workflow-cases, routing-rules: Sitzung und Bearer statt X-User-Id aus der URL

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

web/routing-rules/app/api/routing-rules/[id]/enabled/route.ts

@@ -1,4 +1,5 @@
 import { NextRequest, NextResponse } from "next/server";
+import { bearerHeader } from "../../../../../lib/forward";
 
 function backendURL(): string {
   const base = process.env.ROUTING_RULES_API_URL;
@@ -10,8 +11,9 @@ function backendURL(): string {
 
 export async function PUT(request: NextRequest, context: { params: Promise<{ id: string }> }) {
   const { id } = await context.params;
+  const bearer = bearerHeader(request);
   const userId = request.nextUrl.searchParams.get("userId");
-  if (!userId) {
+  if (!bearer && !userId) {
     return NextResponse.json({ error: "'userId' ist erforderlich" }, { status: 400 });
   }
   const payload = await request.json().catch(() => null);
@@ -22,7 +24,7 @@ export async function PUT(request: NextRequest, context: { params: Promise<{ id:
   try {
     backendResponse = await fetch(`${backendURL()}/routing-rules/${encodeURIComponent(id)}/enabled`, {
       method: "PUT",
-      headers: { "Content-Type": "application/json", "X-User-Id": userId },
+      headers: { "Content-Type": "application/json", ...(bearer ? { Authorization: bearer } : { "X-User-Id": userId as string }) },
       body: JSON.stringify(payload),
     });
   } catch (err) {

web/routing-rules/app/api/routing-rules/[id]/priority/route.ts

@@ -1,4 +1,5 @@
 import { NextRequest, NextResponse } from "next/server";
+import { bearerHeader } from "../../../../../lib/forward";
 
 function backendURL(): string {
   const base = process.env.ROUTING_RULES_API_URL;
@@ -10,8 +11,9 @@ function backendURL(): string {
 
 export async function PUT(request: NextRequest, context: { params: Promise<{ id: string }> }) {
   const { id } = await context.params;
+  const bearer = bearerHeader(request);
   const userId = request.nextUrl.searchParams.get("userId");
-  if (!userId) {
+  if (!bearer && !userId) {
     return NextResponse.json({ error: "'userId' ist erforderlich" }, { status: 400 });
   }
   const payload = await request.json().catch(() => null);
@@ -22,7 +24,7 @@ export async function PUT(request: NextRequest, context: { params: Promise<{ id:
   try {
     backendResponse = await fetch(`${backendURL()}/routing-rules/${encodeURIComponent(id)}/priority`, {
       method: "PUT",
-      headers: { "Content-Type": "application/json", "X-User-Id": userId },
+      headers: { "Content-Type": "application/json", ...(bearer ? { Authorization: bearer } : { "X-User-Id": userId as string }) },
       body: JSON.stringify(payload),
     });
   } catch (err) {

web/routing-rules/app/api/routing-rules/route.test.ts

@@ -58,3 +58,26 @@ describe("POST /api/routing-rules", () => {
     expect(res.status).toBe(400);
   });
 });
+
+
+describe("Bearer routing-rules", () => {
+  const originalFetch = global.fetch;
+  const originalEnv = process.env.ROUTING_RULES_API_URL;
+  afterEach(() => {
+    global.fetch = originalFetch;
+    process.env.ROUTING_RULES_API_URL = originalEnv;
+  });
+
+  it("leitet Authorization weiter und sendet keine X-User-Id", async () => {
+    process.env.ROUTING_RULES_API_URL = "http://backend.local";
+    let h: Headers | undefined;
+    global.fetch = vi.fn(async (_url: string | URL, init?: RequestInit) => {
+      h = new Headers(init?.headers);
+      return new Response(JSON.stringify([]), { status: 200 });
+    }) as typeof fetch;
+    const res = await GET(new NextRequest("http://localhost/api/routing-rules?userId=fremd", { headers: { authorization: "Bearer tok" } }));
+    expect(res.status).toBe(200);
+    expect(h?.get("authorization")).toBe("Bearer tok");
+    expect(h?.get("x-user-id")).toBeNull();
+  });
+});

