 	{
 		userAuthed.GET("/logs", handlers.UserGen.Logs)
 		userAuthed.POST("/generate", handlers.UserGen.Generate)
@@ -99,7 +99,7 @@ func New(cfg *config.Config, auth *service.AuthService, handlers Handlers) *gin.
 	}
 
 	authed := engine.Group("/admin/api")
-	authed.Use(middleware.RequireAdminSession(auth))
+	authed.Use(middleware.RequireAdminSession(auth, cfg))
 	{
 		authed.GET("/dashboard", handlers.AdminRead.Dashboard)
 		authed.GET("/users", handlers.AdminRead.Users)
@@ -186,7 +186,7 @@ func New(cfg *config.Config, auth *service.AuthService, handlers Handlers) *gin.
 		}
 	}
 
-	authGroup.Use(middleware.RequireSession(auth))
+	authGroup.Use(middleware.RequireSession(auth, cfg))
 	{
 		authGroup.GET("/me", handlers.Auth.Me)
 		authGroup.GET("/invites", handlers.Auth.Invites)