@jmruthers/pace-core 0.6.10 → 0.6.12

package/src/providers/services/UnifiedAuthProvider.tsx

@@ -8,7 +8,8 @@
  * Note: RBAC functionality is available via useRBAC() hook from '@jmruthers/pace-core/rbac'
  */
 
-import React, { useMemo, useCallback, useRef, useEffect, useState, useReducer } from 'react';
+import React, { useMemo, useCallback, useRef, useEffect, useState } from 'react';
+import { flushSync } from 'react-dom';
 import { type SupabaseClient, type User, type Session } from '@supabase/supabase-js';
 import type { Event } from '../../types/event';
 import type { SessionRestorationState } from '../../types/auth';
@@ -24,7 +25,15 @@ import { useInactivityService } from '../../hooks/services/useInactivityService'
 import { useSessionRestoration } from '../../hooks/useSessionRestoration';
 import { logger } from '../../utils/core/logger';
 import { setupRBAC, isRBACInitialized } from '../../rbac/api';
-import { UnifiedAuthContext, type UnifiedAuthContextType } from './UnifiedAuthContext';
+import { setPrintAppName } from '../../theming/runtime';
+import { UnifiedAuthContext } from './UnifiedAuthContext';
+import {
+  useAppIdResolution,
+  useUnifiedAuthSubscriptions,
+  useUnifiedAuthContextValue,
+  type UnifiedAuthContextState,
+  type UnifiedAuthContextCallbacks,
+} from './useUnifiedAuthContextValue';
 
 // Re-export UserEventAccess type
 /**
@@ -69,230 +78,40 @@ export interface UnifiedAuthProviderProps {
   dangerouslyDisableInactivity?: boolean; // Dev-only; must not disable in production
 }
 
-// Internal component that combines all contexts
-function UnifiedAuthContextProvider({ 
-  children, 
-  appName,
-  supabaseClient: supabaseClientProp,
-  ..._props 
-}: UnifiedAuthProviderProps) {
-  const authService = useAuthService();
-  const organisationService = useOrganisationService();
-  const inactivityService = useInactivityService();
-  const sessionRestorationState = useSessionRestoration();
-  const {
-    hasTimedOut: sessionRestorationTimedOut,
-    timeoutMs: sessionRestorationTimeoutMs,
-    isRestoring,
-    restorationComplete,
-    restorationError,
-  } = sessionRestorationState;
-  const sessionRestoration: SessionRestorationState = useMemo(() => ({
-    isRestoring,
-    restorationComplete,
-    restorationError,
-  }), [isRestoring, restorationComplete, restorationError]);
-  
-  // App config removed - scope is now page-level only (rbac_app_pages.scope_type)
-
-  // Call hook unconditionally - if provider is missing, it will throw
-  // Errors should be handled by error boundaries at a higher level
-  // We cannot conditionally call hooks
-  const eventService = useEventService();
-
-  // Get current auth state - these will trigger re-renders when services change
-  const currentUser = authService.getUser();
-  const currentSession = authService.getSession();
+/** Build state and callbacks from services. Extracted to keep UnifiedAuthContextProvider under max-lines. */
+function useUnifiedAuthStateAndCallbacks(
+  authService: ReturnType<typeof useAuthService>,
+  organisationService: ReturnType<typeof useOrganisationService>,
+  eventService: ReturnType<typeof useEventService>,
+  inactivityService: ReturnType<typeof useInactivityService>,
+  sessionRestoration: SessionRestorationState,
+  sessionRestorationTimedOut: boolean,
+  sessionRestorationTimeoutMs: number,
+  appName: string,
+  userOverride?: User | null,
+  sessionOverride?: Session | null
+): { state: UnifiedAuthContextState; callbacks: UnifiedAuthContextCallbacks } {
+  const currentUser = userOverride !== undefined ? userOverride : authService.getUser();
+  const currentSession = sessionOverride !== undefined ? sessionOverride : authService.getSession();
   const isAuth = !!(currentUser && currentSession);
-  
-  // Stabilize supabase client reference to prevent infinite re-renders
-  // Memoize the supabaseClient prop to ensure a stable reference across renders
