Reduce workspace query waterfalls and bound related reads

PERFORMANCE.md

@@ -24,3 +24,14 @@ Changes reduce repeated profile reads after mutations, avoid writes on ordinary
 The frontend keeps bounded, account-keyed summary snapshots in tab session storage for at most five minutes. Reloads display them while revalidating. Full analysis payloads are excluded; logout/account changes clear the cache. Server authorization remains required for every API request.
 
 Remaining scaling work should follow production measurements: paginate large rosters and session lists, aggregate ratings in the database, and evaluate backend/database region placement. No production infrastructure or database changes were made here.
+
+
+## 2026-10-21 follow-up
+
+Active subscription and billing reads now embed the plan in the assignment query. Login profile synchronization skips writes for an unchanged email. Roster player/session reads start concurrently, action ratings join their actions, and Sessions embeds its optional player. Roster, detail and session list reads use stable ordered 500-row pages; action reads use batches of 100 session IDs with at most four batches in flight and paginate inside each batch. Authorization filters remain on every scoped parent read. No completed auth/role decisions are cached.
+
+For small, non-admin, nonempty datasets, cold `/auth/me` uses three upstream calls rather than four; unchanged-profile login uses four rather than six. Players overview drops from six dependent stages to four; Sessions saves one total call while preserving its existing four-stage dependency depth. Large datasets require more pages. These are code-derived counts, not measured production latency. The new `workspace-performance.test.ts` runs the actual Express API against a local fake Supabase server and checks scopes, role changes, revocation, scores, billing and failures. `read-pages.test.ts` covers row-cap boundaries and failures.
+
+The join shapes were verified read-only against the configured database. See [Supabase joins and nesting](https://supabase.com/docs/guides/database/joins-and-nesting) and [range pagination](https://supabase.com/docs/reference/javascript/range). The normal Supabase row cap must be at least the 500-row page size. No schema/dependency changes are needed. Full client-facing lists and squad aggregation remain scaling work. The root repository's `PERFORMANCE.md` records the broader audit and frontend bundle measurements.
+
+Admin related counts now page and batch children of the displayed records. The admin Players page no longer scans unrelated sessions. Existing directory result caps remain; replacing them with full UI pagination remains follow-up work. Integration tests cover the three admin read endpoints as well.

src/admin.ts

@@ -1,3 +1,5 @@
+import { readBatches } from "./read-batches.js";
+import { readPages } from "./read-pages.js";
 import type { Express, Request, Response, NextFunction } from "express";
 import { z } from "zod";
 import { env } from "./config.js";
@@ -56,6 +58,18 @@ async function removeImages(paths: Array<string | null | undefined>) {
   if (error) throw new Error(`Unable to remove profile images: ${error.message}`);
 }
 
