Merge pull request #326 from guillermoscript/feat/chat-bearer-auth

feat(api): Bearer-token auth + JWT tenant resolution for chat routes (mobile app backend)

Author: guillermoscript

app/[locale]/dashboard/student/browse/page.tsx

@@ -9,6 +9,12 @@ import Link from 'next/link'
 import { IconAlertCircle, IconSparkles, IconTrophy, IconSearch } from '@tabler/icons-react'
 import {getCurrentTenantId, getCurrentUserId } from '@/lib/supabase/tenant'
 import { fetchAccessibleCourseIds } from '@/lib/services/course-access'
+import {
+  getPublishedCourses,
+  getCourseCategories,
+  getActiveSubscriptions,
+  getPlanCourses,
+} from '@lms/core'
 
 export default async function BrowseCoursesPage({
   searchParams,
@@ -28,50 +34,14 @@ export default async function BrowseCoursesPage({
     redirect('/auth/login')
   }
 
-  // Build course query with filters
-  let query = supabase
-    .from('courses')
-    .select(`
-      course_id,
-      title,
-      description,
-      thumbnail_url,
-      tags,
-      category_id
-    `)
-    .eq('tenant_id', tenantId)
-    .eq('status', 'published')
-    .order('title', { ascending: true })
-
-  // Apply search filter
-  if (sanitizedSearch) {
-    query = query.or(`title.ilike.%${sanitizedSearch}%,description.ilike.%${sanitizedSearch}%`)
-  }
-
-  // Apply category filter
-  if (category) {
-    query = query.eq('category_id', category)
-  }
-
-  // Parallelize 4 independent queries
+  // Parallelize 4 independent queries — shared query logic from @lms/core
   const [{ data: subscriptions }, { data: categories }, { data: courses }, accessibleCourseIds] = await Promise.all([
-    supabase.from('subscriptions').select(`
-      subscription_id,
-      subscription_status,
-      end_date,
-      plan:plans!subscriptions_plan_id_fkey (
-        plan_id,
-        plan_name,
-        price
-      )
-    `)
-      .eq('user_id', userId).eq('tenant_id', tenantId)
-      .eq('subscription_status', 'active')
-      .gte('end_date', new Date().toISOString())
-      .order('end_date', { ascending: false }),
-    supabase.from('course_categories').select('id, name')
-      .eq('tenant_id', tenantId).order('name'),
-    query,
+    getActiveSubscriptions(supabase, userId, tenantId),
+    getCourseCategories(supabase, tenantId),
+    getPublishedCourses(supabase, tenantId, {
+      search: sanitizedSearch || undefined,
+      categoryId: category ? Number(category) : undefined,
+    }),
     // "Already enrolled" set — entitlements model (any active access source).
     fetchAccessibleCourseIds(supabase, userId),
   ])
@@ -83,10 +53,7 @@ export default async function BrowseCoursesPage({
   if (activeSubscription) {
     const planId = (activeSubscription.plan as any)?.plan_id
     if (planId) {
-      const { data: planCourses } = await supabase
-        .from('plan_courses')
-        .select('course_id')
-        .eq('plan_id', planId)
+      const { data: planCourses } = await getPlanCourses(supabase, planId)
 
       if (planCourses && planCourses.length > 0) {
         allowedCourseIds = new Set(planCourses.map(pc => pc.course_id))

app/[locale]/dashboard/student/courses/[courseId]/exercises/[exerciseId]/page.tsx

@@ -247,7 +247,6 @@ export default async function ExercisePage({ params }: PageProps) {
                         exerciseId={exercise.id}
                         isExerciseCompleted={isExerciseCompleted}
                         userCode={lastSubmission?.submission_code}
-                        tenantId={tenantId}
                     />
 
                     {otherExercises && otherExercises.length > 0 && (

app/[locale]/dashboard/student/courses/[courseId]/lessons/[lessonId]/page.tsx

@@ -371,7 +371,7 @@ export default async function LessonPage({ params }: PageProps) {
 
