fix(ui): isolate server-only auth headers

ui/actions/api-keys/api-keys.ts

@@ -9,7 +9,8 @@ import {
   SingleApiKeyResponse,
   UpdateApiKeyPayload,
 } from "@/components/users/profile/api-keys/types";
-import { apiBaseUrl, getAuthHeaders } from "@/lib";
+import { apiBaseUrl } from "@/lib";
+import { getAuthHeaders } from "@/lib/auth-headers";
 import { handleApiError, handleApiResponse } from "@/lib/server-actions-helper";
 
 import { adaptApiKeysResponse } from "./api-keys.adapter";

ui/actions/attack-paths/queries.test.ts

@@ -13,6 +13,10 @@ vi.mock("@/lib", () => ({
   getAuthHeaders: getAuthHeadersMock,
 }));
 
+vi.mock("@/lib/auth-headers", () => ({
+  getAuthHeaders: getAuthHeadersMock,
+}));
+
 vi.mock("@/lib/server-actions-helper", () => ({
   handleApiResponse: handleApiResponseMock,
 }));

ui/actions/attack-paths/queries.ts

@@ -2,8 +2,9 @@
 
 import { z } from "zod";
 
-import { apiBaseUrl, getAuthHeaders } from "@/lib";
+import { apiBaseUrl } from "@/lib";
 import { customAttackPathQuerySchema } from "@/lib/attack-paths/custom-query";
+import { getAuthHeaders } from "@/lib/auth-headers";
 import { handleApiResponse } from "@/lib/server-actions-helper";
 import {
   AttackPathCartographySchema,

ui/actions/attack-paths/scans.test.ts

@@ -19,6 +19,10 @@ vi.mock("@/lib", () => ({
   getAuthHeaders: getAuthHeadersMock,
 }));
 
+vi.mock("@/lib/auth-headers", () => ({
+  getAuthHeaders: getAuthHeadersMock,
+}));
+
 vi.mock("@/lib/server-actions-helper", () => ({
   handleApiResponse: handleApiResponseMock,
 }));

ui/actions/attack-paths/scans.ts

@@ -2,7 +2,8 @@
 
 import { z } from "zod";
 
-import { apiBaseUrl, getAuthHeaders } from "@/lib";
+import { apiBaseUrl } from "@/lib";
+import { getAuthHeaders } from "@/lib/auth-headers";
 import { handleApiResponse } from "@/lib/server-actions-helper";
 import { AttackPathScan, AttackPathScansResponse } from "@/types/attack-paths";
 

ui/actions/compliances/compliances.ts

@@ -1,6 +1,7 @@
 "use server";
 
-import { apiBaseUrl, getAuthHeaders } from "@/lib";
+import { apiBaseUrl } from "@/lib";
+import { getAuthHeaders } from "@/lib/auth-headers";
 import { handleApiResponse } from "@/lib/server-actions-helper";
 
 export const getCompliancesOverview = async ({

ui/actions/finding-groups/finding-groups.test.ts

@@ -39,6 +39,10 @@ vi.mock("@/lib", () => ({
   splitCsvFilterValues,
 }));
 
+vi.mock("@/lib/auth-headers", () => ({
+  getAuthHeaders: getAuthHeadersMock,
+}));
+
 vi.mock("@/lib/provider-filters", () => ({
   // Simulate real appendSanitizedProviderFilters: appends all non-undefined filters to the URL.
   appendSanitizedProviderFilters: vi.fn(

ui/actions/finding-groups/finding-groups.ts

@@ -10,10 +10,10 @@ import {
   FG_RECENT_LAST_SEEN,
   FG_SEVERITY_HIGH_FIRST,
   FINDING_GROUP_RESOURCES_DEFAULT_SORT,
-  getAuthHeaders,
   includesMutedFindings,
   splitCsvFilterValues,
 } from "@/lib";
+import { getAuthHeaders } from "@/lib/auth-headers";
 import { appendSanitizedProviderFilters } from "@/lib/provider-filters";
 import { handleApiResponse } from "@/lib/server-actions-helper";
 

ui/actions/findings/findings-by-resource.test.ts

@@ -35,6 +35,10 @@ vi.mock("@/lib", () => ({
   RESOURCE_DRAWER_OTHER_FINDINGS_SORT,
 }));
 
