fix(#239,#240,#241,#242): close the security-critical auth/payments bug cluster

[TortoiseWolfe]

Summary

Closes the security-critical / money-relevant subset of the Gap-Audit bug cluster: #240, #241, #239, #242. Every one was verified against the real code + live DB before fixing, then re-verified live — no symptom patches, root causes only.

The other six cluster bugs (#243/#247/#248 GDPR trio, #244/#245/#246 messaging reliability) are confirmed and designed but deferred to follow-up PRs.

The four fixes

#240 — Admin dual source of truth (hollow / lingering admins)

Admin status had two authorities that never synced: the user_profiles.is_admin column (client UI gate) vs the JWT app_metadata.is_admin claim (every RLS policy + admin RPC). Flipping the column gave a "hollow admin" (UI yes, data empty); revoking the claim left a "lingering admin" until re-login.

• Column is now the ONE authority. custom_access_token_hook() derives the claim from it at token mint; is_admin() (SECURITY DEFINER) re-reads it live; all 19 admin RLS/RPC guards and the client checkIsAdmin() call is_admin(). UI and data can't disagree, and revocation is immediate (no waiting for token refresh).
• ⚠️ Merge-time step: register custom_access_token_hook as the project's Custom Access Token hook (Dashboard → Auth → Hooks / Management API). is_admin() makes the guards correct even before this is done.

#241 — Auth audit log empty for real activity (3 defects)

1. RLS: the only INSERT policy on auth_audit_logs is service_role, so client logAuthEvent() writes were silently rejected → route them through a SECURITY DEFINER log_auth_event RPC (anti-forgery: caller may only log for itself or anonymously).
2. Vocabulary: writer emitted 'sign_in'+success:false while every stat/detector reads 'sign_in_failed' → SignInForm now emits 'sign_in_success'/'sign_in_failed'.
3. Dead code: the correct-vocab services/auth/audit-logger.ts module was never wired → deleted it + its two duplicate tests; lib/auth/audit-logger.ts is canonical.

#239 — PayPal payments double-counted in revenue

The redirect capture UPDATEs the pending payment_results row (keyed on the ORDER id); the webhook blind-INSERTed a new succeeded row (keyed on the CAPTURE id — a different value) → two succeeded rows per payment.

• paypal-webhook now reconciles onto the existing row by intent_id; a partial unique index (one succeeded row per intent) makes a regression impossible.

#242 — Cancel lets a user start a second subscription before period end

Stripe cancel_at_period_end keeps the sub live at the provider, but our row was set to 'canceled' immediately, dropping it out of the one-live-per-user partial index.

• New 'canceling' status still counts as live; cancel-subscription + the stripe-webhook mapping write it; the terminal customer.subscription.deleted webhook flips it to 'canceled'; resume-subscription handles it. Second sub now correctly rejected.

Verification

All four proven live via DB simulation:

• Admin access is inconsistent depending on how a user was promoted (hollow admins, lingering revoked admins) #240: column true → is_admin() true; flip false → is_admin() false on the same call (immediate revocation).
• Auth audit log is empty for real sign-ins and failed logins #241: log_auth_event writes a sign_in_failed row that admin_auth_stats.failed_this_week counts; anti-forgery guard blocks cross-user logging.
• PayPal payments are double-counted in admin revenue #239: redirect + webhook → exactly ONE succeeded row; a second blind insert is blocked (23505).
• Canceling a subscription lets a user start a second one before the period ends #242: cancel → canceling; a second sub during that window is rejected; resume → active.

Tests: 2 new Vitest (admin-auth-service, audit-logger) + 5 new RLS DB-contract (tests/rls/security-cluster.test.ts). The full 65-test RLS suite still passes — the guard repointing broke nothing. type-check + lint clean; pre-push production build passed.

Schema applied live via the Management API (idempotent, in the monolithic migration). Edge-function redeploy (paypal-webhook, cancel/resume/stripe) is a merge-time step.

🤖 Generated with Claude Code