web/routing-rules/app/api/routing-rules/route.ts

@@ -1,4 +1,5 @@
 import { NextRequest, NextResponse } from "next/server";
+import { bearerHeader } from "../../../lib/forward";
 
 function backendURL(): string {
   const base = process.env.ROUTING_RULES_API_URL;
@@ -13,14 +14,15 @@ function requireUserID(request: NextRequest): string | null {
 }
 
 export async function GET(request: NextRequest) {
+  const bearer = bearerHeader(request);
   const userId = requireUserID(request);
-  if (!userId) {
+  if (!bearer && !userId) {
     return NextResponse.json({ error: "'userId' ist erforderlich" }, { status: 400 });
   }
   let backendResponse: Response;
   try {
     backendResponse = await fetch(`${backendURL()}/routing-rules`, {
-      headers: { "X-User-Id": userId },
+      headers: { ...(bearer ? { Authorization: bearer } : { "X-User-Id": userId as string }) },
       cache: "no-store",
     });
   } catch (err) {
@@ -34,8 +36,9 @@ export async function GET(request: NextRequest) {
 }
 
 export async function POST(request: NextRequest) {
+  const bearer = bearerHeader(request);
   const userId = requireUserID(request);
-  if (!userId) {
+  if (!bearer && !userId) {
     return NextResponse.json({ error: "'userId' ist erforderlich" }, { status: 400 });
   }
   const payload = await request.json().catch(() => null);
@@ -46,7 +49,7 @@ export async function POST(request: NextRequest) {
   try {
     backendResponse = await fetch(`${backendURL()}/routing-rules`, {
       method: "POST",
-      headers: { "Content-Type": "application/json", "X-User-Id": userId },
+      headers: { "Content-Type": "application/json", ...(bearer ? { Authorization: bearer } : { "X-User-Id": userId as string }) },
       body: JSON.stringify(payload),
     });
   } catch (err) {

web/routing-rules/app/api/routing-rules/test/route.ts

@@ -1,4 +1,5 @@
 import { NextRequest, NextResponse } from "next/server";
+import { bearerHeader } from "../../../../lib/forward";
 
 function backendURL(): string {
   const base = process.env.ROUTING_RULES_API_URL;
@@ -9,8 +10,9 @@ function backendURL(): string {
 }
 
 export async function POST(request: NextRequest) {
+  const bearer = bearerHeader(request);
   const userId = request.nextUrl.searchParams.get("userId");
-  if (!userId) {
+  if (!bearer && !userId) {
     return NextResponse.json({ error: "'userId' ist erforderlich" }, { status: 400 });
   }
   const payload = await request.json().catch(() => null);
@@ -21,7 +23,7 @@ export async function POST(request: NextRequest) {
   try {
     backendResponse = await fetch(`${backendURL()}/routing-rules/test`, {
       method: "POST",
-      headers: { "Content-Type": "application/json", "X-User-Id": userId },
+      headers: { "Content-Type": "application/json", ...(bearer ? { Authorization: bearer } : { "X-User-Id": userId as string }) },
       body: JSON.stringify(payload),
     });
   } catch (err) {

web/routing-rules/app/page.tsx

@@ -1,13 +1,18 @@
 "use client";
 
-import { Suspense } from "react";
+import { Suspense, useEffect, useState } from "react";
 import { useSearchParams } from "next/navigation";
 import { TextField } from "@nexarch/shl";
 import { RuleEditor } from "./RuleEditor";
+import { bearerEnabled, sessionUserId } from "../lib/http";
 
 function RulesPage() {
   const params = useSearchParams();
-  const userId = params.get("user") ?? "";
+  const [sessionUser, setSessionUser] = useState("");
+  useEffect(() => {
+    sessionUserId().then(setSessionUser).catch(() => {});
+  }, []);
+  const userId = bearerEnabled() ? sessionUser : (params.get("user") ?? "");
 
   return (
     <main style={{ maxWidth: 1100, margin: "0 auto", padding: 24 }}>

web/routing-rules/lib/api.ts

@@ -2,6 +2,8 @@
 // app/api — kein direkter Zugriff auf die Workflow-API vom Client aus,
 // gleiches Muster wie web/workflow-cases/web/workflow-approvals.
 
