perf(layout): dashboard layout in two waves, nav flags as one RPC, local JWT verification (#1946)

The dashboard layout runs on every hard load, hard refresh, company switch
and the 16 router.refresh() sites, and loading.tsx cannot paint until it
resolves. It cost ~20 network calls in 4 sequential waves: a third
getUser() round trip to Supabase Auth (after the proxy's and the route
guard's), the company resolution, then 16 reads including four limit-1
probes whose only job is to decide whether to render the Webshop and
Körjournal nav rows, and an entitlements read that itself ran two waves.

- lib/auth/claims.ts: claimsPinned/userFromClaims extracted from
  require-auth.ts (unchanged) so the dashboard request context shares the
  exact pinning + mapping. getDashboardAuthContext verifies the JWT locally
  and falls back to getUser() only when claims are missing, unpinned or
  unverifiable: the proxy already performed the per-request revocation
  check before the layout runs (same semantics approved for routes on
  2026-07-23).
- Wave 1 (user-keyed, parallel with the company resolution): team
  membership, profile, user preferences and the memberships join, which
  now also supplies the active company's row and role, so the separate
  companies and company_members reads are gone.
- Wave 2 (company-keyed): settings, agent profile, the switcher's settings
  names, entitlements in ONE wave (getCompanyEntitlements takes the
  team_id the join already carries and runs the grants read alongside
  config + subscription), and get_dashboard_nav_flags().
- supabase/migrations/20260826120000_get_dashboard_nav_flags.sql:
  SECURITY INVOKER, STABLE, EXECUTE for authenticated only; RLS applies
  inside. lib/dashboard/nav-flags.ts wraps it with the pre-RPC four-probe
  fallback on PGRST202/42883/42501 (self-hosted not yet migrated, deploy
  ordering) and degrades to hidden rows on any other error.
- tests/pg/dashboard-nav-flags-rpc.pg.test.ts (6): fresh company, active vs
  pending WooCommerce, active Shopify, mileage trips, RLS for a member of
  another company, EXECUTE grants. Unit tests for the wrapper (RPC row,
  single-object payload, each fallback code, other errors) and for the
  entitlements teamId option.

~20 calls / 4 waves -> ~12 calls / 2 waves, 0 auth network calls.

Co-authored-by: Jakob Wennberg <311770904+jakobwennberg-oss@users.noreply.github.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

lib/dashboard/__tests__/nav-flags.test.ts

@@ -0,0 +1,54 @@
+import { describe, it, expect, vi } from 'vitest'
+import type { SupabaseClient } from '@supabase/supabase-js'
+import { getDashboardNavFlags } from '../nav-flags'
+
+function makeSupabase(
+  rpcResult: { data?: unknown; error?: { code?: string; message?: string } | null },
+  probes: Record<string, unknown[]> = {},
+) {
+  const from = vi.fn((table: string) => {
+    const chain: Record<string, unknown> = {}
+    const self: unknown = new Proxy(chain, {
+      get: (_t, prop) => {
+        if (prop === 'then') {
+          return (resolve: (v: unknown) => void) => resolve({ data: probes[table] ?? [], error: null })
+        }
+        return () => self
+      },
+    })
+    return self
+  })
+  const rpc = vi.fn(async () => ({ data: rpcResult.data ?? null, error: rpcResult.error ?? null }))
+  return { supabase: { from, rpc } as unknown as SupabaseClient, from, rpc }
+}
+
+describe('getDashboardNavFlags', () => {
+  it('reads both flags from the RPC row and never touches the tables', async () => {
+    const { supabase, from, rpc } = makeSupabase({ data: [{ has_webshop: true, has_mileage_trips: false }] })
+    expect(await getDashboardNavFlags(supabase, 'c1')).toEqual({ hasWebshop: true, hasMileageTrips: false })
+    expect(rpc).toHaveBeenCalledWith('get_dashboard_nav_flags', { p_company_id: 'c1' })
+    expect(from).not.toHaveBeenCalled()
+  })
+
+  it('accepts a single-object payload and treats null flags as false', async () => {
+    const { supabase } = makeSupabase({ data: { has_webshop: null, has_mileage_trips: true } })
+    expect(await getDashboardNavFlags(supabase, 'c1')).toEqual({ hasWebshop: false, hasMileageTrips: true })
+  })
+
+  it.each(['PGRST202', '42883', '42501'])('falls back to the four probes when the RPC is unavailable (%s)', async (code) => {
+    const { supabase, from } = makeSupabase({ error: { code } }, { webshop_orders: [{ id: 'o1' }] })
+    expect(await getDashboardNavFlags(supabase, 'c1')).toEqual({ hasWebshop: true, hasMileageTrips: false })
+    expect(from.mock.calls.map((c) => c[0]).sort()).toEqual([
+      'mileage_trips',
+      'shopify_connections',
+      'webshop_orders',
+      'woocommerce_connections',
+    ])
+  })
+
+  it('degrades to hidden rows on any other error instead of probing', async () => {
+    const { supabase, from } = makeSupabase({ error: { code: '57014', message: 'timeout' } })
+    expect(await getDashboardNavFlags(supabase, 'c1')).toEqual({ hasWebshop: false, hasMileageTrips: false })
+    expect(from).not.toHaveBeenCalled()
+  })
+})

