From 2d58c3a2038718c388b30e7c849601160748fb5c Mon Sep 17 00:00:00 2001
From: lekss361 <alexey.kondratev@balance-pl.ru>
Date: Sun, 17 May 2026 10:31:54 +0300
Subject: [PATCH] =?UTF-8?q?fix(#264):=20apiFetch=20=E2=80=94=20global=20X-?=
 =?UTF-8?q?Session-Id=20header=20(custom=20POI=20scoring=20=D0=B2=20UI)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

apiFetch и apiFetchWithStatus не передавали X-Session-Id header, из-за
чего POST /analyze возвращал custom_poi_score_items: [] и score без учёта
пользовательских POI. Добавлен withSessionHeader() helper с SSR guard;
user-supplied headers имеют приоритет (backward compat).
---
 frontend/src/lib/api.ts | 31 +++++++++++++++++++++++++++----
 1 file changed, 27 insertions(+), 4 deletions(-)

diff --git a/frontend/src/lib/api.ts b/frontend/src/lib/api.ts
index 64559e2c..beb34d43 100644
--- a/frontend/src/lib/api.ts
+++ b/frontend/src/lib/api.ts
@@ -1,16 +1,38 @@
+import { getOrCreateSessionId } from "@/lib/sessionId";
+
 // Empty default = same-origin relative URLs.
 // In prod Caddy proxies /api/* to backend; in dev Next.js rewrites do the same.
 export const API_BASE_URL = process.env.NEXT_PUBLIC_API_BASE_URL ?? "";
 
+/**
+ * Merges a global X-Session-Id header into the request init.
+ * Only runs in browser (SSR guard). User-supplied headers win over the
+ * auto-injected value so explicit overrides remain backward-compatible.
+ */
+function withSessionHeader(init?: RequestInit): RequestInit {
+  const base: RequestInit = init ?? {};
+  if (typeof window === "undefined") return base;
+  const sessionId = getOrCreateSessionId();
+  if (!sessionId) return base;
+  return {
+    ...base,
+    headers: {
+      "X-Session-Id": sessionId,
+      ...(base.headers ?? {}),
+    },
+  };
+}
+
 export async function apiFetch<T>(
   path: string,
   init?: RequestInit,
 ): Promise<T> {
+  const merged = withSessionHeader(init);
   const response = await fetch(`${API_BASE_URL}${path}`, {
-    ...init,
+    ...merged,
     headers: {
       "Content-Type": "application/json",
-      ...(init?.headers ?? {}),
+      ...(merged.headers ?? {}),
     },
   });
   if (!response.ok) {
@@ -39,11 +61,12 @@ export async function apiFetchWithStatus<T>(
   path: string,
   init?: RequestInit,
 ): Promise<{ status: number; body: T }> {
+  const merged = withSessionHeader(init);
   const response = await fetch(`${API_BASE_URL}${path}`, {
-    ...init,
+    ...merged,
     headers: {
       "Content-Type": "application/json",
-      ...(init?.headers ?? {}),
+      ...(merged.headers ?? {}),
     },
   });
   let body: unknown = null;