Fix mobile account session selection

lib/auth-cookie.ts

@@ -2,6 +2,7 @@ import { getCookie as serializeStoredCookies } from "@better-auth/expo/client";
 import * as SecureStore from "expo-secure-store";
 import type { createAuthClient } from "better-auth/react";
 
+import { GUEST_AUTH_STORAGE_PREFIX } from "@/lib/auth-storage";
 import { normalizeSecureStoreKey } from "@/lib/secure-store-keys";
 
 type AuthClient = ReturnType<typeof createAuthClient>;
@@ -9,6 +10,7 @@ type AuthClient = ReturnType<typeof createAuthClient>;
 const CHUNK_MARKER = "\u0001ba-chunks:";
 const SESSION_TOKEN_COOKIE_PART =
   /(?:^|;\s*)(?:__Secure-)?[^=]*session_token=([^;]+)/;
+const AUTH_COOKIE_DEBUG = process.env.EXPO_PUBLIC_AUTH_COOKIE_DEBUG === "1";
 
 function readSecureStoreValueSync(key: string): string | null {
   const value = SecureStore.getItem(key);
@@ -27,16 +29,7 @@ function readSecureStoreValueSync(key: string): string | null {
   return assembled;
 }
 
-/** Read session cookie string for tRPC requests (Expo client plugin + SecureStore fallback). */
-export function getAuthCookie(
-  authClient: AuthClient,
-  storagePrefix: string,
-): string | null {
-  const fromClient = (
-    authClient as AuthClient & { getCookie?: () => string }
-  ).getCookie?.();
-  if (fromClient?.trim()) return fromClient.trim();
-
+function readStoredCookie(storagePrefix: string): string | null {
   const raw = readSecureStoreValueSync(
     normalizeSecureStoreKey(`${storagePrefix}_cookie`),
   );
@@ -46,14 +39,85 @@ export function getAuthCookie(
   return cookie.trim() || null;
 }
 
+function cookieNames(cookie: string): string[] {
+  return cookie
+    .split(";")
+    .map((part) => part.trim().split("=", 1)[0])
+    .filter(Boolean);
+}
+
+/** Read session cookie string for tRPC requests (Expo client plugin + SecureStore fallback). */
+export function getAuthCookie(
+  authClient: AuthClient,
+  storagePrefix: string,
+): string | null {
+  const fromClient = (
+    authClient as AuthClient & { getCookie?: () => string }
+  ).getCookie?.();
+  if (fromClient?.trim()) {
+    const cookie = fromClient.trim();
+    if (AUTH_COOKIE_DEBUG) {
+      console.info("[auth-cookie] using client cookie", {
+        storagePrefix,
+        length: cookie.length,
+        names: cookieNames(cookie),
+      });
+    }
+    return cookie;
+  }
+
+  const fromPrefix = readStoredCookie(storagePrefix);
+  if (fromPrefix) {
+    if (AUTH_COOKIE_DEBUG) {
+      console.info("[auth-cookie] using stored cookie", {
+        storagePrefix,
+        length: fromPrefix.length,
+        names: cookieNames(fromPrefix),
+      });
+    }
+    return fromPrefix;
+  }
+
+  const fromGuest =
+    storagePrefix === GUEST_AUTH_STORAGE_PREFIX
+      ? null
+      : readStoredCookie(GUEST_AUTH_STORAGE_PREFIX);
+  if (AUTH_COOKIE_DEBUG) {
+    console.info("[auth-cookie] resolved tRPC cookie", {
+      storagePrefix,
+      fallbackPrefix:
+        fromGuest && storagePrefix !== GUEST_AUTH_STORAGE_PREFIX
+          ? GUEST_AUTH_STORAGE_PREFIX
+          : null,
+      hasCookie: Boolean(fromGuest),
+      length: fromGuest?.length ?? 0,
+      names: fromGuest ? cookieNames(fromGuest) : [],
+    });
+  }
+  return fromGuest;
+}
+
 export function getAuthCookieHeaders(
   authClient: AuthClient,
   storagePrefix: string,
 ): Record<string, string> {
   const cookie = getAuthCookie(authClient, storagePrefix);
-  if (!cookie) return {};
+  if (!cookie) {
+    if (AUTH_COOKIE_DEBUG) {
+      console.info("[auth-cookie] no tRPC auth cookie", { storagePrefix });
+    }
+    return {};
+  }
 
   const sessionToken = cookie.match(SESSION_TOKEN_COOKIE_PART)?.[1];
+  if (AUTH_COOKIE_DEBUG) {
+    console.info("[auth-cookie] sending tRPC auth headers", {
+      storagePrefix,
+      cookieLength: cookie.length,
+      cookieNames: cookieNames(cookie),
+      hasSessionTokenHeader: Boolean(sessionToken),
+    });
+  }
   return {
     cookie,
     Cookie: cookie,