Refactor auth module: enhance comments, improve token handling, and add admin dispute override functionality

backend/src/index.ts

@@ -22,6 +22,7 @@ import poolRoutes from "./routes/pool";
 import stateRoutes from "./routes/state";
 import { pool } from "./config/db";
 import { startStorageCleanup, stopStorageCleanup } from "./utils/storage-cleanup";
+import { startNonceCleanup, stopNonceCleanup } from "./utils/nonce-cleanup";
 
 dotenv.config();
 
@@ -151,6 +152,7 @@ app.get("/health", async (req: Request, res: Response) => {
 process.on("SIGTERM", async () => {
   logger.info("SIGTERM received, shutting down gracefully");
   stopStorageCleanup();
+  stopNonceCleanup();
   try {
     await prisma.$disconnect();
     logger.info("Database connection closed");
@@ -172,6 +174,7 @@ async function bootstrap(): Promise<void> {
     await connectWithRetry();
     startPoolHealthCheck();
     startStorageCleanup();
+    startNonceCleanup();
     app.listen(port, () => {
       console.log(`⚡️[server]: Server is running at http://localhost:${port}`);
       // Update pool metrics periodically so the Prometheus scrape has fresh data

backend/src/middleware/authGuard.ts

@@ -39,8 +39,9 @@ export async function authGuard(
   res: Response,
   next: NextFunction
 ): Promise<void> {
-  // Try to get token from cookie first, then from Authorization header
-  let token = req.cookies[ACCESS_TOKEN_COOKIE];
+  // Try to get token from cookie first (cookie-parser adds req.cookies;
+  // when unavailable, skip gracefully), then from Authorization header.
+  let token = req.cookies?.[ACCESS_TOKEN_COOKIE];
   const header = req.headers.authorization;
   if (!token && header?.startsWith("Bearer ")) {
     token = header.slice(7);