From 25f11912dd66ee9e4839e701ee32c3f886dc129f Mon Sep 17 00:00:00 2001
From: "2569718930@qq.com" <2569718930@qq.com>
Date: Fri, 13 Mar 2026 10:44:11 +0800
Subject: [PATCH] feat: Add backend authentication utilities for constructing
 request headers with entitlement and user session tokens, and for applying
 auth response cookies.

---
 frontend/lib/backend-auth.ts | 38 +++++++++++++++++++-----------------
 1 file changed, 20 insertions(+), 18 deletions(-)

diff --git a/frontend/lib/backend-auth.ts b/frontend/lib/backend-auth.ts
index 5ac11e67..bcacdd88 100644
--- a/frontend/lib/backend-auth.ts
+++ b/frontend/lib/backend-auth.ts
@@ -30,27 +30,29 @@ export async function buildBackendRequestHeaders(
   }
 
   const incomingAuth = extractBearerToken(request.headers.get("authorization"));
+  if (hasSupabaseServerEnv()) {
+    const passthroughResponse = new NextResponse(null, { status: 200 });
+    const supabase = createSupabaseRouteClient(request, passthroughResponse);
+    const {
+      data: { session },
+    } = await supabase.auth.getSession();
+
+    const accessToken = session?.access_token || "";
+    if (accessToken) {
+      // Prefer server-side session token to avoid stale client bearer tokens.
+      headers.set("Authorization", `Bearer ${accessToken}`);
+      return { headers, response: passthroughResponse };
+    }
+    if (incomingAuth) {
+      headers.set("Authorization", `Bearer ${incomingAuth}`);
+    }
+    return { headers, response: passthroughResponse };
+  }
+
   if (incomingAuth) {
     headers.set("Authorization", `Bearer ${incomingAuth}`);
-    return { headers, response: null };
   }
-
-  if (!hasSupabaseServerEnv()) {
-    return { headers, response: null };
-  }
-
-  const passthroughResponse = new NextResponse(null, { status: 200 });
-  const supabase = createSupabaseRouteClient(request, passthroughResponse);
-  const {
-    data: { session },
-  } = await supabase.auth.getSession();
-
-  const accessToken = session?.access_token || "";
-  if (accessToken) {
-    headers.set("Authorization", `Bearer ${accessToken}`);
-  }
-
-  return { headers, response: passthroughResponse };
+  return { headers, response: null };
 }
 
 export function applyAuthResponseCookies(