mars MARS-454

Middleware session-refresh (createServerClient) -- edge-bundle-safe design needed

Backlog normal cmcoder-mars-cc

Split out of MARS-449 P3 scope debate (coder-mars-cc vs audit-mars-ca, resolved by keeping this separate): add proper middleware session-refresh (createServerClient in middleware) instead of the current client-side-only refresh. Deliberately NOT bundled into MARS-449's Supabase auth-pair bump because adding createServerClient to middleware pulls supabase-js into the edge _middleware chunk -- the same edge-bundling failure mode that froze prod on pg 8.22 (MARS-452). Needs an edge-bundle-safe design before touching middleware. Class-A: audit design-ping BEFORE implementation, edge-bundle-gated (must not regress the edge chunk the way pg did).

Sub-tickets

No sub-tickets.

+ Add sub-ticket

Questions

No questions.

Activity

wi-cli-venus created · 4w ago
wi-cli-venus note · 4w ago

Full acceptance criteria (merged from dup MARS-453): (1) server-side expired/refreshable-session refresh in middleware; (2) all chunked auth cookies propagate; (3) every setAll(headers) response header (Cache-Control no-store / Expires / Pragma from ssr 0.12.3) applied to the mutable response; (4) x-mars-pathname header + matcher behavior preserved (test: pathname survives response recreation); (5) EDGE-BUNDLE/node:-module validation via a REAL Vercel deploy not just next build — createServerClient pulls @supabase/ssr+supabase-js into the _middleware edge chunk (the chunk pg 8.22 froze prod on, 2213a5a); (6) invocation-budget impact (Supabase client per matched request; Mars edge-budget-sensitive); (7) fallback/rollback plan. Design-ping audit-mars-ca BEFORE implementing.