-  // This is critical for preventing infinite loops when supabase is used in useEffect dependency arrays
-  // The reference will only change when supabaseClientProp actually changes (different instance)
-  // If the consuming app creates the client once and reuses it, this will be stable
-  const supabase = useMemo(() => supabaseClientProp, [supabaseClientProp]);
-  
-  // Resolve appId immediately when user logs in (don't wait for organisation/event)
-  // This makes appId available early for navigation menu filtering
-  const [appId, setAppId] = useState<string | undefined>(undefined);
-  
-
-  const isResolvingAppIdRef = useRef(false);
-  const resolvedAppIdRef = useRef<string | undefined>(undefined);
-  const resolvedUserIdRef = useRef<string | undefined>(undefined);
-  
-  useEffect(() => {
-    // Clear appId when user logs out or changes
-    if (!isAuth) {
-      // User logged out - clear all refs and state
-      resolvedAppIdRef.current = undefined;
-      resolvedUserIdRef.current = undefined;
-      setAppId(undefined);
-      return;
-    }
-    
-    // User changed - clear previous resolution to allow re-resolution for new user
-    if (currentUser?.id && resolvedUserIdRef.current && resolvedUserIdRef.current !== currentUser.id) {
-      resolvedAppIdRef.current = undefined;
-      resolvedUserIdRef.current = undefined;
-      setAppId(undefined);
-    }
-    
-    // Resolve appId as soon as we have user + supabase + appName
-    // Don't wait for organisation or event - appId resolution only needs user + appName
-    // Extract userId to stable const to prevent reference issues
-    const currentUserId = currentUser?.id;
-    
-    // Only resolve if we haven't already resolved for this user
-    if (
-      isAuth &&
-      currentUserId &&
-      supabase &&
-      appName &&
-      resolvedUserIdRef.current !== currentUserId && // Haven't resolved for this user yet
-      !isResolvingAppIdRef.current
-    ) {
-      // CRITICAL FIX: Set refs IMMEDIATELY (synchronously) before async operation
-      // This prevents race conditions where effect re-runs before async completes
-      isResolvingAppIdRef.current = true;
-      resolvedUserIdRef.current = currentUserId; // Set BEFORE async, not after
-      
-      const userId = currentUserId;
-      const appNameValue = appName;
-      
-      // Resolve appId immediately
-      import('../../rbac/api').then(async ({ resolveAppContext, setupRBAC }) => {
-        try {
-          // Ensure RBAC is initialized (idempotent - safe to call multiple times)
-          setupRBAC(supabase);
-          
-          const result = await resolveAppContext({
-            userId,
-            appName: appNameValue
-          });
-          
-          if (result?.appId) {
-            resolvedAppIdRef.current = result.appId;
-            // resolvedUserIdRef already set above to prevent race conditions
-            setAppId(result.appId);
-          } else {
-            // No appId returned - reset ref to allow retry
-            resolvedUserIdRef.current = undefined;
-          }
-        } catch (error) {
-          logger.error('UnifiedAuthProvider', 'Failed to resolve appId on login', {
-            error: error instanceof Error ? error.message : String(error),
-            appName: appNameValue,
-            userId
-          });
-          // Reset ref on error to allow retry
-          resolvedUserIdRef.current = undefined;
-        } finally {
-          isResolvingAppIdRef.current = false;
-        }
-      }).catch((importError) => {
-        logger.error('UnifiedAuthProvider', 'Failed to import RBAC API', importError);
-        isResolvingAppIdRef.current = false;
-        // Reset ref on import error to allow retry
-        resolvedUserIdRef.current = undefined;
-      });
-    }
-  }, [isAuth, currentUser?.id, supabase, appName]); // Removed appId from deps - it's the output, not an input. currentUser?.id is stable primitive.
