// tdd-guard:skip — Next.js root layout composes provider components; no // isolated unit test that wouldn't duplicate Next.js framework behavior. import"./globals.css" import { headers } from"next/headers" import { SpeedInsights } from"@vercel/speed-insights/next" import { ThemeProvider } from"@/components/theme-provider" import { OnlineStatusProvider } from"@/lib/offline/connection" import OnlineStatusBanner from"@/components/offline/online-status-banner" import SwRegistrar from"@/components/offline/sw-registrar" import OfflineProvider from"@/components/offline/offline-provider" import OfflineSafeWrapper from"@/components/offline/offline-error-boundary" import { ToastProvider } from"@/components/repository/toast" import { TooltipProvider } from"@/components/ui/tooltip" import { MasterDataProvider } from"@/components/repository/master-data-provider" import { getUserSession } from"@/lib/auth/permissions" import { UserSessionProvider } from"@/lib/auth/session-context" import { createClient } from"@/lib/supabase/server" import { I18nProvider } from"@/lib/i18n/i18n-context" import DemoBanner from"@/components/demo/demo-banner" import DemoControlPanel from"@/components/demo/demo-control-panel" import { ErrorBoundary } from"@/components/error-boundary" import { isProd } from"@/lib/env" // Single-tenant: static branding replaces the deleted cp_branding_profiles // engine. Constitution v1.1 (2026-05-22) — DCT Petrol primary colours. // allow-hardcoded-color: DCT Petrol hex — DB-column substitution, not CSS-var circular. const BMW_CSS_VARS: Record = { '--primary': '#037493', '--primary-dark': '#035970', '--color-primary': '#037493', '--color-primary-dark': '#035970', } export const dynamic = 'force-dynamic' export const metadata = { title:'SupplierPulse', description:'Cycle Time & Supplier Development Platform', manifest:'/manifest.json', appleWebApp: { capable: true, statusBarStyle:'black-translucent'as const, title:'SupplierPulse', }, } export const viewport = { themeColor:'var(--primary)', width:'device-width', initialScale: 1, maximumScale: 1, userScalable: false, viewportFit:'cover'as const, } export default async function RootLayout({ children, }: Readonly<{ children: React.ReactNode }>) { const session = await getUserSession() // Pull the per-request CSP nonce that proxy.ts injected via x-nonce. // We forward it to next-themes so its inline FOUC-prevention script // gets nonce'd and stops violating script-src 'self' 'nonce-…'. const nonce = (await headers()).get('x-nonce') ?? undefined // Graceful fallback: if claims exist but no user_profiles row found let showSetupFallback = false if (!session) { const supabase = await createClient() const { data: claimsData } = await supabase.auth.getClaims() if (claimsData?.claims) { // Authenticated user but no session — profile missing showSetupFallback = true } } return ( {showSetupFallback ? (
Logo

Profil wird eingerichtet

Ihr Benutzerprofil wird eingerichtet. Bitte kontaktieren Sie Ihren Administrator.

) : ( {/* DemoBanner is dev/staging-only — visible reminder that the environment is non-prod. */} {!isProd && } {children} {/* DemoControlPanel is admin-gated INSIDE the component (`if (!isAdmin) return null`) and the matching API routes `/api/demo/load`, `/api/demo/reset` enforce isAtLeastRole(session, 'admin'). Showing it in production is safe and lets the operator load or reset demo data on the live tenant — needed for the BMW // allow-customer-string pilot rollout. */} {session && } )} {/* Vercel Speed Insights — Core Web Vitals (LCP, INP, CLS) RUM. KAR-522 Source 3. Sends field-measurements from real users; no cookies, GDPR-conform. No-op outside Vercel deploy. */} ) }