@jmruthers/pace-core 0.6.9 → 0.6.11

package/src/providers/services/UnifiedAuthProvider.tsx

@@ -8,8 +8,11 @@
  * Note: RBAC functionality is available via useRBAC() hook from '@jmruthers/pace-core/rbac'
  */
 
-import React, { createContext, useContext, useMemo, useCallback, useRef, useEffect, useState, useReducer } from 'react';
+import React, { useMemo, useCallback, useRef, useEffect, useState } from 'react';
+import { flushSync } from 'react-dom';
 import { type SupabaseClient, type User, type Session } from '@supabase/supabase-js';
+import type { Event } from '../../types/event';
+import type { SessionRestorationState } from '../../types/auth';
 import { AuthServiceProvider } from './AuthServiceProvider';
 import { OrganisationServiceProvider } from './OrganisationServiceProvider';
 import { EventServiceProvider } from './EventServiceProvider';
@@ -20,12 +23,17 @@ import { useOrganisations } from '../../hooks/useOrganisations';
 import { useEventService } from '../../hooks/services/useEventService';
 import { useInactivityService } from '../../hooks/services/useInactivityService';
 import { useSessionRestoration } from '../../hooks/useSessionRestoration';
-import type { Organisation, OrganisationMembership } from '../../types/organisation';
-import type { Event } from '../../types/event';
-import type { AuthError } from '@supabase/supabase-js';
-import type { SessionRestorationState } from '../../types/auth';
 import { logger } from '../../utils/core/logger';
 import { setupRBAC, isRBACInitialized } from '../../rbac/api';
+import { setPrintAppName } from '../../theming/runtime';
+import { UnifiedAuthContext } from './UnifiedAuthContext';
+import {
+  useAppIdResolution,
+  useUnifiedAuthSubscriptions,
+  useUnifiedAuthContextValue,
+  type UnifiedAuthContextState,
+  type UnifiedAuthContextCallbacks,
+} from './useUnifiedAuthContextValue';
 
 // Re-export UserEventAccess type
 /**
@@ -45,108 +53,6 @@ export interface UserEventAccess {
   organisation_id: string;
 }
 
-// Combined context type - focuses on auth, organisations, events, and inactivity
-/**
- * Unified auth context type.
- * Provides combined authentication, organisation, event, and inactivity state and methods.
- */
-export interface UnifiedAuthContextType {
-  // Auth state
-  user: User | null;
-  session: Session | null;
-  isAuthenticated: boolean;
-  authLoading: boolean;
-  authError: AuthError | null;
-  supabase: SupabaseClient | null;
-  
-  // App context (resolved immediately on login)
-  appName: string;
-  appId: string | undefined; // Resolved from appName when user logs in
-  
-  // Auth methods
-  signIn: (email: string, password?: string) => Promise<{ error: AuthError | null }>;
-  signUp: (email: string, password: string) => Promise<{ error: AuthError | null }>;
-  signOut: () => Promise<{ error: AuthError | null }>;
-  resetPassword: (email: string) => Promise<{ error: AuthError | null }>;
-  updatePassword: (password: string) => Promise<{ error: AuthError | null }>;
-  refreshSession: () => Promise<{ error: AuthError | null }>;
-
-  // Organisation state
-  selectedOrganisation: Organisation | null;
-  selectedOrganisationId: string | null;
-  organisations: Organisation[];
-  userMemberships: OrganisationMembership[];
-  organisationLoading: boolean;
-  organisationError: Error | null;
-  hasValidOrganisationContext: boolean;
-  isContextReady: boolean;
-  
-  // Organisation methods
-  switchOrganisation: (orgId: string) => Promise<void>;
-  getUserRole: (orgId?: string) => string;
-  validateOrganisationAccess: (orgId: string) => boolean;
-  refreshOrganisations: () => Promise<void>;
-  ensureOrganisationContext: () => Organisation;
-  isOrganisationSecure: () => boolean;
-  getPrimaryOrganisation: () => Organisation | null;
-
-  // Event state
-  events: Event[];
-  selectedEvent: Event | null;
-  selectedEventId: string | null;
-  eventLoading: boolean;
-  eventError: Error | null;
-  
-  // Event methods
-  setSelectedEvent: (event: Event | null) => void;
-  refreshEvents: () => Promise<void>;
-
-  // Inactivity state
-  showInactivityWarning: boolean;
-  inactivityTimeRemaining: number;
-  isIdle: boolean;
-  timeRemaining: number;
-  showWarning: boolean;
-  isTracking: boolean;
-  
-  // Inactivity methods
-  resetActivity: () => void;
-  startTracking: () => void;
-  stopTracking: () => void;
-  handleIdleLogout: () => Promise<void>;
-  handleStaySignedIn: () => void;
-  handleSignOutNow: () => Promise<void>;
-
-  // Additional unified properties
-  isLoading: boolean;
-  hasErrors: boolean;
-  sessionRestoration: SessionRestorationState;
-  sessionRestorationTimedOut: boolean;
-  sessionRestorationTimeoutMs: number;
-}
-
-/**
- * Context for unified authentication.