-
 
-  // Subscribe to service state changes to trigger re-renders
-  // Use useReducer to force updates when services notify
-  const [, forceUpdate] = useReducer(x => x + 1, 0);
-  const forceUpdateTimeoutRef = useRef<ReturnType<typeof setTimeout> | null>(null);
-
-  const debouncedForceUpdate = useCallback(() => {
-    if (forceUpdateTimeoutRef.current) {
-      clearTimeout(forceUpdateTimeoutRef.current);
-    }
-
-    forceUpdateTimeoutRef.current = setTimeout(() => {
-      forceUpdate();
-      forceUpdateTimeoutRef.current = null;
-    }, 100); // Batch updates - 100ms debounce to prevent excessive re-renders
-    // Reduced from 16ms to 100ms to better batch service state updates
-    // and prevent flickering when multiple services update in quick succession
-  }, [forceUpdate]);
-
-  // Use refs for services to avoid dependency on service instances
-  // This prevents re-subscriptions when service instances change reference
-  const authServiceRef = useRef(authService);
-  const organisationServiceRef = useRef(organisationService);
-  const eventServiceRef = useRef(eventService);
-  const inactivityServiceRef = useRef(inactivityService);
-
-  // Update refs when services change
-  useEffect(() => {
-    authServiceRef.current = authService;
-    organisationServiceRef.current = organisationService;
-    eventServiceRef.current = eventService;
-    inactivityServiceRef.current = inactivityService;
-  }, [authService, organisationService, eventService, inactivityService]);
-
-  // Subscribe using refs - only depends on debouncedForceUpdate
-  // This prevents re-subscriptions when service instances change
-  useEffect(() => {
-    // Subscribe to all service changes using current refs
-    const unsubscribeAuth = authServiceRef.current.subscribe(debouncedForceUpdate);
-    const unsubscribeOrg = organisationServiceRef.current.subscribe(debouncedForceUpdate);
-    const unsubscribeEvent = eventServiceRef.current.subscribe(debouncedForceUpdate);
-    const unsubscribeInactivity = inactivityServiceRef.current.subscribe(debouncedForceUpdate);
-
-    return () => {
-      unsubscribeAuth();
-      unsubscribeOrg();
-      unsubscribeEvent();
-      unsubscribeInactivity();
-
-      if (forceUpdateTimeoutRef.current) {
-        clearTimeout(forceUpdateTimeoutRef.current);
-      }
-    };
-  }, [debouncedForceUpdate]);
-
-  // Get loading states - these will trigger re-renders when services change
   const authLoading = authService.isLoading();
   const orgLoading = organisationService.isLoading();
   const eventLoading = eventService.isLoading();
   const restorationLoading = sessionRestoration.isRestoring && !sessionRestorationTimedOut && !sessionRestoration.restorationError;
-  // For ADMIN/PORTAL apps, don't block on organisation loading (super admins can proceed)
   const shouldIncludeOrgLoading = appName !== 'ADMIN' && appName !== 'PORTAL';
   const totalLoading = restorationLoading || authLoading || (shouldIncludeOrgLoading ? orgLoading : false) || eventLoading;
-  
-  // Extract all primitive values from services to use in dependencies
   const authError = authService.getError();
-  // supabase is already declared above (line 198)
-  const rawSelectedOrganisation = organisationService.getSelectedOrganisation();
+  const selectedOrganisation = organisationService.getSelectedOrganisation();
   const organisationError = organisationService.getError();
-  
-  // Scope is now page-level only - use whatever organisation is selected
-  // No app-level scope determination needed
-  const selectedOrganisation = rawSelectedOrganisation;
   const hasValidOrganisationContext = organisationService.hasValidOrganisationContext();
   const isContextReady = organisationService.isContextReady();
-  
-  // Get raw data from services
   const rawEvents = eventService.getEvents();
   const rawOrganisations = organisationService.getOrganisations();
   const rawUserMemberships = organisationService.getUserMemberships();
-  
-  // Memoize arrays to prevent unnecessary context updates when service returns same data
-  const events = useMemo(() => {
-    return rawEvents;
-  }, [rawEvents]);
-  
-  const organisations = useMemo(() => {
-    return rawOrganisations;
-  }, [rawOrganisations]);
-  
-  const userMemberships = useMemo(() => {
-    return rawUserMemberships;
-  }, [rawUserMemberships]);
-  
+  const events = useMemo(() => rawEvents, [rawEvents]);
+  const organisations = useMemo(() => rawOrganisations, [rawOrganisations]);
+  const userMemberships = useMemo(() => rawUserMemberships, [rawUserMemberships]);
