fix(auth): fix JWT cookie propagation + missing profile trigger (Fixes LMS-FRONT-7H)

proxy.ts used headers.get('set-cookie') on protected routes, which only
returns the first cookie — dropping the refreshed JWT tokens after tenant
sync. Fixed to use getSetCookie() + append() (matching the public routes
path). This caused fresh accounts to have stale JWT claims, making RLS
block course reads after creation.

Also adds the missing on_auth_user_created trigger (was never in migrations)
with profile backfill, and a safety-net profile upsert in createCourse.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: guillermoscript

app/[locale]/dashboard/teacher/courses/[courseId]/page.tsx

@@ -42,8 +42,6 @@ export default async function CourseManagementPage({ params }: PageProps) {
     redirect('/auth/login')
   }
 
-  // Use admin client — RLS get_tenant_id() reads JWT claims which may not match
-  // the actual subdomain tenant. We validate tenant ownership manually.
   const { data: course, error: courseError } = await supabase
     .from('courses')
     .select('*')

app/actions/teacher/courses.ts

@@ -132,6 +132,17 @@ export async function createCourse(courseData: CourseFormData) {
   // The user's JWT may have stale tenant_role claims that don't match the
   // RLS policy on courses (requires tenant_role = teacher|admin in JWT).
   const adminClient = createAdminClient()
+
+  // Ensure profile exists (FK courses_author_profile_fkey requires it).
+  // The on_auth_user_created trigger should create profiles, but as a safety
+  // net for accounts created before the trigger was added, upsert here.
+  await adminClient
+    .from('profiles')
+    .upsert(
+      { id: user.id, full_name: user.user_metadata?.full_name || null },
+      { onConflict: 'id', ignoreDuplicates: true }
+    )
+
   const { data: course, error } = await adminClient
     .from('courses')
     .insert({
@@ -148,7 +159,7 @@ export async function createCourse(courseData: CourseFormData) {
 
   if (error) {
     console.error('Failed to create course:', error)
-    throw new Error('Failed to create course')
+    throw new Error(`Failed to create course: ${error.message}`)
   }
 
   revalidatePath('/dashboard/teacher/courses')
@@ -204,7 +215,7 @@ export async function updateCourse(courseId: number, courseData: CourseFormData)
 
   if (error) {
     console.error('Failed to update course:', error)
-    throw new Error('Failed to update course')
+    throw new Error(`Failed to update course: ${error.message}`)
   }
 
   revalidatePath('/dashboard/teacher/courses')

components/teacher/course-form.tsx

@@ -160,8 +160,12 @@ export function CourseForm({ categories, initialData }: CourseFormProps) {
               value={formData.title}
               onChange={(e) => setFormData({ ...formData, title: e.target.value })}
               placeholder={t('titlePlaceholder')}
+              maxLength={100}
               required
             />
+            {formData.title.length > 80 && (
+              <p className="text-xs text-muted-foreground">{formData.title.length}/100</p>
+            )}
           </div>
 
           <div className="space-y-2">

proxy.ts

@@ -394,9 +394,8 @@ export default async function proxy(request: NextRequest) {
     }
     // Allow super admin through — bypass tenant membership checks
     const finalPlatformResponse = intlResponse
-    const supabasePlatformCookies = supabaseResponse.headers.get('set-cookie')
-    if (supabasePlatformCookies) {
-      finalPlatformResponse.headers.set('set-cookie', supabasePlatformCookies)
+    for (const cookie of supabaseResponse.headers.getSetCookie()) {
+      finalPlatformResponse.headers.append('set-cookie', cookie)
     }
     finalPlatformResponse.headers.set('x-tenant-id', tenantId)
     return finalPlatformResponse
@@ -416,11 +415,11 @@ export default async function proxy(request: NextRequest) {
     return NextResponse.redirect(new URL(`/${locale}/dashboard/${userRole}`, request.url))
   }
 
-  // Allow access
+  // Allow access — copy ALL Set-Cookie headers (not just the first one)
+  // so refreshed JWT tokens from tenant sync are fully propagated.
   const finalResponse = intlResponse
-  const supabaseCookies = supabaseResponse.headers.get('set-cookie')
-  if (supabaseCookies) {
-    finalResponse.headers.set('set-cookie', supabaseCookies)
+  for (const cookie of supabaseResponse.headers.getSetCookie()) {
+    finalResponse.headers.append('set-cookie', cookie)
   }
 
   return finalResponse

supabase/migrations/20260405215804_fix_missing_profile_trigger.sql

@@ -0,0 +1,39 @@
+-- =============================================================================
+-- Fix missing profile trigger + backfill profiles for existing users
+--
+-- Root cause of LMS-FRONT-7H ("Failed to create course"):
+--   The `handle_new_user()` function exists but the trigger
+--   `on_auth_user_created` was never created via migrations.
+--   Combined with the new FK `courses_author_profile_fkey`
+--   (courses.author_id → profiles.id), any user without a profile
+--   row cannot create courses.
+--
+-- Fixes:
+--   1. Backfill missing profiles for all auth.users
+--   2. Create the trigger (idempotent) so new signups always get a profile
+-- =============================================================================
+
+
+-- ---------------------------------------------------------------------------
+-- 1. Backfill: insert profiles for any auth.users that don't have one
+-- ---------------------------------------------------------------------------
+
+INSERT INTO public.profiles (id, full_name, avatar_url)
+SELECT
+  u.id,
+  u.raw_user_meta_data->>'full_name',
+  u.raw_user_meta_data->>'avatar_url'
+FROM auth.users u
+LEFT JOIN public.profiles p ON p.id = u.id
+WHERE p.id IS NULL;
+
+
+-- ---------------------------------------------------------------------------
+-- 2. Ensure the trigger exists (DROP + CREATE for idempotency)
+-- ---------------------------------------------------------------------------
+
+DROP TRIGGER IF EXISTS on_auth_user_created ON auth.users;
+
+CREATE TRIGGER on_auth_user_created
+  AFTER INSERT ON auth.users
+  FOR EACH ROW EXECUTE FUNCTION public.handle_new_user();