fix: force token refresh and clear cookies on failure to avoid logout loop (#511)

* fix: force token refresh and clear cookies on failure to avoid logout loop

Switch the token-refresh route from `auth.api.getAccessToken` (which only
refreshes inside Better Auth's 5s threshold) to `auth.api.refreshToken`
(unconditional refresh). This eliminates the 5–10s race window where the
caller's near-expiry margin would redirect to the route but Better Auth
would return 200 OK with no Set-Cookie, sending the browser back into a
redirect loop ("page isn't redirecting properly").

On refresh failure, call `auth.api.signOut` and forward its Set-Cookie
headers onto the /signin redirect so `session_token` and `account_data`
are actually cleared — otherwise the stale account_data cookie keeps
`isTokenNearExpiry` returning true and the user can fall back into the
loop on the next navigation.

Also export the handler as both GET and POST: Next.js `redirect()` uses
307 (method-preserving) outside Server Actions, so a redirect triggered
from a Server Component render that follows a Server Action POST would
otherwise hit this route as POST and 405.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* chore: bump next + transitive deps to clear pnpm audit advisories

- next 16.2.3 → 16.2.6 (clears GHSA advisories for App Router middleware
  bypass, image-API DoS, SSRF, RSC cache poisoning, beforeInteractive XSS,
  etc.)
- pnpm.overrides: hono ≥4.12.18 (cache middleware Vary leakage, CSS-in-style
  injection, JWT NumericDate validation)
- pnpm.overrides: kysely ≥0.28.17 (JSON-path traversal)
- pnpm.overrides: fast-uri ≥3.1.2 (path traversal + host confusion via ajv)
- pnpm.overrides: ip-address ≥10.1.1 (XSS in Address6 HTML emitters via
  @modelcontextprotocol/sdk → express-rate-limit)

`pnpm audit` now reports no known vulnerabilities.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix: pin kysely override to 0.28.x to satisfy better-auth adapter

kysely@0.29 dropped the root re-exports of `DEFAULT_MIGRATION_LOCK_TABLE`
and `DEFAULT_MIGRATION_TABLE` (moved under `kysely/migration`), which
@better-auth/kysely-adapter@1.6.2 still imports from the root entry. The
prior `kysely >=0.28.17` override therefore floated to 0.29.2 and broke
the Turbopack build with 12 module-export errors (this also cascaded into
the Playwright E2E job, which builds before running).

Pin to `>=0.28.17 <0.29.0`: still covers the JSON-path traversal CVE
(advisory GHSA, patched in 0.28.17) without bumping past the adapter's
compatibility line.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix: use 303 See Other for outbound redirects to avoid 405 on POST flow

`NextResponse.redirect()` defaults to 307 (method-preserving). Now that this
route also accepts POST (added in the previous commit), a refresh that
arrived via POST would have its outbound redirect to /catalog or /signin
sent as POST too — both of which only handle GET, producing 405.

Switch both the success and failure redirects to 303 See Other, which
unconditionally instructs the browser to follow with GET. Caught by Copilot
review on the PR.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: peppescg

package.json

@@ -60,7 +60,7 @@
     "lucide-react": "^0.577.0",
     "msw": "^2.12.2",
     "nanoid": "^5.1.6",
-    "next": "16.2.3",
+    "next": "16.2.6",
     "next-themes": "^0.4.6",
     "nuqs": "^2.8.1",
     "pg": "^8.13.3",
@@ -116,18 +116,20 @@
       "express-rate-limit": ">=8.2.2",
       "lodash": ">=4.17.23",
       "lodash-es": ">=4.17.23",
-      "hono": ">=4.12.14",
+      "hono": ">=4.12.18",
       "@hono/node-server": "^1.19.14",
       "defu": "^6.1.5",
       "rollup": ">=4.59.0",
       "undici": "7.24.6",
-      "kysely": ">=0.28.14",
+      "kysely": ">=0.28.17 <0.29.0",
       "picomatch": ">=4.0.4",
       "qs": ">=6.14.2",
       "yaml": ">=2.8.3",
       "path-to-regexp@>=8.0.0 <8.4.0": "8.4.0",
       "path-to-regexp@>=0.1.0 <0.1.13": "0.1.13",
-      "postcss": ">=8.5.10"
+      "postcss": ">=8.5.10",
+      "fast-uri": ">=3.1.2",
+      "ip-address": ">=10.1.1"
     }
   }
 }