@jmruthers/pace-core 0.6.4 → 0.6.6

package/src/services/AuthService.ts

@@ -37,18 +37,20 @@ export class AuthService extends BaseService implements IAuthService {
     restorationError: null,
   };
   private restorationTimeoutId: ReturnType<typeof setTimeout> | null = null;
-  private readonly restorationTimeoutMs = 5000;
+  // Increased timeout to handle hard refresh scenarios where localStorage access
+  // and session restoration may take longer, especially with organisation/event context
+  private readonly restorationTimeoutMs = 10000; // 10 seconds (increased from 5)
   private restorationStartTime: number | null = null;
   private appName: string | undefined = undefined;
   private errorHandler: ((event: ErrorEvent) => void) | null = null;
   private unhandledRejectionHandler: ((event: PromiseRejectionEvent) => void) | null = null;
+  private wasAuthenticatedRef: boolean = false; // Track previous auth state to detect transitions
 
   constructor(supabaseClient: SupabaseClient, appName?: string) {
     super();
     this.instanceId = ++AuthService.instanceCount;
     this.supabaseClient = supabaseClient;
     this.appName = appName;
-    logger.debug('AuthService', `Instance created [ID:${this.instanceId}]`, { appName });
   }
 
   getInstanceId(): number {
@@ -57,11 +59,8 @@ export class AuthService extends BaseService implements IAuthService {
 
   // Auth state getters
   getUser(): User | null {
-    if (this.user) {
-      logger.debug('AuthService', `getUser() [ID:${this.instanceId}] returning user: ${this.user.id}`);
-    } else {
-      logger.debug('AuthService', `getUser() [ID:${this.instanceId}] returning null`);
-    }
+    // Removed debug logging - getUser() is called frequently and state changes
+    // are already logged in the auth state change handler
     return this.user;
   }
 
@@ -112,6 +111,15 @@ export class AuthService extends BaseService implements IAuthService {
         this.authError = null;
         this.user = data.user;
         this.session = data.session;
+        
+        // Clear persistence immediately on successful login
+        // This prevents dialogs/forms/datatables from auto-opening with stale state
+        // We clear here synchronously before components can mount and check persisted state
+        // Also clear old unscoped keys to prevent data leakage
+        if (!this.wasAuthenticatedRef && data.user) {
+          this.clearPersistenceOnLogin(null, true);
+          this.wasAuthenticatedRef = true;
+        }
       }
       
       this.notify();
@@ -151,6 +159,14 @@ export class AuthService extends BaseService implements IAuthService {
         this.authError = null;
         this.user = data.user;
         this.session = data.session;
+        
+        // Clear persistence immediately on successful signup/login
+        // This prevents dialogs/forms/datatables from auto-opening with stale state
+        // Also clear old unscoped keys to prevent data leakage
+        if (!this.wasAuthenticatedRef && data.user) {
+          this.clearPersistenceOnLogin(null, true);
+          this.wasAuthenticatedRef = true;
+        }
       }
       
       this.notify();
@@ -179,6 +195,14 @@ export class AuthService extends BaseService implements IAuthService {
     try {
       const { error } = await this.supabaseClient.auth.signOut();
       
+      // Clear sessionStorage on logout
+      try {
+        sessionStorage.clear();
+      } catch (storageError) {
+        // Ignore storage errors (e.g., in private browsing mode)
+        logger.warn('AuthService', 'Failed to clear sessionStorage', { error: storageError });
+      }
+      
       if (error) {
         this.authError = error;
       } else {
@@ -190,6 +214,14 @@ export class AuthService extends BaseService implements IAuthService {
       this.notify();
       return { user: null, session: null, error };
     } catch (error) {
+      // Clear sessionStorage even on error
+      try {
+        sessionStorage.clear();
+      } catch (storageError) {
+        // Ignore storage errors (e.g., in private browsing mode)
+        logger.warn('AuthService', 'Failed to clear sessionStorage', { error: storageError });
+      }
+      
       // Convert regular Error to AuthError if needed
       const authError = error instanceof AuthError 
         ? error 
@@ -400,6 +432,56 @@ export class AuthService extends BaseService implements IAuthService {
     }
   }
 
