fix and update

apps/api-gateway/src/main.ts

@@ -1,12 +1,14 @@
 import { ValidationPipe } from '@nestjs/common';
 import { NestFactory } from '@nestjs/core';
+import { NestExpressApplication } from '@nestjs/platform-express';
 import { DocumentBuilder, SwaggerModule } from '@nestjs/swagger';
 import cookieParser from 'cookie-parser';
 import { AppModule } from './app.module';
 import { AllExceptionsFilter } from './grpc-exception.filter';
 
 async function bootstrap() {
-  const app = await NestFactory.create(AppModule);
+  const app = await NestFactory.create<NestExpressApplication>(AppModule);
+  app.set('trust proxy', 1);
   app.use(cookieParser());
   app.enableCors({ origin: true, credentials: true });
   app.useGlobalPipes(

apps/frontend/lib/api.ts

@@ -612,16 +612,21 @@ export function buildSystemSettingPayload(setting: Pick<SystemSetting, 'key' | '
 
 export async function apiFetch<T>(path: string, options: RequestInit = {}, token?: string | null, allowRetry = true): Promise<T> {
   const resolvedToken = token ?? (typeof window !== 'undefined' ? window.localStorage.getItem(AUTH_TOKEN_KEY) : null);
+  const method = (options.method ?? 'GET').toUpperCase();
+  const hasBody = options.body !== undefined && options.body !== null;
+  const headers: Record<string, string> = {
+    ...(hasBody || method === 'POST' || method === 'PUT' || method === 'PATCH'
+      ? { 'Content-Type': 'application/json' }
+      : {}),
+    ...(resolvedToken ? { Authorization: `Bearer ${resolvedToken}` } : {}),
+    ...(options.headers as Record<string, string> | undefined)
+  };
 
   let response: Response;
   try {
     response = await fetch(`${getApiUrl()}${path}`, {
       ...options,
-      headers: {
-        'Content-Type': 'application/json',
-        ...(resolvedToken ? { Authorization: `Bearer ${resolvedToken}` } : {}),
-        ...options.headers
-      }
+      headers
     });
   } catch (error) {
     throw mapFetchError(error);