fix(auth): web/components/nav.tsx — fix nav not updating after login + add missing middleware

web/components/nav.tsx

@@ -1,14 +1,14 @@
 "use client";
 
 import Link from "next/link";
-import { usePathname } from "next/navigation";
+import { usePathname, useRouter } from "next/navigation";
 import type { LucideIcon } from "lucide-react";
 import {
   ShieldCheck, Menu, X, Crown, GitCompare, LayoutDashboard,
   ScanText, Settings, LogIn, Zap, Sparkles, CreditCard, UserCircle,
   LogOut, Users
 } from "lucide-react";
-import { useState, useEffect } from "react";
+import { useState, useEffect, useCallback } from "react";
 import { createClient } from "@/lib/supabase/client";
 
 interface NavLink {
@@ -28,45 +28,82 @@ export function Nav() {
   const isAdmin = userRole === "admin";
   const hasTeam = !!userTeam;
 
+  // FIX v4.3: Extracted into a reusable function so it can be called
+  // both on mount AND when Supabase fires auth state changes.
+  const refreshAuth = useCallback(async () => {
+    try {
+      const supabase = createClient();
+      const { data: { user }, error } = await supabase.auth.getUser();
+
+      if (error || !user) {
+        setUserEmail(null);
+        setUserRole(null);
+        setUserTeam(null);
+        setLoaded(true);
+        return;
+      }
+
+      setUserEmail(user.email || null);
+
+      try {
+        const { data: profile } = await supabase
+          .from("profiles")
+          .select("role, team_id")
+          .eq("id", user.id)
+          .single();
+        setUserRole(profile?.role || "user");
+        setUserTeam(profile?.team_id || null);
+      } catch {
+        setUserRole("user");
+        setUserTeam(null);
+      }
+    } catch {
+      // Supabase client init error (env vars missing)
+    }
+    setLoaded(true);
+  }, []);
+
   useEffect(() => {
+    // Initial auth check
+    refreshAuth();
+
+    // FIX v4.3: Listen to Supabase onAuthStateChange.
+    // This fires on SIGNED_IN, SIGNED_OUT, TOKEN_REFRESHED, etc.
+    // Without this, Nav never updates after login because the useEffect
+    // only ran once on mount with [] deps.
+    let subscription: { unsubscribe: () => void } | null = null;
     try {
       const supabase = createClient();
-      supabase.auth.getUser().then(async ({ data, error }) => {
-        if (error) {
-          console.error("Auth error:", error);
-          setLoaded(true);
-          return;
+      const { data } = supabase.auth.onAuthStateChange((event) => {
+        // Re-fetch on any auth event
+        if (event === "SIGNED_IN" || event === "SIGNED_OUT" || event === "TOKEN_REFRESHED" || event === "INITIAL_SESSION") {
+          refreshAuth();
         }
-        const user = data.user;
-        setUserEmail(user?.email || null);
-        if (user) {
-          try {
-            const { data: profile } = await supabase
-              .from("profiles")
-              .select("role, team_id")
-              .eq("id", user.id)
-              .single();
-            setUserRole(profile?.role || "user");
-            setUserTeam(profile?.team_id || null);
-          } catch (err) {
-            console.error("Profile error:", err);
-          }
-        }
-        setLoaded(true);
-      }).catch(err => {
-        console.error("Unexpected error:", err);
-        setLoaded(true);
       });
-    } catch (err) {
-      console.error("Supabase client init error:", err);
-      // Fallback for when env variables are not found/configured
-      setLoaded(true);
+      subscription = data.subscription;
+    } catch {
+      // env vars missing
     }
-  }, []);
+
+    return () => {
+      subscription?.unsubscribe();
+    };
+  }, [refreshAuth]);
+
+  // FIX v4.3: Also re-check when pathname changes (covers router.push after login)
+  useEffect(() => {
+    if (loaded) {
+      refreshAuth();
+    }
+  }, [pathname, loaded, refreshAuth]);
 
   async function handleSignOut() {
-    const supabase = createClient();
-    await supabase.auth.signOut();
+    try {
+      const supabase = createClient();
+      await supabase.auth.signOut();
+    } catch {
+      // ignore
+    }
     setUserEmail(null);
     setUserRole(null);
     setUserTeam(null);