fix: source client access tokens from the session

[devin-ai-integration]

Summary

The client TokenStore (src/client/tokenStore.ts) read a JavaScript-readable workos-access-token cookie and adopted it as the session bearer token. This change removes that client-readable cookie channel and sources the token from the server-side session.

Please review before merging.

[devin-ai-integration]

Original prompt from Linear User

Please work on ticket "AuthKit TanStack client token store adopts attacker-plantable workos-access-token cookie as the session access token (persistent token fixation via cookie injection)" (SEC-1348)

@playbook:playbook-b588614117c7477a9b9729928385384f

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[linear-code]

SEC-1348

[greptile-apps]

Confidence Score: 5/5

The PR appears safe to merge.

Summary

Removes the client-readable access-token cookie channel.

• Initializes the client token store without adopting a browser cookie.
• Sources access tokens through the session-bound server action.
• Updates token refresh tests and adds coverage proving planted cookies are ignored.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart LR
    Client[Client TokenStore] --> Action[getAccessTokenAction]
    Action --> Session[Server-side session context]
    Session --> Token[Session access token]
    Token --> Client
    Cookie[Client-readable workos-access-token cookie] -. ignored .-> Client

Loading

_{Reviews (2) · Last reviewed commit: "fix: recover session-bound access token ..."}

[nicknisi]

Recovered this branch onto current main. The original cookie-channel removal remains unchanged.

Verification: 251 tests passed, including coverage. Lint, typecheck, formatting, library build, example build, and client-bundle leak check passed. A fresh independent code review found no blocker. Not merged or released.

[devin-ai-integration]

❌ Cannot revive Devin session - the session is too old. Please start a new session instead.

View session