From 759c725793c586cf2e3ddb4913830b1381c3eaae Mon Sep 17 00:00:00 2001
From: Benjamin Admin <benjaminadmin@MacBook-Pro.local>
Date: Thu, 26 Feb 2026 12:05:08 +0100
Subject: [PATCH] fix(proxy): add default X-User-ID and X-Tenant-ID headers to
 API proxies

Both academy and training proxy routes now set default identity headers
so the Go backend RBAC middleware can set the tenant context. Without
these defaults, the browser doesn't send X-User-ID and modules/courses
return empty.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---
 .../app/api/sdk/v1/academy/[[...path]]/route.ts           | 8 +++++---
 .../app/api/sdk/v1/training/[[...path]]/route.ts          | 6 +++++-
 2 files changed, 10 insertions(+), 4 deletions(-)

diff --git a/admin-compliance/app/api/sdk/v1/academy/[[...path]]/route.ts b/admin-compliance/app/api/sdk/v1/academy/[[...path]]/route.ts
index 6af67ab..63b0a78 100644
--- a/admin-compliance/app/api/sdk/v1/academy/[[...path]]/route.ts
+++ b/admin-compliance/app/api/sdk/v1/academy/[[...path]]/route.ts
@@ -29,10 +29,12 @@ async function proxyRequest(
       headers['Authorization'] = authHeader
     }
 
+    // Forward identity headers for RBAC context
+    const userHeader = request.headers.get('x-user-id')
+    headers['X-User-ID'] = userHeader || '00000000-0000-0000-0000-000000000001'
+
     const tenantHeader = request.headers.get('x-tenant-id')
-    if (tenantHeader) {
-      headers['X-Tenant-Id'] = tenantHeader
-    }
+    headers['X-Tenant-ID'] = tenantHeader || (process.env.DEFAULT_TENANT_ID || '9282a473-5c95-4b3a-bf78-0ecc0ec71d3e')
 
     const fetchOptions: RequestInit = {
       method,
diff --git a/admin-compliance/app/api/sdk/v1/training/[[...path]]/route.ts b/admin-compliance/app/api/sdk/v1/training/[[...path]]/route.ts
index bc33fe8..c9cfd43 100644
--- a/admin-compliance/app/api/sdk/v1/training/[[...path]]/route.ts
+++ b/admin-compliance/app/api/sdk/v1/training/[[...path]]/route.ts
@@ -24,7 +24,7 @@ async function proxyRequest(
       'Content-Type': 'application/json',
     }
 
-    const headerNames = ['authorization', 'x-tenant-id', 'x-user-id', 'x-namespace-id', 'x-tenant-slug']
+    const headerNames = ['authorization', 'x-namespace-id', 'x-tenant-slug']
     for (const name of headerNames) {
       const value = request.headers.get(name)
       if (value) {
@@ -32,6 +32,10 @@ async function proxyRequest(
       }
     }
 
+    // Forward identity headers with defaults for RBAC context
+    headers['X-User-ID'] = request.headers.get('x-user-id') || '00000000-0000-0000-0000-000000000001'
+    headers['X-Tenant-ID'] = request.headers.get('x-tenant-id') || (process.env.DEFAULT_TENANT_ID || '9282a473-5c95-4b3a-bf78-0ecc0ec71d3e')
+
     const fetchOptions: RequestInit = {
       method,
       headers,