feat: add csrf protection

[perber]

No description provided.

[Copilot]

Pull request overview

This PR implements CSRF (Cross-Site Request Forgery) protection for the application by adding CSRF tokens to authentication flows and protected endpoints. The implementation reorganizes middleware into separate auth and security packages, introduces a new CSRF cookie mechanism, and updates both backend and frontend code to handle CSRF tokens.

Key changes:

• Implements CSRF token generation, validation, and middleware protection
• Reorganizes middleware code into auth and security subpackages with a shared utils package
• Integrates CSRF token issuance in login, logout, and token refresh flows

Reviewed changes

Copilot reviewed 14 out of 15 changed files in this pull request and generated 7 comments.

Show a summary per file

File	Description
internal/http/middleware/security/csrf.go	New CSRF middleware that validates tokens for mutating HTTP methods
internal/http/middleware/security/csrf_cookie.go	Manages CSRF cookie lifecycle (issue, read, clear) with secure/insecure modes
internal/http/middleware/security/csrf_test.go	Tests for CSRF middleware validation logic
internal/http/middleware/security/csrf_cookie_test.go	Tests for CSRF cookie operations
internal/http/middleware/security/rate_limiter.go	Moved rate limiter to security package
internal/http/middleware/security/rate_limiter_test.go	Updated package declaration for rate limiter tests
internal/http/middleware/auth/auth.go	Moved authentication middleware to auth package
internal/http/middleware/auth/auth_cookie.go	Refactored to use shared RequireSecure utility
internal/http/middleware/auth/auth_cookie_test.go	Updated tests to use utils.RequireSecure
internal/http/middleware/utils/require_secure.go	Extracted shared logic for HTTPS detection
internal/http/router.go	Updated imports and integrated CSRF middleware into protected routes
internal/http/api/login_user.go	Added CSRF token issuance on successful login
internal/http/api/logout_user.go	Added CSRF token clearing on logout
internal/http/api/refresh_token_user.go	Added CSRF token issuance on token refresh
ui/leafwiki-ui/src/lib/api/auth.ts	Added CSRF token extraction from cookies and inclusion in API requests

Comments suppressed due to low confidence (1)

internal/http/middleware/auth/auth_cookie.go:1

• The package declaration is incorrect. This file is in the internal/http/middleware/auth/ directory and is imported as auth_middleware, so it should declare package auth instead of package middleware.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 15 out of 16 changed files in this pull request and generated 2 comments.

Comments suppressed due to low confidence (1)

internal/http/middleware/auth/auth_cookie.go:1

• The package declaration is package middleware but the file is in the internal/http/middleware/auth/ directory. The package name should be auth to match the directory structure and import alias used in router.go. This inconsistency will cause import issues.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.