@lastbrain/ai-ui-core 1.0.47 → 1.0.49

package/src/route-handlers/nextjs/lb-proxy.ts

@@ -77,10 +77,10 @@ export function createLBProxyHandler(config: LBProxyConfig = {}) {
 
       // Routes publiques qui ne nécessitent pas d'authentification
       const publicPaths = [
-        "auth/login",
-        "auth/session/create",
-        "auth/session",
-        "public/user/api-keys",
+        "public/login",
+        "public/status",
+        "auth/session/verify",
+        "auth/session/logout",
       ];
       const isPublicPath = publicPaths.some((p) => path.startsWith(p));
 
@@ -105,21 +105,30 @@ export function createLBProxyHandler(config: LBProxyConfig = {}) {
       }
 
       const authorization = request.headers.get("authorization");
+      const explicitApiKeyHeader = request.headers.get("x-lb-api-key");
+      const sessionToken = request.cookies.get(sessionCookieName)?.value;
       if (authorization) {
         headers["Authorization"] = authorization;
       }
+      if (explicitApiKeyHeader) {
+        headers["x-lb-api-key"] = explicitApiKeyHeader;
+      }
+      if (sessionToken) {
+        // Always forward lb_session cookie to allow backend fallback auth,
+        // even when an Authorization header is present.
+        headers["Cookie"] = `${sessionCookieName}=${sessionToken}`;
+      }
 
       // Authentification : LB_API_KEY ou session cookie
-      if (!authorization) {
+      if (!authorization && !explicitApiKeyHeader) {
         if (apiKey) {
+          headers["x-lb-api-key"] = apiKey;
           headers["Authorization"] = `Bearer ${apiKey}`;
         } else {
           // Lire le cookie de session
-          const sessionToken = request.cookies.get(sessionCookieName)?.value;
           if (sessionToken) {
             // Envoyer le cookie à la fois comme Authorization ET comme Cookie
             headers["Authorization"] = `Bearer ${sessionToken}`;
-            headers["Cookie"] = `${sessionCookieName}=${sessionToken}`;
             console.log("[LB Proxy] Forwarding session cookie:", {
               name: sessionCookieName,
               hasValue: !!sessionToken,

package/src/types/auth.ts

@@ -11,6 +11,8 @@ export interface LBAuthConfig {
   baseUrl?: string;
   /** Clé API LastBrain (côté serveur uniquement) */
   apiKey?: string;
+  /** API key sélectionnée (utile en mode supabase) */
+  selectedApiKeyId?: string;
   /** Mode d'authentification */
   mode?: "env-key" | "session" | "auto";
 }

package/src/types/index.ts

@@ -124,7 +124,9 @@ export interface AiStatus {
 
 export interface ClientConfig {
   baseUrl: string;
-  apiKeyId: string;
+  apiKeyId?: string;
+  sessionToken?: string;
+  credentials?: RequestCredentials;
   timeout?: number;
   retries?: number;
 }