+vi.mock("@/lib/auth-headers", () => ({
+  getAuthHeaders: getAuthHeadersMock,
+}));
+
 vi.mock("@/lib/provider-filters", () => ({
   appendSanitizedProviderTypeFilters: appendSanitizedProviderTypeFiltersMock,
 }));

ui/actions/findings/findings-by-resource.ts

@@ -4,11 +4,8 @@ import {
   getFindingGroupResources,
   getLatestFindingGroupResources,
 } from "@/actions/finding-groups";
-import {
-  apiBaseUrl,
-  getAuthHeaders,
-  RESOURCE_DRAWER_OTHER_FINDINGS_SORT,
-} from "@/lib";
+import { apiBaseUrl, RESOURCE_DRAWER_OTHER_FINDINGS_SORT } from "@/lib";
+import { getAuthHeaders } from "@/lib/auth-headers";
 import { runWithConcurrencyLimit } from "@/lib/concurrency";
 import { appendSanitizedProviderTypeFilters } from "@/lib/provider-filters";
 import { handleApiResponse } from "@/lib/server-actions-helper";

ui/actions/findings/findings-triage.test.ts

@@ -23,6 +23,10 @@ vi.mock("@/lib", () => ({
   getAuthHeaders: getAuthHeadersMock,
 }));
 
+vi.mock("@/lib/auth-headers", () => ({
+  getAuthHeaders: getAuthHeadersMock,
+}));
+
 vi.mock("@/lib/server-actions-helper", () => ({
   handleApiResponse: handleApiResponseMock,
 }));

ui/actions/findings/findings-triage.ts

@@ -2,7 +2,8 @@
 
 import { adaptLatestFindingTriageNote } from "@/actions/findings/findings-triage.adapter";
 import { createMuteRule } from "@/actions/mute-rules";
-import { apiBaseUrl, getAuthHeaders } from "@/lib";
+import { apiBaseUrl } from "@/lib";
+import { getAuthHeaders } from "@/lib/auth-headers";
 import { handleApiResponse } from "@/lib/server-actions-helper";
 import {
   FINDING_TRIAGE_STATUS_LABELS,

ui/actions/findings/findings.test.ts

@@ -23,6 +23,10 @@ vi.mock("@/lib", () => ({
   getAuthHeaders: getAuthHeadersMock,
 }));
 
+vi.mock("@/lib/auth-headers", () => ({
+  getAuthHeaders: getAuthHeadersMock,
+}));
+
 vi.mock("@/lib/provider-filters", () => ({
   appendSanitizedProviderTypeFilters: appendSanitizedProviderTypeFiltersMock,
 }));

ui/actions/findings/findings.ts

@@ -4,7 +4,8 @@ import { redirect } from "next/navigation";
 
 import { attachFindingTriageSummariesToResponse } from "@/actions/findings/findings-triage.adapter";
 import { getFindingTriageAdapterOptions } from "@/actions/findings/findings-triage.options";
-import { apiBaseUrl, getAuthHeaders } from "@/lib";
+import { apiBaseUrl } from "@/lib";
+import { getAuthHeaders } from "@/lib/auth-headers";
 import { appendSanitizedProviderTypeFilters } from "@/lib/provider-filters";
 import { handleApiResponse } from "@/lib/server-actions-helper";
 

ui/actions/integrations/integrations.ts

@@ -3,7 +3,8 @@
 import { revalidatePath } from "next/cache";
 
 import { pollTaskUntilSettled } from "@/actions/task/poll";
-import { apiBaseUrl, getAuthHeaders, parseStringify } from "@/lib";
+import { apiBaseUrl, parseStringify } from "@/lib";
+import { getAuthHeaders } from "@/lib/auth-headers";
 import { handleApiError, handleApiResponse } from "@/lib/server-actions-helper";
 import { IntegrationType } from "@/types/integrations";
 import type { TaskState } from "@/types/tasks";

ui/actions/integrations/jira-dispatch.test.ts

@@ -13,6 +13,10 @@ vi.mock("@/lib", () => ({
   getAuthHeaders: vi.fn(),
 }));
 
+vi.mock("@/lib/auth-headers", () => ({
+  getAuthHeaders: vi.fn(),
+}));
+
 vi.mock("@/lib/server-actions-helper", () => ({
   handleApiError: vi.fn(),
 }));

ui/actions/integrations/jira-dispatch.ts

@@ -1,7 +1,8 @@
 "use server";
 
 import { pollTaskUntilSettled } from "@/actions/task/poll";
-import { apiBaseUrl, getAuthHeaders } from "@/lib";
+import { apiBaseUrl } from "@/lib";
+import { getAuthHeaders } from "@/lib/auth-headers";
 import { handleApiError } from "@/lib/server-actions-helper";
 import type {
   IntegrationProps,

ui/actions/integrations/saml.ts

@@ -2,7 +2,8 @@
 
 import { revalidatePath } from "next/cache";
 
