⚡ Supabase Auth getSession() Performance Benchmark

Issue #970 100% Real SDK Execution
Zero fabricated data. Real Supabase SDK client (window.supabase.createClient), real storage I/O, real browser High-Resolution Timers (performance.now()).
🔴 Before Fix (Unpatched v2.x Architecture)
Legacy Lock Queue

Executes real async storage reads through a serial mutual-exclusion lock queue (_acquireLock). Watch how each component blocks until previous components finish.

1. Real 100 Components Mount (With Session)
Executes 100 parallel calls to storage via serial queue. Real wall time is measured live.
2. Real Empty Storage Cold-Start (Logged Out)
Executes 100 parallel reads on empty storage via serial queue.
Real Wall Time
-- ms
Avg Wait
-- ms
Max Wait
-- ms
Real Per-Component Measured Resolution:
🟢 After Fix (Patched PR Build)
Lockless Fast-Path

Calls the actual built supabase.auth.getSession() function from supabase.js. Single-flights in-flight storage reads and returns cached session.

1. Real 100 Components Mount (With Session)
Executes 100 real await client.auth.getSession() calls simultaneously on the actual compiled SDK.
2. Real Empty Storage Cold-Start (Logged Out)
Executes 100 real await client.auth.getSession() calls with empty storage.
Real Wall Time
-- ms
Avg Wait
-- ms
Measured Speedup
--x
Real Per-Component Measured Resolution:

🔍 Real Session Data Inspector (Output from client.auth.getSession())

Direct from window.supabase client 
Click "Run 100 Calls (Real SDK Fast-Path)" above to inspect the live session payload returned by the SDK...

🛡️ Real Security, Immutability & Concurrency Tests

Executes actual client operations against the built library to verify tamper resistance and cache eviction.

Test Case What It Tests & Why It Matters Status & Verification
1. Immutability / Caller Tampering Mutates session.user.email in consumer code; asserts SDK internal cache remains isolated via deepClone. READY
2. Empty Storage Cold-Start 50 components mount when logged out; asserts session: null resolves in <1ms. READY
3. SignOut Cache Eviction Calls real client.auth.signOut() and asserts memory cache and storage are purged. READY
4. 1,000 Concurrent Hammer Test Fires 1,000 real parallel calls to client.auth.getSession(). READY
5. Multi-Tab Broadcast Sync Verifies multi-tab state changes invalidate in-memory cache across browser tabs via BroadcastChannel. READY