fix(auth): break /_account ↔ /_console login redirect loop

Root cause: Console's @object-ui/auth AuthProvider has a Bearer-token
fetch wrapper that pulls auth-session-token from localStorage and
sends it as Authorization on every /api/* call. The Account SPA's
sign-in/sign-out paths use a different client (client-react) that
touches cookies but never touches that localStorage key. After a
user signs out on Account and a new user signs in, Account writes
fresh cookies but localStorage still holds the previous user's
Bearer token. Console then sends the stale Bearer to /get-session,
the server prefers Bearer over Cookie and returns null, AuthProvider
thinks the session is invalid, AuthGuard renders AccountLoginRedirect,
the browser navigates to /_account/login, Account sees a valid cookie
session and bounces back to /_console/home — infinite loop.

Two-layer fix:

1. apps/console/src/lib/auth-preflight.ts (NEW) — before mounting
   <AuthProvider>, probe /get-session with the localStorage Bearer
   alone (no cookie). If the response is unauthenticated, purge the
   stale auth-session-token + auth-active-organization-id keys so
   AuthProvider's first getSession() falls back to the cookie cleanly.

2. apps/account/src/hooks/useSession.ts — mirror cookie session into
   localStorage on every refresh() and clear it on logout(), so the
   keys never go stale in the first place. Also stamp the active org
   id when the user changes orgs.

Net effect: the loop is fixed at the source (Account keeps localStorage
in sync) AND any historical stale state is self-healed on first visit
(Console preflight). Single round-trip cost when token is valid; zero
UI flicker because it runs before React mounts.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: hotlong

apps/account/src/hooks/useSession.ts

@@ -77,6 +77,44 @@ export interface Organization {
 
 const SessionContext = createContext<SessionState | null>(null);
 
+/**
+ * Storage keys used by `@object-ui/auth`'s built-in Bearer fetch wrapper.
+ * The Console SPA mounts an `<AuthProvider>` from that package which reads
+ * `auth-session-token` out of localStorage and injects it as a Bearer header
+ * on every API call. We don't use that AuthProvider here in Account, but we
+ * MUST keep those keys in sync with our cookie session — otherwise a stale
+ * token left by a previous user causes the Console to think the current
+ * cookie session is invalid, bouncing it back to `/_account/login`, which
+ * Account in turn bounces back to the Console (infinite loop).
+ *
+ * On every successful session refresh / login we mirror the server token
+ * into `auth-session-token`; on logout (or when the server reports no
+ * session) we clear both keys.
+ */
+const OBJECT_UI_AUTH_TOKEN_KEY = 'auth-session-token';
+const OBJECT_UI_AUTH_ACTIVE_ORG_KEY = 'auth-active-organization-id';
+
+function syncObjectUiAuthStorage(session: SessionData | null): void {
+  if (typeof window === 'undefined') return;
+  try {
+    if (session?.token) {
+      localStorage.setItem(OBJECT_UI_AUTH_TOKEN_KEY, session.token);
+    } else {
+      localStorage.removeItem(OBJECT_UI_AUTH_TOKEN_KEY);
+    }
+    if (session?.activeOrganizationId) {
+      localStorage.setItem(
+        OBJECT_UI_AUTH_ACTIVE_ORG_KEY,
+        session.activeOrganizationId,
+      );
+    } else {
+      localStorage.removeItem(OBJECT_UI_AUTH_ACTIVE_ORG_KEY);
+    }
+  } catch {
+    /* localStorage unavailable (Safari private, SSR, etc.) — ignore */
+  }
+}
+
 /**
  * Normalise the better-auth `/get-session` response shape. Depending on the
  * version, the body is either `{ user, session }` directly or wrapped in
@@ -125,10 +163,15 @@ export function SessionProvider({ children }: { children: ReactNode }) {
       const { user: u, session: s } = normaliseSessionResponse(raw);
       setUser(u);
       setSession(s);
+      // Mirror cookie session → localStorage so `@object-ui/auth`'s
+      // Bearer-based AuthProvider (used by Console) doesn't see a stale
+      // token from a previous user.
+      syncObjectUiAuthStorage(u ? s : null);
     } catch (err) {
       setError(err as Error);
       setUser(null);
       setSession(null);
+      syncObjectUiAuthStorage(null);
     } finally {
       setLoading(false);
     }
@@ -156,6 +199,9 @@ export function SessionProvider({ children }: { children: ReactNode }) {
       setSession(null);
       setOrganizations([]);
       setOrganizationsFetched(false);
+      // Clear `@object-ui/auth`'s localStorage so the Console SPA doesn't
+      // carry a Bearer token across the sign-out boundary.
+      syncObjectUiAuthStorage(null);
     }
   }, [client]);
 