+import { apiFetch } from "./http";
+
 export class ApiError extends Error {
   status: number;
   constructor(message: string, status: number) {
@@ -60,12 +62,12 @@ async function handle<T>(res: Response): Promise<T> {
 }
 
 export async function listRules(userId: string): Promise<Rule[]> {
-  const res = await fetch(`/api/routing-rules?userId=${encodeURIComponent(userId)}`, { cache: "no-store" });
+  const res = await apiFetch(`/api/routing-rules?userId=${encodeURIComponent(userId)}`, { cache: "no-store" });
   return handle<Rule[]>(res);
 }
 
 export async function createRule(userId: string, input: { name: string; priority: number; conditions: Condition[]; actions: Action[] }): Promise<Rule> {
-  const res = await fetch(`/api/routing-rules?userId=${encodeURIComponent(userId)}`, {
+  const res = await apiFetch(`/api/routing-rules?userId=${encodeURIComponent(userId)}`, {
     method: "POST",
     headers: { "Content-Type": "application/json" },
     body: JSON.stringify(input),
@@ -74,7 +76,7 @@ export async function createRule(userId: string, input: { name: string; priority
 }
 
 export async function setPriority(userId: string, id: string, priority: number): Promise<void> {
-  const res = await fetch(`/api/routing-rules/${encodeURIComponent(id)}/priority?userId=${encodeURIComponent(userId)}`, {
+  const res = await apiFetch(`/api/routing-rules/${encodeURIComponent(id)}/priority?userId=${encodeURIComponent(userId)}`, {
     method: "PUT",
     headers: { "Content-Type": "application/json" },
     body: JSON.stringify({ priority }),
@@ -85,7 +87,7 @@ export async function setPriority(userId: string, id: string, priority: number):
 }
 
 export async function setEnabled(userId: string, id: string, enabled: boolean): Promise<void> {
-  const res = await fetch(`/api/routing-rules/${encodeURIComponent(id)}/enabled?userId=${encodeURIComponent(userId)}`, {
+  const res = await apiFetch(`/api/routing-rules/${encodeURIComponent(id)}/enabled?userId=${encodeURIComponent(userId)}`, {
     method: "PUT",
     headers: { "Content-Type": "application/json" },
     body: JSON.stringify({ enabled }),
@@ -96,7 +98,7 @@ export async function setEnabled(userId: string, id: string, enabled: boolean):
 }
 
 export async function testRule(userId: string, object: Record<string, unknown>, history?: string[]): Promise<TestResult> {
-  const res = await fetch(`/api/routing-rules/test?userId=${encodeURIComponent(userId)}`, {
+  const res = await apiFetch(`/api/routing-rules/test?userId=${encodeURIComponent(userId)}`, {
     method: "POST",
     headers: { "Content-Type": "application/json" },
     body: JSON.stringify({ object, history }),

web/routing-rules/lib/forward.ts

@@ -0,0 +1,6 @@
+import type { NextRequest } from "next/server";
+
+export function bearerHeader(request: NextRequest): string | null {
+  const auth = request.headers.get("authorization") ?? "";
+  return auth.startsWith("Bearer ") && auth.length > 7 ? auth : null;
+}