+// Count only children of the displayed records, without oversized filters or
+// silently losing rows to Supabase's response cap.
+async function loadRelatedCounts(table: "players" | "sessions" | "actions", key: "user_id" | "player_id" | "session_id", ids: string[]) {
+  const primaryKey = table === "players" ? "player_id" : table === "sessions" ? "session_id" : "action_id";
+  return readBatches<string, Record<string, string | null>>(ids, (batch) => readPages(async (from, to) => {
+    const { data, error } = await supabaseAdmin.from(table).select(`${primaryKey},${key}`)
+      .in(key, batch).order(primaryKey).range(from, to);
+    if (error) throw new Error(`Unable to load ${table} counts: ${error.message}`);
+    return (data ?? []) as unknown as Record<string, string | null>[];
+  }));
+}
+
 export function registerAdminRoutes(app: Express) {
   app.get("/api/admin/users", asyncRoute(async (req, res) => {
     if (!await admin(req, res)) return;
@@ -67,12 +81,10 @@ export function registerAdminRoutes(app: Express) {
     const ids = (data ?? []).map((row) => row.user_id);
     const [subs, counts, playerCounts] = ids.length ? await Promise.all([
       supabaseAdmin.from("users_subscriptions").select("user_id,subscription_id,startdate,enddate,num_players,num_sessions").in("user_id", ids),
-      supabaseAdmin.from("sessions").select("user_id").in("user_id", ids),
-      supabaseAdmin.from("players").select("user_id").in("user_id", ids),
+      loadRelatedCounts("sessions", "user_id", ids).then((data) => ({ data, error: null })),
+      loadRelatedCounts("players", "user_id", ids).then((data) => ({ data, error: null })),
     ]) : [{ data: [], error: null }, { data: [], error: null }, { data: [], error: null }];
     if (subs.error) throw new Error(`Unable to load user plans: ${subs.error.message}`);
-    if (counts.error) throw new Error(`Unable to load user session counts: ${counts.error.message}`);
-    if (playerCounts.error) throw new Error(`Unable to load user player counts: ${playerCounts.error.message}`);
     const planIds = [...new Set((subs.data ?? []).flatMap((row) => row.subscription_id ? [row.subscription_id] : []))];
     const { data: plans, error: plansError } = planIds.length
       ? await supabaseAdmin.from("subscriptions").select("subscription_id,plan,price,player_limit,session_limit").in("subscription_id", planIds)
@@ -175,16 +187,9 @@ export function registerAdminRoutes(app: Express) {
     if (error) throw new Error(`Unable to load players: ${error.message}`);
     if (userError) throw new Error(`Unable to load owners: ${userError.message}`);
     const sessionCounts = new Map<string, number>();
-    let sessionOffset = 0;
-    while (true) {
-      const { data: linkedSessions, error: linkedSessionsError } = await supabaseAdmin.from("sessions")
-        .select("player_id").not("player_id", "is", null).range(sessionOffset, sessionOffset + 999);
-      if (linkedSessionsError) throw new Error(`Unable to count player sessions: ${linkedSessionsError.message}`);
-      for (const session of linkedSessions ?? []) {
-        if (session.player_id) sessionCounts.set(session.player_id, (sessionCounts.get(session.player_id) ?? 0) + 1);
-      }
-      if ((linkedSessions ?? []).length < 1000) break;
-      sessionOffset += 1000;
+    const linkedSessions = await loadRelatedCounts("sessions", "player_id", (players ?? []).map((player) => player.player_id));
+    for (const session of linkedSessions) {
+      if (session.player_id) sessionCounts.set(session.player_id, (sessionCounts.get(session.player_id) ?? 0) + 1);
     }
     const owners = new Map((users ?? []).map((user) => [user.user_id, user]));
     return res.json({ players: (players ?? []).map((player) => {
@@ -265,10 +270,7 @@ export function registerAdminRoutes(app: Express) {
     const owners = new Map((users ?? []).map((user) => [user.user_id, user]));
     const roster = new Map((players ?? []).map((player) => [player.player_id, player]));
     const ids = (sessions ?? []).map((session) => session.session_id);
-    const { data: actionRows, error: actionsError } = ids.length
-      ? await supabaseAdmin.from("actions").select("session_id").in("session_id", ids)
-      : { data: [], error: null };
-    if (actionsError) throw new Error(`Unable to load session action counts: ${actionsError.message}`);
+    const actionRows = await loadRelatedCounts("actions", "session_id", ids);
     const actionCounts = new Map<string, number>();
     for (const action of actionRows ?? []) if (action.session_id) actionCounts.set(action.session_id, (actionCounts.get(action.session_id) ?? 0) + 1);
     return res.json({ sessions: (sessions ?? []).map((session) => {

src/read-pages.ts

@@ -0,0 +1,15 @@
+/** Read ordered rows in bounded pages, including children of batched IDs.
+ * Callers must supply a stable order and preserve their authorization filters.
+ */
+export async function readPages<T>(
+  load: (from: number, to: number) => PromiseLike<readonly T[]>,
+  pageSize = 500,
+): Promise<T[]> {
+  if (!Number.isInteger(pageSize) || pageSize < 1) throw new Error("Invalid page size");
+  const rows: T[] = [];
+  for (let from = 0; ; from += pageSize) {
+    const page = await load(from, from + pageSize - 1);
+    rows.push(...page);
+    if (page.length < pageSize) return rows;
+  }
+}

src/server.ts

@@ -19,6 +19,7 @@ import { deleteStoredSession, refundAdminUsage } from "./resource-deletion.js";
 import { singleFlight } from "./single-flight.js";
 import { requestTiming } from "./request-timing.js";
 import { readBatches } from "./read-batches.js";
+import { readPages } from "./read-pages.js";
 
 const app = express();
 app.disable("x-powered-by");
@@ -173,13 +174,15 @@ export async function requireAdmin(req: Request, res: Response) {
   return current;
 }
 
-async function loadActionAnnotations(actionIds: string[]) {
-  return readBatches<string, { action_id: string; score: number | null }>(actionIds, async (batch) => {
-    const { data, error } = await supabaseAdmin.from("annotations")
-      .select("action_id,score").in("action_id", batch);
+type ScoredAction = { action_id: string; session_id: string; type: string; annotation: { score: number | null } | null };
+async function loadScoredActions(sessionIds: string[]) {
+  return readBatches<string, ScoredAction>(sessionIds, (batch) => readPages(async (from, to) => {
+    const { data, error } = await supabaseAdmin.from("actions")
+      .select("action_id,session_id,type,annotation:annotations(score)").in("session_id", batch)
+      .order("action_id").range(from, to);
     if (error) throw new Error(`Unable to load action scores: ${error.message}`);
-    return data ?? [];
-  });
+    return (data ?? []) as unknown as ScoredAction[];
+  }));
 }
 