- * Provides combined authentication, organisation, event, and inactivity functionality.
- */
-export const UnifiedAuthContext = createContext<UnifiedAuthContextType | undefined>(undefined);
-
-/**
- * Hook to access unified authentication context.
- * Must be used within a UnifiedAuthProvider.
- * 
- * @returns Unified authentication context
- * @throws Error if used outside UnifiedAuthProvider
- */
-export const useUnifiedAuth = () => {
-  const context = useContext(UnifiedAuthContext);
-  if (!context) {
-    // Provide a helpful error log in addition to throwing for testability and DX
-    logger.error('useUnifiedAuth', 'useUnifiedAuth must be used within a UnifiedAuthProvider');
-    throw new Error('useUnifiedAuth must be used within a UnifiedAuthProvider');
-  }
-  return context;
-};
 
 /**
  * Props for the UnifiedAuthProvider component.
@@ -172,240 +78,40 @@ export interface UnifiedAuthProviderProps {
   dangerouslyDisableInactivity?: boolean; // Dev-only; must not disable in production
 }
 
-// Internal component that combines all contexts
-function UnifiedAuthContextProvider({ 
-  children, 
-  appName,
-  supabaseClient: supabaseClientProp,
-  ...props 
-}: UnifiedAuthProviderProps) {
-  const authService = useAuthService();
-  const organisationService = useOrganisationService();
-  const inactivityService = useInactivityService();
-  const sessionRestorationState = useSessionRestoration();
-  const {
-    hasTimedOut: sessionRestorationTimedOut,
-    timeoutMs: sessionRestorationTimeoutMs,
-    isRestoring,
-    restorationComplete,
-    restorationError,
-  } = sessionRestorationState;
-  const sessionRestoration: SessionRestorationState = useMemo(() => ({
-    isRestoring,
-    restorationComplete,
-    restorationError,
-  }), [isRestoring, restorationComplete, restorationError]);
-  
-  // App config removed - scope is now page-level only (rbac_app_pages.scope_type)
-
-  // Call hook unconditionally - if provider is missing, it will throw
-  // Errors should be handled by error boundaries at a higher level
-  // We cannot conditionally call hooks
-  const eventService = useEventService();
-
-  // Get current auth state - these will trigger re-renders when services change
-  const currentUser = authService.getUser();
-  const currentSession = authService.getSession();
+/** Build state and callbacks from services. Extracted to keep UnifiedAuthContextProvider under max-lines. */
+function useUnifiedAuthStateAndCallbacks(
+  authService: ReturnType<typeof useAuthService>,
+  organisationService: ReturnType<typeof useOrganisationService>,
+  eventService: ReturnType<typeof useEventService>,
+  inactivityService: ReturnType<typeof useInactivityService>,
+  sessionRestoration: SessionRestorationState,
+  sessionRestorationTimedOut: boolean,
+  sessionRestorationTimeoutMs: number,
+  appName: string,
+  userOverride?: User | null,
+  sessionOverride?: Session | null
+): { state: UnifiedAuthContextState; callbacks: UnifiedAuthContextCallbacks } {
+  const currentUser = userOverride !== undefined ? userOverride : authService.getUser();
+  const currentSession = sessionOverride !== undefined ? sessionOverride : authService.getSession();
   const isAuth = !!(currentUser && currentSession);
-  
-  // Stabilize supabase client reference to prevent infinite re-renders
-  // Memoize the supabaseClient prop to ensure a stable reference across renders
-  // This is critical for preventing infinite loops when supabase is used in useEffect dependency arrays
-  // The reference will only change when supabaseClientProp actually changes (different instance)
-  // If the consuming app creates the client once and reuses it, this will be stable
