@innertia-solutions/innertia-nuxt 0.1.66 → 0.1.67

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@innertia-solutions/innertia-nuxt",
-  "version": "0.1.66",
+  "version": "0.1.67",
   "description": "Innertia Solutions — Nuxt layer unificada: core, auth, multitenancy, theme y app contexts",
   "keywords": [
     "nuxt",

package/server/routes/_auth/[provider]/callback.get.ts

@@ -1,6 +1,7 @@
-import { defineEventHandler, getRouterParam, getQuery, sendRedirect, createError } from 'h3'
+import { defineEventHandler, getRouterParam, getQuery, sendRedirect, createError, getRequestHeader } from 'h3'
 import { writeSession } from '../../../utils/session'
 import { normalizeLoginResponse } from '../../../utils/login'
+import { forwardClientHeaders } from '../../../utils/bff'
 
 // Recibe el callback de OAuth, intercambia contra Laravel, sella la sesión y
 // redirige a la app. El token nunca llega al browser.
@@ -12,7 +13,7 @@ export default defineEventHandler(async (event) => {
   let data: any
   try {
     data = await $fetch(`${config.apiInternalUrl}/auth/${provider}/callback`, {
-      method: 'GET', query, headers: { Accept: 'application/json' },
+      method: 'GET', query, headers: { Accept: 'application/json', ...forwardClientHeaders(n => getRequestHeader(event, n)) },
     })
   } catch (err: any) {
     const msg = err?.data?.message ?? 'oauth_failed'

package/server/routes/_auth/login.post.ts

@@ -1,5 +1,6 @@
-import { defineEventHandler, readBody, createError } from 'h3'
+import { defineEventHandler, readBody, createError, getRequestHeader } from 'h3'
 import { writeSession } from '../../utils/session'
+import { forwardClientHeaders } from '../../utils/bff'
 import { normalizeLoginResponse } from '../../utils/login'
 
 // Llama a Laravel /auth/login server-to-server; en éxito sella el JWT en la
@@ -13,7 +14,7 @@ export default defineEventHandler(async (event) => {
     data = await $fetch(`${config.apiInternalUrl}/auth/login`, {
       method: 'POST',
       body: { context, email, password, remember },
-      headers: { Accept: 'application/json' },
+      headers: { Accept: 'application/json', ...forwardClientHeaders(n => getRequestHeader(event, n)) },
     })
   } catch (err: any) {
     const status = err?.response?.status ?? err?.statusCode ?? 500

package/server/routes/_auth/platform/login.post.ts

@@ -1,5 +1,6 @@
-import { defineEventHandler, readBody, createError } from 'h3'
+import { defineEventHandler, readBody, createError, getRequestHeader } from 'h3'
 import { writeSession } from '../../../utils/session'
+import { forwardClientHeaders } from '../../../utils/bff'
 import { normalizeLoginResponse } from '../../../utils/login'
 
 // Login de plataforma (identidad separada, sin contexto de tenant). Llama a
@@ -15,7 +16,7 @@ export default defineEventHandler(async (event) => {
     data = await $fetch(`${config.apiInternalUrl}/platform/auth/login`, {
       method: 'POST',
       body: { email, password },
-      headers: { Accept: 'application/json' },
+      headers: { Accept: 'application/json', ...forwardClientHeaders(n => getRequestHeader(event, n)) },
     })
   } catch (err: any) {
     const status = err?.response?.status ?? err?.statusCode ?? 500

package/server/utils/__tests__/bff.test.ts

@@ -20,3 +20,21 @@ describe('buildAuthHeaders', () => {
     expect(buildAuthHeaders(undefined)).toEqual({ cookie: '' })
   })
 })
+
+describe('forwardClientHeaders', () => {
+  it('reenvía solo IP y user-agent del cliente, omitiendo los ausentes', async () => {
+    const { forwardClientHeaders } = await import('../bff')
+    const headers: Record<string, string> = {
+      'x-forwarded-for': '200.1.2.3, 172.68.0.1',
+      'cf-connecting-ip': '200.1.2.3',
+      'user-agent': 'Mozilla/5.0',
+      cookie: 'innertia_session=secret',
+      authorization: 'Bearer x',
+    }
+    expect(forwardClientHeaders(n => headers[n])).toEqual({
+      'x-forwarded-for': '200.1.2.3, 172.68.0.1',
+      'cf-connecting-ip': '200.1.2.3',
+      'user-agent': 'Mozilla/5.0',
+    })
+  })
+})

package/server/utils/bff.ts

@@ -18,3 +18,22 @@ export function resolveApiTarget(base: string, path: string, search: string): st
 export function buildAuthHeaders(token?: string): Record<string, string> {
   return token ? { authorization: `Bearer ${token}`, cookie: '' } : { cookie: '' }
 }
+
+/** Headers del cliente que Laravel necesita para conocer su IP real y dispositivo. */
+const CLIENT_HEADERS = ['x-forwarded-for', 'x-real-ip', 'cf-connecting-ip', 'user-agent'] as const
+
+/**
+ * Headers del cliente original a reenviar en las llamadas server-to-server
+ * (login, login de plataforma, callback OAuth, logout). Sin esto Laravel ve a
+ * TODOS los usuarios con la IP del contenedor Nuxt: el throttle de login queda
+ * compartido entre todos (un atacante bloquea el login de todos) y las
+ * sesiones quedan sin IP ni dispositivo. Recibe un getter para no depender de h3.
+ */
+export function forwardClientHeaders(get: (name: string) => string | undefined | null): Record<string, string> {
+  const out: Record<string, string> = {}
+  for (const name of CLIENT_HEADERS) {
+    const value = get(name)
+    if (value) out[name] = value
+  }
+  return out
+}