 
@@ -250,16 +253,19 @@ app.get("/api/plan-billing", async (req, res, next) => {
     const current = await authenticatedUser(req, res);
     if (!current) return res.status(401).json({ error: "Authentication required." });
     const userId = current.user.id;
-    const isAdmin = await userIsAdmin(userId);
-    const assignmentResult = await supabaseAdmin.from("users_subscriptions")
-      .select("subscription_id,startdate,enddate,num_players,num_sessions").eq("user_id", userId).maybeSingle();
+    const [isAdmin, assignmentResult] = await Promise.all([
+      userIsAdmin(userId),
+      supabaseAdmin.from("users_subscriptions")
+        .select("subscription_id,startdate,enddate,num_players,num_sessions,plan:subscriptions(subscription_id,plan,price,player_limit,session_limit)")
+        .eq("user_id", userId).maybeSingle(),
+    ]);
     if (assignmentResult.error) throw new Error(`Unable to load plan assignment: ${assignmentResult.error.message}`);
     const assignment = assignmentResult.data;
     let subscription = null;
     if (!isAdmin && assignment?.subscription_id) {
-      const { data: plan, error } = await supabaseAdmin.from("subscriptions")
-        .select("subscription_id,plan,price,player_limit,session_limit").eq("subscription_id", assignment.subscription_id).maybeSingle();
-      if (error) throw new Error(`Unable to load plan: ${error.message}`);
+      const plan = assignment.plan as unknown as {
+        subscription_id: string; plan: string; price: number; player_limit: number | null; session_limit: number | null;
+      } | null;
       if (plan) {
         const today = new Date().toISOString().slice(0, 10);
         subscription = {
@@ -454,37 +460,44 @@ app.get("/api/players-overview", async (req, res, next) => {
     if (!current) return res.status(401).json({ error: "Authentication required." });
 
     const isAdmin = await userIsAdmin(current.user.id);
-    let playersQuery = supabaseAdmin.from("players")
-      .select("player_id,user_id,fname,lname,bdate,height,weight,position,club,gender,image_path")
-      .order("fname", { ascending: true });
-    if (!isAdmin) playersQuery = playersQuery.eq("user_id", current.user.id);
-    const { data: rows, error } = await playersQuery;
-    if (error) throw new Error(`Unable to load players: ${error.message}`);
-
-    const playerIds = (rows ?? []).map((row) => row.player_id);
-    let sessionsQuery = supabaseAdmin.from("sessions").select("session_id,player_id,name,created_at,user_id")
-      .in("player_id", playerIds).order("created_at", { ascending: false });
-    if (!isAdmin) sessionsQuery = sessionsQuery.eq("user_id", current.user.id);
-    const { data: sessions, error: sessionsError } = playerIds.length
-      ? await sessionsQuery
-      : { data: [], error: null };
-    if (sessionsError) throw new Error(`Unable to load player sessions: ${sessionsError.message}`);
+    // These reads share only the authenticated scope, so start them together.
+    const [rows, visibleSessions] = await Promise.all([
+      readPages(async (from, to) => {
+        let query = supabaseAdmin.from("players")
+          .select("player_id,user_id,fname,lname,bdate,height,weight,position,club,gender,image_path")
+          .order("fname").order("player_id").range(from, to);
+        if (!isAdmin) query = query.eq("user_id", current.user.id);
+        const { data, error } = await query;
+        if (error) throw new Error(`Unable to load players: ${error.message}`);
+        return data ?? [];
+      }),
+      readPages(async (from, to) => {
+        let query = supabaseAdmin.from("sessions").select("session_id,player_id,name,created_at,user_id")
+          .order("created_at", { ascending: false }).order("session_id").range(from, to);
+        if (!isAdmin) query = query.eq("user_id", current.user.id);
+        const { data, error } = await query;
+        if (error) throw new Error(`Unable to load player sessions: ${error.message}`);
+        return data ?? [];
+      }),
+    ]);
+    const playerIds = new Set(rows.map((row) => row.player_id));
+    const sessions = visibleSessions.filter((row) => playerIds.has(row.player_id));
 
