- Add User.role (enum Role/ADMIN) and User.tokenVersion with migration
- Login now issues short-lived access token (30m default) + 7d refresh
token, both embedding tokenVersion and a typ discriminator
- Tokens delivered via HttpOnly SameSite cookies (ir_at, ir_rt scoped
to /auth); refresh token never leaves the cookie
- New endpoints: POST /auth/refresh (rotation), GET /auth/me,
POST /auth/logout (bumps tokenVersion, revoking all tokens)
- JWT strategy accepts bearer or cookie, rejects refresh tokens, and
verifies tokenVersion + user existence on every request
- Global RolesGuard: authenticated routes require ADMIN unless widened
via @Roles(...)
- Admin SPA: session fully cookie-based, no token in localStorage;
router guard restores session via /auth/me; axios auto-refreshes once
on 401; stale localStorage keys cleaned up
yeuimu