Added auth interceptor to fetch

X-Lovable-Edit-ID: edt-a45f60f0-c32e-4a69-8470-1f2eba431711

src/integrations/supabase/server-fn-fetch.ts

@@ -0,0 +1,40 @@
+// Attaches the current Supabase access token to every TanStack server-fn request.
+// Server functions are protected by `requireSupabaseAuth`, which expects a
+// `Authorization: Bearer <jwt>` header. The default useServerFn fetch does
+// not forward auth, so we patch window.fetch once on the client.
+import { supabase } from "./client";
+
+let installed = false;
+
+export function installServerFnAuthFetch() {
+  if (installed || typeof window === "undefined") return;
+  installed = true;
+
+  const originalFetch = window.fetch.bind(window);
+
+  window.fetch = async (input: RequestInfo | URL, init?: RequestInit) => {
+    try {
+      const url =
+        typeof input === "string"
+          ? input
+          : input instanceof URL
+          ? input.href
+          : input.url;
+
+      if (url && url.includes("/_serverFn/")) {
+        const { data } = await supabase.auth.getSession();
+        const token = data.session?.access_token;
+        if (token) {
+          const headers = new Headers(init?.headers ?? (input instanceof Request ? input.headers : undefined));
+          if (!headers.has("authorization")) {
+            headers.set("authorization", `Bearer ${token}`);
+          }
+          return originalFetch(input, { ...init, headers });
+        }
+      }
+    } catch {
+      // fall through to original fetch
+    }
+    return originalFetch(input, init);
+  };
+}

src/routes/__root.tsx

@@ -1,6 +1,11 @@
 import { Outlet, Link, createRootRoute, HeadContent, Scripts } from "@tanstack/react-router";
 import { Toaster } from "@/components/ui/sonner";
 import appCss from "../styles.css?url";
+import { installServerFnAuthFetch } from "@/integrations/supabase/server-fn-fetch";
+
+if (typeof window !== "undefined") {
+  installServerFnAuthFetch();
+}
 
 function NotFoundComponent() {
   return (