-  const supabase = useMemo(() => supabaseClientProp, [supabaseClientProp]);
-  
-  // Resolve appId immediately when user logs in (don't wait for organisation/event)
-  // This makes appId available early for navigation menu filtering
-  const [appId, setAppId] = useState<string | undefined>(undefined);
-  
 
-  const isResolvingAppIdRef = useRef(false);
-  const resolvedAppIdRef = useRef<string | undefined>(undefined);
-  const resolvedUserIdRef = useRef<string | undefined>(undefined);
-  
-  useEffect(() => {
-    // Clear appId when user logs out or changes
-    if (!isAuth) {
-      // User logged out - clear all refs and state
-      resolvedAppIdRef.current = undefined;
-      resolvedUserIdRef.current = undefined;
-      setAppId(undefined);
-      return;
-    }
-    
-    // User changed - clear previous resolution to allow re-resolution for new user
-    if (currentUser?.id && resolvedUserIdRef.current && resolvedUserIdRef.current !== currentUser.id) {
-      resolvedAppIdRef.current = undefined;
-      resolvedUserIdRef.current = undefined;
-      setAppId(undefined);
-    }
-    
-    // Resolve appId as soon as we have user + supabase + appName
-    // Don't wait for organisation or event - appId resolution only needs user + appName
-    // Extract userId to stable const to prevent reference issues
-    const currentUserId = currentUser?.id;
-    
-    // Only resolve if we haven't already resolved for this user
-    if (
-      isAuth &&
-      currentUserId &&
-      supabase &&
-      appName &&
-      resolvedUserIdRef.current !== currentUserId && // Haven't resolved for this user yet
-      !isResolvingAppIdRef.current
-    ) {
-      // CRITICAL FIX: Set refs IMMEDIATELY (synchronously) before async operation
-      // This prevents race conditions where effect re-runs before async completes
-      isResolvingAppIdRef.current = true;
-      resolvedUserIdRef.current = currentUserId; // Set BEFORE async, not after
-      
-      const userId = currentUserId;
-      const appNameValue = appName;
-      
-      // Resolve appId immediately
-      import('../../rbac/api').then(async ({ resolveAppContext, setupRBAC }) => {
-        try {
-          // Ensure RBAC is initialized (idempotent - safe to call multiple times)
-          setupRBAC(supabase);
-          
-          const result = await resolveAppContext({
-            userId,
-            appName: appNameValue
-          });
-          
-          if (result?.appId) {
-            resolvedAppIdRef.current = result.appId;
-            // resolvedUserIdRef already set above to prevent race conditions
-            setAppId(result.appId);
-          } else {
-            // No appId returned - reset ref to allow retry
-            resolvedUserIdRef.current = undefined;
-          }
-        } catch (error) {
-          logger.error('UnifiedAuthProvider', 'Failed to resolve appId on login', {
-            error: error instanceof Error ? error.message : String(error),
-            appName: appNameValue,
-            userId
-          });
-          // Reset ref on error to allow retry
-          resolvedUserIdRef.current = undefined;
-        } finally {
-          isResolvingAppIdRef.current = false;
-        }
-      }).catch((importError) => {
-        logger.error('UnifiedAuthProvider', 'Failed to import RBAC API', importError);
-        isResolvingAppIdRef.current = false;
-        // Reset ref on import error to allow retry
-        resolvedUserIdRef.current = undefined;
-      });
-    }
-  }, [isAuth, currentUser?.id, supabase, appName]); // Removed appId from deps - it's the output, not an input. currentUser?.id is stable primitive.