web/routing-rules/lib/http.ts

@@ -0,0 +1,29 @@
+import { createSession, redirectToLogin, type Session } from "@nexarch/shl";
+
+let session: Session | undefined;
+
+export function bearerEnabled(): boolean {
+  return Boolean(process.env.NEXT_PUBLIC_CORE_API_BASE);
+}
+
+export function getSession(): Session {
+  if (!session) {
+    session = createSession({
+      coreBase: process.env.NEXT_PUBLIC_CORE_API_BASE as string,
+      module: "workflow",
+      onLoginRequired: () => redirectToLogin(process.env.NEXT_PUBLIC_LOGIN_URL),
+    });
+  }
+  return session;
+}
+
+export function apiFetch(input: RequestInfo | URL, init?: RequestInit): Promise<Response> {
+  return bearerEnabled() ? getSession().fetch(input, init) : fetch(input, init);
+}
+
+export async function sessionUserId(): Promise<string> {
+  if (!bearerEnabled()) return "";
+  const s = getSession();
+  await s.token();
+  return s.identity()?.userId ?? "";
+}

web/workflow-cases/app/api/cases/[id]/overview/route.ts

@@ -1,4 +1,5 @@
 import { NextRequest, NextResponse } from "next/server";
+import { bearerHeader } from "../../../../../lib/forward";
 
 function backendURL(): string {
   const base = process.env.WORKFLOW_CASES_API_URL;
@@ -10,15 +11,16 @@ function backendURL(): string {
 
 export async function GET(request: NextRequest, { params }: { params: Promise<{ id: string }> }) {
   const { id } = await params;
+  const bearer = bearerHeader(request);
   const userId = request.nextUrl.searchParams.get("userId");
-  if (!userId) {
+  if (!bearer && !userId) {
     return NextResponse.json({ error: "'userId' ist erforderlich" }, { status: 400 });
   }
 
   let backendResponse: Response;
   try {
     backendResponse = await fetch(`${backendURL()}/cases/${encodeURIComponent(id)}/overview`, {
-      headers: { "X-User-Id": userId },
+      headers: { ...(bearer ? { Authorization: bearer } : { "X-User-Id": userId as string }) },
       cache: "no-store",
     });
   } catch (err) {

web/workflow-cases/app/api/cases/route.test.ts

@@ -39,3 +39,26 @@ describe("GET /api/cases", () => {
     expect(capturedHeaders?.get("X-User-Id")).toBe("alice");
   });
 });
+
+
+describe("Bearer cases", () => {
+  const originalFetch = global.fetch;
+  const originalEnv = process.env.WORKFLOW_CASES_API_URL;
+  afterEach(() => {
+    global.fetch = originalFetch;
+    process.env.WORKFLOW_CASES_API_URL = originalEnv;
+  });
+
+  it("leitet Authorization weiter und sendet keine X-User-Id", async () => {
+    process.env.WORKFLOW_CASES_API_URL = "http://backend.local";
+    let h: Headers | undefined;
+    global.fetch = vi.fn(async (_url: string | URL, init?: RequestInit) => {
+      h = new Headers(init?.headers);
+      return new Response(JSON.stringify([]), { status: 200 });
+    }) as typeof fetch;
+    const res = await GET(new NextRequest("http://localhost/api/cases?userId=fremd", { headers: { authorization: "Bearer tok" } }));
+    expect(res.status).toBe(200);
+    expect(h?.get("authorization")).toBe("Bearer tok");
+    expect(h?.get("x-user-id")).toBeNull();
+  });
+});

web/workflow-cases/app/api/cases/route.ts

@@ -1,4 +1,5 @@
 import { NextRequest, NextResponse } from "next/server";
+import { bearerHeader } from "../../../lib/forward";
 
 function backendURL(): string {
   const base = process.env.WORKFLOW_CASES_API_URL;
@@ -9,8 +10,9 @@ function backendURL(): string {
 }
 
