Harden repeated login and auth state handling

[andrew-polk]

Hardens the Firebase → Parse Server login flow so that a repeated or concurrent login no longer logs the user out or nags them with an error dialog.

What changed

• Deduplicate concurrent Parse logins (ParseServerConnection.ts): connectParseServer now returns a single shared in-flight promise keyed by email, so overlapping login attempts for the same user don't fire redundant requests. The tracked promise clears itself on completion.
• Suppress spurious login failures for an already-authenticated user: when a valid Parse session is already active for the same user, a failed repeat login no longer shows the "Oops, something went wrong…" alert (failedToLoginInToParseServer now takes a showAlert flag) and Firebase no longer signs the user out (firebase.ts catch handler early-returns via the new hasActiveParseSession check).
• Strip the session token from the login POST (getHeadersForParseLogin): the X-Parse-Session-Token header is removed from the login requests themselves.
• Fix auth-state subscription/effect leaks:
  • UserMenu.tsx: the firebaseAuthStateChanged effect no longer re-subscribes on every loggedInUser change; it reads the previous user through a ref and depends only on [setCookie].
  • LoggedInUser.ts: useGetLoggedInUser / useGetUserIsModerator now wrap their MobX autorun in useEffect and return the disposer, so the autorun is cleaned up on unmount instead of leaking a new one per render.

Testing

• Typecheck: no new type errors introduced by these files.
• Lint: clean on all changed files.
• Full unit suite: 181 tests passing.

---

This change is 

[greptile-apps]

Greptile Summary

This PR hardens the Firebase → Parse Server login flow across four files, targeting two classes of bugs: redundant/concurrent logins causing spurious sign-outs or error dialogs, and React effect/subscription leaks that caused new subscriptions to accumulate on every render.

• ParseServerConnection.ts: deduplicates concurrent Parse login calls via a module-level in-flight promise keyed by email; strips X-Parse-Session-Token from login POST headers; gates the Sentry report and alert() behind a showAlert flag so benign repeated-login failures are silently swallowed.
• firebase.ts: the Parse-login catch handler now checks for an active session before signing the user out of Firebase, preventing a duplicate-login failure from logging the user out.
• LoggedInUser.ts: wraps autorun in useEffect(…, []) and returns the disposer, fixing a real leak (a new autorun was created on every render) and removing a stale-closure comparison bug in the old condition.
• UserMenu.tsx: moves the previous-user comparison to a useRef so the firebaseAuthStateChanged effect depends only on setCookie (stable), registering the listener once instead of re-subscribing on every loggedInUser state change.

Important Files Changed

Filename	Overview
src/connection/ParseServerConnection.ts	Adds in-flight promise deduplication keyed by email, strips the session token from login POST headers, exports hasActiveParseSession, and gates the Sentry alert on showAlert. Logic is correct, including the finally-based cleanup and the alreadyHadSession snapshot.
src/authentication/firebase/firebase.ts	Adds an early-return guard in the Parse-login catch handler so a repeated login failure doesn't sign the user out of Firebase when an active Parse session for the same email is already established.
src/components/User/UserMenu.tsx	Replaces the stale-closure anti-pattern (loggedInUser in dep array causing re-subscription) with a ref-based previous-value approach; auth state listener is now registered once per mount. The known limitation that firebaseAuthStateChanged doesn't surface an unsubscribe handle is pre-existing.
src/connection/LoggedInUser.ts	Wraps MobX autorun in useEffect with [] and returns the disposer, fixing a real leak where a new autorun was created on every render. Also removes the stale-closure condition that compared LoggedInUser.current to a captured-at-mount user value.

_{Reviews (2): Last reviewed commit: "Suppress spurious Sentry report on benig..." | Re-trigger Greptile}

[andrew-polk]

🤖 Claude Opus 4.8 (automated preflight)

Consulted Devin on 2026-07-17 23:35 UTC up to commit da1d44f6.

Reviewer results for this HEAD:

• Devin: 0 bugs; 1 Investigate flag (the UserMenu auth-state effect — re-subscription / no unsubscribe), mirrored above and assessed as a verified non-issue for this PR; 4 informational items (skipped as low-signal).
• Greptile: passed. Its P2 about a Sentry report on benign repeated logins was fixed in da1d44f6; its P2 about the firebase listener not unsubscribing was assessed as a pre-existing, non-regression limitation. Both threads resolved.
• CI (Build and Deploy): does not run on pull requests in this repo (push-only to master/release/embed), so there are no PR checks to report.
• Local unit suite: 181 tests passing.