perf(layout): dashboard layout in two waves, nav flags as one RPC, local JWT verification (#1946)

The dashboard layout runs on every hard load, hard refresh, company switch and the 16 router.refresh() sites, and loading.tsx cannot paint until it resolves. It cost ~20 network calls in 4 sequential waves: a third getUser() round trip to Supabase Auth (after the proxy's and the route guard's), the company resolution, then 16 reads including four limit-1 probes whose only job is to decide whether to render the Webshop and Körjournal nav rows, and an entitlements read that itself ran two waves. - lib/auth/claims.ts: claimsPinned/userFromClaims extracted from require-auth.ts (unchanged) so the dashboard request context shares the exact pinning + mapping. getDashboardAuthContext verifies the JWT locally and falls back to getUser() only when claims are missing, unpinned or unverifiable: the proxy already performed the per-request revocation check before the layout runs (same semantics approved for routes on 2026-07-23). - Wave 1 (user-keyed, parallel with the company resolution): team membership, profile, user preferences and the memberships join, which now also supplies the active company's row and role, so the separate companies and company_members reads are gone. - Wave 2 (company-keyed): settings, agent profile, the switcher's settings names, entitlements in ONE wave (getCompanyEntitlements takes the team_id the join already carries and runs the grants read alongside config + subscription), and get_dashboard_nav_flags(). - supabase/migrations/20260826120000_get_dashboard_nav_flags.sql: SECURITY INVOKER, STABLE, EXECUTE for authenticated only; RLS applies inside. lib/dashboard/nav-flags.ts wraps it with the pre-RPC four-probe fallback on PGRST202/42883/42501 (self-hosted not yet migrated, deploy ordering) and degrades to hidden rows on any other error. - tests/pg/dashboard-nav-flags-rpc.pg.test.ts (6): fresh company, active vs pending WooCommerce, active Shopify, mileage trips, RLS for a member of another company, EXECUTE grants. Unit tests for the wrapper (RPC row, single-object payload, each fallback code, other errors) and for the entitlements teamId option. ~20 calls / 4 waves -> ~12 calls / 2 waves, 0 auth network calls. Co-authored-by: Jakob Wennberg <311770904+jakobwennberg-oss@users.noreply.github.com> Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
2026-08-26 15:14:49 +02:00
parent 1a41119682
commit 4ac7b45c8a
11 changed files with 433 additions and 109 deletions
@@ -244,6 +244,30 @@ describe('getCompanyEntitlements', () => {
    expect(result.trialExpiredAt).toBeNull()
  })

+  it('skips the companies lookup and still scopes grants to the team when teamId is supplied', async () => {
+    const teamId = '22222222-2222-4222-8222-222222222222'
+    const base = makeSupabase({
+      // Deliberately wrong: if the lookup ran, the team scope would be lost.
+      companies: { data: { team_id: null } },
+      capability_grants: {
+        data: [{ capability_key: CAPABILITY.ai, expires_at: null, source: 'stripe' }],
+      },
+      company_capability_config: { data: [] },
+    })
+    const tables: string[] = []
+    const supabase = {
+      from: (table: string) => {
+        tables.push(table)
+        return (base.from as (t: string) => unknown)(table)
+      },
+    } as unknown as SupabaseClient
+    const result = await getCompanyEntitlements(supabase, companyId, { teamId })
+    expect(result.capabilities).toContain(CAPABILITY.ai)
+    expect(result.entitlementState).toBe('paid')
+    expect(tables).not.toContain('companies')
+    expect(tables).toContain('capability_grants')
+  })
+
  it('hides the trial once a non-trial grant is active (converted customer)', async () => {
    const supabase = makeSupabase({
      companies: { data: { team_id: null } },
@@ -321,9 +321,36 @@ const PAYING_SUBSCRIPTION_STATUSES = ['active', 'trialing', 'past_due']
 * CompanyContext so the UI can hide/disable/upsell gated features.
 * Self-hosted holds everything.
 */
+function normalizeTeamId(raw: string | null | undefined): string | null {
+  return raw && isUuid(raw) ? raw : null
+}
+
+function readGrants(supabase: SupabaseClient, companyId: string, teamId: string | null) {
+  const scopeFilter = teamId
+    ? `company_id.eq.${companyId},team_id.eq.${teamId}`
+    : `company_id.eq.${companyId}`
+  return supabase
+    .from('capability_grants')
+    .select('capability_key, expires_at, source')
+    .in('capability_key', PAID_CAPABILITIES as unknown as string[])
+    .or(scopeFilter)
+}
+
+export interface GetCompanyEntitlementsOptions {
+  /**
+   * The company's team_id when the caller already has it (the dashboard
+   * layout reads it off the membership join): skips the companies lookup and
+   * lets the grants read run in the same wave as the other two, one round
+   * trip instead of two on the layout's critical path. Pass null for a
+   * company without a team.
+   */
+  teamId?: string | null
+}
+
 export async function getCompanyEntitlements(
  supabase: SupabaseClient,
  companyId: string,
+  options: GetCompanyEntitlementsOptions = {},
 ): Promise<CompanyEntitlements> {
  if (isPaywallBypassed()) {
    return {
@@ -345,8 +372,11 @@ export async function getCompanyEntitlements(
  // per RLS) distinguishes a churned payer from an expired trial: cancelled
  // subscriptions have their stripe grants deleted, so the grants alone
  // cannot tell the two apart.
-  const [{ data: company }, { data: configs }, { data: subscription }] = await Promise.all([
-    supabase.from('companies').select('team_id').eq('id', companyId).maybeSingle(),
+  const knownTeam = options.teamId !== undefined
+  const [{ data: company }, { data: configs }, { data: subscription }, earlyGrants] = await Promise.all([
+    knownTeam
+      ? Promise.resolve({ data: { team_id: options.teamId } })
+      : supabase.from('companies').select('team_id').eq('id', companyId).maybeSingle(),
    supabase
      .from('company_capability_config')
      .select('capability_key, enabled')
@@ -357,18 +387,12 @@ export async function getCompanyEntitlements(
      .select('status')
      .eq('company_id', companyId)
      .maybeSingle(),
+    // With the team known up front the grants read joins this wave.
+    knownTeam ? readGrants(supabase, companyId, normalizeTeamId(options.teamId)) : Promise.resolve(null),
  ])
-  const rawTeamId = (company as { team_id: string | null } | null)?.team_id ?? null
-  const teamId = rawTeamId && isUuid(rawTeamId) ? rawTeamId : null
+  const teamId = normalizeTeamId((company as { team_id: string | null } | null)?.team_id ?? null)

-  const scopeFilter = teamId
-    ? `company_id.eq.${companyId},team_id.eq.${teamId}`
-    : `company_id.eq.${companyId}`
-  const { data: grants } = await supabase
-    .from('capability_grants')
-    .select('capability_key, expires_at, source')
-    .in('capability_key', PAID_CAPABILITIES as unknown as string[])
-    .or(scopeFilter)
+  const { data: grants } = earlyGrants ?? (await readGrants(supabase, companyId, teamId))

  const now = Date.now()
  const entitled = new Set<string>()