fix(rls): forward x-tenant-id header to PostgREST for anon tenant context

Anon users on non-default tenant subdomains had no tenant_id in JWT,
so get_tenant_id() defaulted to wrong tenant and RLS blocked all queries.

Fix: server Supabase client now forwards x-tenant-id header (set by
proxy.ts) to PostgREST. Updated get_tenant_id() reads request.headers
JSON as fallback when JWT has no tenant_id claim.

Priority chain: JWT claims > x-tenant-id header > default tenant.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: guillermoscript

lib/supabase/server.ts

@@ -1,5 +1,5 @@
 import { createServerClient } from '@supabase/ssr'
-import { cookies } from 'next/headers'
+import { cookies, headers } from 'next/headers'
 
 // Derive root domain for cross-subdomain cookie sharing
 function getCookieDomain(): string | undefined {
@@ -15,13 +15,23 @@ function getCookieDomain(): string | undefined {
  * function when using it.
  */
 export async function createClient() {
-  const cookieStore = await cookies()
+  const [cookieStore, headersList] = await Promise.all([cookies(), headers()])
   const cookieDomain = getCookieDomain()
+  const tenantId = headersList.get('x-tenant-id')
 
   return createServerClient(
     process.env.NEXT_PUBLIC_SUPABASE_URL!,
     process.env.NEXT_PUBLIC_SUPABASE_PUBLISHABLE_OR_ANON_KEY!,
     {
+      // Forward tenant ID to PostgREST so get_tenant_id() can read it
+      // via current_setting('request.header.x-tenant-id'). This is
+      // critical for anon users on non-default tenants where the JWT
+      // has no tenant_id claim.
+      global: {
+        headers: {
+          ...(tenantId ? { 'x-tenant-id': tenantId } : {}),
+        },
+      },
       cookies: {
         getAll() {
           return cookieStore.getAll()

supabase/migrations/20260406171518_fix_get_tenant_id_header_fallback.sql

@@ -0,0 +1,29 @@
+-- =============================================================================
+-- Fix get_tenant_id() to read x-tenant-id header as fallback for anon users
+--
+-- Problem: On non-default tenant subdomains, anon (unauthenticated) users have
+-- no tenant_id in their JWT claims. get_tenant_id() falls back to the default
+-- tenant UUID, which means RLS blocks all queries for the actual tenant.
+--
+-- Fix: Read x-tenant-id from the request headers JSON (set by proxy.ts and
+-- forwarded by the Supabase server client). PostgREST exposes all request
+-- headers via current_setting('request.headers', true) as a JSON object.
+--
+-- Priority: JWT claims > request header > default tenant
+-- =============================================================================
+
+CREATE OR REPLACE FUNCTION public.get_tenant_id()
+RETURNS uuid
+LANGUAGE sql
+STABLE
+SET search_path = ''
+AS $$
+  SELECT COALESCE(
+    -- 1. JWT claims (authenticated users with tenant context)
+    (current_setting('request.jwt.claims', true)::jsonb ->>'tenant_id')::uuid,
+    -- 2. Request header from proxy.ts (anon users on tenant subdomains)
+    (current_setting('request.headers', true)::json ->>'x-tenant-id')::uuid,
+    -- 3. Default tenant fallback
+    '00000000-0000-0000-0000-000000000001'::uuid
+  );
+$$;