fix(auth): pass user ID from middleware via header to eliminate redundant getUser() calls

The middleware already validates the token via getUser() — server components were
calling getUser() again (a network call each time), causing Supabase Auth rate limits.
Now passes x-user-id header from middleware, and getUserRole() + isSuperAdmin() read
from it instead of making redundant auth API calls.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: guillermoscript

lib/supabase/get-user-role.ts

@@ -1,29 +1,25 @@
 import { createClient } from '@/lib/supabase/server'
 import { createAdminClient } from '@/lib/supabase/admin'
-import { getCurrentTenantId } from '@/lib/supabase/tenant'
+import { getCurrentTenantId, getCurrentUserId } from '@/lib/supabase/tenant'
 
 /**
  * Get the user's role for the current tenant.
  * First checks tenant_users table (authoritative for multi-tenant),
  * then falls back to JWT claims.
+ *
+ * Uses x-user-id header (set by middleware) to avoid redundant getUser() calls.
  */
 export async function getUserRole(): Promise<'student' | 'teacher' | 'admin' | null> {
-  const supabase = await createClient()
-
-  const {
-    data: { user },
-  } = await supabase.auth.getUser()
-
-  if (!user) {
-    return null
-  }
+  const userId = await getCurrentUserId()
+  if (!userId) return null
 
   // Check tenant_users for the current tenant (authoritative source)
+  const supabase = await createClient()
   const tenantId = await getCurrentTenantId()
   const { data: membership } = await supabase
     .from('tenant_users')
     .select('role')
-    .eq('user_id', user.id)
+    .eq('user_id', userId)
     .eq('tenant_id', tenantId)
     .eq('status', 'active')
     .single()
@@ -79,17 +75,18 @@ export async function getUserTenantId(): Promise<string | null> {
 /**
  * Check if current user is a super admin by querying the super_admins table directly.
  * Does NOT trust JWT claims to prevent privilege escalation.
+ *
+ * Uses x-user-id header (set by middleware) to avoid redundant getUser() calls.
  */
 export async function isSuperAdmin(): Promise<boolean> {
-  const supabase = await createClient()
-  const { data: { user } } = await supabase.auth.getUser()
-  if (!user) return false
+  const userId = await getCurrentUserId()
+  if (!userId) return false
 
   const adminClient = createAdminClient()
   const { data } = await adminClient
     .from('super_admins')
     .select('user_id')
-    .eq('user_id', user.id)
+    .eq('user_id', userId)
     .maybeSingle()
 
   return !!data

lib/supabase/tenant.ts

@@ -61,6 +61,17 @@ export async function getCurrentTenantId(): Promise<string> {
   return headersList.get('x-tenant-id') || DEFAULT_TENANT_ID
 }
 
+/**
+ * Get the current user ID from headers (set by middleware after getUser() validation).
+ * Returns null for unauthenticated requests.
+ * Use this instead of supabase.auth.getUser() in server components to avoid
+ * redundant network calls to Supabase Auth (prevents rate limiting).
+ */
+export async function getCurrentUserId(): Promise<string | null> {
+  const headersList = await headers()
+  return headersList.get('x-user-id') || null
+}
+
 /**
  * Get the default tenant (for single-tenant backward compat).
  */

proxy.ts

@@ -219,9 +219,16 @@ export default async function proxy(request: NextRequest) {
   // Re-using the user here avoids a second getUser() network call.
   const { response: supabaseResponse, user } = await updateSession(request)
 
-  // Set tenant ID header on the response for downstream server components
+  // Set tenant + user ID headers on the response for downstream server components.
+  // This lets server components read the user ID from headers instead of calling
+  // getUser() again (which is a network call to Supabase Auth on every invocation).
   intlResponse.headers.set('x-tenant-id', tenantId)
   supabaseResponse.headers.set('x-tenant-id', tenantId)
+  if (user) {
+    request.headers.set('x-user-id', user.id)
+    intlResponse.headers.set('x-user-id', user.id)
+    supabaseResponse.headers.set('x-user-id', user.id)
+  }
 
   // Single Supabase client used for the rest of this middleware run.
   // getSession() reads from cookie (no network call) — safe because updateSession