Remove some confusion between exchange and set-session endpoints, all using set-session now with a bearer code. Using codes in remote auth as well. Full separation of cookie and OIDC codes.

frontend/auth/restricted/RestrictedApi.vue

@@ -53,7 +53,7 @@ function handleAuthenticated(result) {
   postToParent({
     type: 'auth-success',
     authenticated: true,
-    sessionToken: result.session_token
+    exchangeCode: result.exchange_code
   })
 }
 

frontend/int/reset/ResetApp.vue

@@ -144,7 +144,7 @@ async function registerPasskey() {
   }
 
   try {
-    await setSessionCookie(result)
+    await exchangeCode(result)
   } catch (error) {
     loading.value = false
     const message = error?.message || 'Failed to establish session'
@@ -156,15 +156,13 @@ async function registerPasskey() {
   setTimeout(() => { loading.value = false; goHome() }, 800)
 }
 
-async function setSessionCookie(result) {
-  if (!result?.session_token) {
-    throw new Error('Registration response missing session_token')
+async function exchangeCode(result) {
+  if (!result?.exchange_code) {
+    throw new Error('Registration response missing exchange_code')
   }
   return await apiJson('/auth/api/set-session', {
     method: 'POST',
-    headers: {
-      Authorization: `Bearer ${result.session_token}`
-    }
+    headers: { 'Authorization': `Bearer ${result.exchange_code}` }
   })
 }
 

frontend/src/components/RemoteAuthRequest.vue

@@ -196,7 +196,7 @@ async function startRemoteAuth() {
       } else if (msg.status === 'authenticated') {
         // Success
         completed.value = true
-        emit('authenticated', { session_token: msg.session_token })
+        emit('authenticated', { exchange_code: msg.exchange_code })
         break
       } else if (msg.status === 'denied') {
         // Explicitly denied by the authenticating device

frontend/src/components/RestrictedAuth.vue

@@ -181,7 +181,7 @@ async function authenticateUser() {
     emit('authenticated', result)
     return
   }
-  try { await setSessionCookie(result) } catch (error) {
+  try { await exchangeCode(result) } catch (error) {
     loading.value = false
     const message = error?.message || 'Failed to establish session'
     showMessage(message, 'error', 4000)
@@ -212,13 +212,13 @@ function openProfile() {
   if (profileWindow) profileWindow.focus()
 }
 
-async function setSessionCookie(result) {
-  if (!result?.session_token) {
-    console.error('setSessionCookie called with missing session_token:', result)
-    throw new Error('Authentication response missing session_token')
+async function exchangeCode(result) {
+  if (!result?.exchange_code) {
+    console.error('exchangeCode called with missing exchange_code:', result)
+    throw new Error('Authentication response missing exchange_code')
   }
   return await fetchJson('/auth/api/set-session', {
-    method: 'POST', headers: { Authorization: `Bearer ${result.session_token}` }
+    method: 'POST', headers: { 'Authorization': `Bearer ${result.exchange_code}` }
   })
 }
 
@@ -233,7 +233,7 @@ function switchToLocal() {
 async function handleRemoteAuthenticated(result) {
   showMessage('Authenticated from another device!', 'success', 2000)
   try {
-    await setSessionCookie(result)
+    await exchangeCode(result)
   } catch (error) {
     const message = error?.message || 'Failed to establish session'
     showMessage(message, 'error', 4000)

frontend/src/stores/auth.js

@@ -41,21 +41,21 @@ export const useAuthStore = defineStore('auth', {
         }, effectiveDuration)
       }
     },
-    async setSessionCookie(result) {
-      if (!result?.session_token) {
-        console.error('setSessionCookie called with missing session_token:', result)
-        throw new Error('Authentication response missing session_token')
+    async exchangeCode(result) {
+      if (!result?.exchange_code) {
+        console.error('exchangeCode called with missing exchange_code:', result)
+        throw new Error('Authentication response missing exchange_code')
       }
       return await apiJson('/auth/api/set-session', {
         method: 'POST',
-        headers: {'Authorization': `Bearer ${result.session_token}`},
+        headers: { 'Authorization': `Bearer ${result.exchange_code}` },
       })
     },
     async register() {
       this.isLoading = true
       try {
         const result = await register()
-        await this.setSessionCookie(result)
+        await this.exchangeCode(result)
         await this.loadUserInfo()
         this.selectView()
         return result
@@ -68,7 +68,7 @@ export const useAuthStore = defineStore('auth', {
       try {
         const result = await authenticate()
 
-        await this.setSessionCookie(result)
+        await this.exchangeCode(result)
         await this.loadUserInfo()
         this.selectView()