             {/* Comments Section */}
             <section className="border-t pt-10">
-              <LessonComments lessonId={lesson.id} userId={userId} tenantId={tenantId} initialComments={initialComments} />
+              <LessonComments lessonId={lesson.id} userId={userId} initialComments={initialComments} />
             </section>
           </div>
         </div>

app/[locale]/dashboard/student/courses/page.tsx

@@ -9,6 +9,13 @@ import Link from 'next/link'
 import {getCurrentTenantId, getCurrentUserId } from '@/lib/supabase/tenant'
 import { fetchCourseAccessMap } from '@/lib/services/course-access'
 import type { CourseAccess } from '@/lib/services/enrollment-service'
+import {
+  getCoursesByIds,
+  getLessonsByCourseIds,
+  getExamsByCourseIds,
+  getLessonCompletions,
+  getExamSubmissions,
+} from '@lms/core'
 
 const NO_ACCESS: CourseAccess = {
   hasAccess: false,
@@ -62,16 +69,11 @@ export default async function MyCoursesPage({ searchParams }: PageProps) {
       { data: lessonCompletions },
       { data: examSubmissions },
     ] = await Promise.all([
-      supabase.from('courses').select('course_id, title, description, thumbnail_url, status')
-        .in('course_id', courseIds).eq('tenant_id', tenantId),
-      supabase.from('lessons').select('id, title, sequence, course_id')
-        .in('course_id', courseIds).eq('tenant_id', tenantId),
-      supabase.from('exams').select('exam_id, title, sequence, course_id')
-        .in('course_id', courseIds).eq('tenant_id', tenantId),
-      supabase.from('lesson_completions').select('lesson_id, completed_at')
-        .eq('user_id', userId),
-      supabase.from('exam_submissions').select('submission_id, exam_id, submission_date, score')
-        .eq('student_id', userId).eq('tenant_id', tenantId),
+      getCoursesByIds(supabase, courseIds, tenantId),
+      getLessonsByCourseIds(supabase, courseIds, tenantId),
+      getExamsByCourseIds(supabase, courseIds, tenantId),
+      getLessonCompletions(supabase, userId),
+      getExamSubmissions(supabase, userId, tenantId),
     ])
 
     // Build lookup maps

app/[locale]/dashboard/student/page.tsx

@@ -13,6 +13,7 @@ import { MiniLeaderboard } from '@/components/gamification/mini-leaderboard'
 import { getCurrentTenantId, getSessionUser } from '@/lib/supabase/tenant'
 import { OnboardingChecklist } from '@/components/shared/onboarding-checklist'
 import { StudentDashboardTour } from '@/components/tours/student-dashboard-tour'
+import { getLessonCompletions } from '@lms/core'
 
 async function getData(userId: string, tenantId: string) {
   const supabase = createAdminClient()
@@ -44,10 +45,7 @@ async function getData(userId: string, tenantId: string) {
       .order('submission_date', { ascending: false })
       .limit(5),
 
-    supabase
-      .from('lesson_completions')
-      .select('lesson_id')
-      .eq('user_id', userId),
+    getLessonCompletions(supabase, userId),
 
     supabase
       .from('exams')

app/api/chat/aristotle/restart/route.ts

@@ -1,13 +1,10 @@
-import { createClient } from '@/lib/supabase/server'
-import { getCurrentTenantId } from '@/lib/supabase/tenant'
+import { getApiAuthContext } from '@/lib/supabase/api-auth'
 import { generateSessionSummary } from '@/lib/ai/aristotle-summary'
 
 export async function POST(req: Request) {
-    const supabase = await createClient()
-    const tenantId = await getCurrentTenantId()
-    const { data: { user } } = await supabase.auth.getUser()
-
-    if (!user) return new Response('Unauthorized', { status: 401 })
+    const auth = await getApiAuthContext(req)
+    if (!auth) return new Response('Unauthorized', { status: 401 })
+    const { supabase, user, tenantId } = auth
 
     const { courseId } = await req.json()
     if (!courseId) return new Response('Course ID is required', { status: 400 })

app/api/chat/aristotle/route.ts

@@ -1,5 +1,4 @@
-import { createClient } from '@/lib/supabase/server'
-import { getCurrentTenantId } from '@/lib/supabase/tenant'
+import { getApiAuthContext } from '@/lib/supabase/api-auth'
 import { AI_CONFIG, AI_MODELS } from '@/lib/ai/config'
 import { buildAristotlePrompt } from '@/lib/ai/aristotle-prompt'
 import { convertToModelMessages, stepCountIs, streamText } from 'ai'
@@ -10,11 +9,9 @@ export const maxDuration = 120
 const SESSION_IDLE_MINUTES = 30
 
