Debug auth — 401 on protected routes
Goal: Trace why signed-in users get 401 on API routes after a middleware change.
Cost: ~6 requests
- 1get_project_context
topic auth — summarize auth method, session storage, and middleware entry points
→ Auth stack snapshot: Next.js middleware, JWT in cookie, Supabase client
- 2explain_architecture
focus auth — trace request from middleware to session validation
→ Sequence diagram: middleware → validateSession → API handler
- 3find_code
intent symbol, query "validateSession"
→ Definition in src/lib/auth.ts:42 plus 8 usages
- 4read_code
mode symbol, target "validateSession"
→ Full function body — missing null check on expired token
- 5keep_thinking
Hypothesis: middleware runs before cookie refresh. Rule out CORS, then check refresh timing.
→ Structured reasoning — next file: src/middleware.ts
- 6read_code
mode outline, files ["src/middleware.ts"]
→ TOC shows refreshToken call missing before validateSession