     const sessionIds = (sessions ?? []).map((row) => row.session_id);
-    const { data: actions, error: actionsError } = sessionIds.length
-      ? await supabaseAdmin.from("actions").select("action_id,session_id,type")
-        .in("session_id", sessionIds)
-      : { data: [], error: null };
-    if (actionsError) throw new Error(`Unable to load player actions: ${actionsError.message}`);
-
-    const actionIds = (actions ?? []).map((row) => row.action_id);
-    const annotations = await loadActionAnnotations(actionIds);
-
-    const scoresByAction = new Map(annotations.map((row) => [row.action_id, row.score == null ? null : Number(row.score)]));
+    const actions = await loadScoredActions(sessionIds);
+    const scoresByAction = new Map(actions.map((row) => [row.action_id, row.annotation?.score == null ? null : Number(row.annotation.score)]));
     const sessionsByPlayer = new Map<string, typeof sessions>();
-    for (const session of sessions ?? []) sessionsByPlayer.set(session.player_id, [...(sessionsByPlayer.get(session.player_id) ?? []), session]);
+    for (const session of sessions ?? []) {
+      const group = sessionsByPlayer.get(session.player_id) ?? [];
+      group.push(session);
+      sessionsByPlayer.set(session.player_id, group);
+    }
     const actionsBySession = new Map<string, typeof actions>();
-    for (const action of actions ?? []) actionsBySession.set(action.session_id, [...(actionsBySession.get(action.session_id) ?? []), action]);
+    for (const action of actions) {
+      const group = actionsBySession.get(action.session_id) ?? [];
+      group.push(action);
+      actionsBySession.set(action.session_id, group);
+    }
 
     const players = (rows ?? []).map((row) => {
       const playerSessions = sessionsByPlayer.get(row.player_id) ?? [];
@@ -535,31 +548,32 @@ app.get("/api/players-overview/:playerId", async (req, res, next) => {
     const playerId = z.string().uuid().safeParse(req.params.playerId);
     if (!playerId.success) return res.status(404).json({ error: "Player not found." });
     const isAdmin = await userIsAdmin(current.user.id);
-    let playerQuery = supabaseAdmin.from("players").select("player_id,user_id")
+    let playerQuery = supabaseAdmin.from("players").select("player_id,user_id,fname,lname,bdate,height,weight,position,club,gender,image_path")
       .eq("player_id", playerId.data);
     if (!isAdmin) playerQuery = playerQuery.eq("user_id", current.user.id);
     const { data, error } = await playerQuery.maybeSingle();
     if (error) throw new Error(`Unable to load player: ${error.message}`);
     if (!data) return res.status(404).json({ error: "Player not found." });
 
-    let overviewQuery = supabaseAdmin.from("players")
-      .select("player_id,user_id,fname,lname,bdate,height,weight,position,club,gender,image_path")
-      .order("fname", { ascending: true });
-    if (!isAdmin) overviewQuery = overviewQuery.eq("user_id", current.user.id);
-    let sessionsQuery = supabaseAdmin.from("sessions").select("session_id,player_id,name,created_at,user_id");
-    if (!isAdmin) sessionsQuery = sessionsQuery.eq("user_id", current.user.id);
-    const [{ data: overview, error: overviewError }, { data: sessions, error: sessionsError }] =
-      await Promise.all([overviewQuery, sessionsQuery]);
-    if (overviewError) throw new Error(`Unable to load players: ${overviewError.message}`);
-    if (sessionsError) throw new Error(`Unable to load sessions: ${sessionsError.message}`);
-    const { data: actions, error: actionsError } = (sessions ?? []).length
-      ? await supabaseAdmin.from("actions").select("action_id,session_id,type").in("session_id", sessions!.map((row) => row.session_id))
-      : { data: [], error: null };
-    if (actionsError) throw new Error(`Unable to load actions: ${actionsError.message}`);
-    const actionIds = (actions ?? []).map((row) => row.action_id);
-    const annotations = await loadActionAnnotations(actionIds);
-
-    const scoreMap = new Map(annotations.map((row) => [row.action_id, row.score == null ? null : Number(row.score)]));
+    const [overview, sessions] = await Promise.all([
+      readPages(async (from, to) => {
+        let query = supabaseAdmin.from("players").select("player_id").order("player_id").range(from, to);
+        if (!isAdmin) query = query.eq("user_id", current.user.id);
+        const { data, error } = await query;
+        if (error) throw new Error(`Unable to load players: ${error.message}`);
+        return data ?? [];
+      }),
+      readPages(async (from, to) => {
+        let query = supabaseAdmin.from("sessions").select("session_id,player_id,name,created_at,user_id")
+          .order("created_at", { ascending: false }).order("session_id").range(from, to);
+        if (!isAdmin) query = query.eq("user_id", current.user.id);
+        const { data, error } = await query;
+        if (error) throw new Error(`Unable to load sessions: ${error.message}`);
+        return data ?? [];
+      }),
+    ]);
+    const actions = await loadScoredActions((sessions ?? []).map((row) => row.session_id));
+    const scoreMap = new Map(actions.map((row) => [row.action_id, row.annotation?.score == null ? null : Number(row.annotation.score)]));
     const ownSessions = (sessions ?? []).filter((row) => row.player_id === playerId.data);
     const ownSessionIds = new Set(ownSessions.map((session) => session.session_id));
     const ownActions = (actions ?? []).filter((row) => ownSessionIds.has(row.session_id));
@@ -571,7 +585,7 @@ app.get("/api/players-overview/:playerId", async (req, res, next) => {
       return Boolean(ownerId) && ownerId !== playerId.data;
     });
     const squadByAction = playerSkillRatings(squadActions, scoreMap);
-    const player = overview?.find((row) => row.player_id === playerId.data);
+    const player = data;
     if (!player) return res.status(404).json({ error: "Player not found." });
     const sessionsForPlayer = ownSessions.map((row) => {
       const sessionActions = ownActions.filter((action) => action.session_id === row.session_id);
@@ -582,7 +596,11 @@ app.get("/api/players-overview/:playerId", async (req, res, next) => {
     for (const action of actions ?? []) {
       const ownerId = sessionPlayerById.get(action.session_id);
       const score = scoreMap.get(action.action_id);
-      if (ownerId && score != null && Number.isFinite(score)) playerScores.set(ownerId, [...(playerScores.get(ownerId) ?? []), score]);
+      if (ownerId && score != null && Number.isFinite(score)) {
+        const values = playerScores.get(ownerId) ?? [];
+        values.push(score);
+        playerScores.set(ownerId, values);
+      }
     }
     const rankedPlayers = [...playerScores.entries()]
       .map(([id, values]) => ({ id, score: meanPlayerScore(values)! }))
@@ -612,26 +630,21 @@ app.get("/api/sessions-overview", async (req, res, next) => {
     if (!current) return res.status(401).json({ error: "Authentication required." });
 