-
-
-  // Subscribe to service state changes to trigger re-renders
-  // Use useReducer to force updates when services notify
-  const [, forceUpdate] = useReducer(x => x + 1, 0);
-  const forceUpdateTimeoutRef = useRef<ReturnType<typeof setTimeout> | null>(null);
-
-  const debouncedForceUpdate = useCallback(() => {
-    if (forceUpdateTimeoutRef.current) {
-      clearTimeout(forceUpdateTimeoutRef.current);
-    }
-
-    forceUpdateTimeoutRef.current = setTimeout(() => {
-      forceUpdate();
-      forceUpdateTimeoutRef.current = null;
-    }, 100); // Batch updates - 100ms debounce to prevent excessive re-renders
-    // Reduced from 16ms to 100ms to better batch service state updates
-    // and prevent flickering when multiple services update in quick succession
-  }, [forceUpdate]);
-
-  // Use refs for services to avoid dependency on service instances
-  // This prevents re-subscriptions when service instances change reference
-  const authServiceRef = useRef(authService);
-  const organisationServiceRef = useRef(organisationService);
-  const eventServiceRef = useRef(eventService);
-  const inactivityServiceRef = useRef(inactivityService);
-
-  // Update refs when services change
-  useEffect(() => {
-    authServiceRef.current = authService;
-    organisationServiceRef.current = organisationService;
-    eventServiceRef.current = eventService;
-    inactivityServiceRef.current = inactivityService;
-  }, [authService, organisationService, eventService, inactivityService]);
-
-  // Subscribe using refs - only depends on debouncedForceUpdate
-  // This prevents re-subscriptions when service instances change
-  useEffect(() => {
-    // Subscribe to all service changes using current refs
-    const unsubscribeAuth = authServiceRef.current.subscribe(debouncedForceUpdate);
-    const unsubscribeOrg = organisationServiceRef.current.subscribe(debouncedForceUpdate);
-    const unsubscribeEvent = eventServiceRef.current.subscribe(debouncedForceUpdate);
-    const unsubscribeInactivity = inactivityServiceRef.current.subscribe(debouncedForceUpdate);
-
-    return () => {
-      unsubscribeAuth();
-      unsubscribeOrg();
-      unsubscribeEvent();
-      unsubscribeInactivity();
-
-      if (forceUpdateTimeoutRef.current) {
-        clearTimeout(forceUpdateTimeoutRef.current);
-      }
-    };
-  }, [debouncedForceUpdate]);
-
-  // Get loading states - these will trigger re-renders when services change
   const authLoading = authService.isLoading();
   const orgLoading = organisationService.isLoading();
   const eventLoading = eventService.isLoading();
   const restorationLoading = sessionRestoration.isRestoring && !sessionRestorationTimedOut && !sessionRestoration.restorationError;
-  // For ADMIN/PORTAL apps, don't block on organisation loading (super admins can proceed)
   const shouldIncludeOrgLoading = appName !== 'ADMIN' && appName !== 'PORTAL';
   const totalLoading = restorationLoading || authLoading || (shouldIncludeOrgLoading ? orgLoading : false) || eventLoading;
-  
-  // Extract all primitive values from services to use in dependencies
   const authError = authService.getError();
-  // supabase is already declared above (line 198)
-  const rawSelectedOrganisation = organisationService.getSelectedOrganisation();
+  const selectedOrganisation = organisationService.getSelectedOrganisation();
   const organisationError = organisationService.getError();
-  
-  // Scope is now page-level only - use whatever organisation is selected
-  // No app-level scope determination needed
-  const selectedOrganisation = rawSelectedOrganisation;
   const hasValidOrganisationContext = organisationService.hasValidOrganisationContext();
   const isContextReady = organisationService.isContextReady();
-  
-  // Get raw data from services
   const rawEvents = eventService.getEvents();
   const rawOrganisations = organisationService.getOrganisations();
   const rawUserMemberships = organisationService.getUserMemberships();
-  
-  // Memoize arrays to prevent unnecessary context updates when service returns same data