   const selectedEvent = eventService.getSelectedEvent();
   const eventError = eventService.getError();
   const showInactivityWarning = inactivityService.getShowInactivityWarning();
@@ -301,8 +120,6 @@ function UnifiedAuthContextProvider({
   const timeRemaining = inactivityService.getTimeRemaining();
   const showWarning = inactivityService.isWarningShown();
   const isTracking = inactivityService.isTracking();
-  
-  // Memoize inactivity values to prevent unnecessary context updates
   const inactivityState = useMemo(() => ({
     showInactivityWarning,
     inactivityTimeRemaining,
@@ -310,25 +127,15 @@ function UnifiedAuthContextProvider({
     timeRemaining,
     showWarning,
     isTracking,
-  }), [
-    showInactivityWarning,
-    inactivityTimeRemaining,
-    isIdle,
-    timeRemaining,
-    showWarning,
-    isTracking,
-  ]);
-  
+  }), [showInactivityWarning, inactivityTimeRemaining, isIdle, timeRemaining, showWarning, isTracking]);
   const hasErrors = !!(authError || organisationError || eventError || sessionRestoration.restorationError);
 
-  // Wrap all functions in useCallback to ensure stable references
   const signIn = useCallback((email: string, password?: string) => authService.signIn(email, password), [authService]);
   const signUp = useCallback((email: string, password: string) => authService.signUp(email, password), [authService]);
   const signOut = useCallback(() => authService.signOut(), [authService]);
   const resetPassword = useCallback((email: string) => authService.resetPassword(email), [authService]);
   const updatePassword = useCallback((password: string) => authService.updatePassword(password), [authService]);
   const refreshSession = useCallback(() => authService.refreshSession(), [authService]);
-  
   const switchOrganisation = useCallback((orgId: string) => organisationService.switchOrganisation(orgId), [organisationService]);
   const getUserRole = useCallback((orgId?: string) => organisationService.getUserRole(orgId), [organisationService]);
   const validateOrganisationAccess = useCallback((orgId: string) => organisationService.validateOrganisationAccess(orgId), [organisationService]);
@@ -336,10 +143,8 @@ function UnifiedAuthContextProvider({
   const ensureOrganisationContext = useCallback(() => organisationService.ensureOrganisationContext(), [organisationService]);
   const isOrganisationSecure = useCallback(() => organisationService.isOrganisationSecure(), [organisationService]);
   const getPrimaryOrganisation = useCallback(() => organisationService.getPrimaryOrganisation(), [organisationService]);
-  
   const setSelectedEvent = useCallback((event: Event | null) => eventService.setSelectedEvent(event), [eventService]);
   const refreshEvents = useCallback(() => eventService.refreshEvents(), [eventService]);
-  
   const resetActivity = useCallback(() => inactivityService.resetActivity(), [inactivityService]);
   const startTracking = useCallback(() => inactivityService.startTracking(), [inactivityService]);
   const stopTracking = useCallback(() => inactivityService.stopTracking(), [inactivityService]);
@@ -347,115 +152,12 @@ function UnifiedAuthContextProvider({
   const handleStaySignedIn = useCallback(() => inactivityService.handleStaySignedIn(), [inactivityService]);
   const handleSignOutNow = useCallback(() => inactivityService.handleSignOutNow(), [inactivityService]);
 
-  // Use ref to track previous state for conditional logging (dev only)
-  const prevStateRef = useRef<{
-    isAuthenticated: boolean;
-    userEmail: string | undefined;
-    totalLoading: boolean;
-  } | null>(null);
-  
-  // Only log when state actually changes (dev mode detection)
-  const isDev = import.meta.env.DEV || import.meta.env.MODE === 'development';
-  if (isDev) {
-    const currentState = {
-      isAuthenticated: isAuth,
-      userEmail: currentUser?.email,
-      totalLoading,
-    };
-    
-    const prevState = prevStateRef.current;
-    if (!prevState || 
-        prevState.isAuthenticated !== currentState.isAuthenticated ||
-        prevState.userEmail !== currentState.userEmail ||
-        prevState.totalLoading !== currentState.totalLoading) {
-      // State change detected, notify subscribers
-      prevStateRef.current = currentState;
-    }
-  }
-  
-  // Memoized combined context value - only depends on primitive values
-  const contextValue = useMemo<UnifiedAuthContextType>(() => {
-    return {
-    // Auth state
-    user: currentUser,
-    session: currentSession,
-    isAuthenticated: isAuth,
