fix: extract user_id (UUID) from JWT instead of email in session handlers

All session handlers were passing the user's email to service methods
that expected a UUID, causing "Invalid user ID" errors. Now extracts
user_id from JWT claims instead.

Fixed: get_my_sessions, post_book_session, put_update_session_status,
post_submit_feedback

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

imphnen-dimentorin/src/sessions/infrastructure/http/handlers/mutation_handlers.rs

@@ -6,14 +6,25 @@ use super::super::dto::{
 use crate::sessions::domain::SessionService;
 use axum::{
 	extract::{Extension, Path},
-	http::HeaderMap,
+	http::{HeaderMap, header::AUTHORIZATION},
 	response::IntoResponse,
 };
-use imphnen_libs::ValidatedJson;
+use imphnen_libs::{ValidatedJson, decode_access_token};
 use imphnen_utils::AppError;
-use imphnen_utils::{ApiSuccess, extract_email};
+use imphnen_utils::ApiSuccess;
 use std::sync::Arc;
 
+fn extract_user_id(headers: &HeaderMap) -> Result<String, AppError> {
+	let token = headers
+		.get(AUTHORIZATION)
+		.and_then(|h| h.to_str().ok())
+		.and_then(|s| s.strip_prefix("Bearer "))
+		.ok_or_else(|| AppError::AuthenticationError("Token tidak valid".to_string()))?;
+	let claims = decode_access_token(token)
+		.map_err(|_| AppError::AuthenticationError("Token tidak valid".to_string()))?;
+	Ok(claims.claims.user_id)
+}
+
 #[utoipa::path(
     post,
     path = "/v1/dimentorin/mentors/{id}/sessions/create",
@@ -36,11 +47,10 @@ pub async fn post_book_session(
 	Path(mentor_id): Path<String>,
 	ValidatedJson(dto): ValidatedJson<BookSessionRequestDto>,
 ) -> Result<impl IntoResponse, AppError> {
-	let user_email = extract_email(&headers)
+	let user_id = extract_user_id(&headers)?;
-		.ok_or_else(|| AppError::AuthenticationError("Token tidak valid".to_string()))?;
 	let resp = BookSessionResponseDto::from(
 		service
-			.book_session(mentor_id, user_email, dto.into())
+			.book_session(mentor_id, user_id, dto.into())
 			.await?,
 	);
 	Ok(ApiSuccess(resp))
@@ -68,11 +78,10 @@ pub async fn put_update_session_status(
 	Path(session_id): Path<String>,
 	ValidatedJson(dto): ValidatedJson<UpdateSessionStatusRequestDto>,
 ) -> Result<impl IntoResponse, AppError> {
-	let user_email = extract_email(&headers)
+	let user_id = extract_user_id(&headers)?;
-		.ok_or_else(|| AppError::AuthenticationError("Token tidak valid".to_string()))?;
 	let resp = UpdateSessionStatusResponseDto::from(
 		service
-			.update_session_status(session_id, user_email, dto.into())
+			.update_session_status(session_id, user_id, dto.into())
 			.await?,
 	);
 	Ok(ApiSuccess(resp))
@@ -101,11 +110,10 @@ pub async fn post_submit_feedback(
 	Path(session_id): Path<String>,
 	ValidatedJson(dto): ValidatedJson<SessionFeedbackRequestDto>,
 ) -> Result<impl IntoResponse, AppError> {
-	let user_email = extract_email(&headers)
+	let user_id = extract_user_id(&headers)?;
-		.ok_or_else(|| AppError::AuthenticationError("Token tidak valid".to_string()))?;
 	let resp = SessionFeedbackResponseDto::from(
 		service
-			.submit_feedback(session_id, user_email, dto.into())
+			.submit_feedback(session_id, user_id, dto.into())
 			.await?,
 	);
 	Ok(ApiSuccess(resp))

imphnen-dimentorin/src/sessions/infrastructure/http/handlers/query_handlers.rs

@@ -5,6 +5,7 @@ use axum::{
 	http::HeaderMap,
 	response::IntoResponse,
 };
+use imphnen_libs::decode_access_token;
 use imphnen_utils::AppError;
 use imphnen_utils::{ApiSuccess, extract_email};
 use serde::Deserialize;
@@ -85,10 +86,16 @@ pub async fn get_my_sessions(
 	Extension(service): Extension<Arc<dyn SessionService>>,
 	Query(filter): Query<SessionStatusFilter>,
 ) -> Result<impl IntoResponse, AppError> {
-	let user_email = extract_email(&headers)
+	let token = headers
+		.get(axum::http::header::AUTHORIZATION)
+		.and_then(|h| h.to_str().ok())
+		.and_then(|s| s.strip_prefix("Bearer "))
 		.ok_or_else(|| AppError::AuthenticationError("Token tidak valid".to_string()))?;
+	let claims = decode_access_token(token)
+		.map_err(|_| AppError::AuthenticationError("Token tidak valid".to_string()))?;
+	let user_id = claims.claims.user_id;
 	let resp = SessionListResponseDto::from(
-		service.get_user_sessions(user_email, filter.status).await?,
+		service.get_user_sessions(user_id, filter.status).await?,
 	);
 	Ok(ApiSuccess(resp))
 }