fix(auth): address Copilot review feedback

Author: Chaitanya-970

…/backend/src/__tests__/auth-util.test.ts …nd/src/__tests__/auth-validation.test.tsapps/backend/src/__tests__/auth-util.test.ts renamed to apps/backend/src/__tests__/auth-validation.test.ts apps/backend/src/__tests__/auth-util.test.ts renamed to apps/backend/src/__tests__/auth-validation.test.ts

@@ -496,7 +496,7 @@ export async function authRoutes(app: FastifyInstance): Promise<void> {
   });
 
   app.post('/refresh', async(request: FastifyRequest, reply: FastifyReply) => {
-    if (request.body && typeof request.body === 'object' && Object.keys(request.body).length > 0) {
+    if (request.body && typeof request.body === 'object' && 'refresh_token' in request.body) {
       const parsed = refreshTokenSchema.safeParse(request.body);
       if (!parsed.success) {
         return reply.status(400).send({ error: 'Invalid request body', details: parsed.error.flatten() });

apps/backend/src/routes/auth.ts

@@ -4,12 +4,12 @@ export const mobileExchangeSchema = z.object({
   code: z.string({
     required_error: 'missing code',
     invalid_type_error: 'code must be a string'
-  }).min(1, 'code is empty')
+  }).trim().min(1, 'code is empty')
 });
 
 export const refreshTokenSchema = z.object({
   refresh_token: z.string({
     required_error: 'missing refresh_token',
     invalid_type_error: 'refresh_token must be a string'
-  }).min(1, 'refresh_token is empty')
+  }).trim().min(1, 'refresh_token is empty')
 });