fix(auth): web/components/nav.tsx

web/components/nav.tsx

@@ -32,91 +32,43 @@ export function Nav() {
     let cancelled = false;
     const supabase = createClient();
 
-    async function checkAuth() {
-      try {
-        const { data: { session } } = await supabase.auth.getSession();
-
+    // Single source of truth: onAuthStateChange.
+    // Fires INITIAL_SESSION immediately on setup (synchronous replay of stored session).
+    // Then fires SIGNED_IN, SIGNED_OUT, TOKEN_REFRESHED on auth changes.
+    // No separate getSession/getUser call — that was causing race conditions.
+    const { data: { subscription } } = supabase.auth.onAuthStateChange(
+      (event, session) => {
         if (cancelled) return;
 
         if (!session?.user) {
           setUserEmail(null);
           setUserRole(null);
           setUserTeam(null);
-          if (!loaded) setLoaded(true);
+          setLoaded(true);
           return;
         }
 
-        const user = session.user;
-        setUserEmail(user.email || null);
+        // User is authenticated — show logged-in nav immediately
+        setUserEmail(session.user.email || null);
+        setLoaded(true);
 
-        // Fetch profile for role/team — use getSession instead of getUser
-        // to avoid extra network call
-        const { data: profile, error: profileError } = await supabase
+        // Fetch profile (role, team) in background — don't block the UI
+        supabase
           .from("profiles")
           .select("role, team_id")
-          .eq("id", user.id)
-          .single();
-
-        if (cancelled) return;
-
-        if (profileError) {
-          console.error("[ClauseGuard Nav] Profile error:", profileError.message);
-          // Even if profile fails, still show the user as logged in
-          setUserRole("user");
-          setUserTeam(null);
-        } else {
-          setUserRole(profile?.role || "user");
-          setUserTeam(profile?.team_id || null);
-        }
-      } catch (err) {
-        console.error("[ClauseGuard Nav] Auth check error:", err);
-        if (!cancelled) {
-          setUserEmail(null);
-          setUserRole(null);
-          setUserTeam(null);
-        }
-      }
-      if (!cancelled) setLoaded(true);
-    }
-
-    // Check auth immediately
-    checkAuth();
-
-    // Listen for auth changes (login, logout, token refresh)
-    const { data: { subscription } } = supabase.auth.onAuthStateChange(
-      (event, session) => {
-        console.log("[ClauseGuard Nav] Auth event:", event);
-
-        if (event === "SIGNED_OUT" || !session?.user) {
-          setUserEmail(null);
-          setUserRole(null);
-          setUserTeam(null);
-          setLoaded(true);
-          return;
-        }
-
-        if (event === "SIGNED_IN" || event === "TOKEN_REFRESHED" || event === "INITIAL_SESSION") {
-          // We have a session — update email immediately, then fetch profile
-          setUserEmail(session.user.email || null);
-          setLoaded(true); // Show logged-in state immediately (even before profile loads)
-
-          // Fetch profile in background
-          supabase
-            .from("profiles")
-            .select("role, team_id")
-            .eq("id", session.user.id)
-            .single()
-            .then(({ data: profile, error }) => {
-              if (cancelled) return;
-              if (error) {
-                console.error("[ClauseGuard Nav] Profile error:", error.message);
-                setUserRole("user");
-              } else {
-                setUserRole(profile?.role || "user");
-                setUserTeam(profile?.team_id || null);
-              }
-            });
-        }
+          .eq("id", session.user.id)
+          .single()
+          .then(({ data: profile, error }) => {
+            if (cancelled) return;
+            if (error) {
+              console.error("[ClauseGuard Nav] Profile error:", error.message);
+              setUserRole("user");
+              setUserTeam(null);
+            } else {
+              setUserRole(profile?.role || "user");
+              setUserTeam(profile?.team_id || null);
+            }
+          });
       }
     );