-    authLoading: authLoading,
-    authError: authError,
-    supabase: supabase,
-    
-    // Auth methods
-    signIn,
-    signUp,
-    signOut,
-    resetPassword,
-    updatePassword,
-    refreshSession,
-
-    // Organisation state
-    selectedOrganisation: selectedOrganisation,
-    selectedOrganisationId: selectedOrganisation?.id || null,
-    organisations: organisations,
-    userMemberships: userMemberships,
-    organisationLoading: orgLoading,
-    organisationError: organisationError,
-    hasValidOrganisationContext: hasValidOrganisationContext,
-    isContextReady: isContextReady,
-    
-    // Organisation methods
-    switchOrganisation,
-    getUserRole,
-    validateOrganisationAccess,
-    refreshOrganisations,
-    ensureOrganisationContext,
-    isOrganisationSecure,
-    getPrimaryOrganisation,
-
-    // Event state
-    events: events,
-    selectedEvent: selectedEvent,
-    selectedEventId: selectedEvent?.event_id || null,
-    eventLoading: eventLoading,
-    eventError: eventError,
-    
-    // Event methods
-    setSelectedEvent,
-    refreshEvents,
-
-    // Inactivity state
-    showInactivityWarning: inactivityState.showInactivityWarning,
-    inactivityTimeRemaining: inactivityState.inactivityTimeRemaining,
-    isIdle: inactivityState.isIdle,
-    timeRemaining: inactivityState.timeRemaining,
-    showWarning: inactivityState.showWarning,
-    isTracking: inactivityState.isTracking,
-    
-    // Inactivity methods
-    resetActivity,
-    startTracking,
-    stopTracking,
-    handleIdleLogout,
-    handleStaySignedIn,
-    handleSignOutNow,
-
-    // Additional unified properties
-    appName,
-    appId, // Resolved immediately on login
-    isLoading: totalLoading,
-    hasErrors: hasErrors,
-    sessionRestoration: sessionRestoration,
-    sessionRestorationTimedOut,
-    sessionRestorationTimeoutMs,
-  };
-  }, [
-    // All primitive values extracted from services
-    // Note: Arrays/objects from services are stable references (same reference unless data changes)
+  const state: UnifiedAuthContextState = useMemo(() => ({
     currentUser,
     currentSession,
     isAuth,
     authLoading,
     authError,
-    supabase,
     selectedOrganisation,
     organisations,
     userMemberships,
@@ -467,38 +169,86 @@ function UnifiedAuthContextProvider({
     selectedEvent,
     eventLoading,
     eventError,
-    inactivityState, // Use memoized object instead of individual values
+    inactivityState,
     totalLoading,
     hasErrors,
-    appName,
-    appId,
     sessionRestoration,
     sessionRestorationTimedOut,
     sessionRestorationTimeoutMs,
-    // Stable function references from useCallback (services are stable, so callbacks are too)
-    signIn,
-    signUp,
-    signOut,
-    resetPassword,
-    updatePassword,
-    refreshSession,
-    switchOrganisation,
-    getUserRole,
-    validateOrganisationAccess,
-    refreshOrganisations,
-    ensureOrganisationContext,
-    isOrganisationSecure,
-    getPrimaryOrganisation,
-    setSelectedEvent,
-    refreshEvents,
-    resetActivity,
-    startTracking,
-    stopTracking,
-    handleIdleLogout,
-    handleStaySignedIn,
-    handleSignOutNow,
+  }), [
+    currentUser, currentSession, isAuth, authLoading, authError, selectedOrganisation, organisations,
+    userMemberships, orgLoading, organisationError, hasValidOrganisationContext, isContextReady,
+    events, selectedEvent, eventLoading, eventError, inactivityState, totalLoading, hasErrors,
+    sessionRestoration, sessionRestorationTimedOut, sessionRestorationTimeoutMs,
+  ]);
+
+  const callbacks: UnifiedAuthContextCallbacks = useMemo(() => ({
+    signIn, signUp, signOut, resetPassword, updatePassword, refreshSession,
+    switchOrganisation, getUserRole, validateOrganisationAccess, refreshOrganisations,
+    ensureOrganisationContext, isOrganisationSecure, getPrimaryOrganisation,
+    setSelectedEvent, refreshEvents, resetActivity, startTracking, stopTracking,
+    handleIdleLogout, handleStaySignedIn, handleSignOutNow,
+  }), [
+    signIn, signUp, signOut, resetPassword, updatePassword, refreshSession,
+    switchOrganisation, getUserRole, validateOrganisationAccess, refreshOrganisations,
+    ensureOrganisationContext, isOrganisationSecure, getPrimaryOrganisation,
+    setSelectedEvent, refreshEvents, resetActivity, startTracking, stopTracking,
+    handleIdleLogout, handleStaySignedIn, handleSignOutNow,
   ]);
 
+  return { state, callbacks };
+}
+
+// Internal component that combines all contexts.