-import { apiBaseUrl, getAuthHeaders } from "@/lib/helper";
+import { getAuthHeaders } from "@/lib/auth-headers";
+import { apiBaseUrl } from "@/lib/helper";
 import { handleApiResponse } from "@/lib/server-actions-helper";
 import { samlConfigFormSchema } from "@/types/formSchemas";
 

ui/actions/invitations/invitation.ts

@@ -4,7 +4,8 @@ import { revalidatePath } from "next/cache";
 import { redirect } from "next/navigation";
 import { z } from "zod";
 
-import { apiBaseUrl, getAuthHeaders } from "@/lib";
+import { apiBaseUrl } from "@/lib";
+import { getAuthHeaders } from "@/lib/auth-headers";
 import { handleApiError, handleApiResponse } from "@/lib/server-actions-helper";
 
 const invitationTokenSchema = z.string().min(1).max(500);

ui/actions/lighthouse-v1/lighthouse.ts

@@ -1,6 +1,7 @@
 "use server";
 
-import { apiBaseUrl, getAuthHeaders } from "@/lib/helper";
+import { getAuthHeaders } from "@/lib/auth-headers";
+import { apiBaseUrl } from "@/lib/helper";
 import {
   validateBaseUrl,
   validateCredentials,

ui/actions/manage-groups/manage-groups.test.ts

@@ -26,6 +26,10 @@ vi.mock("@/lib", () => ({
   getErrorMessage: vi.fn(),
 }));
 
+vi.mock("@/lib/auth-headers", () => ({
+  getAuthHeaders: getAuthHeadersMock,
+}));
+
 vi.mock("@/lib/server-actions-helper", () => ({
   handleApiError: handleApiErrorMock,
   handleApiResponse: handleApiResponseMock,
@@ -111,6 +115,16 @@ describe("getAllProviderGroups", () => {
     expect(result).toBeUndefined();
   });
 
+  it("rethrows the framework redirect from authentication", async () => {
+    // Given
+    const redirectError = new Error("NEXT_REDIRECT");
+    getAuthHeadersMock.mockRejectedValueOnce(redirectError);
+
+    // When / Then
+    await expect(getAllProviderGroups()).rejects.toBe(redirectError);
+    expect(fetchMock).not.toHaveBeenCalled();
+  });
+
   it("returns undefined when a later page resolves to an error payload", async () => {
     handleApiResponseMock
       .mockResolvedValueOnce(makePage([makeGroup("g1", "Group 1")], 1, 2))

ui/actions/manage-groups/manage-groups.ts

@@ -3,7 +3,8 @@
 import { revalidatePath } from "next/cache";
 import { redirect } from "next/navigation";
 
-import { apiBaseUrl, getAuthHeaders, getErrorMessage } from "@/lib";
+import { apiBaseUrl, getErrorMessage } from "@/lib";
+import { getAuthHeaders } from "@/lib/auth-headers";
 import { handleApiError, handleApiResponse } from "@/lib/server-actions-helper";
 import { ManageGroupPayload, ProviderGroupsResponse } from "@/types/components";
 
@@ -65,9 +66,9 @@ export const getAllProviderGroups = async (): Promise<
   const allGroups: ProviderGroupsResponse["data"] = [];
   let lastResponse: ProviderGroupsResponse | undefined;
   let hasMorePages = true;
+  const headers = await getAuthHeaders({ contentType: false });
 
   try {
-    const headers = await getAuthHeaders({ contentType: false });
     while (hasMorePages && currentPage <= maxPages) {
       const url = new URL(`${apiBaseUrl}/provider-groups`);
       url.searchParams.append("page[number]", currentPage.toString());

ui/actions/mute-rules/mute-rules.ts

@@ -2,7 +2,8 @@
 
 import { revalidatePath } from "next/cache";
 
-import { apiBaseUrl, getAuthHeaders } from "@/lib/helper";
+import { getAuthHeaders } from "@/lib/auth-headers";
+import { apiBaseUrl } from "@/lib/helper";
 
 import {
   DeleteMuteRuleActionState,

ui/actions/organizations/organizations.test.ts

@@ -23,6 +23,10 @@ vi.mock("@/lib", () => ({
   getAuthHeaders: getAuthHeadersMock,
 }));
 