-  // Compare by IDs to detect actual changes, not just reference changes
-  const events = useMemo(() => {
-    return rawEvents;
-  }, [
-    // Create dependency string from event IDs - only changes when events actually change
-    rawEvents.map(e => e.event_id || e.id).join(',')
-  ]);
-  
-  const organisations = useMemo(() => {
-    return rawOrganisations;
-  }, [
-    // Create dependency string from organisation IDs - only changes when orgs actually change
-    rawOrganisations.map(o => o.id).join(',')
-  ]);
-  
-  const userMemberships = useMemo(() => {
-    return rawUserMemberships;
-  }, [
-    // Create dependency string from membership IDs - only changes when memberships actually change
-    rawUserMemberships.map(m => `${m.organisation_id}-${m.user_id}`).join(',')
-  ]);
-  
+  const events = useMemo(() => rawEvents, [rawEvents]);
+  const organisations = useMemo(() => rawOrganisations, [rawOrganisations]);
+  const userMemberships = useMemo(() => rawUserMemberships, [rawUserMemberships]);
   const selectedEvent = eventService.getSelectedEvent();
   const eventError = eventService.getError();
   const showInactivityWarning = inactivityService.getShowInactivityWarning();
@@ -414,8 +120,6 @@ function UnifiedAuthContextProvider({
   const timeRemaining = inactivityService.getTimeRemaining();
   const showWarning = inactivityService.isWarningShown();
   const isTracking = inactivityService.isTracking();
-  
-  // Memoize inactivity values to prevent unnecessary context updates
   const inactivityState = useMemo(() => ({
     showInactivityWarning,
     inactivityTimeRemaining,
@@ -423,152 +127,37 @@ function UnifiedAuthContextProvider({
     timeRemaining,
     showWarning,
     isTracking,
-  }), [
-    showInactivityWarning,
-    inactivityTimeRemaining,
-    isIdle,
-    timeRemaining,
-    showWarning,
-    isTracking,
-  ]);
-  
+  }), [showInactivityWarning, inactivityTimeRemaining, isIdle, timeRemaining, showWarning, isTracking]);
   const hasErrors = !!(authError || organisationError || eventError || sessionRestoration.restorationError);
 
-  // React Compiler handles memoization automatically
-  const signIn = (email: string, password?: string) => authService.signIn(email, password);
-  const signUp = (email: string, password: string) => authService.signUp(email, password);
-  const signOut = () => authService.signOut();
-  const resetPassword = (email: string) => authService.resetPassword(email);
-  const updatePassword = (password: string) => authService.updatePassword(password);
-  const refreshSession = () => authService.refreshSession();
-  
-  const switchOrganisation = (orgId: string) => organisationService.switchOrganisation(orgId);
-  const getUserRole = (orgId?: string) => organisationService.getUserRole(orgId);
-  const validateOrganisationAccess = (orgId: string) => organisationService.validateOrganisationAccess(orgId);
-  const refreshOrganisations = () => organisationService.refreshOrganisations();
-  const ensureOrganisationContext = () => organisationService.ensureOrganisationContext();
-  const isOrganisationSecure = () => organisationService.isOrganisationSecure();
-  const getPrimaryOrganisation = () => organisationService.getPrimaryOrganisation();
-  
-  const setSelectedEvent = (event: Event | null) => eventService.setSelectedEvent(event);
-  const refreshEvents = () => eventService.refreshEvents();
-  
-  const resetActivity = () => inactivityService.resetActivity();
-  const startTracking = () => inactivityService.startTracking();
-  const stopTracking = () => inactivityService.stopTracking();
-  const handleIdleLogout = () => inactivityService.handleIdleLogout();
-  const handleStaySignedIn = () => inactivityService.handleStaySignedIn();
-  const handleSignOutNow = () => inactivityService.handleSignOutNow();
-
-  // Use ref to track previous state for conditional logging (dev only)
-  const prevStateRef = useRef<{
-    isAuthenticated: boolean;
-    userEmail: string | undefined;
