Consolidate access-token storage to the server-side session

[devin-ai-integration]

Summary

The client TokenStore (src/client/tokenStore.ts) read a JavaScript-readable workos-access-token cookie and adopted it as the session bearer token. This change removes that client-readable cookie channel and sources the token from the server-side session.

Please review before merging.

[devin-ai-integration]

Original prompt from Linear User

Please work on ticket "AuthKit TanStack client token store adopts attacker-plantable workos-access-token cookie as the session access token (persistent token fixation via cookie injection)" (SEC-1348)

@playbook:playbook-b588614117c7477a9b9729928385384f

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[linear-code]

SEC-1348

[greptile-apps]

Greptile Summary

This PR removes the client-readable access-token cookie channel. The main changes are:

• Initializes the client token store without reading document.cookie.
• Uses session-bound server actions as the only access-token source.
• Updates refresh scheduling coverage to use server action results.
• Adds a test proving that a planted access-token cookie is ignored.

Confidence Score: 5/5

This looks safe to merge.

• No blocking issues found in the changed code.
• Fresh token stores already acquire tokens through the session-bound server action.
• Successful RPC acquisition still schedules token refreshes.
• The new test covers the reported cookie-substitution path.

Important Files Changed

Filename	Overview
src/client/tokenStore.ts	Removes cookie-based token initialization and retrieval while preserving session-bound acquisition and refresh scheduling.
src/client/tokenStore.spec.ts	Moves refresh setup to the server action path and verifies that planted access-token cookies are ignored.

_{Reviews (1): Last reviewed commit: "Remove client-readable access-token cook..." | Re-trigger Greptile}