+  /**
+   * Clear pace-core persistence entries from sessionStorage
+   * This includes dialog, form, and datatable persistence
+   * 
+   * @param userId - Optional user ID to clear only that user's persistence.
+   *                 If not provided, clears all pace-core persistence (for user changes).
+   * @param clearUnscoped - If true, also clears old unscoped keys (without :user: prefix)
+   */
+  private clearPersistenceOnLogin(userId?: string | null, clearUnscoped: boolean = true): void {
+    if (typeof window === 'undefined' || !window.sessionStorage) {
+      return;
+    }
+
+    try {
+      const keysToRemove: string[] = [];
+      
+      // Collect all pace-core persistence keys
+      for (let i = 0; i < sessionStorage.length; i++) {
+        const key = sessionStorage.key(i);
+        if (key && (
+          key.startsWith('pace-core:draft:') ||
+          key.startsWith('pace-core:dialog:')
+        )) {
+          // If userId is provided, only clear keys for that user
+          // Otherwise, clear all (for user changes or fresh login)
+          if (userId && !key.includes(`:user:${userId}`)) {
+            // Also clear old unscoped keys (without :user: prefix) if requested
+            if (clearUnscoped && !key.includes(':user:')) {
+              keysToRemove.push(key);
+            }
+            continue; // Skip keys that don't match this user
+          }
+          keysToRemove.push(key);
+        }
+      }
+
+      // Remove all collected keys
+      keysToRemove.forEach(key => {
+        try {
+          sessionStorage.removeItem(key);
+        } catch (error) {
+          logger.warn('AuthService', `Failed to remove persistence key: ${key}`, error);
+        }
+      });
+
+    } catch (error) {
+      logger.warn('AuthService', `Failed to clear persistence [ID:${this.instanceId}]:`, error);
+    }
+  }
+
   private async setupAuthStateListener(): Promise<void> {
     if (!this.supabaseClient) {
       this.authLoading = false;
@@ -411,16 +493,20 @@ export class AuthService extends BaseService implements IAuthService {
       const subscription = this.supabaseClient.auth.onAuthStateChange(
         (event: AuthChangeEvent, session: SupabaseSession | null) => {
           try {
-            logger.debug('AuthService', `Auth state change [ID:${this.instanceId}]`, {
-              event,
-              hasSession: !!session,
-              userId: session?.user?.id
-            });
+            
+            // Track authentication state transition
+            const wasAuthenticated = this.wasAuthenticatedRef;
+            const isNowAuthenticated = !!session?.user;
+            const previousUserId = this.user?.id || null;
+            const newUserId = session?.user?.id || null;
+            const userChanged = previousUserId !== null && newUserId !== null && previousUserId !== newUserId;
+            
             // Handle different auth events
             if (event === 'SIGNED_OUT') {
               this.session = null;
               this.user = null;
               this.authError = null;
+              this.wasAuthenticatedRef = false;
               
               // Automatic session tracking (non-blocking)
               if (session?.user) {
@@ -437,6 +523,19 @@ export class AuthService extends BaseService implements IAuthService {
                 this.authError = null;
               }
               
+              // Clear persistence when:
+              // 1. Transitioning from unauthenticated to authenticated (fresh login) - clear all + old unscoped keys
+              // 2. User changes (different user logs in) - clear previous user's persistence + old unscoped keys
+              if (!wasAuthenticated && isNowAuthenticated && event === 'SIGNED_IN') {
+                // Fresh login - clear all persistence including old unscoped keys
+                this.clearPersistenceOnLogin(null, true);
+              } else if (userChanged && previousUserId) {
+                // User changed - clear previous user's persistence + old unscoped keys
+                this.clearPersistenceOnLogin(previousUserId, true);
+              }
+              
+              this.wasAuthenticatedRef = isNowAuthenticated;
+              
               // Automatic session tracking for login (non-blocking)
               // Only track on SIGNED_IN, not TOKEN_REFRESHED (to avoid duplicate login records)
               if (event === 'SIGNED_IN' && session?.user) {
@@ -446,10 +545,30 @@ export class AuthService extends BaseService implements IAuthService {
               }
             } else if (event === 'INITIAL_SESSION') {
               if (session) {
+                const previousUserId = this.user?.id || null;
+                const newUserId = session.user?.id || null;
+                const userChanged = previousUserId !== null && newUserId !== null && previousUserId !== newUserId;
+                
                 this.session = session;
                 this.user = session.user ?? null;
                 this.authError = null;
                 
