fix: preserve browser during permission refresh

components/app-sidebar.tsx

@@ -68,9 +68,9 @@ export function AppSidebar() {
   const dir = useDirection()
   const brandInitial = APP_NAME.charAt(0).toUpperCase() ?? "R"
 
-  const { isAdmin, canAccessPath, hasResolvedAdmin, hasFetchedPolicy, isLoading } = usePermissions()
+  const { isAdmin, canAccessPath, hasResolvedAdmin, hasFetchedPolicy } = usePermissions()
   const { route: homeRoute } = useFirstAccessibleDashboardRoute()
-  const isPermissionsReady = hasResolvedAdmin && (isAdmin || (!isLoading && hasFetchedPolicy))
+  const isPermissionsReady = hasResolvedAdmin && (isAdmin || hasFetchedPolicy)
 
   if (!isPermissionsReady) {
     return null

components/dashboard-auth-guard.tsx

@@ -17,7 +17,7 @@ export function DashboardAuthGuard({ children }: { children: React.ReactNode })
   const { isAuthenticated } = useAuth()
   const { isReady: apiReady } = useApiReady()
   const { isReady: s3Ready } = useS3Ready()
-  const { isAdmin, isLoading, hasFetchedPolicy, hasResolvedAdmin, canAccessPath } = usePermissions()
+  const { isAdmin, hasFetchedPolicy, hasResolvedAdmin, canAccessPath } = usePermissions()
 
   const isReady = apiReady && s3Ready
 
@@ -29,23 +29,14 @@ export function DashboardAuthGuard({ children }: { children: React.ReactNode })
 
   useEffect(() => {
     if (!isReady || !isAuthenticated || !hasResolvedAdmin) return
-    if (!isAdmin && (isLoading || !hasFetchedPolicy)) return
+    if (!isAdmin && !hasFetchedPolicy) return
     if (!canAccessDashboardRoute(pathname, { isAdmin, canAccessPath })) {
       router.replace("/403/")
     }
-  }, [
-    isReady,
-    isAuthenticated,
-    hasResolvedAdmin,
-    isAdmin,
-    isLoading,
-    hasFetchedPolicy,
-    canAccessPath,
-    pathname,
-    router,
-  ])
-
-  if (!isReady || !isAuthenticated || !hasResolvedAdmin || (!isAdmin && (isLoading || !hasFetchedPolicy))) {
+  }, [isReady, isAuthenticated, hasResolvedAdmin, isAdmin, hasFetchedPolicy, canAccessPath, pathname, router])
+
+  // Background refreshes must not unmount the page that requested them.
+  if (!isReady || !isAuthenticated || !hasResolvedAdmin || (!isAdmin && !hasFetchedPolicy)) {
     return (
       <div role="status" className="flex min-h-64 items-center justify-center gap-3 text-sm text-muted-foreground">
         <Spinner className="size-5" />

hooks/use-first-accessible-dashboard-route.ts

@@ -7,9 +7,9 @@ import { getFirstAccessibleDashboardRoute } from "@/lib/dashboard-route-meta"
 
 export function useFirstAccessibleDashboardRoute() {
   const { isAuthenticated } = useAuth()
-  const { isAdmin, canAccessPath, hasFetchedPolicy, hasResolvedAdmin, isLoading } = usePermissions()
+  const { isAdmin, canAccessPath, hasFetchedPolicy, hasResolvedAdmin } = usePermissions()
 
-  const isReady = isAuthenticated && hasResolvedAdmin && (isAdmin || (!isLoading && hasFetchedPolicy))
+  const isReady = isAuthenticated && hasResolvedAdmin && (isAdmin || hasFetchedPolicy)
 
   const route = useMemo(() => {
     if (!isReady) return null