Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@apps/next/app/`(dashboard)/_dashboard-shell.tsx:
- Around line 29-30: The AuthBadge import in _dashboard-shell.tsx points to the
wrong package; update the import to the local component at
apps/next/components/shared/auth-badge.tsx (the AuthBadge component that uses
useUser()). Also modify the logout route handler (route.ts in app/auth/logout)
to explicitly invalidate the auth/session/user query cache after clearing
cookies by calling queryClient.invalidateQueries({ queryKey:
['auth','session','user'] })—follow the same pattern used in use-passkey-auth.ts
and use-link-email.ts so the badge updates immediately after logout.

In `@apps/next/app/`(dashboard)/layout.tsx:
- Around line 7-8: Layout is missing an explicit return type and getAuthStatus
performs decode-only JWT checks allowing forged tokens; add a return type (e.g.,
React.ReactNode or JSX.Element) to the Layout function signature and replace the
decode-only validation in getAuthStatus with proper signature verification using
jose's verifyJwt (or call a server action that runs verifyJwt on the token
server-side) so the cookie/JWT is cryptographically validated before rendering;
also update auth-server cookie creation to set httpOnly: true so the token is
not accessible to client-side JS.

---

Nitpick comments:
In `@apps/next/app/`(dashboard)/_dashboard-shell.tsx:
- Line 15: Add an explicit return type to the exported component function by
annotating DashboardShell's signature with React.JSX.Element (e.g. change
"export function DashboardShell({ children }: Readonly<{ children:
React.ReactNode }>)" to "export function DashboardShell({ children }: Readonly<{
children: React.ReactNode }>): React.JSX.Element" ); ensure any needed type-only
import for React is used if your tsconfig requires it.

In `@apps/next/app/`(dashboard)/layout.tsx:
- Line 6: The exported async function Layout lacks an explicit return type;
update its signature (the Layout function) to include an explicit return type
such as Promise<React.JSX.Element> (or the appropriate JSX element type used in
the app) so the declaration reads like: export default async function
Layout(...): Promise<React.JSX.Element> { ... }; this satisfies the project's
TypeScript guideline for explicit return types on exported functions.

Verify each finding against the current code and only fix it if needed.

Inline comments:
In @.gitleaks.toml:
- Line 31: Remove the broad allowlist entry '''scripts/run-qa\.mjs$''' in
.gitleaks.toml and instead add an allowlist rule that targets only the specific
sentinel string used as the placeholder JWT in scripts/run-qa.mjs (i.e., the
exact literal token or the constant name defined there), using a precise regex
or exact match so other secrets in that file remain detectable; update the rule
to reference that exact sentinel value rather than the whole filename.

In `@apps/next/app/`(dashboard)/_dashboard-shell.tsx:
- Around line 21-25: In handleSignOut, don't assume logout succeeded: check the
fetch('/auth/logout') response (use response.ok and/or response.status) and only
call queryClient.invalidateQueries(authSessionUserQueryKey |
authSessionJwtQueryKey) and set window.location.href='/' after a successful
response; on non-2xx responses, surface an error (throw, show UI toast, or
console.error) and avoid clearing client auth state or redirecting so the UI
remains consistent with the server session.

In `@apps/next/lib/auth/jwt-utils.ts`:
- Around line 33-39: Replace the manual base64 decode in isTokenExpired() with
the existing decodeJwtToken() helper: call decodeJwtToken(token) to get the
payload, then check payload.exp (convert to ms) to determine expiry; ensure you
handle a missing or unparsable payload by returning true (expired) and avoid
using atob() or direct token.split('.') decoding. Update references in
isTokenExpired() to use decodeJwtToken() and retain the same boolean semantics.

In `@apps/next/proxy.ts`:
- Around line 25-27: The proxy currently calls verifyJwtToken(...) (which uses
jwtVerify and enforces exp) and treats a null result as unauthenticated,
blocking the refresh path; change the flow so you first inspect the token
without enforcing expiration (either by using an existing isTokenExpired(token)
to decide refresh vs reject, or by decoding the token/verifying with expiration
ignored) to allow expired-but-refreshable tokens to reach the refresh logic,
then perform full verification (verifyJwtToken / jwtVerify) only after deciding
not to refresh; update the logic around verifyJwtToken, isTokenExpired and the
refresh decision so typ/sub/sid are checked from the decoded claims or after
ignoring exp, and only enforce exp when appropriate.

---

Nitpick comments:
In `@apps/next/lib/auth/auth-utils.ts`:
- Around line 29-33: The code redundantly re-checks token expiration after
verification; remove the call to isTokenExpired({ token }) and its conditional
return, because verifyJwtToken({ token, secret: env.JWT_SECRET }) already
enforces the exp claim (throwing on expiry) and ensures decoded is valid; update
the block around verifyJwtToken/decoded to rely on decoded.typ, decoded.sub,
decoded.sid only and delete the isTokenExpired check.

Verify each finding against the current code and only fix it if needed.

Nitpick comments:
In @.cursor/rules/frontend/auth.mdc:
- Line 3: The glob pattern is too broad and may flag non-Next.js packages;
narrow it so the "Auth Protection (proxy.ts)" rule only scans Next.js app code.
Update the rule configuration to target only the Next.js app files (e.g., change
the glob from including packages/core/** and packages/react/** to only
apps/next/**) so the rule that looks for Next.js-specific symbols like
getAuthStatus() and redirect() runs only against Next.js routes.

In `@apps/next/app/`(dashboard)/layout.tsx:
- Around line 3-6: The Layout function is marked async but contains no awaits;
remove the async keyword and the Promise return type to make it a synchronous
component: change the signature of Layout (currently "export default async
function Layout({ children }: Readonly<{ children: React.ReactNode }>):
Promise<React.JSX.Element>") to a plain synchronous function returning
React.JSX.Element (e.g., "export default function Layout(...) :
React.JSX.Element") and keep using DashboardShell to render children.