     const isAdmin = await userIsAdmin(current.user.id);
-    let sessionsQuery = supabaseAdmin.from("sessions")
-      .select("session_id,player_id,user_id,name,path,created_at,status,by_admin")
-      .order("created_at", { ascending: false });
-    if (!isAdmin) sessionsQuery = sessionsQuery.eq("user_id", current.user.id);
-    const { data: sessions, error } = await sessionsQuery;
-    if (error) throw new Error(`Unable to load sessions: ${error.message}`);
-    const playerIds = [...new Set((sessions ?? []).flatMap((row) => row.player_id ? [row.player_id] : []))];
-    const sessionIds = (sessions ?? []).map((row) => row.session_id);
-    const [{ data: players, error: playersError }, { data: actions, error: actionsError }] = await Promise.all([
-      playerIds.length
-        ? supabaseAdmin.from("players").select("player_id,fname,lname,gender,image_path").in("player_id", playerIds)
-        : Promise.resolve({ data: [], error: null }),
-      sessionIds.length
-        ? supabaseAdmin.from("actions").select("session_id,type").in("session_id", sessionIds)
-        : Promise.resolve({ data: [], error: null }),
-    ]);
-    if (playersError) throw new Error(`Unable to load session players: ${playersError.message}`);
-    if (actionsError) throw new Error(`Unable to load session actions: ${actionsError.message}`);
-    const playerNames = new Map((players ?? []).map((row) => [row.player_id, [row.fname, row.lname].filter(Boolean).join(" ")]));
-    const playerImages = new Map((players ?? []).map((row) => [row.player_id, { gender: row.gender, imagePath: row.image_path }]));
+    const sessions = await readPages(async (from, to) => {
+      let query = supabaseAdmin.from("sessions")
+        .select("session_id,player_id,user_id,name,path,created_at,status,by_admin,player:players(fname,lname,gender,image_path)")
+        .order("created_at", { ascending: false }).order("session_id").range(from, to);
+      if (!isAdmin) query = query.eq("user_id", current.user.id);
+      const { data, error } = await query;
+      if (error) throw new Error(`Unable to load sessions: ${error.message}`);
+      return data ?? [];
+    });
+    const actions = await readBatches(sessions.map((row) => row.session_id), (batch) => readPages(async (from, to) => {
+      const { data, error } = await supabaseAdmin.from("actions").select("action_id,session_id,type")
+        .in("session_id", batch).order("action_id").range(from, to);
+      if (error) throw new Error(`Unable to load session actions: ${error.message}`);
+      return data ?? [];
+    }));
     const breakdownBySession = new Map<string, Record<string, number>>();
     for (const action of actions ?? []) {
       const breakdown = breakdownBySession.get(action.session_id) ?? {};
@@ -640,10 +653,11 @@ app.get("/api/sessions-overview", async (req, res, next) => {
     }
     return res.json({ sessions: (sessions ?? []).map((row) => {
       const actionBreakdown = breakdownBySession.get(row.session_id) ?? {};
+      const player = row.player as unknown as { fname: string; lname: string | null; gender: string | null; image_path: string | null } | null;
       return {
-        sessionId: row.session_id, isOwner: row.user_id === current.user.id, canDelete: isAdmin || row.user_id === current.user.id, isAdmin, byAdmin: row.by_admin, playerId: row.player_id ?? "", playerName: row.player_id ? playerNames.get(row.player_id) ?? "" : "Deleted player",
-        playerGender: row.player_id ? playerImages.get(row.player_id)?.gender ?? null : null,
-        playerImagePath: row.player_id ? playerImages.get(row.player_id)?.imagePath ?? null : null,
+        sessionId: row.session_id, isOwner: row.user_id === current.user.id, canDelete: isAdmin || row.user_id === current.user.id, isAdmin, byAdmin: row.by_admin, playerId: row.player_id ?? "", playerName: row.player_id ? [player?.fname, player?.lname].filter(Boolean).join(" ") : "Deleted player",
+        playerGender: row.player_id ? player?.gender ?? null : null,
+        playerImagePath: row.player_id ? player?.image_path ?? null : null,
         name: row.name, createdAt: Date.parse(row.created_at) || 0,
         actionCount: Object.values(actionBreakdown).reduce((sum, count) => sum + count, 0),
         cameraCount: 0, actionBreakdown, path: row.path, status: row.status,

