Auth Role Preservation and Router Re creation Fix 20260416

Auth Role Preservation and Router Re-creation Fix 20260416

Summary

Stabilized user.roles reference in AuthProvider to prevent unnecessary router recreation on periodic token refresh cycles.

The router was being recreated every 3 minutes during silent authentication token refresh because AppRoutes.tsx depends on user?.roles for route selection. However, parseToken was creating a new FamLoginUser object with a new roles array even when role content hadn't changed. The fix preserves the previous roles array reference when role content is structurally equal, preventing false-positive dependency invalidations.

Related Issues

• PH-1: Router re-created on every auth state change

Goals

• Prevent unnecessary router recreation during periodic auth state refreshes
• Eliminate wasteful useMemo invalidations in AppRoutes caused by reference churn
• Maintain reference stability for authentication state without changing public APIs
• Improve session stability and reduce render cycles triggered by non-substantive auth updates

Changes

Structural Changes

• Added preserveRolesReference() helper function in AuthProvider to maintain role reference identity when content is unchanged
• Modified setUser() state update logic to use preserveRolesReference() instead of simple equality check
• Helper co-located with refresh logic for clarity and encapsulation

Performance Improvements

• Prevents unnecessary router re-creation by preserving user.roles reference identity
• Eliminates wasteful useMemo invalidations in AppRoutes that depend on user.roles
• Reduces React render cycles triggered by false-positive auth state changes
• Particularly impactful during periodic silent token refresh (every 3 minutes) for all authenticated sessions

API / Data Flow Changes

• None — public AuthProvider API remains unchanged
• Internal optimization fully contained within provider layer

UI / UX Adjustments

• None — no user-facing changes

Cleanup and Simplification

• None

Bug Fixes

• Fixed issue where router was being recreated unnecessarily on every auth state refresh, even when user roles hadn't changed

Impact

• Improved router stability during periodic auth token refreshes (occurring every 3 minutes)
• Reduced unnecessary re-renders of components depending on router state
• More efficient auth state management without breaking existing API contracts or component dependencies
• Low-risk fix — isolated to auth provider layer with zero surface-area API changes

Follow-up Work

• Monitor auth state refresh cycles in production to confirm router stability improvement
• Consider applying similar reference-preservation patterns to other auth attributes (e.g., privileges) if similar reference-churn issues arise
• Update frontend structure guidelines to document reference-preservation pattern for context providers