feat(frontend): currentProjectID in session + sidebar project switcher (#14)

[jpricardo]

Closes #14.

What

Phase 4, part one: the session now remembers which project the user is working in, and the sidebar gets a switcher to change it.

• Session — SessionData gains currentProjectID, plus a getCurrentProjectID(request) helper.
• Layout loader — fetches the user's projects via GET /projects, drops the stored id when the project is gone or the user lost access to it, auto-selects the first reachable project, and passes user, csrfToken, projects, and currentProject down. When it re-points the session it redirects to the same URL, so child loaders run against the corrected cookie instead of the stale one they were handed.
• Sidebar — static header replaced by a project dropdown (active project, full list with a check on the current one, and a "New project" entry pointing at /projects/new, which lands in [Phase 4] Add /projects/new and /projects pages; implement first-time flow #15). With no projects it collapses to a single "New project" call to action.
• /projects/switch — POST-only action. Validates CSRF, re-checks membership server-side (the id comes from the browser), writes the session, and redirects back to the originating page so every loader revalidates. A switch to a project the user can no longer reach leaves the session untouched and redirects back, where the layout re-points it.
• API client — adds Project and getProjects().

Drive-by fix

/events returned a 500 whenever the SDK key was rejected — it is the one page still reading through the public SDK route rather than the internal API, so it had none of the noProject guards its siblings got in Phase 3. It now shows the same empty state as the other pages, and a rejected key renders an alert over an empty table instead of taking the page down. /events/:id and the delete action had the identical crash path and are guarded too.

Routing /events through the internal project-scoped API is #17 and needs a new broker route, so it is not attempted here.

Notes for review

• Based on feat/multi-tenancy, not main — GET /projects does not exist on main.
• Open-redirect guard on redirectTo rejects absolute, protocol-relative, and backslash-prefixed targets.
• Pages still read ?projectId= from the query string; migrating them to the session is [Phase 4] Update API client and existing pages to use current project scope #17.

Verification

npm run typecheck, oxlint, and oxfmt --check are clean on every touched file. Verified live against the local Docker stack: /events no longer 500s with no active project.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
logwolf-docs	Ready	Preview	Aug 19, 2026 12:13am