feat: drop outdated session (#14373)

#### PR Dependency Tree


* **PR #14373** 👈

This tree was auto-generated by
[Charcoal](https://github.com/danerwilliams/charcoal)

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **New Features**
* Added client version tracking and validation to ensure application
compatibility across authentication flows and sessions.
* Enhanced OAuth authentication with improved version handling during
sign-in and refresh operations.

* **Bug Fixes**
* Improved payment callback URL handling with safer defaults for
redirect links.

* **Tests**
* Expanded test coverage for client version enforcement and session
management.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->

packages/backend/server/src/plugins/oauth/controller.ts

@@ -15,6 +15,7 @@ import type { Request, Response } from 'express';
 import {
   ActionForbidden,
   Config,
+  getClientVersionFromRequest,
   InvalidAuthState,
   InvalidOauthCallbackState,
   MissingOauthQueryParameter,
@@ -50,6 +51,7 @@ export class OAuthController {
   @Post('/preflight')
   @HttpCode(HttpStatus.OK)
   async preflight(
+    @Req() req: Request,
     @Body('provider') unknownProviderName?: keyof typeof OAuthProviderName,
     @Body('redirect_uri') redirectUri?: string,
     @Body('client') client?: string,
@@ -75,11 +77,13 @@ export class OAuthController {
       throw new ActionForbidden();
     }
 
+    const clientVersion = getClientVersionFromRequest(req);
     const state = await this.oauth.saveOAuthState({
       provider: providerName,
       redirectUri,
       client,
       clientNonce,
+      clientVersion,
       ...(pkce
         ? {
             pkce: {
@@ -220,7 +224,7 @@ export class OAuthController {
       tokens
     );
 
-    await this.auth.setCookies(req, res, user.id);
+    await this.auth.setCookies(req, res, user.id, state.clientVersion);
 
     if (
       state.provider === OAuthProviderName.Apple &&

packages/backend/server/src/plugins/oauth/types.ts

@@ -13,6 +13,7 @@ export interface OAuthState {
   redirectUri?: string;
   client?: string;
   clientNonce?: string;
+  clientVersion?: string;
   provider: OAuthProviderName;
   pkce?: OAuthPkceState;
   token?: string;