+vi.mock("@/lib/auth-headers", () => ({
+  getAuthHeaders: getAuthHeadersMock,
+}));
+
 vi.mock("@/lib/server-actions-helper", () => ({
   handleApiError: handleApiErrorMock,
   handleApiResponse: handleApiResponseMock,

ui/actions/organizations/organizations.ts

@@ -2,7 +2,8 @@
 
 import { revalidatePath } from "next/cache";
 
-import { apiBaseUrl, getAuthHeaders } from "@/lib";
+import { apiBaseUrl } from "@/lib";
+import { getAuthHeaders } from "@/lib/auth-headers";
 import { handleApiError, handleApiResponse } from "@/lib/server-actions-helper";
 import {
   OrganizationListResponse,

ui/actions/overview/attack-surface/attack-surface.ts

@@ -1,6 +1,7 @@
 "use server";
 
-import { apiBaseUrl, getAuthHeaders } from "@/lib";
+import { apiBaseUrl } from "@/lib";
+import { getAuthHeaders } from "@/lib/auth-headers";
 import { appendSanitizedProviderTypeFilters } from "@/lib/provider-filters";
 import { handleApiResponse } from "@/lib/server-actions-helper";
 

ui/actions/overview/compliance-watchlist/compliance-watchlist.ts

@@ -1,6 +1,7 @@
 "use server";
 
-import { apiBaseUrl, getAuthHeaders } from "@/lib";
+import { apiBaseUrl } from "@/lib";
+import { getAuthHeaders } from "@/lib/auth-headers";
 import { appendSanitizedProviderTypeFilters } from "@/lib/provider-filters";
 import { handleApiResponse } from "@/lib/server-actions-helper";
 

ui/actions/overview/findings/findings.ts

@@ -2,7 +2,8 @@
 
 import { redirect } from "next/navigation";
 
-import { apiBaseUrl, getAuthHeaders } from "@/lib";
+import { apiBaseUrl } from "@/lib";
+import { getAuthHeaders } from "@/lib/auth-headers";
 import { appendSanitizedProviderTypeFilters } from "@/lib/provider-filters";
 import { handleApiResponse } from "@/lib/server-actions-helper";
 

ui/actions/overview/providers/providers.ts

@@ -2,7 +2,8 @@
 
 import { redirect } from "next/navigation";
 
-import { apiBaseUrl, getAuthHeaders } from "@/lib";
+import { apiBaseUrl } from "@/lib";
+import { getAuthHeaders } from "@/lib/auth-headers";
 import { appendSanitizedProviderTypeFilters } from "@/lib/provider-filters";
 import { handleApiResponse } from "@/lib/server-actions-helper";
 

ui/actions/overview/regions/regions.ts

@@ -1,6 +1,7 @@
 "use server";
 
-import { apiBaseUrl, getAuthHeaders } from "@/lib";
+import { apiBaseUrl } from "@/lib";
+import { getAuthHeaders } from "@/lib/auth-headers";
 import { appendSanitizedProviderTypeFilters } from "@/lib/provider-filters";
 import { handleApiResponse } from "@/lib/server-actions-helper";
 

ui/actions/overview/resources-inventory/resources-inventory.ts

@@ -1,6 +1,7 @@
 "use server";
 
-import { apiBaseUrl, getAuthHeaders } from "@/lib";
+import { apiBaseUrl } from "@/lib";
+import { getAuthHeaders } from "@/lib/auth-headers";
 import { appendSanitizedProviderTypeFilters } from "@/lib/provider-filters";
 import { handleApiResponse } from "@/lib/server-actions-helper";
 

ui/actions/overview/risk-radar/risk-radar.ts

@@ -1,6 +1,7 @@
 "use server";
 
-import { apiBaseUrl, getAuthHeaders } from "@/lib";
+import { apiBaseUrl } from "@/lib";
+import { getAuthHeaders } from "@/lib/auth-headers";
 import { appendSanitizedProviderTypeFilters } from "@/lib/provider-filters";
 import { handleApiResponse } from "@/lib/server-actions-helper";
 

ui/actions/overview/services/services.ts

@@ -1,6 +1,7 @@
 "use server";
 
