Fix terminal auth bootstrap and account checkout gate

frontend/components/dashboard/scan-terminal/__tests__/terminalAuthBootstrap.test.ts

@@ -228,6 +228,46 @@ export async function runTests() {
     "terminal auth bootstrap must not resolve to an anonymous paywall when a bearer session exists but the auth profile request is transiently failing",
   );
 
+  const unresolvedSession = deferred<{ data: { session: { access_token: string } | null } }>();
+  let anonymousResolvedBeforeSession = false;
+  try {
+    const maybeAnonymous = await loadTerminalAuthProfile({
+      hasSupabasePublicEnv: true,
+      getSession: () => unresolvedSession.promise,
+      timeoutMs: 1,
+      loadAuthProfile: (accessToken) => {
+        assert(!accessToken, "cookie-only anonymous probe should not receive a bearer token");
+        return Promise.resolve({
+          authenticated: false,
+          subscription_active: false,
+          points: 0,
+        });
+      },
+    });
+    anonymousResolvedBeforeSession = maybeAnonymous.authenticated === false;
+  } catch {}
+  assert(
+    !anonymousResolvedBeforeSession,
+    "terminal auth bootstrap must not show the signed-out gate while the local Supabase session is still unresolved",
+  );
+
+  const signedOutProfile = await loadTerminalAuthProfile({
+    hasSupabasePublicEnv: true,
+    getSession: () => Promise.resolve({ data: { session: null } }),
+    loadAuthProfile: (accessToken) => {
+      assert(!accessToken, "signed-out profile should be resolved through the cookie probe only");
+      return Promise.resolve({
+        authenticated: false,
+        subscription_active: false,
+        points: 0,
+      });
+    },
+  });
+  assert(
+    signedOutProfile.authenticated === false,
+    "terminal auth bootstrap must still resolve a confirmed signed-out browser as unauthenticated",
+  );
+
   assert(
     isSubscriptionRequiredBackendResponse(
       403,

frontend/components/dashboard/scan-terminal/terminal-auth-bootstrap.ts

@@ -96,6 +96,7 @@ export async function loadTerminalAuthProfile({
     | null = null;
   let latestCookiePayload: TerminalAuthProfilePayload | null = null;
   let latestBearerPayload: TerminalAuthProfilePayload | null = null;
+  let sessionSettled = !hasSupabasePublicEnv;
 
   const authenticatedProfile = new Promise<TerminalAuthProfilePayload>((resolve) => {
     resolveAuthenticated = resolve;
@@ -119,6 +120,7 @@ export async function loadTerminalAuthProfile({
     (async () => {
       if (!hasSupabasePublicEnv) return null;
       const sessionResult = await getSession();
+      sessionSettled = true;
       if (resolvedAuthenticated) return null;
       const accessToken = String(
         sessionResult?.data?.session?.access_token || "",
@@ -142,6 +144,14 @@ export async function loadTerminalAuthProfile({
         resolve(latestBearerPayload);
         return;
       }
+      if (
+        latestCookiePayload?.authenticated === false &&
+        hasSupabasePublicEnv &&
+        !sessionSettled
+      ) {
+        reject(new Error("Terminal auth bootstrap timeout"));
+        return;
+      }
       if (latestCookiePayload) {
         resolve(latestCookiePayload);
         return;