+                // Clear persistence if user changed (e.g., different user's session restored)
+                // This prevents data leakage when a different user's session is restored
+                if (userChanged && previousUserId) {
+                  // Clear previous user's persistence + old unscoped keys
+                  this.clearPersistenceOnLogin(previousUserId, true);
+                } else if (!wasAuthenticated && !!session.user) {
+                  // Fresh login on INITIAL_SESSION - clear all persistence including old unscoped keys
+                  this.clearPersistenceOnLogin(null, true);
+                }
+                // Don't clear persistence on INITIAL_SESSION for same user - this is just session restoration
+                // Persistence should only be cleared on actual SIGNED_IN events or user changes
+                // INITIAL_SESSION happens on page load/refresh, and we want to preserve
+                // dialog/form/datatable state across page refreshes for the same user
+                
+                this.wasAuthenticatedRef = !!session.user;
+                
                 // Reset restoration state if valid session arrives after earlier failure
                 // This clears stale errors when session eventually succeeds
                 const hasTimeoutError = this.sessionRestorationState.restorationError?.name === 'SessionRestorationTimeoutError';
@@ -460,6 +579,7 @@ export class AuthService extends BaseService implements IAuthService {
                 }
               } else {
                 // No session in INITIAL_SESSION event - user is not authenticated
+                this.wasAuthenticatedRef = false;
                 // Finish restoration to clear loading state
                 if (this.sessionRestorationState.isRestoring) {
                   this.finishSessionRestoration();
@@ -471,11 +591,6 @@ export class AuthService extends BaseService implements IAuthService {
               // before checking authentication state
               this.authLoading = false;
               
-              // Final check: Ensure state matches what we just logged
-              logger.debug('AuthService', `State synchronized after INITIAL_SESSION [ID:${this.instanceId}]`, {
-                hasUser: !!this.user,
-                userId: this.user?.id
-              });
               
               this.notify();
               return; // Return early to avoid setting loading to false again below
@@ -484,12 +599,6 @@ export class AuthService extends BaseService implements IAuthService {
             // For other events (SIGNED_IN, SIGNED_OUT, TOKEN_REFRESHED), set loading to false and notify
             this.authLoading = false;
             
-            // Final check: Ensure state matches what we just logged
-            logger.debug('AuthService', `State synchronized after event [ID:${this.instanceId}]`, {
-              event,
-              hasUser: !!this.user,
-              userId: this.user?.id
-            });
             
             this.notify();
           } catch (error) {

package/src/services/EventService.ts

@@ -59,11 +59,6 @@ export class EventService extends BaseService implements IEventService {
     this.appName = appName;
     this.selectedOrganisation = selectedOrganisation;
     this.setSelectedEventId = setSelectedEventId;
-    logger.debug('EventService', `Instance created [ID:${this.instanceId}]`, {
-      appName,
-      hasUser: !!user,
-      userId: user?.id
-    });
   }
 
   getInstanceId(): number {
@@ -112,11 +107,6 @@ export class EventService extends BaseService implements IEventService {
       this.userClearedEventRef = false;
       this.hasAutoSelectedRef = false;
       