-import { apiBaseUrl, getAuthHeaders } from "@/lib";
+import { apiBaseUrl } from "@/lib";
+import { getAuthHeaders } from "@/lib/auth-headers";
 import { appendSanitizedProviderTypeFilters } from "@/lib/provider-filters";
 import { handleApiResponse } from "@/lib/server-actions-helper";
 

ui/actions/overview/severity-trends/severity-trends.ts

@@ -4,7 +4,8 @@ import {
   getDateFromForTimeRange,
   type TimeRange,
 } from "@/app/(prowler)/_overview/severity-over-time/_constants/time-range.constants";
-import { apiBaseUrl, getAuthHeaders } from "@/lib";
+import { apiBaseUrl } from "@/lib";
+import { getAuthHeaders } from "@/lib/auth-headers";
 import { appendSanitizedProviderTypeFilters } from "@/lib/provider-filters";
 import { handleApiResponse } from "@/lib/server-actions-helper";
 

ui/actions/overview/threat-score/threat-score.ts

@@ -1,6 +1,7 @@
 "use server";
 
-import { apiBaseUrl, getAuthHeaders } from "@/lib";
+import { apiBaseUrl } from "@/lib";
+import { getAuthHeaders } from "@/lib/auth-headers";
 import { appendSanitizedProviderTypeFilters } from "@/lib/provider-filters";
 import { handleApiResponse } from "@/lib/server-actions-helper";
 

ui/actions/processors/processors.ts

@@ -1,6 +1,7 @@
 "use server";
 
-import { apiBaseUrl, getAuthHeaders } from "@/lib/helper";
+import { getAuthHeaders } from "@/lib/auth-headers";
+import { apiBaseUrl } from "@/lib/helper";
 import { mutedFindingsConfigFormSchema } from "@/types/formSchemas";
 import {
   DeleteMutedFindingsConfigActionState,

ui/actions/providers/providers.test.ts

@@ -29,6 +29,10 @@ vi.mock("@/lib", () => ({
   wait: vi.fn(),
 }));
 
+vi.mock("@/lib/auth-headers", () => ({
+  getAuthHeaders: getAuthHeadersMock,
+}));
+
 vi.mock("@/lib/provider-credentials/build-credentials", () => ({
   buildSecretConfig: vi.fn(() => ({
     secretType: "access-secret-key",

ui/actions/providers/providers.ts

@@ -3,7 +3,8 @@
 import { revalidatePath } from "next/cache";
 import { redirect } from "next/navigation";
 
-import { apiBaseUrl, getAuthHeaders, getFormValue, wait } from "@/lib";
+import { apiBaseUrl, getFormValue, wait } from "@/lib";
+import { getAuthHeaders } from "@/lib/auth-headers";
 import { buildSecretConfig } from "@/lib/provider-credentials/build-credentials";
 import { ProviderCredentialFields } from "@/lib/provider-credentials/provider-credential-fields";
 import { appendSanitizedProviderInFilters } from "@/lib/provider-filters";

ui/actions/resources/resources.test.ts

@@ -43,6 +43,10 @@ vi.mock("@/lib", () => ({
   splitCsvFilterValues,
 }));
 
+vi.mock("@/lib/auth-headers", () => ({
+  getAuthHeaders: getAuthHeadersMock,
+}));
+
 vi.mock("@/lib/server-actions-helper", () => ({
   handleApiResponse: handleApiResponseMock,
 }));

ui/actions/resources/resources.ts

@@ -8,9 +8,9 @@ import {
   apiBaseUrl,
   FINDINGS_FILTERED_SORT,
   GENERIC_SERVER_ERROR_MESSAGE,
-  getAuthHeaders,
   sanitizeErrorMessage,
 } from "@/lib";
+import { getAuthHeaders } from "@/lib/auth-headers";
 import { appendSanitizedProviderTypeFilters } from "@/lib/provider-filters";
 import { handleApiResponse } from "@/lib/server-actions-helper";
 import { OrganizationResource } from "@/types/organizations";

ui/actions/roles/roles.test.ts

@@ -25,6 +25,10 @@ vi.mock("@/lib", () => ({
   getAuthHeaders: getAuthHeadersMock,
 }));
 
+vi.mock("@/lib/auth-headers", () => ({
+  getAuthHeaders: getAuthHeadersMock,
+}));
+
 vi.mock("@/lib/server-actions-helper", () => ({
   handleApiError: handleApiErrorMock,
   handleApiResponse: handleApiResponseMock,

ui/actions/roles/roles.ts

@@ -3,7 +3,8 @@
 import { revalidatePath } from "next/cache";
 import { redirect } from "next/navigation";
 
