feat(auth): harden auth flow, extract context loader, enable local beta whitelist

[scottcarlton]

Summary

• Logout cookie leak — new server-side POST /logout clears the httpOnly active_org_id cookie (the client signOut can't), so the prior user's active org no longer leaks across sessions on a shared browser.
• Auth hook extraction — context loading moved from hooks.server.ts into src/lib/server/auth.ts (loadUserContext/applyUserContext + pure helpers); the hook is now a thin orchestrator. Adds 19 unit tests covering the four identity branches (system-admin / org-member / buyer / onboarding) and SSO enforcement. Semantics preserved.
• SSO auto-join hardening — /auth/callback now gates the domain-based auto-join on an actual SSO session (isSsoSession), so a plain OAuth/magic-link signup whose email domain happens to match an org's SSO provider is no longer auto-joined to that org.
• Per-request perf — positive beta-whitelist results are cached in a short-TTL (60s) in-memory map (warm-instance / Fluid Compute friendly, no new infra), dropping a per-request query. Negatives are never cached and authz context (role/brand-scope) is never cached.
• Beta whitelist (local dev) — BETA_WHITELIST_ENABLED documented in .env.example and allow-listed emails seeded in supabase/seed.sql so local mirrors deployed behavior.
• "Join Beta" → /beta — the marketing nav button and login page now link to /beta unconditionally (was host-gated to beta.threadline.systems, so it fell through to /login everywhere else); the not-whitelisted error also surfaces a /beta link.
• a11y/CSS cleanup — resolved all 14 svelte-check warnings (aria-labels on icon-only buttons, label→span on composite controls, a keyboard-accessible color swatch, removed an empty CSS ruleset). No visual change.

Why

Tightens the auth flow (logout hygiene, SSO auto-join), makes the most security-critical path testable, brings beta-whitelist parity to local dev, and clears accumulated lint/a11y debt on the branch.

Verification

• bun run lint passes (prettier + eslint)
• bun run check passes — 0 errors, 0 warnings
• bun run test:run passes — 742 tests
• Manual browser pass recommended (see test plan)

Test plan

• Sign out from the app → confirm active_org_id cookie is cleared and re-login lands in the right org.
• With BETA_WHITELIST_ENABLED=true, a non-whitelisted email is bounced to /login with the "Join the private beta" link → /beta; a whitelisted email gets in.
• "Join Beta" (marketing nav) and the login-page link both navigate to /beta on localhost.
• SSO-enforced org: genuine SSO login still auto-joins; a non-SSO signup on the same domain goes to /onboarding, not auto-joined.

Notes

• Deliberately not included: swapping getUser() → getClaims() (drops the per-request auth network call but is security-sensitive and depends on JWT signing-key setup) — can follow up if wanted.
• supabase/seed.sql emails are local-only (seed is not applied to deployed envs).

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
threadline	Ready	Preview, Comment	Jun 8, 2026 6:30pm