 export async function GET(request: NextRequest) {
+  const bearer = bearerHeader(request);
   const userId = request.nextUrl.searchParams.get("userId");
-  if (!userId) {
+  if (!bearer && !userId) {
     return NextResponse.json({ error: "'userId' ist erforderlich" }, { status: 400 });
   }
   const status = request.nextUrl.searchParams.get("status") ?? "";
@@ -22,7 +24,7 @@ export async function GET(request: NextRequest) {
   let backendResponse: Response;
   try {
     backendResponse = await fetch(`${backendURL()}/cases?${params.toString()}`, {
-      headers: { "X-User-Id": userId },
+      headers: { ...(bearer ? { Authorization: bearer } : { "X-User-Id": userId as string }) },
       cache: "no-store",
     });
   } catch (err) {

web/workflow-cases/app/api/reminders/[id]/move/route.ts

@@ -1,4 +1,5 @@
 import { NextRequest, NextResponse } from "next/server";
+import { bearerHeader } from "../../../../../lib/forward";
 
 function backendURL(): string {
   const base = process.env.WORKFLOW_CASES_API_URL;
@@ -10,8 +11,9 @@ function backendURL(): string {
 
 export async function POST(request: NextRequest, { params }: { params: Promise<{ id: string }> }) {
   const { id } = await params;
+  const bearer = bearerHeader(request);
   const userId = request.nextUrl.searchParams.get("userId");
-  if (!userId) {
+  if (!bearer && !userId) {
     return NextResponse.json({ error: "'userId' ist erforderlich" }, { status: 400 });
   }
   const payload = await request.json().catch(() => null);
@@ -23,7 +25,7 @@ export async function POST(request: NextRequest, { params }: { params: Promise<{
   try {
     backendResponse = await fetch(`${backendURL()}/reminders/${encodeURIComponent(id)}/move`, {
       method: "POST",
-      headers: { "X-User-Id": userId, "Content-Type": "application/json" },
+      headers: { ...(bearer ? { Authorization: bearer } : { "X-User-Id": userId as string }), "Content-Type": "application/json" },
       body: JSON.stringify({ target: payload.target }),
     });
   } catch (err) {

web/workflow-cases/app/api/reminders/kanban/route.ts

@@ -1,4 +1,5 @@
 import { NextRequest, NextResponse } from "next/server";
+import { bearerHeader } from "../../../../lib/forward";
 
 function backendURL(): string {
   const base = process.env.WORKFLOW_CASES_API_URL;
@@ -9,15 +10,16 @@ function backendURL(): string {
 }
 
 export async function GET(request: NextRequest) {
+  const bearer = bearerHeader(request);
   const userId = request.nextUrl.searchParams.get("userId");
-  if (!userId) {
+  if (!bearer && !userId) {
     return NextResponse.json({ error: "'userId' ist erforderlich" }, { status: 400 });
   }
 
   let backendResponse: Response;
   try {
     backendResponse = await fetch(`${backendURL()}/reminders/kanban`, {
-      headers: { "X-User-Id": userId },
+      headers: { ...(bearer ? { Authorization: bearer } : { "X-User-Id": userId as string }) },
       cache: "no-store",
     });
   } catch (err) {

web/workflow-cases/app/page.tsx

@@ -1,16 +1,21 @@
 "use client";
 
-import { Suspense, useState } from "react";
+import { Suspense, useEffect, useState } from "react";
 import { useSearchParams } from "next/navigation";
 import { TextField } from "@nexarch/shl";
 import { CaseOverview } from "./CaseOverview";
 import { ReminderKanban } from "./ReminderKanban";
+import { bearerEnabled, sessionUserId } from "../lib/http";
 
 type Tab = "cases" | "kanban";
 
 function CasesPage() {
   const params = useSearchParams();
-  const userId = params.get("user") ?? "";
+  const [sessionUser, setSessionUser] = useState("");
+  useEffect(() => {
+    sessionUserId().then(setSessionUser).catch(() => {});
+  }, []);
+  const userId = bearerEnabled() ? sessionUser : (params.get("user") ?? "");
   const [tab, setTab] = useState<Tab>("cases");
 
   return (

web/workflow-cases/lib/api.ts

@@ -3,6 +3,8 @@
 // (Rolle: "Alle Daten ausschliesslich ueber die oeffentliche
 // Schnittstelle beziehen"), gleiches Muster wie web/workflow-approvals.
 