-    totalLoading: boolean;
-  } | null>(null);
-  
-  // Only log when state actually changes (dev mode detection)
-  const isDev = import.meta.env.DEV || import.meta.env.MODE === 'development';
-  if (isDev) {
-    const currentState = {
-      isAuthenticated: isAuth,
-      userEmail: currentUser?.email,
-      totalLoading,
-    };
-    
-    const prevState = prevStateRef.current;
-    if (!prevState || 
-        prevState.isAuthenticated !== currentState.isAuthenticated ||
-        prevState.userEmail !== currentState.userEmail ||
-        prevState.totalLoading !== currentState.totalLoading) {
-      // State change detected, notify subscribers
-      prevStateRef.current = currentState;
-    }
-  }
-  
-  // Memoized combined context value - only depends on primitive values
-  const contextValue = useMemo<UnifiedAuthContextType>(() => {
-    return {
-    // Auth state
-    user: currentUser,
-    session: currentSession,
-    isAuthenticated: isAuth,
-    authLoading: authLoading,
-    authError: authError,
-    supabase: supabase,
-    
-    // Auth methods
-    signIn,
-    signUp,
-    signOut,
-    resetPassword,
-    updatePassword,
-    refreshSession,
-
-    // Organisation state
-    selectedOrganisation: selectedOrganisation,
-    selectedOrganisationId: selectedOrganisation?.id || null,
-    organisations: organisations,
-    userMemberships: userMemberships,
-    organisationLoading: orgLoading,
-    organisationError: organisationError,
-    hasValidOrganisationContext: hasValidOrganisationContext,
-    isContextReady: isContextReady,
-    
-    // Organisation methods
-    switchOrganisation,
-    getUserRole,
-    validateOrganisationAccess,
-    refreshOrganisations,
-    ensureOrganisationContext,
-    isOrganisationSecure,
-    getPrimaryOrganisation,
-
-    // Event state
-    events: events,
-    selectedEvent: selectedEvent,
-    selectedEventId: selectedEvent?.event_id || null,
-    eventLoading: eventLoading,
-    eventError: eventError,
-    
-    // Event methods
-    setSelectedEvent,
-    refreshEvents,
-
-    // Inactivity state
-    showInactivityWarning: inactivityState.showInactivityWarning,
-    inactivityTimeRemaining: inactivityState.inactivityTimeRemaining,
-    isIdle: inactivityState.isIdle,
-    timeRemaining: inactivityState.timeRemaining,
-    showWarning: inactivityState.showWarning,
-    isTracking: inactivityState.isTracking,
-    
-    // Inactivity methods
-    resetActivity,
-    startTracking,
-    stopTracking,
-    handleIdleLogout,
-    handleStaySignedIn,
-    handleSignOutNow,
-
-    // Additional unified properties
-    appName,
-    appId, // Resolved immediately on login
-    isLoading: totalLoading,
-    hasErrors: hasErrors,
-    sessionRestoration: sessionRestoration,
-    sessionRestorationTimedOut,
-    sessionRestorationTimeoutMs,
-  };
-  }, [
-    // All primitive values extracted from services
-    // Note: Arrays/objects from services are stable references (same reference unless data changes)
+  const signIn = useCallback((email: string, password?: string) => authService.signIn(email, password), [authService]);
+  const signUp = useCallback((email: string, password: string) => authService.signUp(email, password), [authService]);
+  const signOut = useCallback(() => authService.signOut(), [authService]);
+  const resetPassword = useCallback((email: string) => authService.resetPassword(email), [authService]);
+  const updatePassword = useCallback((password: string) => authService.updatePassword(password), [authService]);
+  const refreshSession = useCallback(() => authService.refreshSession(), [authService]);
+  const switchOrganisation = useCallback((orgId: string) => organisationService.switchOrganisation(orgId), [organisationService]);
+  const getUserRole = useCallback((orgId?: string) => organisationService.getUserRole(orgId), [organisationService]);
+  const validateOrganisationAccess = useCallback((orgId: string) => organisationService.validateOrganisationAccess(orgId), [organisationService]);
