From 31dec292feb13756ec5aa975a21818d48bff6296 Mon Sep 17 00:00:00 2001
From: Jakob Wennberg <jakob.wennberg@gmail.com>
Date: Mon, 2 Mar 2026 19:12:33 +0100
Subject: [PATCH] fix: CSP blocking hydration and Enable Banking widget, stale
 auth cleanup

- Add 'unsafe-inline' to script-src so Next.js hydration scripts run
- Whitelist *.enablebanking.com in CSP (script, style, connect, img)
- Allow HTTPS images broadly for third-party bank logos
- Clear stale refresh tokens in middleware (skip on /auth callback)
- Fix login button disabled on browser autofill by reading email from form DOM

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---
 app/(auth)/login/page.tsx  | 13 ++++++++++---
 lib/supabase/middleware.ts |  8 ++++++++
 next.config.ts             |  8 ++++----
 3 files changed, 22 insertions(+), 7 deletions(-)

diff --git a/app/(auth)/login/page.tsx b/app/(auth)/login/page.tsx
index 586614f7..1eb9f060 100644
--- a/app/(auth)/login/page.tsx
+++ b/app/(auth)/login/page.tsx
@@ -17,13 +17,17 @@ export default function LoginPage() {
   const { toast } = useToast()
   const supabase = createClient()
 
-  const handleLogin = async (e: React.FormEvent) => {
+  const handleLogin = async (e: React.FormEvent<HTMLFormElement>) => {
     e.preventDefault()
     setIsLoading(true)
 
+    // Read from DOM to handle browser autofill (which may not trigger onChange)
+    const formData = new FormData(e.currentTarget)
+    const emailValue = (formData.get('email') as string) || email
+
     try {
       const { error } = await supabase.auth.signInWithOtp({
-        email,
+        email: emailValue,
         options: {
           emailRedirectTo: `${window.location.origin}/auth/callback`,
         },
@@ -38,6 +42,7 @@ export default function LoginPage() {
         return
       }
 
+      setEmail(emailValue)
       setIsEmailSent(true)
       toast({
         title: 'E-post skickad!',
@@ -101,7 +106,9 @@ export default function LoginPage() {
               <Label htmlFor="email">E-postadress</Label>
               <Input
                 id="email"
+                name="email"
                 type="email"
+                autoComplete="email"
                 placeholder="namn@exempel.se"
                 value={email}
                 onChange={(e) => setEmail(e.target.value)}
@@ -112,7 +119,7 @@ export default function LoginPage() {
             <Button
               type="submit"
               className="w-full"
-              disabled={isLoading || !email}
+              disabled={isLoading}
             >
               {isLoading ? (
                 <>
diff --git a/lib/supabase/middleware.ts b/lib/supabase/middleware.ts
index b1b443c9..fe089b0b 100644
--- a/lib/supabase/middleware.ts
+++ b/lib/supabase/middleware.ts
@@ -35,11 +35,19 @@ export async function updateSession(request: NextRequest) {
 
   const {
     data: { user },
+    error: authError,
   } = await supabase.auth.getUser()
 
   // Get the pathname
   const pathname = request.nextUrl.pathname
 
+  // If the refresh token is stale/invalid, clear the session cookies
+  // so the browser stops sending them on every request.
+  // Skip on auth routes — the callback needs PKCE cookies intact.
+  if (authError && !user && !pathname.startsWith('/auth')) {
+    await supabase.auth.signOut()
+  }
+
   // Auth routes - allow access
   if (pathname.startsWith('/login') || pathname.startsWith('/auth')) {
     // If user is logged in and trying to access login, redirect to dashboard or onboarding
diff --git a/next.config.ts b/next.config.ts
index 0174789a..bb3f7895 100644
--- a/next.config.ts
+++ b/next.config.ts
@@ -7,10 +7,10 @@ const supabaseUrl = process.env.NEXT_PUBLIC_SUPABASE_URL ?? "";
 
 const cspDirectives = [
   "default-src 'self'",
-  `connect-src 'self' ${supabaseUrl} https://*.supabase.co wss://*.supabase.co https://*.ingest.sentry.io`,
-  `style-src 'self' 'unsafe-inline'`,
-  `script-src 'self'${isDev ? " 'unsafe-eval'" : ""}`,
-  "img-src 'self' data: blob:",
+  `connect-src 'self' ${supabaseUrl} https://*.supabase.co wss://*.supabase.co https://*.ingest.sentry.io https://*.enablebanking.com`,
+  `style-src 'self' 'unsafe-inline' https://*.enablebanking.com`,
+  `script-src 'self' 'unsafe-inline'${isDev ? " 'unsafe-eval'" : ""} https://*.enablebanking.com`,
+  "img-src 'self' data: blob: https:",
   "font-src 'self'",
   "frame-ancestors 'none'",
 ].join("; ");