-import { apiBaseUrl, getAuthHeaders } from "@/lib";
+import { apiBaseUrl } from "@/lib";
+import { getAuthHeaders } from "@/lib/auth-headers";
 import { handleApiError, handleApiResponse } from "@/lib/server-actions-helper";
 
 export const getRoles = async ({

ui/actions/scan-configurations/scan-configurations.ts

@@ -4,7 +4,8 @@ import yaml from "js-yaml";
 import { revalidatePath } from "next/cache";
 import { z } from "zod";
 
-import { apiBaseUrl, getAuthHeaders } from "@/lib/helper";
+import { getAuthHeaders } from "@/lib/auth-headers";
+import { apiBaseUrl } from "@/lib/helper";
 import { scanConfigurationFormSchema } from "@/types/formSchemas";
 import {
   DeleteScanConfigurationActionState,

ui/actions/scans/scans.test.ts

@@ -21,6 +21,10 @@ vi.mock("@/lib", () => ({
     error instanceof Error ? error.message : String(error),
 }));
 
+vi.mock("@/lib/auth-headers", () => ({
+  getAuthHeaders: getAuthHeadersMock,
+}));
+
 vi.mock("@/lib/server-actions-helper", () => ({
   handleApiError: handleApiErrorMock,
   handleApiResponse: handleApiResponseMock,

ui/actions/scans/scans.ts

@@ -6,9 +6,9 @@ import { redirect } from "next/navigation";
 import {
   apiBaseUrl,
   GENERIC_SERVER_ERROR_MESSAGE,
-  getAuthHeaders,
   getErrorMessage,
 } from "@/lib";
+import { getAuthHeaders } from "@/lib/auth-headers";
 import {
   COMPLIANCE_REPORT_DISPLAY_NAMES,
   type ComplianceReportType,

ui/actions/schedules/schedules.test.ts

@@ -28,6 +28,10 @@ vi.mock("@/lib", () => ({
   getAuthHeaders: getAuthHeadersMock,
 }));
 
+vi.mock("@/lib/auth-headers", () => ({
+  getAuthHeaders: getAuthHeadersMock,
+}));
+
 vi.mock("@/lib/server-actions-helper", () => ({
   handleApiError: handleApiErrorMock,
   handleApiResponse: handleApiResponseMock,

ui/actions/schedules/schedules.ts

@@ -3,7 +3,8 @@
 import { revalidatePath } from "next/cache";
 import { z } from "zod";
 
-import { apiBaseUrl, getAuthHeaders } from "@/lib";
+import { apiBaseUrl } from "@/lib";
+import { getAuthHeaders } from "@/lib/auth-headers";
 import { scheduleUpdatePayloadSchema } from "@/lib/schedules";
 import { handleApiError, handleApiResponse } from "@/lib/server-actions-helper";
 import type {

ui/actions/task/tasks.ts

@@ -1,6 +1,7 @@
 "use server";
 
-import { apiBaseUrl, getAuthHeaders } from "@/lib";
+import { apiBaseUrl } from "@/lib";
+import { getAuthHeaders } from "@/lib/auth-headers";
 import { handleApiError, handleApiResponse } from "@/lib/server-actions-helper";
 
 export const getTask = async (taskId: string) => {

ui/actions/users/tenants.ts

@@ -4,7 +4,8 @@ import { revalidatePath } from "next/cache";
 import { z } from "zod";
 
 import { signOut } from "@/auth.config";
-import { apiBaseUrl, getAuthHeaders } from "@/lib/helper";
+import { getAuthHeaders } from "@/lib/auth-headers";
+import { apiBaseUrl } from "@/lib/helper";
 import { handleApiError, handleApiResponse } from "@/lib/server-actions-helper";
 
 export const getAllTenants = async () => {

ui/actions/users/users.ts

@@ -5,7 +5,8 @@ import { redirect } from "next/navigation";
 import { z } from "zod";
 
 import { auth } from "@/auth.config";
-import { apiBaseUrl, getAuthHeaders } from "@/lib";
+import { apiBaseUrl } from "@/lib";
+import { getAuthHeaders } from "@/lib/auth-headers";
 import { handleApiError, handleApiResponse } from "@/lib/server-actions-helper";
 import {
   TENANT_MEMBERSHIP_ROLE,

ui/app/(prowler)/alerts/_actions/alerts.test.ts

@@ -19,6 +19,10 @@ vi.mock("@/lib", () => ({
     error instanceof Error ? error.message : String(error),
 }));
 