+  const refreshOrganisations = useCallback(() => organisationService.refreshOrganisations(), [organisationService]);
+  const ensureOrganisationContext = useCallback(() => organisationService.ensureOrganisationContext(), [organisationService]);
+  const isOrganisationSecure = useCallback(() => organisationService.isOrganisationSecure(), [organisationService]);
+  const getPrimaryOrganisation = useCallback(() => organisationService.getPrimaryOrganisation(), [organisationService]);
+  const setSelectedEvent = useCallback((event: Event | null) => eventService.setSelectedEvent(event), [eventService]);
+  const refreshEvents = useCallback(() => eventService.refreshEvents(), [eventService]);
+  const resetActivity = useCallback(() => inactivityService.resetActivity(), [inactivityService]);
+  const startTracking = useCallback(() => inactivityService.startTracking(), [inactivityService]);
+  const stopTracking = useCallback(() => inactivityService.stopTracking(), [inactivityService]);
+  const handleIdleLogout = useCallback(() => inactivityService.handleIdleLogout(), [inactivityService]);
+  const handleStaySignedIn = useCallback(() => inactivityService.handleStaySignedIn(), [inactivityService]);
+  const handleSignOutNow = useCallback(() => inactivityService.handleSignOutNow(), [inactivityService]);
+
+  const state: UnifiedAuthContextState = useMemo(() => ({
     currentUser,
     currentSession,
     isAuth,
     authLoading,
     authError,
-    supabase,
     selectedOrganisation,
     organisations,
     userMemberships,
@@ -580,38 +169,86 @@ function UnifiedAuthContextProvider({
     selectedEvent,
     eventLoading,
     eventError,
-    inactivityState, // Use memoized object instead of individual values
+    inactivityState,
     totalLoading,
     hasErrors,
-    appName,
-    appId,
     sessionRestoration,
     sessionRestorationTimedOut,
     sessionRestorationTimeoutMs,
-    // Stable function references from useCallback (services are stable, so callbacks are too)
-    signIn,
-    signUp,
-    signOut,
-    resetPassword,
-    updatePassword,
-    refreshSession,
-    switchOrganisation,
-    getUserRole,
-    validateOrganisationAccess,
-    refreshOrganisations,
-    ensureOrganisationContext,
-    isOrganisationSecure,
-    getPrimaryOrganisation,
-    setSelectedEvent,
-    refreshEvents,
-    resetActivity,
-    startTracking,
-    stopTracking,
-    handleIdleLogout,
-    handleStaySignedIn,
-    handleSignOutNow,
+  }), [
+    currentUser, currentSession, isAuth, authLoading, authError, selectedOrganisation, organisations,
+    userMemberships, orgLoading, organisationError, hasValidOrganisationContext, isContextReady,
+    events, selectedEvent, eventLoading, eventError, inactivityState, totalLoading, hasErrors,
+    sessionRestoration, sessionRestorationTimedOut, sessionRestorationTimeoutMs,
+  ]);
+
+  const callbacks: UnifiedAuthContextCallbacks = useMemo(() => ({
+    signIn, signUp, signOut, resetPassword, updatePassword, refreshSession,
+    switchOrganisation, getUserRole, validateOrganisationAccess, refreshOrganisations,
+    ensureOrganisationContext, isOrganisationSecure, getPrimaryOrganisation,
+    setSelectedEvent, refreshEvents, resetActivity, startTracking, stopTracking,
+    handleIdleLogout, handleStaySignedIn, handleSignOutNow,
+  }), [
+    signIn, signUp, signOut, resetPassword, updatePassword, refreshSession,
+    switchOrganisation, getUserRole, validateOrganisationAccess, refreshOrganisations,
+    ensureOrganisationContext, isOrganisationSecure, getPrimaryOrganisation,
+    setSelectedEvent, refreshEvents, resetActivity, startTracking, stopTracking,
+    handleIdleLogout, handleStaySignedIn, handleSignOutNow,
   ]);
 
+  return { state, callbacks };
+}
+
+// Internal component that combines all contexts.
+// When user/session are passed from ServiceAwareProviders, they are the subscription-updated values
+// and must be used for the context so consumers see the same state (avoids stale authService.getUser() in same tick).
