fix(auth): clear stale cookies on refresh token failure to stop infinite retry loop

When a user visits the login page with an expired/revoked refresh token,
the browser Supabase client retries token refresh endlessly (400 → 429).

Two fixes:
- middleware updateSession(): properly detect getUser() auth errors (returned,
  not thrown) and clear all sb-* cookies via Set-Cookie maxAge=0
- proxy.ts: use getSetCookie() instead of get('set-cookie') to copy ALL
  Set-Cookie headers to the response (was only copying the first one,
  losing cookie-clearing headers for chunked auth tokens)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: guillermoscript

lib/supabase/proxy.ts

@@ -45,7 +45,7 @@ export async function updateSession(request: NextRequest): Promise<{ response: N
   )
 
   // Do not run code between createServerClient and
-  // supabase.auth.getClaims(). A simple mistake could make it very hard to debug
+  // supabase.auth.getUser(). A simple mistake could make it very hard to debug
   // issues with users being randomly logged out.
 
   // IMPORTANT: Only call getUser() when auth cookies exist.
@@ -58,19 +58,25 @@ export async function updateSession(request: NextRequest): Promise<{ response: N
     return { response: supabaseResponse, user: null }
   }
 
-  try {
-    const { data } = await supabase.auth.getUser()
-    user = data.user
-  } catch (e: any) {
-    // If refresh token is invalid/expired, clear auth cookies so we stop retrying
-    if (e?.code === 'refresh_token_not_found' || e?.message?.includes('Refresh Token Not Found')) {
-      const cookieNames = request.cookies.getAll()
-        .map(c => c.name)
-        .filter(name => name.startsWith('sb-'))
-      for (const name of cookieNames) {
-        request.cookies.delete(name)
-        supabaseResponse.cookies.delete(name)
-      }
+  const { data, error } = await supabase.auth.getUser()
+  user = data.user
+
+  // When the refresh token is invalid/expired, getUser() returns an error with no user.
+  // The @supabase/ssr setAll callback may have already fired with the failed session,
+  // but we need to explicitly clear all sb-* cookies from the response so the browser
+  // deletes them. Without this, the browser's Supabase client will see stale cookies
+  // and start an infinite refresh_token retry loop (400 → 429 → 400...).
+  if (error && !user) {
+    // Clear cookies from both the request (for downstream server components)
+    // and the response (for the browser via Set-Cookie headers).
+    const sbCookies = request.cookies.getAll().filter(c => c.name.startsWith('sb-'))
+    for (const { name } of sbCookies) {
+      request.cookies.delete(name)
+      supabaseResponse.cookies.set(name, '', {
+        maxAge: 0,
+        path: '/',
+        ...(cookieDomain ? { domain: cookieDomain } : {}),
+      })
     }
   }
 

proxy.ts

@@ -278,9 +278,13 @@ export default async function proxy(request: NextRequest) {
       return NextResponse.redirect(dashboardUrl)
     }
 
-    const supabaseCookies = supabaseResponse.headers.get('set-cookie')
-    if (supabaseCookies) {
-      intlResponse.headers.set('set-cookie', supabaseCookies)
+    // Copy ALL Set-Cookie headers from supabaseResponse to intlResponse.
+    // headers.get('set-cookie') only returns the first header — use getSetCookie()
+    // to get all of them. This is critical when clearing multiple sb-* cookies
+    // (e.g., auth token + chunked tokens) to stop the client-side refresh loop.
+    const setCookieHeaders = supabaseResponse.headers.getSetCookie()
+    for (const cookie of setCookieHeaders) {
+      intlResponse.headers.append('set-cookie', cookie)
     }
     return intlResponse
   }