Stage M2

apps/api/src/main.ts

@@ -5,6 +5,7 @@ import { NestFactory } from '@nestjs/core';
 import type { NestExpressApplication } from '@nestjs/platform-express';
 import { DocumentBuilder, SwaggerModule } from '@nestjs/swagger';
 import compression from 'compression';
+import cookieParser from 'cookie-parser';
 import helmet from 'helmet';
 import { Logger } from 'nestjs-pino';
 
@@ -31,6 +32,9 @@ async function bootstrap(): Promise<void> {
 
   // First in the chain: every log line and error response carries this id.
   app.use(requestIdMiddleware);
+  // Refresh tokens arrive as httpOnly cookies; without this `req.cookies` is
+  // undefined and every refresh silently fails as "no session".
+  app.use(cookieParser());
   app.use(helmet({ crossOriginResourcePolicy: { policy: 'cross-origin' } }));
   app.use(compression());