fix login and some errors while login

apps/marketplace/next-env.d.ts

@@ -1,6 +1,5 @@
 /// <reference types="next" />
 /// <reference types="next/image-types/global" />
-import "./.next/types/routes.d.ts";
 
 // NOTE: This file should not be edited
-// see https://nextjs.org/docs/app/api-reference/config/typescript for more information.
+// see https://nextjs.org/docs/basic-features/typescript for more information.

apps/marketplace/next.config.js

@@ -1,27 +1,12 @@
 /** @type {import('next').NextConfig} */
 
-const securityHeaders = [
-  { key: 'Strict-Transport-Security', value: 'max-age=31536000; includeSubDomains' },
-  { key: 'X-Content-Type-Options', value: 'nosniff' },
-  { key: 'X-Frame-Options', value: 'DENY' },
-  { key: 'Referrer-Policy', value: 'strict-origin-when-cross-origin' },
-  { key: 'Permissions-Policy', value: 'camera=(), microphone=(), geolocation=()' },
-  {
-    key: 'Content-Security-Policy',
-    value: [
-      "default-src 'self'",
-      "script-src 'self' 'unsafe-inline'",
-      "style-src 'self' 'unsafe-inline'",
-      "img-src 'self' data: blob: https:",
-      "font-src 'self' data:",
-      "connect-src 'self' https: wss:",
-      "frame-ancestors 'none'",
-      "base-uri 'self'",
-      "form-action 'self'",
-      "object-src 'none'",
-    ].join('; '),
-  },
-]
+const { buildSecurityHeaders } = require('../../config/nextSecurityHeaders')
+
+// The marketplace proxies /dashboard and /admin to their own Next dev servers.
+// Allow those asset-prefix origins so proxied pages can load chunks and HMR.
+const securityHeaders = buildSecurityHeaders({
+  assetSources: [process.env.DASHBOARD_ASSET_PREFIX, process.env.ADMIN_ASSET_PREFIX],
+})
 const nextConfig = {
   images: {
     domains: ['res.cloudinary.com'],

apps/marketplace/src/components/MarketplaceShell.auth.test.ts

@@ -0,0 +1,41 @@
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { clearCachedEmployeeProfile, hasCachedEmployeeProfile } from './MarketplaceShell'
+
+afterEach(() => {
+  vi.unstubAllGlobals()
+})
+
+describe('MarketplaceShell auth helpers', () => {
+  it('does not report an employee profile when the browser cache is empty', () => {
+    vi.stubGlobal('window', {
+      localStorage: {
+        getItem: vi.fn(() => null),
+      },
+    })
+
+    expect(hasCachedEmployeeProfile()).toBe(false)
+  })
+
+  it('detects the cached employee profile marker written by dashboard sign-in', () => {
+    vi.stubGlobal('window', {
+      localStorage: {
+        getItem: vi.fn((key: string) => (key === 'employee_profile' ? '{"id":"emp_1"}' : null)),
+      },
+    })
+
+    expect(hasCachedEmployeeProfile()).toBe(true)
+  })
+
+  it('clears the cached employee profile marker', () => {
+    const removeItem = vi.fn()
+    vi.stubGlobal('window', {
+      localStorage: {
+        removeItem,
+      },
+    })
+
+    clearCachedEmployeeProfile()
+
+    expect(removeItem).toHaveBeenCalledWith('employee_profile')
+  })
+})

apps/marketplace/src/components/MarketplaceShell.tsx

@@ -56,6 +56,8 @@ const dictionaries: Record<MarketplaceLanguage, Dictionary> = {
   },
 }
 
+const EMPLOYEE_PROFILE_KEY = 'employee_profile'
+
 export const localeOptions: Array<{ value: MarketplaceLanguage; label: string; flag: string }> = [
   { value: 'en', label: 'Global (English)', flag: '🇺🇸' },
   { value: 'ar', label: 'North Africa (Arabic)', flag: '🇲🇦' },
@@ -127,6 +129,24 @@ export function getFooterContent(language: MarketplaceLanguage): {
   }
 }
 
+export function hasCachedEmployeeProfile(): boolean {
+  if (typeof window === 'undefined') return false
+
+  try {
+    return Boolean(window.localStorage.getItem(EMPLOYEE_PROFILE_KEY))
+  } catch {
+    return false
+  }
+}
+
+export function clearCachedEmployeeProfile() {
+  if (typeof window === 'undefined') return
+
+  try {
+    window.localStorage.removeItem(EMPLOYEE_PROFILE_KEY)
+  } catch {}
+}
+
 function detectBrowserLanguage(): string | null {
   if (typeof navigator === 'undefined') return null
   const langs = Array.from(navigator.languages ?? [navigator.language])
@@ -201,12 +221,20 @@ export default function MarketplaceShell({
   }
 
   async function syncCompanyBrand() {
+    if (!hasCachedEmployeeProfile()) {
+      setCompanyName(null)
+      return
+    }
+
     try {
       const response = await fetch(`${apiUrl}/companies/me/brand`, {
         credentials: 'include',
       })
 
       if (!response.ok) {
+        if (response.status === 401) {
+          clearCachedEmployeeProfile()
+        }
         setCompanyName(null)
         return
       }