@@ -164,6 +210,14 @@ export function SessionProvider({ children }: { children: ReactNode }) {
       if (!client?.organizations) return;
       await client.organizations.setActive(organizationId);
       await refresh();
+      // `refresh()` already syncs storage with the new session's active
+      // org; this is just belt-and-braces in case `client.auth.me()` is
+      // momentarily stale.
+      try {
+        localStorage.setItem(OBJECT_UI_AUTH_ACTIVE_ORG_KEY, organizationId);
+      } catch {
+        /* ignore */
+      }
     },
     [client, refresh],
   );

apps/console/src/lib/auth-preflight.ts

@@ -0,0 +1,84 @@
+// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.
+
+/**
+ * Auth preflight — validate any stale Bearer token sitting in localStorage
+ * BEFORE `<AuthProvider>` mounts.
+ *
+ * # Why this exists
+ *
+ * `@object-ui/auth`'s `createAuthClient` wraps fetch in `createBearerFetch`,
+ * which injects `Authorization: Bearer <token>` from
+ * `localStorage['auth-session-token']` on every `/api/*` request.
+ *
+ * The Account SPA (`/_account/*`) uses a separate auth code path
+ * (`useClient().auth.login/logout` from `@objectstack/client-react`) that
+ * touches cookies but NOT this localStorage key. So when a user:
+ *
+ *   1. signs in on Account (cookie set, localStorage untouched), then
+ *   2. signs out on Account (cookie cleared, localStorage still has the old
+ *      token from a previous Console visit), then
+ *   3. signs in again as a different user, then
+ *   4. visits `/_console/home`
+ *
+ * the Console's AuthProvider sends the **stale Bearer** to `get-session`,
+ * the server prefers Bearer over cookie, returns null, AuthProvider thinks
+ * the user is unauthenticated, AuthGuard renders `<AccountLoginRedirect>`,
+ * which sends the browser back to `/_account/login` — but Account sees a
+ * valid cookie and bounces straight back to `/_console/home`.
+ *
+ *                        ╔════════════════╗
+ *                        ║  LOGIN LOOP    ║
+ *                        ╚════════════════╝
+ *
+ * # What this does
+ *
+ * Run BEFORE React renders. If `auth-session-token` is present, probe
+ * `/api/v1/auth/get-session` with that Bearer (and no cookie). If the
+ * response is not authenticated, delete the stale token + the stale
+ * `auth-active-organization-id` so AuthProvider's first `getSession()`
+ * falls back to cookie auth cleanly.
+ *
+ * Idempotent, runs once per page load, < 50 ms when the token is valid
+ * (single round-trip), no UI flicker (happens before render).
+ */
+
+const TOKEN_KEY = 'auth-session-token';
+const ACTIVE_ORG_KEY = 'auth-active-organization-id';
+
+export async function preflightAuth(authBaseUrl: string): Promise<void> {
+  if (typeof window === 'undefined') return;
+  let token: string | null = null;
+  try {
+    token = localStorage.getItem(TOKEN_KEY);
+  } catch {
+    return;
+  }
+  if (!token) return;
+
+  try {
+    const res = await fetch(`${authBaseUrl}/get-session`, {
+      method: 'GET',
+      // Send ONLY the Bearer (no cookie) — we want to know if the token
+      // alone is valid. If we sent the cookie too the server might accept
+      // the cookie and we wouldn't detect a stale token.
+      credentials: 'omit',
+      headers: {
+        Authorization: `Bearer ${token}`,
+        Accept: 'application/json',
+      },
+    });
+
+    if (res.ok) {
+      const body = await res.json().catch(() => null);
+      const user = body?.user ?? body?.data?.user ?? null;
+      if (user) return; // token valid — leave localStorage alone
+    }
+
+    // 401, 4xx, or 200-with-null — token is stale. Purge.
+    localStorage.removeItem(TOKEN_KEY);
+    localStorage.removeItem(ACTIVE_ORG_KEY);
+  } catch {
+    // Network error: assume token might still be good; don't punish the
+    // user by clearing it. Worst case AuthProvider will detect it next.
+  }
+}

apps/console/src/main.tsx

@@ -22,11 +22,22 @@ import '@object-ui/plugin-map';
 import './index.css';
 import { App } from './App';
 import { loadLanguage } from './loadLanguage';
+import { preflightAuth } from './lib/auth-preflight';
 
-ReactDOM.createRoot(document.getElementById('root')!).render(
-  <React.StrictMode>
-    <I18nProvider loadLanguage={loadLanguage}>
-      <App />
-    </I18nProvider>
-  </React.StrictMode>,
-);
+const AUTH_URL = `${import.meta.env.VITE_SERVER_URL || ''}/api/v1/auth`;
+
+// Drop any stale Bearer token in localStorage BEFORE React mounts.
+// Without this, a token left by a previous user (or by sign-out via the
+// Account SPA, which doesn't touch this localStorage key) would cause
+// AuthProvider's first `get-session` to be rejected by the server, even
+// though the current cookie session is valid — producing an infinite
+// /_account/login ↔ /_console/home bounce. See auth-preflight.ts.
+preflightAuth(AUTH_URL).finally(() => {
+  ReactDOM.createRoot(document.getElementById('root')!).render(
+    <React.StrictMode>
+      <I18nProvider loadLanguage={loadLanguage}>
+        <App />
+      </I18nProvider>
+    </React.StrictMode>,
+  );
+});