refactor (#369)

* fix: remove duplicate OAuth callback route registrations in auth.ts

- Removed duplicate nested app.get('/github/callback') that was registered
  inside an outer callback handler (caused by a bad merge)
- Removed duplicate nested app.get('/google/callback') same issue
- Removed dead code blocks (stray authUrl + redirect calls outside handlers)
  that were left over after the duplicate outer wrappers were stripped
- All routes (/github, /github/callback, /google, /google/callback, /me, /logout)
  are now correctly registered at the top level within authRoutes plugin scope

* fix: resolve OAuth CSRF vulnerabilities and add cookie types

---------

Signed-off-by: Roshan Kumar Singh <162692544+roshankumar0036singh@users.noreply.github.com>

Author: roshankumar0036singh

apps/backend/src/routes/auth.ts

@@ -57,8 +57,7 @@ export async function authRoutes(app: FastifyInstance) {
   // GitHub OAuth callback
   app.get('/github/callback', async (request: FastifyRequest<{ Querystring: OAuthCallbackQuery }>, reply: FastifyReply) => {
     const { code, state } = request.query;
-    const storedState = (request.cookies as any)?.oauth_state;
-
+    const storedState = request.cookies?.oauth_state;
     if (!state || !storedState || state !== storedState) {
       return reply.status(400).send({ error: 'Invalid or missing OAuth state — possible CSRF attack' });
     }
@@ -183,7 +182,8 @@ export async function authRoutes(app: FastifyInstance) {
   // Google callback
   app.get('/google/callback', async (request: FastifyRequest<{ Querystring: OAuthCallbackQuery }>, reply: FastifyReply) => {
     const { code, state } = request.query;
-    const storedState = (request.cookies as any)?.oauth_state;
+
+    const storedState = request.cookies?.oauth_state;
     if (!state || !storedState || state !== storedState) {
       return reply.status(400).send({ error: 'Invalid or missing OAuth state — possible CSRF attack' });
     }

apps/backend/src/types/fastify.d.ts

@@ -0,0 +1,8 @@
+import '@fastify/cookie';
+import { FastifyRequest } from 'fastify';
+
+declare module 'fastify' {
+  interface FastifyRequest {
+    cookies: Record<string, string | undefined>;
+  }
+}