+vi.mock("@/lib/auth-headers", () => ({
+  getAuthHeaders: getAuthHeadersMock,
+}));
+
 vi.mock("@/lib/server-actions-helper", () => ({
   handleApiError: handleApiErrorMock,
   handleApiResponse: handleApiResponseMock,

ui/app/(prowler)/alerts/_actions/alerts.ts

@@ -1,6 +1,7 @@
 "use server";
 
-import { apiBaseUrl, getAuthHeaders } from "@/lib";
+import { apiBaseUrl } from "@/lib";
+import { getAuthHeaders } from "@/lib/auth-headers";
 import { handleApiError, handleApiResponse } from "@/lib/server-actions-helper";
 
 import {

ui/app/(prowler)/alerts/_actions/recipients.test.ts

@@ -19,6 +19,10 @@ vi.mock("@/lib", () => ({
     error instanceof Error ? error.message : String(error),
 }));
 
+vi.mock("@/lib/auth-headers", () => ({
+  getAuthHeaders: getAuthHeadersMock,
+}));
+
 vi.mock("@/lib/server-actions-helper", () => ({
   handleApiError: handleApiErrorMock,
   handleApiResponse: handleApiResponseMock,

ui/app/(prowler)/alerts/_actions/recipients.ts

@@ -1,6 +1,7 @@
 "use server";
 
-import { apiBaseUrl, getAuthHeaders } from "@/lib";
+import { apiBaseUrl } from "@/lib";
+import { getAuthHeaders } from "@/lib/auth-headers";
 import { handleApiError, handleApiResponse } from "@/lib/server-actions-helper";
 
 const RECIPIENTS_PATH = "/alerts/recipients";

ui/app/(prowler)/compliance/_actions/cross-provider.test.ts

@@ -20,6 +20,10 @@ vi.mock("@/lib", () => ({
   GENERIC_SERVER_ERROR_MESSAGE: "Generic server error.",
 }));
 
+vi.mock("@/lib/auth-headers", () => ({
+  getAuthHeaders: getAuthHeadersMock,
+}));
+
 vi.mock("@/lib/server-actions-helper", () => ({
   handleApiResponse: handleApiResponseMock,
 }));

ui/app/(prowler)/compliance/_actions/cross-provider.ts

@@ -6,10 +6,10 @@ import type { ScanBinaryResult } from "@/actions/scans/scans";
 import {
   apiBaseUrl,
   GENERIC_SERVER_ERROR_MESSAGE,
-  getAuthHeaders,
   getErrorMessage,
 } from "@/lib";
 import { hasActionError } from "@/lib/action-errors";
+import { getAuthHeaders } from "@/lib/auth-headers";
 import { handleApiResponse } from "@/lib/server-actions-helper";
 import { SentryErrorSource, SentryErrorType } from "@/sentry";
 

ui/app/(prowler)/lighthouse/_actions/lighthouse-v2.test.ts

@@ -24,6 +24,12 @@ vi.mock("@/lib/helper", () => ({
   GENERIC_SERVER_ERROR_MESSAGE: "Server error",
 }));
 
+vi.mock("@/lib/auth-headers", () => ({
+  getAuthHeaders: vi
+    .fn()
+    .mockResolvedValue({ Authorization: "Bearer token-123" }),
+}));
+
 import {
   createLighthouseV2Session,
   getLighthouseV2SupportedModels,

ui/app/(prowler)/lighthouse/_actions/lighthouse-v2.ts

@@ -13,7 +13,8 @@ import type {
   LighthouseV2SupportedModel,
   LighthouseV2SupportedProvider,
 } from "@/app/(prowler)/lighthouse/_types";
-import { apiBaseUrl, getAuthHeaders } from "@/lib/helper";
+import { getAuthHeaders } from "@/lib/auth-headers";
+import { apiBaseUrl } from "@/lib/helper";
 import { LIGHTHOUSE_ROUTE } from "@/lib/lighthouse-routes";
 import { handleApiError, handleApiResponse } from "@/lib/server-actions-helper";
 import type { JsonApiDocument } from "@/types/jsonapi";

ui/app/api/scans/[scanId]/report/route.test.ts

@@ -11,6 +11,10 @@ vi.mock("@/lib", () => ({
   getAuthHeaders: getAuthHeadersMock,
 }));
 
+vi.mock("@/lib/auth-headers", () => ({
+  getAuthHeaders: getAuthHeadersMock,
+}));
+
 describe("GET /api/scans/[scanId]/report", () => {
   afterEach(() => {
     vi.unstubAllGlobals();

ui/app/api/scans/[scanId]/report/route.ts

@@ -1,6 +1,7 @@
 import { NextResponse } from "next/server";
 