+// When user/session are passed from ServiceAwareProviders, they are the subscription-updated values
+// and must be used for the context so consumers see the same state (avoids stale authService.getUser() in same tick).
+function UnifiedAuthContextProvider({
+  children,
+  appName,
+  supabaseClient: supabaseClientProp,
+  user: userFromParent,
+  session: sessionFromParent,
+}: UnifiedAuthProviderProps & { user?: User | null; session?: Session | null }) {
+  const authService = useAuthService();
+  const organisationService = useOrganisationService();
+  const inactivityService = useInactivityService();
+  const eventService = useEventService();
+  const sessionRestorationState = useSessionRestoration();
+  const sessionRestoration: SessionRestorationState = useMemo(() => ({
+    isRestoring: sessionRestorationState.isRestoring,
+    restorationComplete: sessionRestorationState.restorationComplete,
+    restorationError: sessionRestorationState.restorationError,
+  }), [sessionRestorationState.isRestoring, sessionRestorationState.restorationComplete, sessionRestorationState.restorationError]);
+  const { hasTimedOut: sessionRestorationTimedOut, timeoutMs: sessionRestorationTimeoutMs } = sessionRestorationState;
+
+  const currentUser = userFromParent !== undefined ? userFromParent : authService.getUser();
+  const currentSession = sessionFromParent !== undefined ? sessionFromParent : authService.getSession();
+  const isAuth = !!(currentUser && currentSession);
+  const supabase = useMemo(() => supabaseClientProp, [supabaseClientProp]);
+
+  const appId = useAppIdResolution(supabase, appName, isAuth, currentUser?.id);
+  useUnifiedAuthSubscriptions(authService, organisationService, eventService, inactivityService);
+
+  const { state, callbacks } = useUnifiedAuthStateAndCallbacks(
+    authService,
+    organisationService,
+    eventService,
+    inactivityService,
+    sessionRestoration,
+    sessionRestorationTimedOut,
+    sessionRestorationTimeoutMs,
+    appName,
+    currentUser,
+    currentSession
+  );
+
+  const contextValue = useUnifiedAuthContextValue(state, callbacks, appId, appName, supabase);
+
+  // Set --print-app-name once when app mounts so print headers/footers use the correct app name
+  useEffect(() => {
+    if (appName) setPrintAppName(appName);
+  }, [appName]);
+
   return (
     <UnifiedAuthContext.Provider value={contextValue}>
       {children}
@@ -574,15 +324,18 @@ function ServiceAwareProviders({
   const [userState, setUserState] = useState(() => authService.getUser());
   const [sessionState, setSessionState] = useState(() => authService.getSession());
   
-  // Subscribe directly to auth service changes and update state immediately
+  // Subscribe directly to auth service changes and update state immediately.
+  // flushSync ensures the context updates before the next tick so consumers (e.g. PaceLoginPage
+  // useEffect, ProtectedRoute) see isAuthenticated/user on the very next render and avoid
+  // redirect-to-login races when navigation happens after signIn.
   useEffect(() => {
     const unsubscribe = authService.subscribe(() => {
-      // Update state immediately when auth service notifies (bypasses debounce)
       const newUser = authService.getUser();
       const newSession = authService.getSession();
-      
-      setUserState(newUser);
-      setSessionState(newSession);
+      flushSync(() => {
+        setUserState(newUser);
+        setSessionState(newSession);
+      });
     });
     return unsubscribe;
   }, [authService]);
@@ -616,6 +369,8 @@ function ServiceAwareProviders({
           <UnifiedAuthContextProvider
             appName={appName}
             supabaseClient={supabaseClient}
+            user={user}
+            session={session}
             persistState={persistState}
             enablePersistence={enablePersistence}
             requireOrganisationContext={requireOrganisationContext}