lib/dashboard/nav-flags.ts

@@ -0,0 +1,60 @@
+import type { SupabaseClient } from '@supabase/supabase-js'
+
+export interface DashboardNavFlags {
+  /** An active WooCommerce/Shopify connection or already-imported webshop orders. */
+  hasWebshop: boolean
+  /** Existing mileage trips (created via UI, API or MCP). */
+  hasMileageTrips: boolean
+}
+
+const FALLBACK_CODES = new Set(['PGRST202', '42883', '42501'])
+
+/**
+ * The two booleans that gate the Webshop and Körjournal nav rows, in one
+ * round trip via get_dashboard_nav_flags() (migration 20260826120000).
+ *
+ * Fallback to the four limit-1 probes the layout ran before the RPC when
+ * the function is not deployed yet (self-hosted instance not migrated, or
+ * the deploy-ordering window before the branching merge applies the
+ * migration) or EXECUTE is not granted: mirrors the load-bearing fallback
+ * in lib/company/context.ts. Any other error degrades to (false, false):
+ * these flags only hide nav rows, they are never load-bearing.
+ */
+export async function getDashboardNavFlags(
+  supabase: SupabaseClient,
+  companyId: string,
+): Promise<DashboardNavFlags> {
+  const rpc = await supabase.rpc('get_dashboard_nav_flags', { p_company_id: companyId })
+  if (!rpc.error) {
+    const row = (Array.isArray(rpc.data) ? rpc.data[0] : rpc.data) as
+      | { has_webshop?: boolean | null; has_mileage_trips?: boolean | null }
+      | null
+      | undefined
+    return {
+      hasWebshop: row?.has_webshop === true,
+      hasMileageTrips: row?.has_mileage_trips === true,
+    }
+  }
+  if (!FALLBACK_CODES.has(rpc.error.code ?? '')) {
+    return { hasWebshop: false, hasMileageTrips: false }
+  }
+  return getDashboardNavFlagsViaProbes(supabase, companyId)
+}
+
+/** The pre-RPC implementation, kept verbatim as the fallback. */
+export async function getDashboardNavFlagsViaProbes(
+  supabase: SupabaseClient,
+  companyId: string,
+): Promise<DashboardNavFlags> {
+  const [woo, shopify, orders, trips] = await Promise.all([
+    supabase.from('woocommerce_connections').select('id').eq('company_id', companyId).eq('status', 'active').limit(1),
+    supabase.from('shopify_connections').select('id').eq('company_id', companyId).eq('status', 'active').limit(1),
+    supabase.from('webshop_orders').select('id').eq('company_id', companyId).limit(1),
+    supabase.from('mileage_trips').select('id').eq('company_id', companyId).limit(1),
+  ])
+  return {
+    hasWebshop:
+      (woo.data?.length ?? 0) > 0 || (shopify.data?.length ?? 0) > 0 || (orders.data?.length ?? 0) > 0,
+    hasMileageTrips: (trips.data?.length ?? 0) > 0,
+  }
+}