Add record access strategy

backend/src/tenant/tenant.middleware.ts

@@ -17,9 +17,14 @@ export class TenantMiddleware implements NestMiddleware {
       // Extract subdomain from hostname
       const host = req.headers.host || '';
       const hostname = host.split(':')[0]; // Remove port if present
-      const parts = hostname.split('.');
+      
+      // Check Origin header to get frontend subdomain (for API calls)
+      const origin = req.headers.origin as string;
+      const referer = req.headers.referer as string;
+      
+      let parts = hostname.split('.');
 
-      this.logger.log(`Host header: ${host}, hostname: ${hostname}, parts: ${JSON.stringify(parts)}`);
+      this.logger.log(`Host header: ${host}, hostname: ${hostname}, origin: ${origin}, referer: ${referer}, parts: ${JSON.stringify(parts)}`);
 
       // For local development, accept x-tenant-id header
       let tenantId = req.headers['x-tenant-id'] as string;
@@ -27,12 +32,26 @@ export class TenantMiddleware implements NestMiddleware {
 
       this.logger.log(`Host header: ${host}, hostname: ${hostname}, parts: ${JSON.stringify(parts)}, x-tenant-id: ${tenantId}`);
 
-      // If x-tenant-id is explicitly provided, use it directly
-      if (tenantId) {
-        this.logger.log(`Using explicit x-tenant-id: ${tenantId}`);
-        (req as any).tenantId = tenantId;
-        next();
-        return;
+      // Try to extract subdomain from Origin header first (for API calls from frontend)
+      if (origin) {
+        try {
+          const originUrl = new URL(origin);
+          const originHost = originUrl.hostname;
+          parts = originHost.split('.');
+          this.logger.log(`Using Origin header hostname: ${originHost}, parts: ${JSON.stringify(parts)}`);
+        } catch (error) {
+          this.logger.warn(`Failed to parse origin: ${origin}`);
+        }
+      } else if (referer && !tenantId) {
+        // Fallback to Referer if no Origin
+        try {
+          const refererUrl = new URL(referer);
+          const refererHost = refererUrl.hostname;
+          parts = refererHost.split('.');
+          this.logger.log(`Using Referer header hostname: ${refererHost}, parts: ${JSON.stringify(parts)}`);
+        } catch (error) {
+          this.logger.warn(`Failed to parse referer: ${referer}`);
+        }
       }
 
       // Extract subdomain (e.g., "tenant1" from "tenant1.routebox.co")
@@ -51,6 +70,36 @@ export class TenantMiddleware implements NestMiddleware {
 
       this.logger.log(`Extracted subdomain: ${subdomain}`);
 
+      // Always attach subdomain to request if present
+      if (subdomain) {
+        (req as any).subdomain = subdomain;
+      }
+
+      // If x-tenant-id is explicitly provided, use it directly but still keep subdomain
+      if (tenantId) {
+        this.logger.log(`Using explicit x-tenant-id: ${tenantId}`);
+        (req as any).tenantId = tenantId;
+        next();
+        return;
+      }
+
+      // Always attach subdomain to request if present
+      if (subdomain) {
+        (req as any).subdomain = subdomain;
+      }
+
+      // Check if this is a central subdomain
+      const centralSubdomains = (process.env.CENTRAL_SUBDOMAINS || 'central,admin').split(',');
+      const isCentral = subdomain && centralSubdomains.includes(subdomain);
+
+      // If it's a central subdomain, skip tenant resolution
+      if (isCentral) {
+        this.logger.log(`Central subdomain detected: ${subdomain}, skipping tenant resolution`);
+        (req as any).subdomain = subdomain;
+        next();
+        return;
+      }
+
       // Get tenant by subdomain if available
       if (subdomain) {
         try {
@@ -72,9 +121,6 @@ export class TenantMiddleware implements NestMiddleware {
       if (tenantId) {
         // Attach tenant info to request object
         (req as any).tenantId = tenantId;
-        if (subdomain) {
-          (req as any).subdomain = subdomain;
-        }
       } else {
         this.logger.warn(`No tenant identified from host: ${hostname}`);
       }