src/subscriptions.ts

@@ -40,13 +40,16 @@ export async function assignPaidSubscription(input: AssignSubscriptionInput) {
 async function loadActiveSubscription(userId: string) {
   const today = new Date().toISOString().slice(0, 10);
   const { data: assignment, error } = await supabaseAdmin.from("users_subscriptions")
-    .select("subscription_id,startdate,enddate").eq("user_id", userId).maybeSingle();
+    .select("subscription_id,startdate,enddate,plan:subscriptions(subscription_id,plan,price,player_limit,session_limit)")
+    .eq("user_id", userId).maybeSingle();
   if (error) throw new Error(`Unable to check subscription: ${error.message}`);
   if (!assignment?.subscription_id || assignment.startdate > today || assignment.enddate < today) return null;
 
-  const { data: plan, error: planError } = await supabaseAdmin.from("subscriptions")
-    .select("subscription_id,plan,price,player_limit,session_limit").eq("subscription_id", assignment.subscription_id).maybeSingle();
-  if (planError) throw new Error(`Unable to load subscription plan: ${planError.message}`);
+  // The FK is many-to-one; untyped Supabase clients infer embedded rows as arrays.
+  const plan = assignment.plan as unknown as {
+    subscription_id: string; plan: string; price: number;
+    player_limit: number | null; session_limit: number | null;
+  } | null;
   return plan ? { ...plan, startdate: assignment.startdate, enddate: assignment.enddate } : null;
 }
 

src/supabase.ts

@@ -53,9 +53,10 @@ async function randomPasswordHash() {
 
 export async function syncProfile(user: User, profile?: { fname?: string; lname?: string; academy?: string | null; role?: string | null; passwordHash?: string }) {
   const metadata = user.user_metadata ?? {};
-  const { data: existing, error: readError } = await supabaseAdmin.from("users").select("user_id").eq("user_id", user.id).maybeSingle();
+  const { data: existing, error: readError } = await supabaseAdmin.from("users").select("user_id,email").eq("user_id", user.id).maybeSingle();
   if (readError) throw new Error(`Unable to read user profile: ${readError.message}`);
   if (existing) {
+    if (existing.email === user.email) return;
     // The profile table is the canonical source for editable profile fields.
     // Auth callbacks should only keep the email in sync, never reset user edits.
     const { error } = await supabaseAdmin.from("users").update({ email: user.email }).eq("user_id", user.id);

