@qelos/integrator-express 4.0.0 → 4.1.0

package/README.md

@@ -1,11 +1,10 @@
 # @qelos/integrator-express
 
-Express middleware that calls the Qelos SDK to identify the current user and
-their active workspace before your route handler runs, exposing them on
-`req.qelos.user` / `req.qelos.workspace`.
-
-This is the Express implementation of the Qelos integrator contract — the same
-shape exposed by `@qelos/integrator-nuxt`, `@qelos/plugin-netlify-api`, etc.
+Express integrator for [Qelos](https://qelos.io). It plugs into an Express app
+to make the Node host act as a same-origin BFF for a managed Qelos app:
+requests under `/api/**` are proxied to Qelos, and every other request resolves
+the current user up front so your route handlers can use `req.qelos.user` /
+`req.qelos.workspace` / `req.qelos.workspaces` / `req.qelos.sdk` directly.
 
 ## Install
 
@@ -15,149 +14,197 @@ npm install @qelos/integrator-express @qelos/sdk
 npm install express
 ```
 
+> Requires Node 18+ — the middleware uses
+> [`Response.headers.getSetCookie()`](https://developer.mozilla.org/docs/Web/API/Headers/getSetCookie)
+> to pipe individual upstream `Set-Cookie` headers back to the client.
+
 ## Quick start
 
 ```ts
 import express from 'express';
-import { createQelosMiddleware, requireUser } from '@qelos/integrator-express';
+import { createQelosIntegrator } from '@qelos/integrator-express';
 
 const app = express();
 
-app.use(
-  createQelosMiddleware({
-    config: {
-      appUrl: process.env.QELOS_APP_URL!, // e.g. https://yourdomain.com
-    },
-  }),
-);
-
-app.get('/me', (req, res) => {
-  // user/workspace are null when the request is anonymous
-  res.json({
-    user: req.qelos!.user,
-    workspace: req.qelos!.workspace,
-  });
+const qelos = createQelosIntegrator({
+  config: {
+    appUrl: process.env.QELOS_APP_URL!, // e.g. https://yourdomain.com
+  },
 });
 
-// Short-circuit with 401 when there is no authenticated user:
-app.get(
-  '/private',
-  requireUser((req, res) => {
-    res.json(req.qelos!.user);
-  }),
-);
-```
-
-## What the middleware does
+// User-resolution middleware. Runs on every non-`/api/` request.
+app.use(qelos.middleware);
 
-1. Reads the access token from `Authorization: Bearer ...` or the
-   `q_access_token` cookie, and the refresh token from `q_refresh_token`.
-2. Builds a per-request Qelos SDK instance bound to those tokens.
-3. Calls `sdk.authentication.getLoggedInUser()` and
-   `sdk.workspaces.getList()`.
-4. Picks the active workspace (first by default — override with
-   `resolveWorkspace`).
-5. Attaches everything to `req.qelos` and calls `next()`.
-
-The middleware never throws for anonymous requests by default — it just leaves
-`req.qelos.user` and `req.qelos.workspace` as `null`. Pass `requireAuth: true`
-to short-circuit anonymous requests with `401`.
-
-## Token refresh
-
-When the access token is rejected, the SDK tries to recover, in order:
-
-1. The **refresh token** (`q_refresh_token`) via
-   `sdk.authentication.refreshToken()` — issues a new access + refresh pair.
-2. The **cookie token** (the access token cookie itself) via
-   `sdk.authentication.refreshCookieToken()` — used for cookie-only sessions
-   that do not carry a separate refresh token (e.g. social-auth flows).
-
-After a successful refresh the middleware fires the `onTokenRefresh` hook.
-The default implementation writes the new tokens back to the response cookies
-(`HttpOnly`, `SameSite=Lax`, `Secure` whenever `appUrl` is `https://...`).
+// User-defined routes still take precedence — mount them BEFORE the proxy.
+app.get('/me', (req, res) => {
+  res.json({ user: req.qelos.user, workspace: req.qelos.workspace });
+});
 
-You can supply your own — for example, to mint your own session cookie or push
-the new tokens into a session store:
+// Catch-all reverse proxy for `/api/**`. Mount it AFTER your own routes.
+if (qelos.proxy) {
+  app.use('/api', qelos.proxy);
+}
 
-```ts
-app.use(
-  createQelosMiddleware({
-    config: { appUrl: process.env.QELOS_APP_URL! },
-    onTokenRefresh: async ({ req, res, newTokens, oldTokens }) => {
-      await sessionStore.rotate(req.sessionID, newTokens);
-    },
-  }),
-);
+app.listen(3000);
 ```
 
-The hook receives `{ req, res, oldTokens, newTokens, sdk }`. Throwing aborts
-the in-flight request.
-
-### Manual cookie refresh
-
-Long-lived integrator-hosted sessions can also call the SDK directly to
-proactively refresh the cookie token (e.g. before a navigation that hands the
-session over to a downstream service):
+If you'd rather wire the middleware and proxy manually, the lower-level
+`createQelosMiddleware` and `createQelosProxy` factories are exported too.
+
+## API proxy
+
+When the integrator is built with `disableProxy !== true`, `createQelosProxy`
+returns an Express `RequestHandler` that transparently proxies any `/api/**`
+request the consuming app does not handle itself to the configured Qelos
+managed-app origin. This lets the Express app act as a same-origin BFF:
+`@qelos/sdk` calls from the browser, server, or the Qelos web SDK can all hit
+`/api/...` on the Express host and reach Qelos without CORS or cross-site
+cookie pain.
+
+User-defined routes still take precedence — mount the proxy after the rest of
+your `/api/*` routes so it only catches requests no other handler matched.
+
+### Cookie domain rewrite
+
+The proxy forwards the incoming `Cookie` header as-is (the Qelos session
+cookie name is treated as opaque) and forwards upstream `Set-Cookie` headers
+back to the client, rewriting the `Domain=` attribute on every upstream
+cookie to the inbound request's own host. That way the session cookie set by
+Qelos is valid on the Express app's domain regardless of which host Qelos
+issues cookies from.
+
+### Resolving the proxy target
+
+The managed Qelos app URL (`config.appUrl`) is the proxy target. Env vars are
+only dev-time overrides for when the configured `appUrl` isn't reachable from
+the local host:
+
+1. `QELOS_PROXY_TARGET` env var.
+2. `QELOS_IP` env var (dev fallback).
+3. `QELOS_API_IP` env var (dev fallback).
+4. `config.appUrl`.
+
+If none of these are set, the proxy handler responds with `503` so
+misconfiguration fails loudly.
+
+### Opting out
+
+Set `disableProxy: true` on the config to skip registration of the proxy
+handler — useful when the Express app implements every `/api/*` route itself
+or terminates the proxy elsewhere (CDN, reverse proxy, etc.). When the proxy
+is disabled, `qelos.proxy` is `null` and `/api/` is **not** auto-added to
+`skipPaths`, so you remain in control of every request.
+
+WebSocket upgrades are not proxied; route them explicitly if needed.
+
+## Middleware
+
+On every non-`/api/` request, the server middleware identifies the current
+user by calling the managed Qelos app directly:
+
+1. Resolve the upstream origin the same way the `/api/**` proxy does
+   (`QELOS_PROXY_TARGET` → `QELOS_IP` → `QELOS_API_IP` → `config.appUrl`).
+2. Issue `fetch('${upstream}/api/me')` with the incoming request's `Cookie`
+   header forwarded verbatim — the Qelos session cookie name is opaque to
+   the integrator, so the whole header is piped through unchanged. Any
+   incoming `Authorization` header is forwarded too.
+3. For every `Set-Cookie` header on the upstream response, rewrite the
+   `Domain=` attribute to the inbound request's `Host` (port stripped) and
+   append it to the outgoing response. This is how session rotations from
+   Qelos reach the browser when the managed app and the Express host live on
+   different origins.
+4. On `2xx`, parse the JSON body and expose it as `req.qelos.user`. On any
+   other status (or a network error), leave `user = null` — and respond with
+   `401` if `requireAuth` is set.
+
+The middleware is independent from the `/api/**` proxy: the proxy handles
+forwarding of API calls themselves, while the middleware identifies the user
+on every page/non-API request before your route handlers run. To avoid
+double-hitting Qelos for `/api/me` (once for proxying, once for user
+resolution), `createQelosIntegrator` adds `/api/` to `skipPaths` automatically
+when the proxy is enabled.
+
+> The middleware does not attempt to strip the `Secure` attribute from
+> rotated cookies. In local dev over plain HTTP, browsers will drop `Secure`
+> cookies — configure the managed Qelos app to issue non-`Secure` cookies in
+> that environment, or run the Express host over HTTPS.
+
+## Use in route handlers
+
+`req.qelos` is augmented onto the Express `Request` type and gives you a typed
+`QelosRequestContext`:
+
+| field        | description                                                       |
+|--------------|-------------------------------------------------------------------|
+| `user`       | The `IUser` body returned by `/api/me`, or `null` when anonymous. |
+| `workspace`  | The active `IWorkspace` for the request, or `null`.               |
+| `workspaces` | All workspaces the user has access to.                            |
+| `sdk`        | A request-scoped `QelosSDK` instance bound to the live cookies.   |
 