+import { apiFetch } from "./http";
+
 export class ApiError extends Error {
   status: number;
   constructor(message: string, status: number) {
@@ -72,24 +74,24 @@ export async function listCases(userId: string, status: string, responsible: str
   const params = new URLSearchParams({ userId });
   if (status) params.set("status", status);
   if (responsible) params.set("responsible", responsible);
-  const res = await fetch(`/api/cases?${params.toString()}`, { cache: "no-store" });
+  const res = await apiFetch(`/api/cases?${params.toString()}`, { cache: "no-store" });
   return parse<Case[]>(res, "Akten konnten nicht geladen werden");
 }
 
 export async function getCaseDetail(userId: string, id: string): Promise<CaseDetail> {
-  const res = await fetch(`/api/cases/${encodeURIComponent(id)}/overview?userId=${encodeURIComponent(userId)}`, {
+  const res = await apiFetch(`/api/cases/${encodeURIComponent(id)}/overview?userId=${encodeURIComponent(userId)}`, {
     cache: "no-store",
   });
   return parse<CaseDetail>(res, "Akte konnte nicht geladen werden");
 }
 
 export async function listKanban(userId: string): Promise<KanbanItem[]> {
-  const res = await fetch(`/api/reminders/kanban?userId=${encodeURIComponent(userId)}`, { cache: "no-store" });
+  const res = await apiFetch(`/api/reminders/kanban?userId=${encodeURIComponent(userId)}`, { cache: "no-store" });
   return parse<KanbanItem[]>(res, "Wiedervorlagen konnten nicht geladen werden");
 }
 
 export async function moveReminder(userId: string, id: string, target: KanbanColumn): Promise<void> {
-  const res = await fetch(`/api/reminders/${encodeURIComponent(id)}/move?userId=${encodeURIComponent(userId)}`, {
+  const res = await apiFetch(`/api/reminders/${encodeURIComponent(id)}/move?userId=${encodeURIComponent(userId)}`, {
     method: "POST",
     headers: { "Content-Type": "application/json" },
     body: JSON.stringify({ target }),

web/workflow-cases/lib/forward.ts

@@ -0,0 +1,6 @@
+import type { NextRequest } from "next/server";
+
+export function bearerHeader(request: NextRequest): string | null {
+  const auth = request.headers.get("authorization") ?? "";
+  return auth.startsWith("Bearer ") && auth.length > 7 ? auth : null;
+}

web/workflow-cases/lib/http.ts

@@ -0,0 +1,29 @@
+import { createSession, redirectToLogin, type Session } from "@nexarch/shl";
+
+let session: Session | undefined;
+
+export function bearerEnabled(): boolean {
+  return Boolean(process.env.NEXT_PUBLIC_CORE_API_BASE);
+}
+
+export function getSession(): Session {
+  if (!session) {
+    session = createSession({
+      coreBase: process.env.NEXT_PUBLIC_CORE_API_BASE as string,
+      module: "workflow",
+      onLoginRequired: () => redirectToLogin(process.env.NEXT_PUBLIC_LOGIN_URL),
+    });
+  }
+  return session;
+}
+
+export function apiFetch(input: RequestInfo | URL, init?: RequestInit): Promise<Response> {
+  return bearerEnabled() ? getSession().fetch(input, init) : fetch(input, init);
+}
+
+export async function sessionUserId(): Promise<string> {
+  if (!bearerEnabled()) return "";
+  const s = getSession();
+  await s.token();
+  return s.identity()?.userId ?? "";
+}