tests/read-pages.test.ts

@@ -0,0 +1,23 @@
+import assert from "node:assert/strict";
+import { test } from "node:test";
+import { readPages } from "../src/read-pages.js";
+
+test("reads beyond the upstream row cap with inclusive, ordered ranges", async () => {
+  const input = Array.from({ length: 1203 }, (_, index) => index);
+  const ranges: number[][] = [];
+  const rows = await readPages(async (from, to) => {
+    ranges.push([from, to]);
+    return input.slice(from, to + 1);
+  });
+  assert.deepEqual(rows, input);
+  assert.deepEqual(ranges, [[0, 499], [500, 999], [1000, 1499]]);
+});
+
+test("handles empty and exact page boundaries, and propagates failure", async () => {
+  assert.deepEqual(await readPages(async () => []), []);
+  let calls = 0;
+  assert.deepEqual(await readPages(async (from) => { calls++; return from ? [] : [1, 2]; }, 2), [1, 2]);
+  assert.equal(calls, 2);
+  await assert.rejects(readPages(async () => { throw new Error("offline"); }), /offline/);
+  await assert.rejects(readPages(async () => [], 0), /Invalid page size/);
+});

tests/workspace-performance.test.ts

@@ -0,0 +1,135 @@
+import assert from "node:assert/strict";
+import { spawn } from "node:child_process";
+import { once } from "node:events";
+import { createServer } from "node:http";
+import type { AddressInfo } from "node:net";
+import { test } from "node:test";
+
+test("optimized workspace reads preserve authorization, scores and fresh permission checks", { timeout: 30_000 }, async () => {
+  const owner = "11111111-1111-4111-8111-111111111111";
+  const other = "22222222-2222-4222-8222-222222222222";
+  const playerId = "33333333-3333-4333-8333-333333333333";
+  const otherPlayerId = "44444444-4444-4444-8444-444444444444";
+  const calls: { method: string; url: URL }[] = [];
+  let role = "user";
+  let revoked = false;
+  let failActions = false;
+  const user = { id: owner, email: "test@example.com", email_confirmed_at: new Date().toISOString(), user_metadata: {} };
+  const plan = { subscription_id: "plan", plan: "Pro", price: 10, player_limit: 5, session_limit: 10 };
+  const player = { player_id: playerId, user_id: owner, fname: "Own", lname: "Player", bdate: "2000-01-01", gender: "male", image_path: null };
+  const sessions = [
+    { session_id: "s1", player_id: playerId, user_id: owner, created_at: "2026-01-02T00:00:00Z", status: "completed", name: "Own session", player },
+    { session_id: "s2", player_id: otherPlayerId, user_id: other, created_at: "2026-01-01T00:00:00Z", status: "completed", name: "Other session", player: { fname: "Other" } },
+  ];
+  const actions = [
+    { action_id: "a1", session_id: "s1", type: "Pass", annotation: { score: 7 } },
+    { action_id: "a2", session_id: "s1", type: "Pass", annotation: null },
+    { action_id: "a3", session_id: "s2", type: "Pass", annotation: { score: 10 } },
+  ];
+  const upstream = createServer((req, res) => {
+    const url = new URL(req.url!, "http://stub");
+    calls.push({ method: req.method!, url });
+    res.setHeader("Content-Type", "application/json");
+    if (url.pathname === "/auth/v1/user") {
+      res.statusCode = revoked ? 401 : 200;
+      return res.end(JSON.stringify(revoked ? { message: "Revoked" } : user));
+    }
+    if (url.pathname === "/auth/v1/token") {
+      return res.end(JSON.stringify({ user, access_token: "access", refresh_token: "refresh", expires_in: 3600, token_type: "bearer" }));
+    }
+    const table = url.pathname.split("/").at(-1);
+    if (table === "actions" && failActions) {
+      res.statusCode = 400;
+      return res.end(JSON.stringify({ message: "Unavailable" }));
+    }
+    let rows: Record<string, unknown>[] = table === "users" ? [{ user_id: owner, email: user.email, account_role: role }]
+      : table === "users_subscriptions" ? [{ user_id: owner, subscription_id: "plan", startdate: "2000-01-01", enddate: "2099-01-01", num_players: 1, num_sessions: 1, plan }]
+      : table === "players" ? [player, { player_id: otherPlayerId, user_id: other, fname: "Other" }]
+      : table === "sessions" ? sessions : table === "actions" ? actions : [];
+    for (const [key, filter] of url.searchParams) {
+      if (filter.startsWith("eq.")) rows = rows.filter((row) => String(row[key]) === filter.slice(3));
+      if (filter.startsWith("in.(")) {
+        const values = filter.slice(4, -1).split(",");
+        rows = rows.filter((row) => values.includes(String(row[key])));
+      }
+    }
+    const from = Number(url.searchParams.get("offset") ?? 0);
