refactor: switch to HttpOnly cookie (#660)

* Switch to httpOnly cookie
* create endpoint to retrieve temporary collaboration token

* cleanups

apps/server/src/core/workspace/controllers/workspace.controller.ts

@@ -6,6 +6,7 @@ import {
   HttpStatus,
   Post,
   Req,
+  Res,
   UseGuards,
 } from '@nestjs/common';
 import { WorkspaceService } from '../services/workspace.service';
@@ -29,6 +30,9 @@ import {
   WorkspaceCaslAction,
   WorkspaceCaslSubject,
 } from '../../casl/interfaces/workspace-ability.type';
+import { addDays } from 'date-fns';
+import { FastifyReply } from 'fastify';
+import { EnvironmentService } from '../../../integrations/environment/environment.service';
 
 @UseGuards(JwtAuthGuard)
 @Controller('workspace')
@@ -37,6 +41,7 @@ export class WorkspaceController {
     private readonly workspaceService: WorkspaceService,
     private readonly workspaceInvitationService: WorkspaceInvitationService,
     private readonly workspaceAbility: WorkspaceAbilityFactory,
+    private environmentService: EnvironmentService,
   ) {}
 
   @Public()
@@ -218,10 +223,18 @@ export class WorkspaceController {
   async acceptInvite(
     @Body() acceptInviteDto: AcceptInviteDto,
     @Req() req: any,
+    @Res({ passthrough: true }) res: FastifyReply,
   ) {
-    return this.workspaceInvitationService.acceptInvitation(
+    const authToken = await this.workspaceInvitationService.acceptInvitation(
       acceptInviteDto,
       req.raw.workspaceId,
     );
+
+    res.setCookie('authToken', authToken, {
+      httpOnly: true,
+      path: '/',
+      expires: addDays(new Date(), 30),
+      secure: this.environmentService.isHttps(),
+    });
   }
 }

apps/server/src/core/workspace/services/workspace-invitation.service.ts

@@ -24,7 +24,6 @@ import { TokenService } from '../../auth/services/token.service';
 import { nanoIdGen } from '../../../common/helpers';
 import { PaginationOptions } from '@docmost/db/pagination/pagination-options';
 import { executeWithPagination } from '@docmost/db/pagination/pagination';
-import { TokensDto } from '../../auth/dto/tokens.dto';
 
 @Injectable()
 export class WorkspaceInvitationService {
@@ -254,8 +253,7 @@ export class WorkspaceInvitationService {
       });
     }
 
-    const tokens: TokensDto = await this.tokenService.generateTokens(newUser);
-    return { tokens };
+    return this.tokenService.generateAccessToken(newUser);
   }
 
   async resendInvitation(