+function UnifiedAuthContextProvider({
+  children,
+  appName,
+  supabaseClient: supabaseClientProp,
+  user: userFromParent,
+  session: sessionFromParent,
+}: UnifiedAuthProviderProps & { user?: User | null; session?: Session | null }) {
+  const authService = useAuthService();
+  const organisationService = useOrganisationService();
+  const inactivityService = useInactivityService();
+  const eventService = useEventService();
+  const sessionRestorationState = useSessionRestoration();
+  const sessionRestoration: SessionRestorationState = useMemo(() => ({
+    isRestoring: sessionRestorationState.isRestoring,
+    restorationComplete: sessionRestorationState.restorationComplete,
+    restorationError: sessionRestorationState.restorationError,
+  }), [sessionRestorationState.isRestoring, sessionRestorationState.restorationComplete, sessionRestorationState.restorationError]);
+  const { hasTimedOut: sessionRestorationTimedOut, timeoutMs: sessionRestorationTimeoutMs } = sessionRestorationState;
+
+  const currentUser = userFromParent !== undefined ? userFromParent : authService.getUser();
+  const currentSession = sessionFromParent !== undefined ? sessionFromParent : authService.getSession();
+  const isAuth = !!(currentUser && currentSession);
+  const supabase = useMemo(() => supabaseClientProp, [supabaseClientProp]);
+
+  const appId = useAppIdResolution(supabase, appName, isAuth, currentUser?.id);
+  useUnifiedAuthSubscriptions(authService, organisationService, eventService, inactivityService);
+
+  const { state, callbacks } = useUnifiedAuthStateAndCallbacks(
+    authService,
+    organisationService,
+    eventService,
+    inactivityService,
+    sessionRestoration,
+    sessionRestorationTimedOut,
+    sessionRestorationTimeoutMs,
+    appName,
+    currentUser,
+    currentSession
+  );
+
+  const contextValue = useUnifiedAuthContextValue(state, callbacks, appId, appName, supabase);
+
+  // Set --print-app-name once when app mounts so print headers/footers use the correct app name
+  useEffect(() => {
+    if (appName) setPrintAppName(appName);
+  }, [appName]);
+
   return (
     <UnifiedAuthContext.Provider value={contextValue}>
       {children}
@@ -687,15 +324,18 @@ function ServiceAwareProviders({
   const [userState, setUserState] = useState(() => authService.getUser());
   const [sessionState, setSessionState] = useState(() => authService.getSession());
   
-  // Subscribe directly to auth service changes and update state immediately
+  // Subscribe directly to auth service changes and update state immediately.
+  // flushSync ensures the context updates before the next tick so consumers (e.g. PaceLoginPage
+  // useEffect, ProtectedRoute) see isAuthenticated/user on the very next render and avoid
+  // redirect-to-login races when navigation happens after signIn.
   useEffect(() => {
     const unsubscribe = authService.subscribe(() => {
-      // Update state immediately when auth service notifies (bypasses debounce)
       const newUser = authService.getUser();
       const newSession = authService.getSession();
-      
-      setUserState(newUser);
-      setSessionState(newSession);
+      flushSync(() => {
+        setUserState(newUser);
+        setSessionState(newSession);
+      });
     });
     return unsubscribe;
   }, [authService]);
@@ -729,6 +369,8 @@ function ServiceAwareProviders({
           <UnifiedAuthContextProvider
             appName={appName}
             supabaseClient={supabaseClient}
+            user={user}
+            session={session}
             persistState={persistState}
             enablePersistence={enablePersistence}
             requireOrganisationContext={requireOrganisationContext}
@@ -819,3 +461,11 @@ export function UnifiedAuthProvider({
   );
 }
 
+// Re-export context and hook for backward compatibility
+// Note: This triggers react-refresh/only-export-components warning, but is necessary
+// for backward compatibility. Consumers can import from './index' to avoid the warning.
+export { UnifiedAuthContext } from './UnifiedAuthContext';
+// eslint-disable-next-line react-refresh/only-export-components
+export { useUnifiedAuth } from './useUnifiedAuth';
+export type { UnifiedAuthContextType } from './UnifiedAuthContext';
+