-import { apiBaseUrl, getAuthHeaders } from "@/lib";
+import { apiBaseUrl } from "@/lib";
+import { getAuthHeaders } from "@/lib/auth-headers";
 
 export const dynamic = "force-dynamic";
 export const runtime = "nodejs";

ui/lib/auth-headers.test.ts

@@ -0,0 +1,43 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+const { authMock, getRequiredAuthHeadersMock } = vi.hoisted(() => ({
+  authMock: vi.fn(),
+  getRequiredAuthHeadersMock: vi.fn(),
+}));
+
+vi.mock("server-only", () => ({}));
+
+vi.mock("@/auth.config", () => ({
+  auth: authMock,
+}));
+
+vi.mock("./server-auth", () => ({
+  getRequiredAuthHeaders: getRequiredAuthHeadersMock,
+}));
+
+import { getAuthHeaders } from "./auth-headers";
+
+describe("getAuthHeaders", () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+  });
+
+  it("forwards the restored session and requested header options", async () => {
+    // Given
+    authMock.mockResolvedValue({
+      accessToken: "access-token",
+      error: "RefreshAccessTokenError",
+    });
+    const options = { contentType: true };
+
+    // When
+    await getAuthHeaders(options);
+
+    // Then
+    expect(getRequiredAuthHeadersMock).toHaveBeenCalledWith(
+      "access-token",
+      options,
+      "RefreshAccessTokenError",
+    );
+  });
+});

ui/lib/auth-headers.ts

@@ -0,0 +1,11 @@
+import "server-only";
+
+import { auth } from "@/auth.config";
+
+import { getRequiredAuthHeaders } from "./server-auth";
+
+export const getAuthHeaders = async (options?: { contentType?: boolean }) => {
+  const session = await auth();
+
+  return getRequiredAuthHeaders(session?.accessToken, options, session?.error);
+};

ui/lib/helper.test.ts

@@ -15,10 +15,6 @@ vi.mock("@/actions/task", () => ({
   getTask: vi.fn(),
 }));
 
-vi.mock("@/auth.config", () => ({
-  auth: vi.fn(),
-}));
-
 const createToast = () => vi.fn();
 
 const getAnchor = () => {

ui/lib/helper.ts

@@ -5,7 +5,6 @@ import {
   type ScanBinaryResult,
 } from "@/actions/scans";
 import { getTask } from "@/actions/task";
-import { auth } from "@/auth.config";
 import { useToast } from "@/components/shadcn";
 import {
   COMPLIANCE_REPORT_DISPLAY_NAMES,
@@ -14,8 +13,6 @@ import {
 import { readEnv } from "@/lib/runtime-env";
 import { AuthSocialProvider, MetaDataProps, PermissionInfo } from "@/types";
 
-import { getRequiredAuthHeaders } from "./server-auth";
-
 export const baseUrl = process.env.AUTH_URL;
 export const apiBaseUrl = readEnv(
   "UI_API_BASE_URL",
@@ -55,17 +52,6 @@ export function filterEmptyValues(
   );
 }
 
-/**
- * Returns the authentication headers for API requests
- * @param options - Optional configuration options
- * @returns Authentication headers with Accept and Authorization
- */
-export const getAuthHeaders = async (options?: { contentType?: boolean }) => {
-  const session = await auth();
-
-  return getRequiredAuthHeaders(session?.accessToken, options, session?.error);
-};
-
 export const getAuthUrl = (provider: AuthSocialProvider) => {
   const config = {
     google: {

ui/lib/server-auth.test.ts

@@ -7,6 +7,8 @@ const { headersMock, redirectMock } = vi.hoisted(() => ({
   }),
 }));
 
+vi.mock("server-only", () => ({}));
+
 vi.mock("next/headers", () => ({
   headers: headersMock,
 }));

ui/lib/server-auth.ts

@@ -1,3 +1,5 @@
+import "server-only";
+
 import { headers } from "next/headers";
 import { redirect } from "next/navigation";
 

ui/vitest.browser.setup.ts

@@ -10,6 +10,8 @@ import { afterAll, afterEach, beforeAll, vi } from "vitest";
 
 import { worker } from "./__tests__/msw/worker";
 
+vi.mock("server-only", () => ({}));
+
 // Server Actions ("use server") are bundled by Vite as plain async functions
 // — the directive is a Next.js compiler concept, not part of Vite. When the
 // page invokes one, it runs in the browser and reaches `auth()` from