-      logger.debug('EventService', `User changed [ID:${this.instanceId}]`, {
-        previousUserId,
-        newUserId,
-        willInitialize: newUserId !== null
-      });
     }
     
     this.supabaseClient = supabaseClient;
@@ -142,10 +132,6 @@ export class EventService extends BaseService implements IEventService {
 
         if (isRBACInitialized()) {
           this.isSuperAdmin = await checkSuperAdmin(user.id as UUID);
-          logger.debug('EventService', 'Super admin status updated in updateDependencies', {
-            userId: user.id,
-            isSuperAdmin: this.isSuperAdmin
-          });
         } else {
           // RBAC not initialized - this should be rare since UnifiedAuthProvider initializes it synchronously
           // Keep existing value (don't reset to false) to avoid clearing a previously determined super admin status
@@ -260,11 +246,6 @@ export class EventService extends BaseService implements IEventService {
       });
       // Reset the user cleared flag when selecting an event
       this.userClearedEventRef = false;
-      logger.debug('EventService', 'Event selected', {
-        eventId: event.event_id,
-        eventName: event.event_name,
-        userClearedEventRef: this.userClearedEventRef
-      });
     } else {
       const previousEventId = this.selectedEvent?.event_id;
       this.selectedEvent = null;
@@ -277,11 +258,6 @@ export class EventService extends BaseService implements IEventService {
       this.hasAutoSelectedRef = false;
       // Mark that user explicitly cleared the event to prevent auto-selection
       this.userClearedEventRef = true;
-      logger.debug('EventService', 'Event cleared via setSelectedEvent(null)', {
-        previousEventId,
-        userClearedEventRef: this.userClearedEventRef,
-        stackTrace: new Error().stack
-      });
     }
     this.notify();
   }
@@ -407,13 +383,11 @@ export class EventService extends BaseService implements IEventService {
   protected async doInitialize(): Promise<void> {
     // Skip if already initialized
     if (this.isInitializedRef) {
-      logger.debug('EventService', 'Skipping initialization - already initialized');
       return;
     }
     
     // Skip if already fetching
     if (this.isFetchingRef) {
-      logger.debug('EventService', 'Skipping initialization - already fetching');
       return;
     }
     
@@ -430,27 +404,14 @@ export class EventService extends BaseService implements IEventService {
     // For event-required apps, selectedOrganisation may be null (org derived from event)
     // For org-required apps, selectedOrganisation is required
     if (!this.user) {
-      logger.debug('EventService', 'Skipping initialization - no user');
       return;
     }
     
-    logger.debug('EventService', 'Initializing', {
-      userId: this.user.id,
-      appName: this.appName,
-      hasSelectedOrganisation: !!this.selectedOrganisation,
-      hasSupabaseClient: !!this.supabaseClient,
-      hasSession: !!this.session
-    });
-    
     // Initial setup - fetch events on initialization
     await this.fetchEvents(false);
     
     // Mark as initialized after successful fetch
     this.isInitializedRef = true;
-    logger.debug('EventService', 'Initialization complete', {
-      eventsCount: this.events.length,
-      hasError: !!this.error
-    });
   }
 
   protected doCleanup(): void {
@@ -505,10 +466,6 @@ export class EventService extends BaseService implements IEventService {
           userIsSuperAdmin = await checkSuperAdmin(this.user.id as UUID);
           // Update cached value for future use
           this.isSuperAdmin = userIsSuperAdmin;
-          logger.debug('EventService', 'Super admin check completed', {
-            userId: this.user.id,
-            isSuperAdmin: userIsSuperAdmin
-          });
         } else {
           // RBAC not initialized - this should be rare since UnifiedAuthProvider initializes it synchronously
           // Use cached value from updateDependencies as fallback
@@ -544,10 +501,6 @@ export class EventService extends BaseService implements IEventService {
           } else {
             // No context available - pass null to get all accessible events via event-app roles
             // This allows users with event-app roles to see their events even without org context
-            logger.debug('EventService', 'No organisation context available, fetching all accessible events', {
-              hasSelectedEvent: !!this.selectedEvent,
-              hasSelectedOrganisation: !!this.selectedOrganisation
-            });
             organisationIdForRpc = null; // Will return events user has access to via event-app roles
           }
         }
@@ -580,14 +533,6 @@ export class EventService extends BaseService implements IEventService {
       
