Harden authentication, tenant isolation and security boundaries

src/app/layout.tsx

@@ -1,3 +1,5 @@
+import { getSession } from "@/lib/auth-utils";
+import { headers } from "next/headers";
 import type { Metadata } from "next";
 import { Manrope } from "next/font/google";
 import "./globals.css";
@@ -44,11 +46,13 @@ export const metadata: Metadata = {
   },
 };
 
-export default function RootLayout({
+export default async function RootLayout({
   children,
 }: Readonly<{
   children: React.ReactNode;
 }>) {
+  const [requestHeaders, session] = await Promise.all([headers(), getSession()]);
+  const nonce = requestHeaders.get("x-nonce") ?? undefined;
   return (
     <html
       lang="de"
@@ -56,7 +60,7 @@ export default function RootLayout({
     >
       <body className="min-h-full flex flex-col">
         {children}
-        <UmamiAnalytics />
+        <UmamiAnalytics nonce={nonce} enabled={!session?.user?.id} />
         <Toaster />
       </body>
     </html>