fix: full-page navigation after login so the session is applied (#365)

[ArnasDon]

Summary

Over an ngrok tunnel, clicking Sign in just refreshed the login page instead of logging in — it worked fine on localhost.

Root cause

The login page signs in client-side, then does a soft navigation into a middleware-gated route:

await supabase.auth.signInWithPassword({ email, password });
router.push("/dashboard");

/dashboard is protected by src/middleware.ts, which redirects to /login unless supabase.auth.getUser() sees the session. A soft router.push can reach the protected route before the server-side layer reliably observes the just-written auth cookies, so the middleware bounces /dashboard → /login — and the page appears to "just refresh."

The repo already knows this pattern: the invite-accept flow in src/app/join/[token]/page.tsx deliberately uses a full reload ("not router.push, so AuthProvider re-fetches"). Login was the lone outlier still using the fragile soft navigation.

Why ngrok and not localhost: environmental. HTTPS + proxy latency widen the timing window, and on Next.js 16 cross-origin dev resources (HMR, the dev overlay) are blocked by default unless the tunnel host is allow-listed.

Changes

• src/app/(auth)/login/page.tsx — navigate with window.location.href after signInWithPassword, mirroring the join flow so the next top-level request carries the fresh cookies to the middleware (removes the now-unused useRouter).
• next.config.ts — add allowedDevOrigins for common dev tunnels (ngrok / cloudflared / localtunnel), extendable via ALLOWED_DEV_ORIGINS, so Next 16 stops returning 403 for dev-only resources over the tunnel.

Testing

• tsc --noEmit ✅
• eslint (changed files) ✅
• vitest run src/middleware.test.ts ✅ (4/4)

A full login-over-ngrok reproduction needs a live Supabase project + an active tunnel, which isn't available in the dev sandbox; the fix rests on the middleware logic, the passing checks, and consistency with the repo's existing full-reload convention.

Closes #365

🤖 Generated with Claude Code

[supabase]

This pull request has been ignored for the connected project crxylxakpapcfziradbb because there are no changes detected in supabase directory. You can change this behaviour in Project Integrations Settings ↗︎.

---

Preview Branches by Supabase.
Learn more about Supabase Branching ↗︎.