 export async function POST(req: Request) {
-    const supabase = await createClient()
-    const tenantId = await getCurrentTenantId()
-    const { data: { user } } = await supabase.auth.getUser()
-
-    if (!user) return new Response('Unauthorized', { status: 401 })
+    const auth = await getApiAuthContext(req)
+    if (!auth) return new Response('Unauthorized', { status: 401 })
+    const { supabase, user, tenantId } = auth
 
     const body = await req.json()
     const { messages, courseId, contextPage } = body

app/api/chat/exercises/student/restart/route.ts

@@ -1,16 +1,13 @@
-import { createClient } from '@/lib/supabase/server'
-import { getCurrentTenantId } from '@/lib/supabase/tenant'
+import { getApiAuthContext } from '@/lib/supabase/api-auth'
 import { NextResponse } from 'next/server'
 
 export async function POST(req: Request) {
     try {
-        const supabase = await createClient()
-        const tenantId = await getCurrentTenantId()
-        const { data: { user } } = await supabase.auth.getUser()
-
-        if (!user) {
+        const auth = await getApiAuthContext(req)
+        if (!auth) {
             return new NextResponse('Unauthorized', { status: 401 })
         }
+        const { supabase, user, tenantId } = auth
 
         const { exerciseId } = await req.json()
 

app/api/chat/exercises/student/route.ts

@@ -1,5 +1,4 @@
-import { createClient } from '@/lib/supabase/server'
-import { getCurrentTenantId } from '@/lib/supabase/tenant'
+import { getApiAuthContext } from '@/lib/supabase/api-auth'
 import { AI_CONFIG, AI_MODELS } from '@/lib/ai/config'
 import { PROMPTS } from '@/lib/ai/prompts'
 import { createAITools } from '@/lib/ai/tools'
@@ -8,11 +7,9 @@ import { convertToModelMessages, stepCountIs, streamText } from 'ai'
 export const maxDuration = 120
 
 export async function POST(req: Request) {
-    const supabase = await createClient()
-    const tenantId = await getCurrentTenantId()
-    const { data: { user } } = await supabase.auth.getUser()
-
-    if (!user) return new Response('Unauthorized', { status: 401 })
+    const auth = await getApiAuthContext(req)
+    if (!auth) return new Response('Unauthorized', { status: 401 })
+    const { supabase, user, tenantId } = auth
 
     const { messages, exerciseId } = await req.json()
     if (!exerciseId) return new Response('Exercise ID is required', { status: 400 })
@@ -29,13 +26,21 @@ export async function POST(req: Request) {
     // 2. Save user message
     const lastUserMessage = messages[messages.length - 1]
     if (lastUserMessage?.role === 'user') {
-        await supabase.from('exercise_messages').insert({
-            exercise_id: exerciseId,
-            user_id: user.id,
-            role: 'user',
-            message: lastUserMessage.content,
-            tenant_id: tenantId,
-        })
+        // AI SDK v6 messages carry text in `parts`, not `content`
+        const messageText = lastUserMessage.parts
+            ?.filter((part: any) => part.type === 'text')
+            .map((part: any) => part.text)
+            .join(' ') || lastUserMessage.content || ''
+
+        if (messageText) {
+            // exercise_messages has NO tenant_id column — sending it silently fails the insert.
+            await supabase.from('exercise_messages').insert({
+                exercise_id: exerciseId,
+                user_id: user.id,
+                role: 'user',
+                message: messageText,
+            })
+        }
     }
 
     // 3. Stream Response
@@ -51,7 +56,6 @@ export async function POST(req: Request) {
                 user_id: user.id,
                 role: 'assistant',
                 message: event.text,
-                tenant_id: tenantId,
             })
         },
         stopWhen: stepCountIs(AI_CONFIG.maxSteps),

app/api/chat/lesson-task/restart/route.ts

@@ -1,16 +1,13 @@
-import { createClient } from '@/lib/supabase/server'
-import { getCurrentTenantId } from '@/lib/supabase/tenant'
+import { getApiAuthContext } from '@/lib/supabase/api-auth'
 import { NextResponse } from 'next/server'
 
 export async function POST(req: Request) {
     try {
-        const supabase = await createClient()
-        const tenantId = await getCurrentTenantId()
-        const { data: { user } } = await supabase.auth.getUser()
-
-        if (!user) {
+        const auth = await getApiAuthContext(req)
+        if (!auth) {
             return new NextResponse('Unauthorized', { status: 401 })
         }
+        const { supabase, user, tenantId } = auth
 
         const { lessonId } = await req.json()