feat: Implement multi-tenancy for pricing plans, refine Supabase middleware to defer auth guards to proxy.ts, and add image processing dependencies to the Dockerfile.

Author: guillermoscript

Dockerfile

@@ -2,7 +2,8 @@ FROM node:20-alpine AS base
 
 # Install dependencies
 FROM base AS deps
-RUN apk add --no-cache libc6-compat
+RUN apk add --no-cache libc6-compat python3 make g++ pkgconfig \
+    cairo-dev pango-dev jpeg-dev giflib-dev librsvg-dev pixman-dev
 WORKDIR /app
 COPY package.json package-lock.json ./
 RUN npm ci
@@ -35,6 +36,7 @@ WORKDIR /app
 ENV NODE_ENV=production
 ENV NEXT_TELEMETRY_DISABLED=1
 
+RUN apk add --no-cache cairo pango libjpeg-turbo giflib librsvg pixman
 RUN addgroup --system --gid 1001 nodejs
 RUN adduser --system --uid 1001 nextjs
 

app/[locale]/(public)/pricing/page.tsx

@@ -1,4 +1,5 @@
 import { createClient } from "@/lib/supabase/server";
+import { getCurrentTenantId } from "@/lib/supabase/tenant";
 import { HelpCircle, PackageSearch, ArrowRight } from "lucide-react";
 import PricingClient from "./pricing-client";
 import { getTranslations } from 'next-intl/server';
@@ -19,12 +20,14 @@ interface Plan {
 
 export default async function PricingPage() {
     const supabase = await createClient();
+    const tenantId = await getCurrentTenantId();
     const t = await getTranslations('pricing');
 
-    // Fetch plans from database
+    // Fetch plans from database - filtered by tenant
     const { data: plans, error } = await supabase
         .from('plans')
         .select('plan_id, plan_name, price, duration_in_days, description, features, payment_provider')
+        .eq('tenant_id', tenantId)
         .order('price', { ascending: true });
 
     if (error) {

lib/supabase/middleware.ts

@@ -30,25 +30,20 @@ export async function updateSession(request: NextRequest) {
   )
 
   // Do not run code between createServerClient and
-  // supabase.auth.getClaims(). A simple mistake could make it very hard to debug
+  // supabase.auth.getUser(). A simple mistake could make it very hard to debug
   // issues with users being randomly logged out.
 
-  // IMPORTANT: If you remove getClaims() and you use server-side rendering
-  // with the Supabase client, your users may be randomly logged out.
-  const { data } = await supabase.auth.getClaims()
-  const user = data?.claims
-
-  if (
-    !user &&
-    !request.nextUrl.pathname.startsWith('/login') &&
-    !request.nextUrl.pathname.startsWith('/auth')
-  ) {
-    // no user, potentially respond by redirecting the user to the login page
-    const url = request.nextUrl.clone()
-    url.pathname = '/auth/login'
-    return NextResponse.redirect(url)
+  // IMPORTANT: DO NOT REMOVE auth.getUser()
+  // It refreshes the session and keeps the user logged in.
+  try {
+    await supabase.auth.getUser()
+  } catch {
+    // Session refresh failed — continue anyway, proxy.ts handles auth guards
   }
 
+  // NOTE: Auth redirects are handled by proxy.ts (the main middleware),
+  // not here. This function only refreshes the Supabase session.
+
   // IMPORTANT: You *must* return the supabaseResponse object as it is.
   // If you're creating a new response object with NextResponse.next() make sure to:
   // 1. Pass the request in it, like so:

proxy.ts

@@ -119,11 +119,15 @@ export default async function proxy(request: NextRequest) {
 
   // For API routes: set tenant header and pass through (no intl/auth guards)
   if (pathname.startsWith('/api')) {
-    const response = NextResponse.next()
+    request.headers.set('x-tenant-id', tenantId)
+    const response = NextResponse.next({ request })
     response.headers.set('x-tenant-id', tenantId)
     return response
   }
 
+  // --- Inject tenant ID into request headers so server components can read it ---
+  request.headers.set('x-tenant-id', tenantId)
+
   // --- Intl Middleware ---
   const intlResponse = intlMiddleware(request)