 ```ts
-const result = await req.qelos!.sdk.authentication.refreshCookieToken();
-// result.headers['set-cookie'] — fresh cookie value to forward
-// result.payload.user        — refreshed user
+app.get('/products', requireUser(async (req, res) => {
+  const products = await req.qelos.sdk.entities('products').getList();
+  res.json(products);
+}));
 ```
 
-## Configuration
+The `sdk` reads cookies from the current request on every call, so any
+session rotation piped through by the middleware is picked up automatically
+by subsequent SDK requests in the same handler.
+
+Use `requireUser` to short-circuit unauthenticated requests with `401`:
 
 ```ts
-createQelosMiddleware({
-  config: {
-    appUrl: 'https://yourdomain.com', // required
+import { requireUser } from '@qelos/integrator-express';
 
-    // Service-to-service: use a static API token instead of cookies/refresh.
-    apiToken: process.env.QELOS_API_TOKEN,
+app.get('/private', requireUser((req, res) => res.json(req.qelos.user)));
+```
 
-    // Cookie names. Defaults shown.
-    accessTokenCookie: 'q_access_token',
-    refreshTokenCookie: 'q_refresh_token',
+## Workspace resolution
 
-    // Reject anonymous requests with 401. Defaults to false.
-    requireAuth: false,
+`req.qelos.workspace` defaults to whatever the managed Qelos app reports on
+`user.workspace` from `/api/me`. That field is non-null only when the user
+has already activated a workspace on the Qelos side; when it is `null`, the
+frontend is expected to prompt the user to either activate an existing
+workspace or create a new one. The middleware deliberately does **not**
+auto-pick `workspaces[0]` — that would silently put the user into the wrong
+workspace.
 
-    // Skip the middleware entirely for these path prefixes.
-    skipPaths: ['/health', '/metrics'],
+To override the default (e.g. force a particular workspace per request),
+pass a `resolveWorkspace` callback:
 
-    // Anything you want passed through to the per-request SDK.
-    sdkOptions: {},
-  },
+```ts
+import { createQelosIntegrator } from '@qelos/integrator-express';
 
-  // Override workspace selection. Defaults to `workspaces[0]`.
+const qelos = createQelosIntegrator({
+  config: { appUrl: process.env.QELOS_APP_URL! },
   resolveWorkspace: ({ req, user, workspaces }) => {
     const headerId = req.headers['x-qelos-workspace'];
-    return workspaces.find((w) => w._id === headerId) || workspaces[0] || null;
+    return (
+      workspaces.find((w) => w._id === headerId) ||
+      user.workspace ||
+      null
+    );
   },
 });
 ```
 
-## TypeScript
+## API token mode
 
-Importing from `@qelos/integrator-express` augments the Express `Request` type
-(via `declare module 'express'` and `declare module 'express-serve-static-core'`)
-so `req.qelos` is typed everywhere in your app. The shape is:
+For service-to-service deployments where every request shares one Qelos API
+token, set `apiToken` and the middleware will skip the cookie flow entirely
+and build an SDK that authenticates with the static token:
 
 ```ts
-interface QelosRequestContext {
-  user: IUser | null;
-  workspace: IWorkspace | null;
-  workspaces: IWorkspace[];
-  sdk: QelosSDK;          // bound to the current request's tokens
-  tokens: QelosTokenPair; // mutated in place when a refresh occurs
-}
+createQelosIntegrator({
+  config: {
+    appUrl: process.env.QELOS_APP_URL!,
+    apiToken: process.env.QELOS_API_TOKEN,
+  },
+});
 ```
 
-`req.qelos` is typed as non-optional. If you use `skipPaths`, the property is
-unset for skipped requests — guard with `if (req.qelos) { ... }` in those routes.
-
 ## Requirements
 
-- Node.js >= 18 (uses the global `fetch`).
+- Node.js >= 18 (uses global `fetch` and `Headers.getSetCookie`).
 - Express 4 or 5.

package/dist/cookies.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Rewrite the `Domain=` attribute of a single `Set-Cookie` header value.
+ *
+ * - If the cookie contains a `Domain=<value>` attribute (case-insensitive), its
+ *   value is replaced with `newDomain`, with any trailing `:port` suffix
+ *   stripped first (cookie `Domain` attributes do not include a port).
+ * - If `newDomain` is `undefined` (or empty), the entire `; Domain=<value>`
+ *   segment is removed so the browser scopes the cookie to the current host.
+ * - If no `Domain=` attribute is present, the input is returned unchanged.
+ *
+ * All other attributes, their casing/order and the original cookie name/value
+ * bytes are preserved.
+ */
+export declare function rewriteSetCookieDomain(setCookie: string, newDomain: string | undefined): string;
+/**
+ * Apply {@link rewriteSetCookieDomain} to each entry of a `Set-Cookie` array
+ * (e.g. the result of `Headers.getSetCookie()`).
+ */
+export declare function rewriteSetCookieDomains(values: string[], newDomain: string | undefined): string[];

package/dist/cookies.js

@@ -0,0 +1,43 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.rewriteSetCookieDomain = rewriteSetCookieDomain;
+exports.rewriteSetCookieDomains = rewriteSetCookieDomains;
+/**
+ * Rewrite the `Domain=` attribute of a single `Set-Cookie` header value.
+ *
+ * - If the cookie contains a `Domain=<value>` attribute (case-insensitive), its
+ *   value is replaced with `newDomain`, with any trailing `:port` suffix
+ *   stripped first (cookie `Domain` attributes do not include a port).
+ * - If `newDomain` is `undefined` (or empty), the entire `; Domain=<value>`
+ *   segment is removed so the browser scopes the cookie to the current host.
+ * - If no `Domain=` attribute is present, the input is returned unchanged.
+ *
+ * All other attributes, their casing/order and the original cookie name/value
+ * bytes are preserved.
+ */
+function rewriteSetCookieDomain(setCookie, newDomain) {
+    const domainSegment = /;\s*Domain\s*=\s*[^;]+/i;
+    if (!domainSegment.test(setCookie))
+        return setCookie;
+    const stripped = newDomain ? stripPort(newDomain) : '';
+    if (!stripped) {
+        return setCookie.replace(domainSegment, '');
+    }
+    return setCookie.replace(/(;\s*Domain\s*=\s*)[^;]+/i, `$1${stripped}`);
+}
+/**
+ * Apply {@link rewriteSetCookieDomain} to each entry of a `Set-Cookie` array
+ * (e.g. the result of `Headers.getSetCookie()`).
+ */
+function rewriteSetCookieDomains(values, newDomain) {
+    return values.map((value) => rewriteSetCookieDomain(value, newDomain));
+}
+function stripPort(host) {
+    if (host.startsWith('[')) {
+        const end = host.indexOf(']');
+        return end === -1 ? host : host.slice(1, end);
+    }
+    const colon = host.indexOf(':');
+    return colon === -1 ? host : host.slice(0, colon);
+}
+//# sourceMappingURL=cookies.js.map

package/dist/cookies.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cookies.js","sourceRoot":"","sources":["../src/cookies.ts"],"names":[],"mappings":";;AAaA,wDAeC;AAMD,0DAKC;AAvCD;;;;;;;;;;;;GAYG;AACH,SAAgB,sBAAsB,CACpC,SAAiB,EACjB,SAA6B;IAE7B,MAAM,aAAa,GAAG,yBAAyB,CAAC;IAChD,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC;QAAE,OAAO,SAAS,CAAC;IAErD,MAAM,QAAQ,GAAG,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACvD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,SAAS,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,SAAS,CAAC,OAAO,CACtB,2BAA2B,EAC3B,KAAK,QAAQ,EAAE,CAChB,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAgB,uBAAuB,CACrC,MAAgB,EAChB,SAA6B;IAE7B,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,sBAAsB,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC;AACzE,CAAC;AAED,SAAS,SAAS,CAAC,IAAY;IAC7B,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC9B,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAChD,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAChC,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;AACpD,CAAC"}

package/dist/index.d.ts

@@ -1,6 +1,33 @@
+import type { RequestHandler } from 'express';
+import { type CreateMiddlewareOptions } from './middleware';
 export { createQelosMiddleware, requireUser, } from './middleware';
 export type { CreateMiddlewareOptions, QelosMiddleware, } from './middleware';
+export { createQelosProxy } from './proxy';
+export type { CreateProxyOptions, QelosProxyHandler } from './proxy';
 export { createRequestSdk } from './sdk-factory';
 export type { CreateSdkParams } from './sdk-factory';
-export type { QelosExpressConfig, QelosRequestContext, QelosTokenPair, ResolvedTokens, TokenRefreshContext, TokenRefreshHook, } from './types';
-export { completeSocialAuthCallback, applySocialAuthCookiesToServerResponse, getSocialAuthSetCookieParts, parseSocialCallbackRefreshToken, type SocialAuthCallbackPayload, type SocialCallbackInput, } from './social-auth';
+export { rewriteSetCookieDomain, rewriteSetCookieDomains } from './cookies';
+export { resolveQelosProxyTarget } from './proxy-target';
+export type { QelosExpressConfig, QelosRequestContext, } from './types';
+export { completeSocialAuthCallback, getSocialAuthSetCookieParts, parseSocialCallbackRefreshToken, type SocialAuthCallbackPayload, type SocialCallbackInput, } from './social-auth';
+export interface QelosIntegrator {
+    /**
+     * User-resolution middleware. Forwards inbound cookies to `/api/me` and
+     * exposes `req.qelos.user` / `req.qelos.workspace` / `req.qelos.workspaces`
+     * / `req.qelos.sdk`.
+     */
+    middleware: RequestHandler;
+    /**
+     * Catch-all reverse-proxy handler for `/api/**`. Mount it AFTER your own
+     * `/api/*` routes so user-defined endpoints still take precedence. Returns
+     * `null` when `config.disableProxy === true`.
+     */
+    proxy: RequestHandler | null;
+}
+/**
+ * Build both the user-resolution middleware and the `/api/**` reverse proxy
+ * from a single config. When the proxy is enabled (the default), `/api/` is
+ * auto-prepended to `skipPaths` so the middleware doesn't shadow the proxy
+ * by running its own `/api/me` probe on every proxied request.
+ */
+export declare function createQelosIntegrator(options: CreateMiddlewareOptions): QelosIntegrator;

package/dist/index.js

@@ -1,14 +1,43 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.parseSocialCallbackRefreshToken = exports.getSocialAuthSetCookieParts = exports.applySocialAuthCookiesToServerResponse = exports.completeSocialAuthCallback = exports.createRequestSdk = exports.requireUser = exports.createQelosMiddleware = void 0;
-var middleware_1 = require("./middleware");
-Object.defineProperty(exports, "createQelosMiddleware", { enumerable: true, get: function () { return middleware_1.createQelosMiddleware; } });
-Object.defineProperty(exports, "requireUser", { enumerable: true, get: function () { return middleware_1.requireUser; } });
+exports.parseSocialCallbackRefreshToken = exports.getSocialAuthSetCookieParts = exports.completeSocialAuthCallback = exports.resolveQelosProxyTarget = exports.rewriteSetCookieDomains = exports.rewriteSetCookieDomain = exports.createRequestSdk = exports.createQelosProxy = exports.requireUser = exports.createQelosMiddleware = void 0;
+exports.createQelosIntegrator = createQelosIntegrator;
+const middleware_1 = require("./middleware");
+const proxy_1 = require("./proxy");
+var middleware_2 = require("./middleware");
+Object.defineProperty(exports, "createQelosMiddleware", { enumerable: true, get: function () { return middleware_2.createQelosMiddleware; } });
+Object.defineProperty(exports, "requireUser", { enumerable: true, get: function () { return middleware_2.requireUser; } });
+var proxy_2 = require("./proxy");
+Object.defineProperty(exports, "createQelosProxy", { enumerable: true, get: function () { return proxy_2.createQelosProxy; } });
 var sdk_factory_1 = require("./sdk-factory");
 Object.defineProperty(exports, "createRequestSdk", { enumerable: true, get: function () { return sdk_factory_1.createRequestSdk; } });
+var cookies_1 = require("./cookies");
+Object.defineProperty(exports, "rewriteSetCookieDomain", { enumerable: true, get: function () { return cookies_1.rewriteSetCookieDomain; } });
+Object.defineProperty(exports, "rewriteSetCookieDomains", { enumerable: true, get: function () { return cookies_1.rewriteSetCookieDomains; } });
+var proxy_target_1 = require("./proxy-target");
+Object.defineProperty(exports, "resolveQelosProxyTarget", { enumerable: true, get: function () { return proxy_target_1.resolveQelosProxyTarget; } });
 var social_auth_1 = require("./social-auth");
 Object.defineProperty(exports, "completeSocialAuthCallback", { enumerable: true, get: function () { return social_auth_1.completeSocialAuthCallback; } });
-Object.defineProperty(exports, "applySocialAuthCookiesToServerResponse", { enumerable: true, get: function () { return social_auth_1.applySocialAuthCookiesToServerResponse; } });
 Object.defineProperty(exports, "getSocialAuthSetCookieParts", { enumerable: true, get: function () { return social_auth_1.getSocialAuthSetCookieParts; } });
 Object.defineProperty(exports, "parseSocialCallbackRefreshToken", { enumerable: true, get: function () { return social_auth_1.parseSocialCallbackRefreshToken; } });
+/**
+ * Build both the user-resolution middleware and the `/api/**` reverse proxy
+ * from a single config. When the proxy is enabled (the default), `/api/` is
+ * auto-prepended to `skipPaths` so the middleware doesn't shadow the proxy
+ * by running its own `/api/me` probe on every proxied request.
+ */
+function createQelosIntegrator(options) {
+    const proxyEnabled = options.config.disableProxy !== true;
+    let config = options.config;
+    if (proxyEnabled) {
+        const existingSkipPaths = options.config.skipPaths ?? [];
+        const alreadyCovered = existingSkipPaths.some((prefix) => '/api/'.startsWith(prefix));
+        if (!alreadyCovered) {
+            config = { ...options.config, skipPaths: ['/api/', ...existingSkipPaths] };
+        }
+    }
+    const middleware = (0, middleware_1.createQelosMiddleware)({ ...options, config });
+    const proxy = proxyEnabled ? (0, proxy_1.createQelosProxy)({ config }) : null;
+    return { middleware, proxy };
+}
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;AAAA,2CAGsB;AAFpB,mHAAA,qBAAqB,OAAA;AACrB,yGAAA,WAAW,OAAA;AAOb,6CAAiD;AAAxC,+GAAA,gBAAgB,OAAA;AAYzB,6CAOuB;AANrB,yHAAA,0BAA0B,OAAA;AAC1B,qIAAA,sCAAsC,OAAA;AACtC,0HAAA,2BAA2B,OAAA;AAC3B,8HAAA,+BAA+B,OAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;AAyDA,sDAkBC;AA1ED,6CAAmF;AACnF,mCAA2C;AAG3C,2CAGsB;AAFpB,mHAAA,qBAAqB,OAAA;AACrB,yGAAA,WAAW,OAAA;AAOb,iCAA2C;AAAlC,yGAAA,gBAAgB,OAAA;AAGzB,6CAAiD;AAAxC,+GAAA,gBAAgB,OAAA;AAGzB,qCAA4E;AAAnE,iHAAA,sBAAsB,OAAA;AAAE,kHAAA,uBAAuB,OAAA;AACxD,+CAAyD;AAAhD,uHAAA,uBAAuB,OAAA;AAOhC,6CAMuB;AALrB,yHAAA,0BAA0B,OAAA;AAC1B,0HAAA,2BAA2B,OAAA;AAC3B,8HAAA,+BAA+B,OAAA;AAoBjC;;;;;GAKG;AACH,SAAgB,qBAAqB,CACnC,OAAgC;IAEhC,MAAM,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,YAAY,KAAK,IAAI,CAAC;IAE1D,IAAI,MAAM,GAAuB,OAAO,CAAC,MAAM,CAAC;IAChD,IAAI,YAAY,EAAE,CAAC;QACjB,MAAM,iBAAiB,GAAG,OAAO,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC;QACzD,MAAM,cAAc,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;QACtF,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,MAAM,GAAG,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,SAAS,EAAE,CAAC,OAAO,EAAE,GAAG,iBAAiB,CAAC,EAAE,CAAC;QAC7E,CAAC;IACH,CAAC;IAED,MAAM,UAAU,GAAG,IAAA,kCAAqB,EAAC,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;IACjE,MAAM,KAAK,GAAG,YAAY,CAAC,CAAC,CAAC,IAAA,wBAAgB,EAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAEjE,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;AAC/B,CAAC"}

package/dist/middleware.d.ts

@@ -1,17 +1,13 @@
 import type { Request, RequestHandler } from 'express';
 import type { IUser } from '@qelos/sdk/dist/authentication';
 import type { IWorkspace } from '@qelos/sdk/workspaces';
-import type { QelosExpressConfig, TokenRefreshHook } from './types';
+import type { QelosExpressConfig } from './types';
 export interface CreateMiddlewareOptions {
     config: QelosExpressConfig;
     /**
-     * Hook invoked after a successful token refresh. The default implementation
-     * writes the new tokens back to the response cookies.
-     */
-    onTokenRefresh?: TokenRefreshHook;
-    /**
-     * Resolve the active workspace for a request. Defaults to picking the first
-     * workspace returned from `sdk.workspaces.getList()`.
+     * Resolve the active workspace for a request. Defaults to whatever
+     * `/api/me` reports on `user.workspace` (the user's currently activated
+     * workspace, or `null` when none is active).
      */
     resolveWorkspace?: (params: {
         req: Request;

package/dist/middleware.js

@@ -2,56 +2,17 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.createQelosMiddleware = createQelosMiddleware;
 exports.requireUser = requireUser;
+const cookies_1 = require("./cookies");
+const proxy_target_1 = require("./proxy-target");
 const sdk_factory_1 = require("./sdk-factory");
-const DEFAULT_ACCESS_COOKIE = 'q_access_token';
-const DEFAULT_REFRESH_COOKIE = 'q_refresh_token';
-function readCookie(req, name) {
-    // Prefer cookie-parser output when available.
-    const parsed = req.cookies;
-    if (parsed && typeof parsed[name] === 'string') {
-        return parsed[name];
-    }
-    const header = req.headers.cookie;
-    if (!header)
-        return undefined;
-    const prefix = name + '=';
-    for (const part of header.split(';')) {
-        const trimmed = part.trim();
-        if (trimmed.startsWith(prefix)) {
-            try {
-                return decodeURIComponent(trimmed.slice(prefix.length));
-            }
-            catch {
-                return trimmed.slice(prefix.length);
-            }
-        }
-    }
-    return undefined;
-}
-function readTokens(req, config) {
-    const accessCookie = config.accessTokenCookie || DEFAULT_ACCESS_COOKIE;
-    const refreshCookie = config.refreshTokenCookie || DEFAULT_REFRESH_COOKIE;
-    const cookieAccess = readCookie(req, accessCookie);
-    const cookieRefresh = readCookie(req, refreshCookie);
-    const authHeader = req.headers.authorization;
-    const headerAccess = authHeader && authHeader.toLowerCase().startsWith('bearer ')
-        ? authHeader.slice(7).trim()
-        : undefined;
-    return {
-        accessToken: headerAccess || cookieAccess || undefined,
-        refreshToken: cookieRefresh || undefined,
-    };
+function shouldSkip(req, config) {
+    if (!config.skipPaths?.length)
+        return false;
+    const path = req.path || req.url || '';
+    return config.skipPaths.some((prefix) => path.startsWith(prefix));
 }
-function serializeCookie(name, value, secure) {
-    const parts = [
-        `${name}=${encodeURIComponent(value)}`,
-        'Path=/',
-        'HttpOnly',
-        'SameSite=Lax',
-    ];
-    if (secure)
-        parts.push('Secure');
-    return parts.join('; ');
+function buildMeUrl(base) {
+    return `${base.replace(/\/+$/, '')}/api/me`;
 }
 function appendSetCookie(res, value) {
     const existing = res.getHeader('set-cookie');
@@ -65,58 +26,24 @@ function appendSetCookie(res, value) {
         res.setHeader('set-cookie', [value]);
     }
 }
-function writeTokensToCookies(res, config, tokens) {
-    const accessCookie = config.accessTokenCookie || DEFAULT_ACCESS_COOKIE;
-    const refreshCookie = config.refreshTokenCookie || DEFAULT_REFRESH_COOKIE;
-    const secure = !/^http:\/\//i.test(config.appUrl);
-    const cookieRes = res;
-    if (typeof cookieRes.cookie === 'function') {
-        const cookieOptions = {
-            httpOnly: true,
-            secure,
-            sameSite: 'lax',
-            path: '/',
-        };
-        cookieRes.cookie(accessCookie, tokens.accessToken, cookieOptions);
-        if (tokens.refreshToken) {
-            cookieRes.cookie(refreshCookie, tokens.refreshToken, cookieOptions);
-        }
-        return;
-    }
-    appendSetCookie(res, serializeCookie(accessCookie, tokens.accessToken, secure));
-    if (tokens.refreshToken) {
-        appendSetCookie(res, serializeCookie(refreshCookie, tokens.refreshToken, secure));
-    }
-}
-function shouldSkip(req, config) {
-    if (!config.skipPaths?.length)
-        return false;
-    const path = req.path || req.url || '';
-    return config.skipPaths.some((prefix) => path.startsWith(prefix));
-}
 function createQelosMiddleware(options) {
     const { config, resolveWorkspace } = options;
-    const onTokenRefresh = options.onTokenRefresh ||
-        (async ({ res, newTokens }) => {
-            writeTokensToCookies(res, config, newTokens);
-        });
+    const sdkFetch = (config.sdkOptions?.fetch ?? globalThis.fetch);
     return async function qelosMiddleware(req, res, next) {
         if (shouldSkip(req, config)) {
             next();
             return;
         }
-        const tokens = readTokens(req, config);
-        const sdk = (0, sdk_factory_1.createRequestSdk)({ config, tokens, req, res, onTokenRefresh });
+        const sdk = (0, sdk_factory_1.createRequestSdk)({ config, req });
         const ctx = {
             user: null,
             workspace: null,
             workspaces: [],
             sdk,
-            tokens,
         };
         req.qelos = ctx;
-        const hasAuthMaterial = Boolean(config.apiToken || tokens.accessToken || tokens.refreshToken);
-        if (!hasAuthMaterial) {
+        const base = (0, proxy_target_1.resolveQelosProxyTarget)(config);
+        if (!base && !config.apiToken) {
             if (config.requireAuth) {
                 res.status(401).json({ code: 'UNAUTHORIZED' });
                 return;
@@ -124,10 +51,44 @@ function createQelosMiddleware(options) {
             next();
             return;
         }
-        try {
-            ctx.user = await sdk.authentication.getLoggedInUser();
+        if (base) {
+            const headers = {};
+            if (req.headers.cookie)
+                headers.cookie = req.headers.cookie;
+            if (req.headers.authorization) {
+                headers.authorization = req.headers.authorization;
+            }
+            const originalHost = req.headers.host;
+            let upstream;
+            try {
+                upstream = await sdkFetch(buildMeUrl(base), {
+                    method: 'GET',
+                    headers,
+                    redirect: 'manual',
+                });
+            }
+            catch {
+                if (config.requireAuth) {
+                    res.status(401).json({ code: 'UNAUTHORIZED' });
+                    return;
+                }
+                next();
+                return;
+            }
+            const setCookieValues = upstream.headers.getSetCookie?.() ?? [];
+            for (const value of setCookieValues) {
+                appendSetCookie(res, (0, cookies_1.rewriteSetCookieDomain)(value, originalHost));
+            }
+            if (upstream.ok) {
+                try {
+                    ctx.user = (await upstream.json());
+                }
+                catch {
+                    ctx.user = null;
+                }
+            }
         }
-        catch {
+        if (!ctx.user) {
             if (config.requireAuth) {
                 res.status(401).json({ code: 'UNAUTHORIZED' });
                 return;
@@ -141,18 +102,20 @@ function createQelosMiddleware(options) {
         catch {
             ctx.workspaces = [];
         }
-        if (ctx.user && ctx.workspaces.length) {
-            if (resolveWorkspace) {
-                ctx.workspace =
-                    (await resolveWorkspace({
-                        req,
-                        user: ctx.user,
-                        workspaces: ctx.workspaces,
-                    })) || null;
-            }
-            else {
-                ctx.workspace = ctx.workspaces[0] || null;
-            }
+        if (resolveWorkspace) {
+            ctx.workspace =
+                (await resolveWorkspace({
+                    req,
+                    user: ctx.user,
+                    workspaces: ctx.workspaces,
+                })) || null;
+        }
+        else {
+            // `/api/me` carries `user.workspace` (`{ _id, name, roles }`) only when
+            // the user has activated a workspace. Null means the frontend must
+            // prompt to activate/create one — don't silently pick workspaces[0].
+            ctx.workspace =
+                ctx.user.workspace || null;
         }
         next();
     };

package/dist/middleware.js.map

@@ -1 +1 @@
-{"version":3,"file":"middleware.js","sourceRoot":"","sources":["../src/middleware.ts"],"names":[],"mappings":";;AA8IA,sDA4EC;AASD,kCAUC;AA1OD,+CAAiD;AASjD,MAAM,qBAAqB,GAAG,gBAAgB,CAAC;AAC/C,MAAM,sBAAsB,GAAG,iBAAiB,CAAC;AAoBjD,SAAS,UAAU,CAAC,GAAY,EAAE,IAAY;IAC5C,8CAA8C;IAC9C,MAAM,MAAM,GAAI,GAAsD,CAAC,OAAO,CAAC;IAC/E,IAAI,MAAM,IAAI,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,QAAQ,EAAE,CAAC;QAC/C,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC;IACtB,CAAC;IACD,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC;IAClC,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,MAAM,MAAM,GAAG,IAAI,GAAG,GAAG,CAAC;IAC1B,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YAC/B,IAAI,CAAC;gBACH,OAAO,kBAAkB,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;YAC1D,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACtC,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,UAAU,CAAC,GAAY,EAAE,MAA0B;IAC1D,MAAM,YAAY,GAAG,MAAM,CAAC,iBAAiB,IAAI,qBAAqB,CAAC;IACvE,MAAM,aAAa,GAAG,MAAM,CAAC,kBAAkB,IAAI,sBAAsB,CAAC;IAC1E,MAAM,YAAY,GAAG,UAAU,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;IACnD,MAAM,aAAa,GAAG,UAAU,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;IACrD,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;IAC7C,MAAM,YAAY,GAChB,UAAU,IAAI,UAAU,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC;QAC1D,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE;QAC5B,CAAC,CAAC,SAAS,CAAC;IAChB,OAAO;QACL,WAAW,EAAE,YAAY,IAAI,YAAY,IAAI,SAAS;QACtD,YAAY,EAAE,aAAa,IAAI,SAAS;KACzC,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CACtB,IAAY,EACZ,KAAa,EACb,MAAe;IAEf,MAAM,KAAK,GAAG;QACZ,GAAG,IAAI,IAAI,kBAAkB,CAAC,KAAK,CAAC,EAAE;QACtC,QAAQ;QACR,UAAU;QACV,cAAc;KACf,CAAC;IACF,IAAI,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACjC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,SAAS,eAAe,CAAC,GAAa,EAAE,KAAa;IACnD,MAAM,QAAQ,GAAG,GAAG,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;IAC7C,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5B,GAAG,CAAC,SAAS,CAAC,YAAY,EAAE,CAAC,GAAG,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC;IACpD,CAAC;SAAM,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACxC,GAAG,CAAC,SAAS,CAAC,YAAY,EAAE,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC;IACjD,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,SAAS,CAAC,YAAY,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;IACvC,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAC3B,GAAa,EACb,MAA0B,EAC1B,MAAsB;IAEtB,MAAM,YAAY,GAAG,MAAM,CAAC,iBAAiB,IAAI,qBAAqB,CAAC;IACvE,MAAM,aAAa,GAAG,MAAM,CAAC,kBAAkB,IAAI,sBAAsB,CAAC;IAC1E,MAAM,MAAM,GAAG,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAWlD,MAAM,SAAS,GAAG,GAAqB,CAAC;IACxC,IAAI,OAAO,SAAS,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;QAC3C,MAAM,aAAa,GAAG;YACpB,QAAQ,EAAE,IAAI;YACd,MAAM;YACN,QAAQ,EAAE,KAAc;YACxB,IAAI,EAAE,GAAG;SACV,CAAC;QACF,SAAS,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;QAClE,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;YACxB,SAAS,CAAC,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,YAAY,EAAE,aAAa,CAAC,CAAC;QACtE,CAAC;QACD,OAAO;IACT,CAAC;IAED,eAAe,CAAC,GAAG,EAAE,eAAe,CAAC,YAAY,EAAE,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC;IAChF,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;QACxB,eAAe,CAAC,GAAG,EAAE,eAAe,CAAC,aAAa,EAAE,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC;IACpF,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,GAAY,EAAE,MAA0B;IAC1D,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM;QAAE,OAAO,KAAK,CAAC;IAC5C,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC;IACvC,OAAO,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;AACpE,CAAC;AAED,SAAgB,qBAAqB,CACnC,OAAgC;IAEhC,MAAM,EAAE,MAAM,EAAE,gBAAgB,EAAE,GAAG,OAAO,CAAC;IAC7C,MAAM,cAAc,GAClB,OAAO,CAAC,cAAc;QACtB,CAAC,KAAK,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,EAAE,EAAE;YAC5B,oBAAoB,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;QAC/C,CAAC,CAAC,CAAC;IAEL,OAAO,KAAK,UAAU,eAAe,CACnC,GAAY,EACZ,GAAa,EACb,IAAkB;QAElB,IAAI,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,CAAC;YAC5B,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QAED,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QACvC,MAAM,GAAG,GAAG,IAAA,8BAAgB,EAAC,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,cAAc,EAAE,CAAC,CAAC;QAE3E,MAAM,GAAG,GAAwB;YAC/B,IAAI,EAAE,IAAI;YACV,SAAS,EAAE,IAAI;YACf,UAAU,EAAE,EAAE;YACd,GAAG;YACH,MAAM;SACP,CAAC;QACF,GAAG,CAAC,KAAK,GAAG,GAAG,CAAC;QAEhB,MAAM,eAAe,GAAG,OAAO,CAC7B,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,YAAY,CAC7D,CAAC;QACF,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;gBACvB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;gBAC/C,OAAO;YACT,CAAC;YACD,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,GAAG,CAAC,IAAI,GAAG,MAAM,GAAG,CAAC,cAAc,CAAC,eAAe,EAAE,CAAC;QACxD,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;gBACvB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;gBAC/C,OAAO;YACT,CAAC;YACD,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,GAAG,CAAC,UAAU,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;QAClD,CAAC;QAAC,MAAM,CAAC;YACP,GAAG,CAAC,UAAU,GAAG,EAAE,CAAC;QACtB,CAAC;QAED,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC;YACtC,IAAI,gBAAgB,EAAE,CAAC;gBACrB,GAAG,CAAC,SAAS;oBACX,CAAC,MAAM,gBAAgB,CAAC;wBACtB,GAAG;wBACH,IAAI,EAAE,GAAG,CAAC,IAAI;wBACd,UAAU,EAAE,GAAG,CAAC,UAAU;qBAC3B,CAAC,CAAC,IAAI,IAAI,CAAC;YAChB,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,SAAS,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;YAC5C,CAAC;QACH,CAAC;QAED,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;AACJ,CAAC;AAID;;;;GAIG;AACH,SAAgB,WAAW,CACzB,OAAuB;IAEvB,OAAO,SAAS,gBAAgB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI;QAC7C,IAAI,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;YAClC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;YAC/C,OAAO;QACT,CAAC;QACD,OAAO,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IACjC,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"middleware.js","sourceRoot":"","sources":["../src/middleware.ts"],"names":[],"mappings":";;AA2CA,sDA2GC;AASD,kCAUC;AAtKD,uCAAmD;AACnD,iDAAyD;AACzD,+CAAiD;AAiBjD,SAAS,UAAU,CAAC,GAAY,EAAE,MAA0B;IAC1D,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM;QAAE,OAAO,KAAK,CAAC;IAC5C,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC;IACvC,OAAO,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;AACpE,CAAC;AAED,SAAS,UAAU,CAAC,IAAY;IAC9B,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,SAAS,CAAC;AAC9C,CAAC;AAED,SAAS,eAAe,CAAC,GAAa,EAAE,KAAa;IACnD,MAAM,QAAQ,GAAG,GAAG,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;IAC7C,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5B,GAAG,CAAC,SAAS,CAAC,YAAY,EAAE,CAAC,GAAG,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC;IACpD,CAAC;SAAM,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACxC,GAAG,CAAC,SAAS,CAAC,YAAY,EAAE,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC;IACjD,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,SAAS,CAAC,YAAY,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;IACvC,CAAC;AACH,CAAC;AAED,SAAgB,qBAAqB,CACnC,OAAgC;IAEhC,MAAM,EAAE,MAAM,EAAE,gBAAgB,EAAE,GAAG,OAAO,CAAC;IAC7C,MAAM,QAAQ,GAAG,CAAC,MAAM,CAAC,UAAU,EAAE,KAAK,IAAI,UAAU,CAAC,KAAK,CAA4B,CAAC;IAE3F,OAAO,KAAK,UAAU,eAAe,CACnC,GAAY,EACZ,GAAa,EACb,IAAkB;QAElB,IAAI,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,CAAC;YAC5B,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QAED,MAAM,GAAG,GAAG,IAAA,8BAAgB,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QAE9C,MAAM,GAAG,GAAwB;YAC/B,IAAI,EAAE,IAAI;YACV,SAAS,EAAE,IAAI;YACf,UAAU,EAAE,EAAE;YACd,GAAG;SACJ,CAAC;QACF,GAAG,CAAC,KAAK,GAAG,GAAG,CAAC;QAEhB,MAAM,IAAI,GAAG,IAAA,sCAAuB,EAAC,MAAM,CAAC,CAAC;QAC7C,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;YAC9B,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;gBACvB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;gBAC/C,OAAO;YACT,CAAC;YACD,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QAED,IAAI,IAAI,EAAE,CAAC;YACT,MAAM,OAAO,GAA2B,EAAE,CAAC;YAC3C,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM;gBAAE,OAAO,CAAC,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC;YAC5D,IAAI,GAAG,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;gBAC9B,OAAO,CAAC,aAAa,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;YACpD,CAAC;YAED,MAAM,YAAY,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC;YAEtC,IAAI,QAAyC,CAAC;YAC9C,IAAI,CAAC;gBACH,QAAQ,GAAG,MAAM,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE;oBAC1C,MAAM,EAAE,KAAK;oBACb,OAAO;oBACP,QAAQ,EAAE,QAAQ;iBACnB,CAAC,CAAC;YACL,CAAC;YAAC,MAAM,CAAC;gBACP,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;oBACvB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;oBAC/C,OAAO;gBACT,CAAC;gBACD,IAAI,EAAE,CAAC;gBACP,OAAO;YACT,CAAC;YAED,MAAM,eAAe,GAAG,QAAQ,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,CAAC;YAChE,KAAK,MAAM,KAAK,IAAI,eAAe,EAAE,CAAC;gBACpC,eAAe,CAAC,GAAG,EAAE,IAAA,gCAAsB,EAAC,KAAK,EAAE,YAAY,CAAC,CAAC,CAAC;YACpE,CAAC;YAED,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;gBAChB,IAAI,CAAC;oBACH,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAU,CAAC;gBAC9C,CAAC;gBAAC,MAAM,CAAC;oBACP,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;gBAClB,CAAC;YACH,CAAC;QACH,CAAC;QAED,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;YACd,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;gBACvB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;gBAC/C,OAAO;YACT,CAAC;YACD,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,GAAG,CAAC,UAAU,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;QAClD,CAAC;QAAC,MAAM,CAAC;YACP,GAAG,CAAC,UAAU,GAAG,EAAE,CAAC;QACtB,CAAC;QAED,IAAI,gBAAgB,EAAE,CAAC;YACrB,GAAG,CAAC,SAAS;gBACX,CAAC,MAAM,gBAAgB,CAAC;oBACtB,GAAG;oBACH,IAAI,EAAE,GAAG,CAAC,IAAI;oBACd,UAAU,EAAE,GAAG,CAAC,UAAU;iBAC3B,CAAC,CAAC,IAAI,IAAI,CAAC;QAChB,CAAC;aAAM,CAAC;YACN,wEAAwE;YACxE,mEAAmE;YACnE,qEAAqE;YACrE,GAAG,CAAC,SAAS;gBACV,GAAG,CAAC,IAAqD,CAAC,SAAS,IAAI,IAAI,CAAC;QACjF,CAAC;QAED,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;AACJ,CAAC;AAID;;;;GAIG;AACH,SAAgB,WAAW,CACzB,OAAuB;IAEvB,OAAO,SAAS,gBAAgB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI;QAC7C,IAAI,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;YAClC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;YAC/C,OAAO;QACT,CAAC;QACD,OAAO,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IACjC,CAAC,CAAC;AACJ,CAAC"}

package/dist/proxy-target.d.ts

@@ -0,0 +1,17 @@
+import type { QelosExpressConfig } from './types';
+/**
+ * Resolve the origin to which `/api/**` requests are proxied. The managed
+ * Qelos app URL (`config.appUrl`) is the proxy target — env vars are only
+ * dev-time overrides when the configured `appUrl` is not reachable from
+ * the local host.
+ *
+ * Priority (highest first):
+ *   1. `process.env.QELOS_PROXY_TARGET`
+ *   2. `process.env.QELOS_IP`
+ *   3. `process.env.QELOS_API_IP`
+ *   4. `config.appUrl`
+ *
+ * Empty / whitespace-only values are skipped, and `undefined` is returned when
+ * nothing is configured so the caller can surface a clear error.
+ */
+export declare function resolveQelosProxyTarget(config: QelosExpressConfig): string | undefined;

package/dist/proxy-target.js

@@ -0,0 +1,29 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveQelosProxyTarget = resolveQelosProxyTarget;
+/**
+ * Resolve the origin to which `/api/**` requests are proxied. The managed
+ * Qelos app URL (`config.appUrl`) is the proxy target — env vars are only
+ * dev-time overrides when the configured `appUrl` is not reachable from
+ * the local host.
+ *
+ * Priority (highest first):
+ *   1. `process.env.QELOS_PROXY_TARGET`
+ *   2. `process.env.QELOS_IP`
+ *   3. `process.env.QELOS_API_IP`
+ *   4. `config.appUrl`
+ *
+ * Empty / whitespace-only values are skipped, and `undefined` is returned when
+ * nothing is configured so the caller can surface a clear error.
+ */
+function resolveQelosProxyTarget(config) {
+    const env = process.env;
+    const fromEnv = env.QELOS_PROXY_TARGET?.trim() ||
+        env.QELOS_IP?.trim() ||
+        env.QELOS_API_IP?.trim();
+    if (fromEnv)
+        return fromEnv;
+    const fromAppUrl = config.appUrl?.trim();
+    return fromAppUrl || undefined;
+}
+//# sourceMappingURL=proxy-target.js.map

package/dist/proxy-target.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"proxy-target.js","sourceRoot":"","sources":["../src/proxy-target.ts"],"names":[],"mappings":";;AAiBA,0DAYC;AA3BD;;;;;;;;;;;;;;GAcG;AACH,SAAgB,uBAAuB,CACrC,MAA0B;IAE1B,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;IACxB,MAAM,OAAO,GACX,GAAG,CAAC,kBAAkB,EAAE,IAAI,EAAE;QAC9B,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE;QACpB,GAAG,CAAC,YAAY,EAAE,IAAI,EAAE,CAAC;IAC3B,IAAI,OAAO;QAAE,OAAO,OAAO,CAAC;IAE5B,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC;IACzC,OAAO,UAAU,IAAI,SAAS,CAAC;AACjC,CAAC"}

package/dist/proxy.d.ts

@@ -0,0 +1,16 @@
+import type { RequestHandler } from 'express';
+import type { QelosExpressConfig } from './types';
+export interface CreateProxyOptions {
+    config: QelosExpressConfig;
+}
+/**
+ * Catch-all `/api/**` reverse proxy. Forwards the inbound request to the
+ * configured Qelos origin, streaming bodies in both directions and rewriting
+ * the `Domain=` attribute of every upstream `Set-Cookie` header to the
+ * inbound request's host so the cookie becomes first-party.
+ *
+ * Responds with `503` when no proxy target is configured. Does not proxy
+ * WebSocket upgrades.
+ */
+export declare function createQelosProxy(options: CreateProxyOptions): RequestHandler;
+export type QelosProxyHandler = ReturnType<typeof createQelosProxy>;

package/dist/proxy.js

@@ -0,0 +1,132 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createQelosProxy = createQelosProxy;
+const http = __importStar(require("node:http"));
+const https = __importStar(require("node:https"));
+const node_url_1 = require("node:url");
+const cookies_1 = require("./cookies");
+const proxy_target_1 = require("./proxy-target");
+const HOP_BY_HOP = new Set([
+    'connection',
+    'keep-alive',
+    'proxy-authenticate',
+    'proxy-authorization',
+    'te',
+    'trailer',
+    'transfer-encoding',
+    'upgrade',
+    'host',
+    'content-length',
+]);
+function buildForwardedHeaders(source, targetHost) {
+    const out = {};
+    for (const [name, value] of Object.entries(source)) {
+        if (value === undefined)
+            continue;
+        if (HOP_BY_HOP.has(name.toLowerCase()))
+            continue;
+        out[name] = value;
+    }
+    out['host'] = targetHost;
+    return out;
+}
+/**
+ * Catch-all `/api/**` reverse proxy. Forwards the inbound request to the
+ * configured Qelos origin, streaming bodies in both directions and rewriting
+ * the `Domain=` attribute of every upstream `Set-Cookie` header to the
+ * inbound request's host so the cookie becomes first-party.
+ *
+ * Responds with `503` when no proxy target is configured. Does not proxy
+ * WebSocket upgrades.
+ */
+function createQelosProxy(options) {
+    const { config } = options;
+    return function qelosApiProxy(req, res) {
+        const base = (0, proxy_target_1.resolveQelosProxyTarget)(config);
+        if (!base) {
+            res.status(503).json({
+                code: 'QELOS_PROXY_NOT_CONFIGURED',
+                message: '[@qelos/integrator-express] Qelos API proxy is not configured. ' +
+                    'Set config.appUrl (or QELOS_PROXY_TARGET / QELOS_IP / QELOS_API_IP in development).',
+            });
+            return;
+        }
+        let target;
+        try {
+            const baseUrl = new node_url_1.URL(base);
+            target = new node_url_1.URL(req.originalUrl || req.url, baseUrl);
+        }
+        catch {
+            res.status(502).json({
+                code: 'QELOS_PROXY_BAD_TARGET',
+                message: '[@qelos/integrator-express] Invalid proxy target URL.',
+            });
+            return;
+        }
+        const client = target.protocol === 'https:' ? https : http;
+        const originalHost = req.headers.host;
+        const forwardedHeaders = buildForwardedHeaders(req.headers, target.host);
+        const upstreamReq = client.request({
+            protocol: target.protocol,
+            hostname: target.hostname,
+            port: target.port || (target.protocol === 'https:' ? 443 : 80),
+            method: req.method,
+            path: target.pathname + target.search,
+            headers: forwardedHeaders,
+        }, (upstreamRes) => {
+            const status = upstreamRes.statusCode ?? 502;
+            for (const [name, value] of Object.entries(upstreamRes.headers)) {
+                if (value === undefined)
+                    continue;
+                const lower = name.toLowerCase();
+                if (HOP_BY_HOP.has(lower))
+                    continue;
+                if (lower === 'set-cookie') {
+                    const values = Array.isArray(value) ? value : [value];
+                    res.setHeader('set-cookie', values.map((v) => (0, cookies_1.rewriteSetCookieDomain)(v, originalHost)));
+                    continue;
+                }
+                res.setHeader(name, value);
+            }
+            res.status(status);
+            upstreamRes.pipe(res);
+        });
+        upstreamReq.on('error', (err) => {
+            if (!res.headersSent) {
+                res.status(502).json({
+                    code: 'QELOS_PROXY_UPSTREAM_ERROR',
+                    message: err.message,
+                });
+            }
+            else {
+                res.end();
+            }
+        });
+        req.on('aborted', () => upstreamReq.destroy());
+        req.pipe(upstreamReq);
+    };
+}
+//# sourceMappingURL=proxy.js.map

package/dist/proxy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"proxy.js","sourceRoot":"","sources":["../src/proxy.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAiDA,4CA2EC;AA3HD,gDAAkC;AAClC,kDAAoC;AACpC,uCAA+B;AAE/B,uCAAmD;AACnD,iDAAyD;AAGzD,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC;IACzB,YAAY;IACZ,YAAY;IACZ,oBAAoB;IACpB,qBAAqB;IACrB,IAAI;IACJ,SAAS;IACT,mBAAmB;IACnB,SAAS;IACT,MAAM;IACN,gBAAgB;CACjB,CAAC,CAAC;AAEH,SAAS,qBAAqB,CAC5B,MAA2B,EAC3B,UAAkB;IAElB,MAAM,GAAG,GAA6B,EAAE,CAAC;IACzC,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACnD,IAAI,KAAK,KAAK,SAAS;YAAE,SAAS;QAClC,IAAI,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YAAE,SAAS;QACjD,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;IACpB,CAAC;IACD,GAAG,CAAC,MAAM,CAAC,GAAG,UAAU,CAAC;IACzB,OAAO,GAAG,CAAC;AACb,CAAC;AAMD;;;;;;;;GAQG;AACH,SAAgB,gBAAgB,CAAC,OAA2B;IAC1D,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IAE3B,OAAO,SAAS,aAAa,CAAC,GAAY,EAAE,GAAa;QACvD,MAAM,IAAI,GAAG,IAAA,sCAAuB,EAAC,MAAM,CAAC,CAAC;QAC7C,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACnB,IAAI,EAAE,4BAA4B;gBAClC,OAAO,EACL,iEAAiE;oBACjE,qFAAqF;aACxF,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,IAAI,MAAW,CAAC;QAChB,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,IAAI,cAAG,CAAC,IAAI,CAAC,CAAC;YAC9B,MAAM,GAAG,IAAI,cAAG,CAAC,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QACxD,CAAC;QAAC,MAAM,CAAC;YACP,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACnB,IAAI,EAAE,wBAAwB;gBAC9B,OAAO,EAAE,uDAAuD;aACjE,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;QAC3D,MAAM,YAAY,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC;QACtC,MAAM,gBAAgB,GAAG,qBAAqB,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;QAEzE,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,CAChC;YACE,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9D,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,IAAI,EAAE,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC,MAAM;YACrC,OAAO,EAAE,gBAAgB;SAC1B,EACD,CAAC,WAAW,EAAE,EAAE;YACd,MAAM,MAAM,GAAG,WAAW,CAAC,UAAU,IAAI,GAAG,CAAC;YAC7C,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;gBAChE,IAAI,KAAK,KAAK,SAAS;oBAAE,SAAS;gBAClC,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjC,IAAI,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC;oBAAE,SAAS;gBACpC,IAAI,KAAK,KAAK,YAAY,EAAE,CAAC;oBAC3B,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;oBACtD,GAAG,CAAC,SAAS,CACX,YAAY,EACZ,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,gCAAsB,EAAC,CAAC,EAAE,YAAY,CAAC,CAAC,CAC3D,CAAC;oBACF,SAAS;gBACX,CAAC;gBACD,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YAC7B,CAAC;YACD,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACnB,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACxB,CAAC,CACF,CAAC;QAEF,WAAW,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YAC9B,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;gBACrB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBACnB,IAAI,EAAE,4BAA4B;oBAClC,OAAO,EAAE,GAAG,CAAC,OAAO;iBACrB,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,GAAG,EAAE,CAAC;YACZ,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,GAAG,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC,CAAC;QAC/C,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACxB,CAAC,CAAC;AACJ,CAAC"}