       // Call the RPC function following the established pattern
       // For super admins, pass null for p_organisation_id to see all events
-      logger.debug('EventService', 'Fetching events', {
-        userId: this.user.id,
-        organisationIdForRpc,
-        appName: this.appName,
-        hasSelectedEvent: !!this.selectedEvent,
-        hasSelectedOrganisation: !!this.selectedOrganisation,
-        isSuperAdmin: userIsSuperAdmin
-      });
       
       let { data, error: rpcError } = await this.supabaseClient.rpc('data_user_events_get', {
         p_user_id: this.user.id,
@@ -595,11 +540,6 @@ export class EventService extends BaseService implements IEventService {
         p_app_name: this.appName
       });
       
-      logger.debug('EventService', 'RPC response', {
-        dataLength: data?.length || 0,
-        hasError: !!rpcError,
-        error: rpcError
-      });
       
       if (rpcError) {
         logger.error('EventService', 'RPC error fetching events:', rpcError);
@@ -671,10 +611,7 @@ export class EventService extends BaseService implements IEventService {
             this.setSelectedEventId?.(null);
             // Restore the previous userClearedEventRef value - this was an automatic clear, not user-initiated
             this.userClearedEventRef = previousUserClearedRef;
-            logger.debug('EventService', 'Cleared selected event - no longer in events list', {
-              previousEventId: selectedEventId,
-              eventsCount: transformedEvents.length
-            });
+            // Cleared selected event - no longer in events list
           }
         }
 
@@ -685,62 +622,32 @@ export class EventService extends BaseService implements IEventService {
         if (!skipLoadPersisted) {
           const persistedEventLoaded = await this.loadPersistedEvent(transformedEvents);
           
-          logger.debug('EventService', 'Event selection check', {
-            persistedEventLoaded,
-            userClearedEventRef: this.userClearedEventRef,
-            eventsCount: transformedEvents.length,
-            hasSelectedEvent: !!this.selectedEvent
-          });
-          
           // If no persisted event was loaded and user hasn't explicitly cleared an event, auto-select the next event
           if (!persistedEventLoaded && !this.userClearedEventRef) {
             const nextEvent = this.getNextEventByDate(transformedEvents);
-            logger.debug('EventService', 'Auto-selection attempt', {
-              nextEventFound: !!nextEvent,
-              nextEventId: nextEvent?.event_id,
-              nextEventDate: nextEvent?.event_date
-            });
             if (nextEvent) {
               this.hasAutoSelectedRef = true;
               // Use setSelectedEvent() to ensure consistent behavior
               // Theme will be applied by useEventTheme() hook
               this.setSelectedEvent(nextEvent);
-              logger.debug('EventService', 'Auto-selected next event', {
-                eventId: nextEvent.event_id,
-                eventName: nextEvent.event_name,
-                eventDate: nextEvent.event_date
-              });
-            } else {
-              logger.debug('EventService', 'No next event found for auto-selection', {
-                eventsCount: transformedEvents.length,
-                eventsWithDates: transformedEvents.filter(e => e.event_date).length
-              });
             }
           } else if (persistedEventLoaded) {
-            logger.debug('EventService', 'Skipped auto-selection - persisted event loaded');
+            // Skipped auto-selection - persisted event loaded
           } else if (this.userClearedEventRef) {
-            logger.debug('EventService', 'Skipped auto-selection - user explicitly cleared event');
+            // Skipped auto-selection - user explicitly cleared event
           }
         } else {
           // If skipping persisted event load, still do auto-selection for new users
           if (!this.userClearedEventRef) {
             const nextEvent = this.getNextEventByDate(transformedEvents);
-            logger.debug('EventService', 'Auto-selection attempt (skip persisted)', {
-              nextEventFound: !!nextEvent,
-              nextEventId: nextEvent?.event_id
-            });
             if (nextEvent) {
               this.hasAutoSelectedRef = true;
               // Use setSelectedEvent() to ensure consistent behavior
               // Theme will be applied by useEventTheme() hook
               this.setSelectedEvent(nextEvent);
-              logger.debug('EventService', 'Auto-selected next event (skip persisted)', {
-                eventId: nextEvent.event_id,
-                eventName: nextEvent.event_name
-              });
             }
           } else {
-            logger.debug('EventService', 'Skipped auto-selection (skip persisted) - user explicitly cleared event');
+            // Skipped auto-selection (skip persisted) - user explicitly cleared event
           }
         }
       }