fix(auth): set app_metadata.tenant_id in create_school RPC + refresh session

The create_school RPC now writes app_metadata.tenant_id directly so the
JWT hook has the correct tenant context on the next token refresh. Both
create-school components call refreshSession() after the RPC, ensuring
the browser gets a JWT with tenant_role before redirecting to the subdomain.

This eliminates the dependency on the proxy's tenant sync for new schools.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: guillermoscript

components/tenant/create-school-flow.tsx

@@ -35,6 +35,7 @@ export function CreateSchoolFlow({ user }: CreateSchoolFlowProps) {
   const [step, setStep] = useState<'account' | 'school'>(user ? 'school' : 'account')
   const [loading, setLoading] = useState(false)
   const [error, setError] = useState<string | null>(null)
+  const [emailConfirmationNeeded, setEmailConfirmationNeeded] = useState(false)
   const [signedInEmail, setSignedInEmail] = useState(user?.email || '')
 
   // Account state
@@ -116,7 +117,7 @@ export function CreateSchoolFlow({ user }: CreateSchoolFlowProps) {
     })
 
     if (signInError) {
-      setError('Account created! Please check your email to confirm, then log in.')
+      setEmailConfirmationNeeded(true)
       setLoading(false)
       return
     }
@@ -154,6 +155,10 @@ export function CreateSchoolFlow({ user }: CreateSchoolFlowProps) {
       // Update preferred tenant so the user lands on this school by default
       await supabase.auth.updateUser({ data: { preferred_tenant_id: tenantId } })
 
+      // Refresh session so the JWT picks up the new app_metadata.tenant_id
+      // (set by the create_school RPC) and tenant_role from the hook.
+      await supabase.auth.refreshSession()
+
       toast.success('School created! Setting up your dashboard...')
 
       // Redirect to subdomain onboarding
@@ -205,7 +210,7 @@ export function CreateSchoolFlow({ user }: CreateSchoolFlowProps) {
       )}
 
       {/* Step 1: Account — sign up + sign in */}
-      {step === 'account' && (
+      {step === 'account' && !emailConfirmationNeeded && (
         <Card className="bg-zinc-900 border-zinc-800">
           <CardContent className="pt-6">
             <form onSubmit={handleSignUp} className="space-y-4">
@@ -332,6 +337,45 @@ export function CreateSchoolFlow({ user }: CreateSchoolFlowProps) {
         </Card>
       )}
 
+      {/* Email confirmation needed */}
+      {step === 'account' && emailConfirmationNeeded && (
+        <Card className="bg-zinc-900 border-zinc-800">
+          <CardContent className="pt-6">
+            <div className="flex flex-col items-center text-center space-y-4 py-4">
+              <div className="w-14 h-14 bg-emerald-500/10 rounded-2xl flex items-center justify-center border border-emerald-500/20">
+                <Mail className="w-7 h-7 text-emerald-400" />
+              </div>
+              <div className="space-y-2">
+                <h2 className="text-xl font-semibold text-white">Check your email</h2>
+                <p className="text-sm text-zinc-400">
+                  We sent a confirmation link to{' '}
+                  <span className="text-zinc-200 font-medium">{email}</span>.
+                  <br />
+                  Please verify your email, then log in to continue.
+                </p>
+              </div>
+              <div className="w-full pt-2 space-y-3">
+                <Link href="/auth/login?redirectTo=/create-school">
+                  <Button className="w-full bg-blue-600 hover:bg-blue-500 text-white">
+                    Go to Log in
+                    <ArrowRight className="ml-2 w-4 h-4" />
+                  </Button>
+                </Link>
+                <Button
+                  type="button"
+                  variant="ghost"
+                  onClick={() => { setEmailConfirmationNeeded(false); setError(null) }}
+                  className="w-full text-zinc-500 hover:text-zinc-300"
+                >
+                  <ArrowLeft className="mr-2 w-4 h-4" />
+                  Back to sign up
+                </Button>
+              </div>
+            </div>
+          </CardContent>
+        </Card>
+      )}
+
       {/* Step 2: School — name and URL */}
       {step === 'school' && (
         <Card className="bg-zinc-900 border-zinc-800">

components/tenant/create-school-form.tsx

@@ -58,6 +58,9 @@ export function CreateSchoolForm({ userId }: { userId: string }) {
       data: { preferred_tenant_id: tenantId }
     })
 
+    // Refresh session so the JWT picks up the new tenant_id/tenant_role
+    await supabase.auth.refreshSession()
+
     toast.success('School created successfully!')
 
     // Redirect to subdomain

supabase/migrations/20260405233204_fix_create_school_set_app_metadata.sql

@@ -0,0 +1,51 @@
+-- =============================================================================
+-- Fix create_school RPC to set app_metadata.tenant_id
+--
+-- The JWT hook reads tenant_id from app_metadata to inject tenant_role into
+-- the JWT. Without this, new school creators get stale JWTs (no tenant_id)
+-- and RLS blocks all queries until the proxy syncs it on a subsequent request.
+--
+-- By setting app_metadata.tenant_id in the RPC itself, the very next token
+-- refresh will produce a JWT with the correct tenant_id and tenant_role.
+-- =============================================================================
+
+CREATE OR REPLACE FUNCTION public.create_school(_name text, _slug text)
+RETURNS uuid
+LANGUAGE plpgsql
+SECURITY DEFINER
+SET search_path TO ''
+AS $$
+DECLARE
+  _tenant_id UUID;
+  _user_id UUID;
+BEGIN
+  _user_id := auth.uid();
+
+  IF _user_id IS NULL THEN
+    RAISE EXCEPTION 'Not authenticated';
+  END IF;
+
+  -- Create the tenant
+  INSERT INTO public.tenants (name, slug, status)
+  VALUES (_name, _slug, 'active')
+  RETURNING id INTO _tenant_id;
+
+  -- Add creator as admin of the new tenant
+  INSERT INTO public.tenant_users (tenant_id, user_id, role, status)
+  VALUES (_tenant_id, _user_id, 'admin', 'active');
+
+  -- Set app_metadata.tenant_id so the JWT hook injects correct claims
+  -- on the next token refresh (before the proxy even runs).
+  UPDATE auth.users
+  SET raw_app_meta_data = COALESCE(raw_app_meta_data, '{}'::jsonb)
+    || jsonb_build_object('tenant_id', _tenant_id::text)
+  WHERE id = _user_id;
+
+  RETURN _tenant_id;
+END;
+$$;
+
+-- Only authenticated users can call this
+REVOKE ALL ON FUNCTION public.create_school(text, text) FROM PUBLIC;
+REVOKE ALL ON FUNCTION public.create_school(text, text) FROM anon;
+GRANT EXECUTE ON FUNCTION public.create_school(text, text) TO authenticated;