fix(auth): eliminate redirect loops in ensureAuthBootstrapped

[Copilot]

The redirectUserGuard was never consumed after firing, so every subsequent null event from onAuthStateChanged would re-push the redirect snapshot — causing bounce loops back to the sign-in screen. Additionally, the previous onAuthStateChanged listener was never unsubscribed before attaching a new one, allowing accumulation across HMR reloads and test teardown/retry cycles.

Changes

• One-shot guard consumption — guard state (redirectUserGuard, redirectUserSnapshot, redirectUserGuardSetAt) is cleared atomically on first use, so future null events propagate naturally instead of re-triggering the snapshot path
• Time-bound TTL — REDIRECT_GUARD_TTL_MS = 10_000 as a belt-and-suspenders cutoff; the guard cannot fire after 10 s regardless of one-shot logic
• Listener cleanup before re-attach — unsubscribeOngoing?.() is called before every onAuthStateChanged call, preventing listener accumulation on HMR / teardown+retry runs
• Unconditional guard clear in normal path — previously only cleared when signedInUser was truthy; now cleared unconditionally so stale/expired guard state can never linger
• redirectUserGuardSetAt propagated to resets — clearRedirectAuthGuard and teardownAuthBootstrapForTests both reset the new timestamp field

if (!signedInUser && redirectUserGuard && redirectUserSnapshot && guardAge < REDIRECT_GUARD_TTL_MS) {
  // Consume the guard immediately — do not re-trigger on future null events.
  const snapshot = redirectUserSnapshot;
  redirectUserGuard = false;
  redirectUserSnapshot = null;
  redirectUserGuardSetAt = null;
  notifyUserListeners(snapshot);
  // ...resolve promise
  return;
}

// Normal path: clear any stale guard state unconditionally.
redirectUserGuard = false;
redirectUserSnapshot = null;
redirectUserGuardSetAt = null;

The persistence → getRedirectResult → onAuthStateChanged ordering is preserved.

Original prompt

Improve ensureAuthBootstrapped in vessel/src/lib/authBootstrap.ts to eliminate remaining redirect loops.

Current problems:

• onAuthStateChanged listener is never unsubscribed in production (only in tests)
• redirectUserGuard can stay active and cause repeated null → snapshot pushes
• Multiple bootstrap calls or HMR can accumulate listeners
• Race conditions between resolveFirebaseRedirectResult and the listener still cause bouncing to sign-in screen

Desired behavior:

• Always clean up previous onAuthStateChanged listener before setting a new one
• Make the redirect guard time-bound or more strictly one-shot
• Ensure the bootstrap promise only resolves once
• Keep the existing persistence → getRedirectResult → listener ordering
• Clear sessionStorage redirect pending flag reliably
• Add clear comments explaining the guard logic

Implement a cleaner, more defensive version of ensureAuthBootstrapped and related functions while preserving the overall architecture.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
shipyard	Ready	Preview, Comment	Jun 28, 2026 4:28pm

[sonarqubecloud]

Quality Gate passed

Issues
2 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud