@podosoft/podokit 1.1.6 → 1.2.0

package/dist/templates/fullstack/apps/api/src/health/health.plugin.spec.ts

@@ -0,0 +1,86 @@
+import { SQL } from "bun";
+import { afterEach, describe, expect, it } from "bun:test";
+import type { DatabaseProviderName } from "@podosoft/podokit-runtime";
+import { Elysia } from "elysia";
+import { AppException } from "../common/app-exception";
+import { validateEnv } from "../config/env.validation";
+import { PROVIDERS } from "../config/providers";
+import {
+  appContext,
+  createCoreServices,
+  DATABASE,
+  READINESS,
+  type ServiceRegistry,
+} from "../core/services";
+import { Database } from "../database/database";
+import type { ReadinessCheck } from "./readiness.service";
+import { healthPlugin } from "./health.plugin";
+
+const opened: ServiceRegistry[] = [];
+
+function databaseProvider(): DatabaseProviderName {
+  return PROVIDERS.database;
+}
+
+afterEach(async () => {
+  for (const services of opened.splice(0)) await services.close();
+});
+
+async function readiness(
+  options: { databaseUp: boolean; checks?: Record<string, ReadinessCheck> },
+): Promise<{ status: number; body: unknown }> {
+  const env = validateEnv({
+    NODE_ENV: "test",
+    DATABASE_URL: databaseProvider() === "sqlite"
+      ? "sqlite://:memory:"
+      : "postgres://podokit:podokit@localhost:5432/podokit",
+    READINESS_CHECK_TIMEOUT_MS: "20",
+    READINESS_CACHE_MS: "0",
+  });
+  const services = createCoreServices(env);
+  opened.push(services);
+  const sql = new SQL(":memory:", { adapter: "sqlite" });
+  if (!options.databaseUp) await sql.close();
+  const database = new Database(env, sql);
+  services.override(DATABASE, database, () => database.close());
+  for (const [name, check] of Object.entries(options.checks ?? {})) {
+    services.resolve(READINESS).register(name, check);
+  }
+  const app = new Elysia()
+    .onError(({ error, set }) => {
+      set.status = error instanceof AppException ? error.statusCode : 500;
+      return { code: error instanceof AppException ? error.code : "INTERNAL_ERROR" };
+    })
+    .use(healthPlugin(appContext(env, services)));
+  const response = await app.handle(new Request("http://localhost/health/ready"));
+  return { status: response.status, body: await response.json() };
+}
+
+describe("GET /health/ready", () => {
+  it("reports the database as db and module checks separately", async () => {
+    const result = await readiness({
+      databaseUp: true,
+      checks: { cache: () => Promise.resolve() },
+    });
+
+    expect(result).toEqual({
+      status: 200,
+      body: { status: "ready", db: "up", checks: { cache: "up" } },
+    });
+  });
+
+  it("fails when the database is down", async () => {
+    const result = await readiness({ databaseUp: false });
+
+    expect(result).toEqual({ status: 503, body: { code: "READINESS_FAILED" } });
+  });
+
+  it("fails when a module check exceeds its timeout", async () => {
+    const result = await readiness({
+      databaseUp: true,
+      checks: { storage: () => new Promise<void>(() => {}) },
+    });
+
+    expect(result).toEqual({ status: 503, body: { code: "READINESS_FAILED" } });
+  });
+});

package/dist/templates/fullstack/apps/api/src/health/health.plugin.ts

@@ -1,8 +1,9 @@
 import { Elysia } from "elysia";
 import { AppException } from "../common/app-exception";
 import type { AppPlugin } from "../core/services";
+import { DATABASE_READINESS_CHECK } from "./readiness.service";
 
-export const healthPlugin: AppPlugin = ({ database, readiness }) =>
+export const healthPlugin: AppPlugin = ({ readiness }) =>
   new Elysia({ name: "podokit.health" })
     .get(
       "/health",
@@ -12,14 +13,8 @@ export const healthPlugin: AppPlugin = ({ database, readiness }) =>
     .get(
       "/health/ready",
       async () => {
-        let db: "up" | "down" = "up";
-        try {
-          await database.ping();
-        } catch {
-          db = "down";
-        }
-        const checks = await readiness.run();
-        if (db === "down" || Object.values(checks).includes("down")) {
+        const { [DATABASE_READINESS_CHECK]: db, ...checks } = await readiness.run();
+        if (db !== "up" || Object.values(checks).includes("down")) {
           throw new AppException("READINESS_FAILED", "One or more dependencies are unavailable", 503);
         }
         return { status: "ready" as const, db: "up" as const, checks };

package/dist/templates/fullstack/apps/api/src/health/readiness.service.spec.ts

@@ -1,6 +1,23 @@
-import { describe, expect, it } from "bun:test";
+import { afterEach, describe, expect, it, setSystemTime } from "bun:test";
 import { ReadinessService } from "./readiness.service";
 
+interface Deferred {
+  promise: Promise<void>;
+  resolve: () => void;
+}
+
+function deferred(): Deferred {
+  let resolve: () => void = () => {};
+  const promise = new Promise<void>((done) => {
+    resolve = done;
+  });
+  return { promise, resolve };
+}
+
+afterEach(() => {
+  setSystemTime();
+});
+
 describe("ReadinessService", () => {
   it("runs registered checks and removes them with the returned callback", async () => {
     const service = new ReadinessService();
@@ -19,4 +36,127 @@ describe("ReadinessService", () => {
       'Readiness check "cache" is already registered',
     );
   });
+
+  it("reports a check that exceeds the timeout as down with the reason", async () => {
+    const failures: Array<[string, string]> = [];
+    const service = new ReadinessService({
+      timeoutMs: 20,
+      cacheMs: 0,
+      onCheckFailure: (name, reason) => failures.push([name, reason]),
+    });
+    service.register("storage", () => new Promise<void>(() => {}));
+    service.register("cache", () => Promise.resolve());
+
+    const started = performance.now();
+    await expect(service.run()).resolves.toEqual({ storage: "down", cache: "up" });
+    expect(performance.now() - started).toBeLessThan(1_000);
+    expect(failures).toEqual([["storage", 'Readiness check "storage" timed out after 20 ms']]);
+  });
+
+  it("reports the error message of a failed check", async () => {
+    const failures: Array<[string, string]> = [];
+    const service = new ReadinessService({
+      cacheMs: 0,
+      onCheckFailure: (name, reason) => failures.push([name, reason]),
+    });
+    service.register("events", () => Promise.reject(new Error("connection refused")));
+    service.register("cache", () => {
+      throw new Error("not connected");
+    });
+
+    await expect(service.run()).resolves.toEqual({ events: "down", cache: "down" });
+    expect(Object.fromEntries(failures)).toEqual({
+      events: "connection refused",
+      cache: "not connected",
+    });
+  });
+
+  it("reuses a finished evaluation until the cache window ends", async () => {
+    setSystemTime(new Date("2026-01-01T00:00:00.000Z"));
+    let calls = 0;
+    const service = new ReadinessService({ cacheMs: 2_000 });
+    service.register("cache", async () => {
+      calls += 1;
+    });
+
+    await service.run();
+    setSystemTime(new Date("2026-01-01T00:00:01.999Z"));
+    await service.run();
+    expect(calls).toBe(1);
+
+    setSystemTime(new Date("2026-01-01T00:00:02.000Z"));
+    await service.run();
+    expect(calls).toBe(2);
+  });
+
+  it("caches a failed evaluation for the same window", async () => {
+    setSystemTime(new Date("2026-01-01T00:00:00.000Z"));
+    let available = false;
+    const service = new ReadinessService({ cacheMs: 2_000 });
+    service.register("cache", async () => {
+      if (!available) throw new Error("unavailable");
+    });
+
+    await expect(service.run()).resolves.toEqual({ cache: "down" });
+    available = true;
+    await expect(service.run()).resolves.toEqual({ cache: "down" });
+    setSystemTime(new Date("2026-01-01T00:00:02.000Z"));
+    await expect(service.run()).resolves.toEqual({ cache: "up" });
+  });
+
+  it("evaluates on every run when the cache is disabled", async () => {
+    let calls = 0;
+    const service = new ReadinessService({ cacheMs: 0 });
+    service.register("cache", async () => {
+      calls += 1;
+    });
+
+    await service.run();
+    await service.run();
+    await service.run();
+    expect(calls).toBe(3);
+  });
+
+  it("shares one evaluation between concurrent runs", async () => {
+    let calls = 0;
+    const gate = deferred();
+    const service = new ReadinessService({ cacheMs: 0 });
+    service.register("cache", async () => {
+      calls += 1;
+      await gate.promise;
+    });
+
+    const runs = [service.run(), service.run(), service.run()];
+    gate.resolve();
+    const results = await Promise.all(runs);
+
+    expect(calls).toBe(1);
+    expect(results).toEqual([{ cache: "up" }, { cache: "up" }, { cache: "up" }]);
+    await service.run();
+    expect(calls).toBe(2);
+  });
+
+  it("does not share or cache an evaluation across a registration change", async () => {
+    const gate = deferred();
+    const service = new ReadinessService({ cacheMs: 60_000 });
+    service.register("cache", () => gate.promise);
+
+    const before = service.run();
+    service.register("events", () => Promise.resolve());
+    const after = service.run();
+    gate.resolve();
+
+    await expect(before).resolves.toEqual({ cache: "up" });
+    await expect(after).resolves.toEqual({ cache: "up", events: "up" });
+    await expect(service.run()).resolves.toEqual({ cache: "up", events: "up" });
+  });
+
+  it("returns a copy that callers cannot use to change the cached result", async () => {
+    const service = new ReadinessService({ cacheMs: 60_000 });
+    service.register("cache", () => Promise.resolve());
+
+    const first = await service.run();
+    first.cache = "down";
+    await expect(service.run()).resolves.toEqual({ cache: "up" });
+  });
 });

package/dist/templates/fullstack/apps/api/src/health/readiness.service.ts

@@ -1,30 +1,104 @@
 export type ReadinessStatus = "up" | "down";
 export type ReadinessCheck = () => Promise<void>;
+export type ReadinessResults = Record<string, ReadinessStatus>;
+
+export const DEFAULT_READINESS_CHECK_TIMEOUT_MS = 800;
+export const DEFAULT_READINESS_CACHE_MS = 2_000;
+
+/** The core database check. The health endpoint reports it as `db`, apart from module checks. */
+export const DATABASE_READINESS_CHECK = "database";
+
+export interface ReadinessOptions {
+  /** Longest one check may run before it is reported down. */
+  timeoutMs?: number;
+  /** How long a finished evaluation is reused. `0` evaluates on every run. */
+  cacheMs?: number;
+  /** Receives the reason for each check that is down, once per evaluation. */
+  onCheckFailure?: (name: string, reason: string) => void;
+}
+
+class ReadinessTimeoutError extends Error {
+  constructor(name: string, timeoutMs: number) {
+    super(`Readiness check "${name}" timed out after ${timeoutMs} ms`);
+    this.name = "ReadinessTimeoutError";
+  }
+}
 
 export class ReadinessService {
   private readonly checks = new Map<string, ReadinessCheck>();
+  private readonly timeoutMs: number;
+  private readonly cacheMs: number;
+  private readonly onCheckFailure: ((name: string, reason: string) => void) | undefined;
+  // Bumped whenever the registered checks change, so an evaluation that started
+  // earlier is neither shared nor cached afterwards.
+  private generation = 0;
+  private inFlight?: Promise<ReadinessResults>;
+  private cached?: { results: ReadinessResults; expiresAt: number };
+
+  constructor(options: ReadinessOptions = {}) {
+    this.timeoutMs = options.timeoutMs ?? DEFAULT_READINESS_CHECK_TIMEOUT_MS;
+    this.cacheMs = options.cacheMs ?? DEFAULT_READINESS_CACHE_MS;
+    this.onCheckFailure = options.onCheckFailure;
+  }
 
   register(name: string, check: ReadinessCheck): () => void {
     if (this.checks.has(name)) {
       throw new Error(`Readiness check "${name}" is already registered`);
     }
     this.checks.set(name, check);
+    this.invalidate();
     return () => {
       this.checks.delete(name);
+      this.invalidate();
     };
   }
 
-  async run(): Promise<Record<string, ReadinessStatus>> {
-    const results = await Promise.all(
-      [...this.checks].map(async ([name, check]): Promise<[string, ReadinessStatus]> => {
-        try {
-          await check();
-          return [name, "up"];
-        } catch {
-          return [name, "down"];
-        }
-      }),
-    );
-    return Object.fromEntries(results);
+  /**
+   * Runs every check in parallel, each bounded by the timeout. Concurrent callers
+   * share one evaluation, and a finished one is reused for the cache window.
+   */
+  async run(): Promise<ReadinessResults> {
+    if (this.cached && Date.now() < this.cached.expiresAt) return { ...this.cached.results };
+    this.inFlight ??= this.evaluate(this.generation);
+    return { ...(await this.inFlight) };
+  }
+
+  private invalidate(): void {
+    this.generation += 1;
+    this.inFlight = undefined;
+    this.cached = undefined;
+  }
+
+  private async evaluate(generation: number): Promise<ReadinessResults> {
+    try {
+      const entries = await Promise.all(
+        [...this.checks].map(
+          async ([name, check]): Promise<[string, ReadinessStatus]> => [name, await this.probe(name, check)],
+        ),
+      );
+      const results: ReadinessResults = Object.fromEntries(entries);
+      if (generation === this.generation && this.cacheMs > 0) {
+        this.cached = { results, expiresAt: Date.now() + this.cacheMs };
+      }
+      return results;
+    } finally {
+      if (generation === this.generation) this.inFlight = undefined;
+    }
+  }
+
+  private async probe(name: string, check: ReadinessCheck): Promise<ReadinessStatus> {
+    let timer: ReturnType<typeof setTimeout> | undefined;
+    const timeout = new Promise<never>((_, reject) => {
+      timer = setTimeout(() => reject(new ReadinessTimeoutError(name, this.timeoutMs)), this.timeoutMs);
+    });
+    try {
+      await Promise.race([check(), timeout]);
+      return "up";
+    } catch (error) {
+      this.onCheckFailure?.(name, error instanceof Error ? error.message : String(error));
+      return "down";
+    } finally {
+      clearTimeout(timer);
+    }
   }
 }

package/dist/templates/fullstack/apps/web/src/lib/server/backend-proxy.test.ts

@@ -1,5 +1,8 @@
+import { createServer } from "node:http";
+import type { AddressInfo } from "node:net";
+import { gzipSync } from "node:zlib";
 import { afterEach, describe, expect, it, vi } from "vitest";
-import { proxyRequest, resolveClientIp } from "./backend-proxy";
+import { proxyRequest, rawSubpath, resolveClientIp } from "./backend-proxy";
 
 describe("backend proxy client address handling", () => {
   afterEach(() => {
@@ -77,6 +80,23 @@ describe("backend proxy client address handling", () => {
     expect(upstreamHeaders?.get("user-agent")).toBe(agent);
   });
 
+  it("aborts the upstream request when the client disconnects", async () => {
+    let upstreamSignal: AbortSignal | undefined;
+    vi.stubGlobal("fetch", async (_input: RequestInfo | URL, init?: RequestInit) => {
+      upstreamSignal = init?.signal ?? undefined;
+      return new Response(null, { status: 204 });
+    });
+
+    const client = new AbortController();
+    const request = new Request("http://app.localhost/api/events", { signal: client.signal });
+    await proxyRequest(request, "http://api:5002/events");
+
+    expect(upstreamSignal).toBeDefined();
+    expect(upstreamSignal?.aborted).toBe(false);
+    client.abort();
+    expect(upstreamSignal?.aborted).toBe(true);
+  });
+
   it("relays rate-limit response headers to browser clients", async () => {
     vi.stubGlobal("fetch", async () => new Response(
       JSON.stringify({ success: false }),
@@ -101,4 +121,171 @@ describe("backend proxy client address handling", () => {
     expect(response.headers.get("ratelimit-limit")).toBe("300");
     expect(response.headers.get("ratelimit-remaining")).toBe("0");
   });
+
+  it("relays the next-page cursor of a cursor-paged list", async () => {
+    vi.stubGlobal("fetch", async () => new Response("[]", {
+      headers: { "content-type": "application/json", "x-next-cursor": "WyIyMDI2Il0" },
+    }));
+
+    const response = await proxyRequest(
+      new Request("http://app.localhost/api/audit-logs?limit=15"),
+      "http://api:5002/audit-logs?limit=15",
+    );
+
+    expect(response.headers.get("x-next-cursor")).toBe("WyIyMDI2Il0");
+  });
+
+  it("relays cache validator and download headers", async () => {
+    vi.stubGlobal("fetch", async () => new Response("report", {
+      headers: {
+        "content-type": "text/csv",
+        etag: '"report-v3"',
+        "last-modified": "Wed, 14 Oct 2026 08:00:00 GMT",
+        "content-disposition": 'attachment; filename="report.csv"',
+        vary: "accept-encoding, cookie",
+        "x-content-type-options": "nosniff",
+      },
+    }));
+
+    const response = await proxyRequest(
+      new Request("http://app.localhost/api/reports/3"),
+      "http://api:5002/reports/3",
+    );
+
+    expect(response.headers.get("etag")).toBe('"report-v3"');
+    expect(response.headers.get("last-modified")).toBe("Wed, 14 Oct 2026 08:00:00 GMT");
+    expect(response.headers.get("content-disposition")).toBe('attachment; filename="report.csv"');
+    expect(response.headers.get("vary")).toBe("accept-encoding, cookie");
+    expect(response.headers.get("x-content-type-options")).toBe("nosniff");
+  });
+
+  it("relays content-length for an uncompressed upstream body", async () => {
+    vi.stubGlobal("fetch", async () => new Response("0123456789", {
+      headers: { "content-length": "10" },
+    }));
+
+    const response = await proxyRequest(
+      new Request("http://app.localhost/api/files/1"),
+      "http://api:5002/files/1",
+    );
+
+    expect(response.headers.get("content-length")).toBe("10");
+    expect(await response.text()).toBe("0123456789");
+  });
+
+  it("drops content-length when the upstream body was compressed", async () => {
+    vi.stubGlobal("fetch", async () => new Response("decoded body", {
+      headers: { "content-encoding": "gzip", "content-length": "4" },
+    }));
+
+    const response = await proxyRequest(
+      new Request("http://app.localhost/api/files/1"),
+      "http://api:5002/files/1",
+    );
+
+    expect(response.headers.get("content-length")).toBeNull();
+    expect(response.headers.get("content-encoding")).toBeNull();
+    expect(await response.text()).toBe("decoded body");
+  });
+
+  it("delivers a gzip-encoded upstream body in full", async () => {
+    const payload = `${"podokit ".repeat(4096)}end`;
+    const compressed = gzipSync(payload);
+    const server = createServer((_request, response) => {
+      response.writeHead(200, {
+        "content-type": "text/plain",
+        "content-encoding": "gzip",
+        "content-length": String(compressed.byteLength),
+      });
+      response.end(compressed);
+    });
+    await new Promise<void>((resolve) => server.listen(0, "127.0.0.1", resolve));
+    try {
+      const { port } = server.address() as AddressInfo;
+      const response = await proxyRequest(
+        new Request("http://app.localhost/api/export"),
+        `http://127.0.0.1:${String(port)}/export`,
+      );
+
+      expect(response.headers.get("content-length")).toBeNull();
+      expect(await response.text()).toBe(payload);
+    } finally {
+      await new Promise<void>((resolve) => server.close(() => resolve()));
+    }
+  });
+
+  it("forwards conditional and range request headers", async () => {
+    let upstreamHeaders: Headers | undefined;
+    vi.stubGlobal("fetch", async (_input: RequestInfo | URL, init?: RequestInit) => {
+      upstreamHeaders = new Headers(init?.headers);
+      return new Response(null, { status: 204 });
+    });
+
+    const request = new Request("http://app.localhost/api/files/1", {
+      headers: {
+        "if-none-match": '"file-v1"',
+        "if-modified-since": "Wed, 14 Oct 2026 08:00:00 GMT",
+        range: "bytes=0-99",
+        "if-range": '"file-v1"',
+      },
+    });
+    await proxyRequest(request, "http://api:5002/files/1");
+
+    expect(upstreamHeaders?.get("if-none-match")).toBe('"file-v1"');
+    expect(upstreamHeaders?.get("if-modified-since")).toBe("Wed, 14 Oct 2026 08:00:00 GMT");
+    expect(upstreamHeaders?.get("range")).toBe("bytes=0-99");
+    expect(upstreamHeaders?.get("if-range")).toBe('"file-v1"');
+  });
+
+  it("passes a 304 Not Modified response through without a body", async () => {
+    vi.stubGlobal("fetch", async () => new Response(null, {
+      status: 304,
+      headers: { etag: '"file-v1"', "cache-control": "private, no-cache" },
+    }));
+
+    const response = await proxyRequest(
+      new Request("http://app.localhost/api/files/1", {
+        headers: { "if-none-match": '"file-v1"' },
+      }),
+      "http://api:5002/files/1",
+    );
+
+    expect(response.status).toBe(304);
+    expect(response.headers.get("etag")).toBe('"file-v1"');
+    expect(await response.text()).toBe("");
+  });
+
+  it("passes a 206 Partial Content response through with its range", async () => {
+    vi.stubGlobal("fetch", async () => new Response("0123", {
+      status: 206,
+      headers: {
+        "content-range": "bytes 0-3/10",
+        "accept-ranges": "bytes",
+        "content-length": "4",
+      },
+    }));
+
+    const response = await proxyRequest(
+      new Request("http://app.localhost/api/files/1", { headers: { range: "bytes=0-3" } }),
+      "http://api:5002/files/1",
+    );
+
+    expect(response.status).toBe(206);
+    expect(response.headers.get("content-range")).toBe("bytes 0-3/10");
+    expect(response.headers.get("accept-ranges")).toBe("bytes");
+    expect(response.headers.get("content-length")).toBe("4");
+    expect(await response.text()).toBe("0123");
+  });
+});
+
+describe("backend proxy raw path", () => {
+  it("keeps encoded separators inside a path segment", () => {
+    const url = new URL("http://localhost/api/files/uploads%2Fu1%2Fa%3Fb.png/url?x=1");
+    expect(rawSubpath(url, "/api/")).toBe("files/uploads%2Fu1%2Fa%3Fb.png/url");
+  });
+
+  it("strips only the given prefix", () => {
+    expect(rawSubpath(new URL("http://localhost/api/auth/get-session"), "/api/auth/")).toBe("get-session");
+    expect(rawSubpath(new URL("http://localhost/other"), "/api/")).toBe("/other");
+  });
 });

package/dist/templates/fullstack/apps/web/src/lib/server/backend-proxy.ts

@@ -15,16 +15,36 @@ const FORWARDED_HEADERS = [
   "origin",
   "referer",
   "user-agent",
+  "if-none-match",
+  "if-modified-since",
+  "range",
+  "if-range",
 ];
 const RELAYED_RESPONSE_HEADERS = [
   "content-type",
+  "content-disposition",
+  "content-range",
+  "accept-ranges",
   "location",
   "cache-control",
+  "etag",
+  "last-modified",
+  "vary",
+  "x-content-type-options",
+  "content-security-policy",
   "retry-after",
   "ratelimit-limit",
   "ratelimit-remaining",
+  // Cursor-paged lists (such as the audit log) return the next page's cursor here.
+  "x-next-cursor",
 ];
 
+// SvelteKit decodes rest params, so an encoded "%2F" or "%3F" inside a path
+// segment would reach the API as "/" or "?". Forward the raw pathname instead.
+export function rawSubpath(url: URL, prefix: string): string {
+  return url.pathname.startsWith(prefix) ? url.pathname.slice(prefix.length) : url.pathname;
+}
+
 export function backendBaseUrl(): string {
   return process.env.BACKEND_INTERNAL_URL ?? "http://localhost:5002";
 }
@@ -71,6 +91,10 @@ export async function proxyRequest(
     // them as text corrupts bytes that are not valid UTF-8 before forwarding.
     body: hasBody ? await request.arrayBuffer() : undefined,
     redirect: "manual",
+    // Abort the upstream request when the browser disconnects. Without this, every
+    // closed EventSource or aborted request keeps its API socket open until Bun's
+    // fetch pool is exhausted and the web process stops serving requests.
+    signal: request.signal,
   });
 
   const responseHeaders = new Headers();
@@ -78,6 +102,12 @@ export async function proxyRequest(
     const value = upstream.headers.get(name);
     if (value) responseHeaders.set(name, value);
   }
+  // Bun's fetch decodes a compressed body but keeps the upstream content-encoding
+  // and compressed content-length, which would truncate the decoded body.
+  const contentLength = upstream.headers.get("content-length");
+  if (contentLength && !upstream.headers.has("content-encoding")) {
+    responseHeaders.set("content-length", contentLength);
+  }
   // Relay Set-Cookie so auth session cookies reach the browser.
   for (const cookie of upstream.headers.getSetCookie()) {
     responseHeaders.append("set-cookie", cookie);

package/dist/templates/fullstack/apps/web/src/routes/api/[...path]/+server.ts

@@ -1,11 +1,11 @@
 import type { RequestHandler } from "@sveltejs/kit";
-import { backendBaseUrl, proxyRequest, resolveClientIp } from "#lib/server/backend-proxy.js";
+import { backendBaseUrl, proxyRequest, rawSubpath, resolveClientIp } from "#lib/server/backend-proxy.js";
 
 // Proxy the app's REST API, stripping the /api prefix (backend routes are at root).
-const handler: RequestHandler = ({ request, params, url, getClientAddress }) =>
+const handler: RequestHandler = ({ request, url, getClientAddress }) =>
   proxyRequest(
     request,
-    `${backendBaseUrl()}/${params.path}${url.search}`,
+    `${backendBaseUrl()}/${rawSubpath(url, "/api/")}${url.search}`,
     resolveClientIp(getClientAddress),
   );
 

package/dist/templates/fullstack/apps/web/src/routes/api/auth/[...all]/+server.ts

@@ -1,11 +1,11 @@
 import type { RequestHandler } from "@sveltejs/kit";
-import { backendBaseUrl, proxyRequest, resolveClientIp } from "#lib/server/backend-proxy.js";
+import { backendBaseUrl, proxyRequest, rawSubpath, resolveClientIp } from "#lib/server/backend-proxy.js";
 
 // Proxy the better-auth handler, keeping the /api/auth prefix.
-const handler: RequestHandler = ({ request, params, url, getClientAddress }) =>
+const handler: RequestHandler = ({ request, url, getClientAddress }) =>
   proxyRequest(
     request,
-    `${backendBaseUrl()}/api/auth/${params.all}${url.search}`,
+    `${backendBaseUrl()}/api/auth/${rawSubpath(url, "/api/auth/")}${url.search}`,
     resolveClientIp(getClientAddress),
   );