+    const limit = Number(url.searchParams.get("limit") ?? rows.length);
+    res.end(JSON.stringify(rows.slice(from, from + limit)));
+  });
+  upstream.listen(0, "127.0.0.1");
+  await once(upstream, "listening");
+  const portProbe = createServer();
+  portProbe.listen(0, "127.0.0.1");
+  await once(portProbe, "listening");
+  const port = (portProbe.address() as AddressInfo).port;
+  await new Promise<void>((resolve) => portProbe.close(() => resolve()));
+  const origin = `http://127.0.0.1:${port}`;
+  const child = spawn(process.execPath, ["--import", "tsx", "src/server.ts"], {
+    env: { ...process.env, NODE_ENV: "test", PORT: String(port), FRONTEND_URL: origin, BACKEND_URL: origin,
+      SUPABASE_URL: `http://127.0.0.1:${(upstream.address() as AddressInfo).port}`,
+      SUPABASE_ANON_KEY: "test-anon", SUPABASE_SERVICE_ROLE_KEY: "test-service", ANALYSIS_PROXY_SECRET: "x".repeat(32) },
+    stdio: ["ignore", "pipe", "pipe"],
+  });
+  try {
+    await new Promise<void>((resolve, reject) => {
+      child.stdout.on("data", (data) => { if (String(data).includes("API listening")) resolve(); });
+      child.once("exit", (code) => reject(new Error(`API exited: ${code}`)));
+      child.once("error", reject);
+    });
+    const request = (path: string, init: RequestInit = {}) => fetch(`${origin}${path}`, {
+      ...init, signal: AbortSignal.timeout(10000), headers: { Cookie: "sp_access=access", Origin: origin, ...init.headers },
+    }).catch((error) => { throw new Error(`Request failed: ${path}`, { cause: error }); });
+    assert.equal((await fetch(`${origin}/api/players-overview`)).status, 401);
+    const meStart = calls.length;
+    const me = await (await request("/api/auth/me")).json();
+    assert.equal(me.access.active, true);
+    assert.equal(me.access.subscription.plan, "Pro");
+    assert.equal(calls.length - meStart, 3); // auth + role + joined assignment/plan
+    const rosterResponse = await request("/api/players-overview");
+    assert.equal(rosterResponse.status, 200);
+    const roster = (await rosterResponse.json()).players;
+    assert.equal(roster.length, 1);
+    assert.equal(roster[0].scores.overall, 70);
+    assert.equal(roster[0].actionCount, 2);
+    assert.equal(roster[0].scores.scoredActions, 1);
+    const list = (await (await request("/api/sessions-overview")).json()).sessions;
+    assert.equal(list.length, 1);
+    assert.equal(list[0].playerName, "Own Player");
+    assert.equal(list[0].actionBreakdown.Pass, 2);
+    const detail = await (await request(`/api/players-overview/${playerId}`)).json();
+    assert.equal(detail.scores.overall, 70);
+    assert.equal(detail.playerCount, 1);
+    assert.equal((await request(`/api/players-overview/${otherPlayerId}`)).status, 404);
+    const billing = await (await request("/api/plan-billing")).json();
+    assert.equal(billing.subscription.name, "Pro");
+    assert.equal(billing.usage.sessions, 1);
+    assert.ok(!calls.some(({ url }) => url.pathname.endsWith("/annotations")));
+    const login = await request("/api/auth/login", { method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify({ email: user.email, password: "password123" }) });
+    assert.equal(login.status, 200);
+    assert.ok(!calls.some(({ method }) => method === "PATCH"));
+    role = "admin";
+    const adminPlayers = await (await request("/api/admin/players")).json();
+    assert.equal(adminPlayers.players.find((row: { player_id: string }) => row.player_id === playerId).sessionCount, 1);
+    const adminSessions = await (await request("/api/admin/sessions")).json();
+    assert.equal(adminSessions.sessions.find((row: { session_id: string }) => row.session_id === "s1").actionCount, 2);
+    const adminUsers = await (await request("/api/admin/users")).json();
+    assert.equal(adminUsers.users[0].dataCounts.sessions, 1);
+    const adminRows = (await (await request("/api/players-overview")).json()).players;
+    assert.equal(adminRows.length, 2);
+    role = "user";
+    assert.equal((await (await request("/api/players-overview")).json()).players.length, 1);
+    failActions = true;
+    assert.equal((await request("/api/sessions-overview")).status, 500);
+    revoked = true;
+    assert.equal((await request("/api/sessions-overview")).status, 401);
+  } finally {
+    if (child.exitCode === null && child.signalCode === null) {
+      const exited = once(child, "exit");
+      child.kill();
+      await exited;
+    }
+    upstream.closeAllConnections();
+    await new Promise<void>((resolve) => upstream.close(() => resolve()));
+  }
+});