feat: Introduce core backend application with authentication API and a new popout HTML page.

backend/auth/router.py

@@ -138,6 +138,17 @@ async def login(request: LoginRequest, response: Response):
 
     logger.info(f"User '{request.username}' logged in")
 
+    # Set access token as cookie for same-origin requests (e.g. popout window)
+    response.set_cookie(
+        key="access_token",
+        value=access_token,
+        max_age=ACCESS_TOKEN_EXPIRE_SECONDS,
+        httponly=True,
+        samesite="lax",
+        secure=secure,
+        path="/",
+    )
+
     return {
         "access_token": access_token,
         "token_type": "bearer",
@@ -174,6 +185,19 @@ async def refresh_token_endpoint(request: Request, response: Response):
 
     new_access_token = create_access_token(user)
 
+    # Update cookies
+    import os
+    secure = os.environ.get("OBSIGATE_SECURE_COOKIES", "false").lower() == "true"
+    response.set_cookie(
+        key="access_token",
+        value=new_access_token,
+        max_age=ACCESS_TOKEN_EXPIRE_SECONDS,
+        httponly=True,
+        samesite="lax",
+        secure=secure,
+        path="/",
+    )
+
     return {
         "access_token": new_access_token,
         "token_type": "bearer",