feat: document templates with auto-fill (P1)

backend/internal/auth/tenant_resolver.go

@@ -35,6 +35,7 @@ func (tr *TenantResolver) Resolve(next http.Handler) http.Handler {
 		}
 
 		var tenantID uuid.UUID
+		ctx := r.Context()
 
 		if header := r.Header.Get("X-Tenant-ID"); header != "" {
 			parsed, err := uuid.Parse(header)
@@ -56,7 +57,14 @@ func (tr *TenantResolver) Resolve(next http.Handler) http.Handler {
 			}
 
 			tenantID = parsed
+<<<<<<< HEAD
 			r = r.WithContext(ContextWithUserRole(r.Context(), role))
+||||||| 8e65463
+			// Override the role from middleware with the correct one for this tenant
+			r = r.WithContext(ContextWithUserRole(r.Context(), role))
+=======
+			ctx = ContextWithUserRole(ctx, role)
+>>>>>>> mai/ritchie/p1-document-templates
 		} else {
 			// Default to user's first tenant
 			first, err := tr.lookup.FirstTenantForUser(r.Context(), userID)
@@ -70,6 +78,7 @@ func (tr *TenantResolver) Resolve(next http.Handler) http.Handler {
 				return
 			}
 			tenantID = *first
+<<<<<<< HEAD
 
 			// Also resolve role for default tenant
 			role, err := tr.lookup.GetUserRole(r.Context(), userID, tenantID)
@@ -79,9 +88,21 @@ func (tr *TenantResolver) Resolve(next http.Handler) http.Handler {
 				return
 			}
 			r = r.WithContext(ContextWithUserRole(r.Context(), role))
+||||||| 8e65463
+=======
+
+			// Get role for default tenant
+			role, err := tr.lookup.GetUserRole(r.Context(), userID, tenantID)
+			if err != nil {
+				slog.Error("failed to get user role", "error", err, "user_id", userID, "tenant_id", tenantID)
+				http.Error(w, `{"error":"internal error"}`, http.StatusInternalServerError)
+				return
+			}
+			ctx = ContextWithUserRole(ctx, role)
+>>>>>>> mai/ritchie/p1-document-templates
 		}
 
-		ctx := ContextWithTenantID(r.Context(), tenantID)
+		ctx = ContextWithTenantID(ctx, tenantID)
 		next.ServeHTTP(w, r.WithContext(ctx))
 	})
 }