fix(api): return uid consistently from login and session endpoints

POST /SASLogon/login and GET /SASjsApi/session still returned the
old `id` field, while the rest of the ID->UID migration (#363)
standardized on `uid`. Not functionally broken - Mongoose provides
a built-in `id` virtual by default (_id.toHexString()) that happened
to resolve to the same value as the new `uid` virtual - but it's an
inconsistent public API surface, and relying on that coincidence
wasn't the intent of the migration.

Neither of these files was touched by any of issue-361's own
commits, so this predates the merge rather than being caused by it.

- web.ts: login response and session storage now source from
  user.uid explicitly
- session.ts: SessionResponse dropped its Omit<UserResponse, 'uid'>
  + id override in favor of just extending UserResponse
- verifyTokenInDB.ts: token-refresh path, same fix
- login.tsx / appContext.tsx: updated to read the corrected field

Verified with a real end-to-end request (genuine app boot, real
MongoDB, real CSRF handshake) - not just type-checking - to confirm
the actual HTTP response bodies carry uid, not id.

api/src/controllers/session.ts

@@ -4,8 +4,7 @@ import { UserResponse } from './user'
 import { getSessionController } from './internal'
 import { SessionState } from '../types'
 
-interface SessionResponse extends Omit<UserResponse, 'uid'> {
+interface SessionResponse extends UserResponse {
-  id: string
   needsToUpdatePassword?: boolean
 }
 
@@ -18,7 +17,7 @@ export class SessionController {
    *
    */
   @Example<SessionResponse>({
-    id: 'userIdString',
+    uid: 'userIdString',
     username: 'johnusername',
     displayName: 'John',
     isAdmin: false,
@@ -45,7 +44,7 @@ export class SessionController {
 }
 
 const session = (req: express.Request) => ({
-  id: req.user!.userId,
+  uid: req.user!.userId,
   username: req.user!.username,
   displayName: req.user!.displayName,
   isAdmin: req.user!.isAdmin,

api/src/controllers/web.ts

@@ -121,7 +121,7 @@ const login = async (
 
   req.session.loggedIn = true
   req.session.user = {
-    userId: user.id,
+    userId: user.uid,
     clientId: 'web_app',
     username: user.username,
     displayName: user.displayName,
@@ -134,7 +134,7 @@ const login = async (
   return {
     loggedIn: true,
     user: {
-      id: user.id,
+      uid: user.uid,
       username: user.username,
       displayName: user.displayName,
       isAdmin: user.isAdmin,

api/src/routes/api/spec/web.spec.ts

@@ -145,7 +145,7 @@ describe('web', () => {
 
       expect(res.body.loggedIn).toBeTruthy()
       expect(res.body.user).toEqual({
-        id: expect.any(String),
+        uid: expect.any(String),
         username: user.username,
         displayName: user.displayName,
         isAdmin: user.isAdmin,

api/src/utils/verifyTokenInDB.ts

@@ -36,7 +36,7 @@ export const verifyTokenInDB = async (
 
   return currentTokenObj?.[tokenType] === token
     ? {
-        userId: dbUser.id,
+        userId: dbUser.uid,
         clientId,
         username: dbUser.username,
         displayName: dbUser.displayName,

web/src/components/login.tsx

@@ -40,7 +40,7 @@ const Login = () => {
       })
 
     if (loggedIn) {
-      appContext.setUserId?.(user.id)
+      appContext.setUserId?.(user.uid)
       appContext.setUsername?.(user.username)
       appContext.setDisplayName?.(user.displayName)
       appContext.setIsAdmin?.(user.isAdmin)

web/src/context/appContext.tsx

@@ -72,7 +72,7 @@ const AppContextProvider = (props: { children: ReactNode }) => {
       .then((res) => res.data)
       .then((data: any) => {
         setCheckingSession(false)
-        setUserId(data.id)
+        setUserId(data.uid)
         setUsername(data.username)
         setDisplayName(data.displayName)
         setIsAdmin(data.isAdmin)