fix: use private helcimApiToken for all server-side Helcim API calls

server/api/auth/refresh.post.js

@@ -40,9 +40,16 @@ export default defineEventHandler(async (event) => {
     })
   }
 
-  // Issue a fresh token
+  if (decoded.tv !== member.tokenVersion) {
+    throw createError({
+      statusCode: 401,
+      statusMessage: 'Session has been revoked'
+    })
+  }
+
+  // Issue a fresh token with current tokenVersion
   const newToken = jwt.sign(
-    { memberId: member._id, email: member.email },
+    { memberId: member._id, email: member.email, tv: member.tokenVersion },
     useRuntimeConfig().jwtSecret,
     { expiresIn: '7d' }
   )
@@ -51,7 +58,8 @@ export default defineEventHandler(async (event) => {
     httpOnly: true,
     secure: process.env.NODE_ENV === 'production',
     sameSite: 'lax',
-    maxAge: 60 * 60 * 24 * 7 // 7 days
+    path: '/',
+    maxAge: 60 * 60 * 24 * 7, // 7 days
   })
 
   return { success: true }