package/dist/sdk-factory.d.ts

@@ -1,16 +1,8 @@
-import type { Request, Response } from 'express';
+import type { Request } from 'express';
 import QelosSDK from '@qelos/sdk';
-import type { QelosExpressConfig, QelosTokenPair, TokenRefreshHook } from './types';
+import type { QelosExpressConfig } from './types';
 export interface CreateSdkParams {
     config: QelosExpressConfig;
-    /**
-     * Tokens for the current request. The factory mutates this object in place
-     * when a token refresh occurs, so callers can read the latest pair after
-     * the SDK has been used.
-     */
-    tokens: QelosTokenPair;
     req: Request;
-    res: Response;
-    onTokenRefresh?: TokenRefreshHook;
 }
-export declare function createRequestSdk({ config, tokens, req, res, onTokenRefresh, }: CreateSdkParams): QelosSDK;
+export declare function createRequestSdk({ config, req }: CreateSdkParams): QelosSDK;

package/dist/sdk-factory.js

@@ -5,93 +5,29 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.createRequestSdk = createRequestSdk;
 const sdk_1 = __importDefault(require("@qelos/sdk"));
-const NO_AUTH_URLS = new Set([
-    '/api/token/refresh',
-    '/api/cookie/refresh',
-    '/api/signin',
-    '/api/signup',
-]);
-function createRequestSdk({ config, tokens, req, res, onTokenRefresh, }) {
-    let sdk;
-    let refreshInFlight = null;
+function createRequestSdk({ config, req }) {
     const baseOptions = config.sdkOptions || {};
-    async function performRefresh() {
-        if (!tokens.refreshToken && !tokens.accessToken) {
-            throw new Error('no refresh token available');
-        }
-        const previous = {
-            accessToken: tokens.accessToken,
-            refreshToken: tokens.refreshToken,
-        };
-        let refreshed;
-        if (tokens.refreshToken) {
-            const result = await sdk.authentication.refreshToken(tokens.refreshToken);
-            refreshed = {
-                accessToken: result.payload.token,
-                refreshToken: result.payload.refreshToken,
-            };
-        }
-        else {
-            const result = await sdk.authentication.refreshCookieToken(tokens.accessToken);
-            refreshed = {
-                accessToken: result.payload.cookieToken,
-            };
-        }
-        tokens.accessToken = refreshed.accessToken;
-        tokens.refreshToken = refreshed.refreshToken;
-        if (onTokenRefresh) {
-            await onTokenRefresh({
-                req,
-                res,
-                oldTokens: previous,
-                newTokens: refreshed,
-                sdk,
-            });
-        }
-    }
-    function ensureRefresh() {
-        if (!refreshInFlight) {
-            refreshInFlight = performRefresh().finally(() => {
-                refreshInFlight = null;
-            });
-        }
-        return refreshInFlight;
-    }
     const options = {
         appUrl: config.appUrl,
         fetch: globalThis.fetch,
-        forceRefresh: !config.apiToken,
         ...baseOptions,
     };
     if (config.apiToken) {
         options.apiToken = config.apiToken;
+        return new sdk_1.default(options);
     }
-    else {
-        if (tokens.accessToken) {
-            options.accessToken = tokens.accessToken;
+    options.extraHeaders = async () => {
+        const headers = {};
+        const cookieHeader = req.headers.cookie;
+        if (cookieHeader) {
+            headers.cookie = cookieHeader;
         }
-        if (tokens.refreshToken) {
-            options.refreshToken = tokens.refreshToken;
+        const authHeader = req.headers.authorization;
+        if (authHeader) {
+            headers.authorization = authHeader;
         }
-        options.extraHeaders = async (relativeUrl, forceRefresh) => {
-            const headers = {};
-            if (NO_AUTH_URLS.has(relativeUrl)) {
-                return headers;
-            }
-            if (forceRefresh && tokens.refreshToken) {
-                await ensureRefresh();
-            }
-            const token = sdk?.authentication?.accessToken || tokens.accessToken;
-            if (token) {
-                headers.authorization = 'Bearer ' + token;
-            }
-            return headers;
-        };
-        options.onFailedRefreshToken = async () => {
-            await ensureRefresh();
-        };
-    }
-    sdk = new sdk_1.default(options);
-    return sdk;
+        return headers;
+    };
+    return new sdk_1.default(options);
 }
 //# sourceMappingURL=sdk-factory.js.map

package/dist/sdk-factory.js.map

@@ -1 +1 @@
-{"version":3,"file":"sdk-factory.js","sourceRoot":"","sources":["../src/sdk-factory.ts"],"names":[],"mappings":";;;;;AA8BA,4CA6FC;AA1HD,qDAAkC;AASlC,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC;IAC3B,oBAAoB;IACpB,qBAAqB;IACrB,aAAa;IACb,aAAa;CACd,CAAC,CAAC;AAeH,SAAgB,gBAAgB,CAAC,EAC/B,MAAM,EACN,MAAM,EACN,GAAG,EACH,GAAG,EACH,cAAc,GACE;IAChB,IAAI,GAAa,CAAC;IAClB,IAAI,eAAe,GAAyB,IAAI,CAAC;IAEjD,MAAM,WAAW,GAAG,MAAM,CAAC,UAAU,IAAI,EAAE,CAAC;IAE5C,KAAK,UAAU,cAAc;QAC3B,IAAI,CAAC,MAAM,CAAC,YAAY,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;YAChD,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QAChD,CAAC;QACD,MAAM,QAAQ,GAAmB;YAC/B,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,YAAY,EAAE,MAAM,CAAC,YAAY;SAClC,CAAC;QACF,IAAI,SAAyB,CAAC;QAC9B,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;YACxB,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,cAAc,CAAC,YAAY,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;YAC1E,SAAS,GAAG;gBACV,WAAW,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK;gBACjC,YAAY,EAAE,MAAM,CAAC,OAAO,CAAC,YAAY;aAC1C,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,cAAc,CAAC,kBAAkB,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;YAC/E,SAAS,GAAG;gBACV,WAAW,EAAE,MAAM,CAAC,OAAO,CAAC,WAAW;aACxC,CAAC;QACJ,CAAC;QACD,MAAM,CAAC,WAAW,GAAG,SAAS,CAAC,WAAW,CAAC;QAC3C,MAAM,CAAC,YAAY,GAAG,SAAS,CAAC,YAAY,CAAC;QAC7C,IAAI,cAAc,EAAE,CAAC;YACnB,MAAM,cAAc,CAAC;gBACnB,GAAG;gBACH,GAAG;gBACH,SAAS,EAAE,QAAQ;gBACnB,SAAS,EAAE,SAAS;gBACpB,GAAG;aACJ,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,SAAS,aAAa;QACpB,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,eAAe,GAAG,cAAc,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE;gBAC9C,eAAe,GAAG,IAAI,CAAC;YACzB,CAAC,CAAC,CAAC;QACL,CAAC;QACD,OAAO,eAAe,CAAC;IACzB,CAAC;IAED,MAAM,OAAO,GAAoB;QAC/B,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,KAAK,EAAE,UAAU,CAAC,KAAiC;QACnD,YAAY,EAAE,CAAC,MAAM,CAAC,QAAQ;QAC9B,GAAG,WAAW;KACf,CAAC;IAEF,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACpB,OAAO,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;IACrC,CAAC;SAAM,CAAC;QACN,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;YACvB,OAAO,CAAC,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC;QAC3C,CAAC;QACD,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;YACxB,OAAO,CAAC,YAAY,GAAG,MAAM,CAAC,YAAY,CAAC;QAC7C,CAAC;QACD,OAAO,CAAC,YAAY,GAAG,KAAK,EAAE,WAAmB,EAAE,YAAsB,EAAE,EAAE;YAC3E,MAAM,OAAO,GAA8B,EAAE,CAAC;YAC9C,IAAI,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;gBAClC,OAAO,OAAO,CAAC;YACjB,CAAC;YACD,IAAI,YAAY,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;gBACxC,MAAM,aAAa,EAAE,CAAC;YACxB,CAAC;YACD,MAAM,KAAK,GACT,GAAG,EAAE,cAAc,EAAE,WAAW,IAAI,MAAM,CAAC,WAAW,CAAC;YACzD,IAAI,KAAK,EAAE,CAAC;gBACV,OAAO,CAAC,aAAa,GAAG,SAAS,GAAG,KAAK,CAAC;YAC5C,CAAC;YACD,OAAO,OAAO,CAAC;QACjB,CAAC,CAAC;QACF,OAAO,CAAC,oBAAoB,GAAG,KAAK,IAAI,EAAE;YACxC,MAAM,aAAa,EAAE,CAAC;QACxB,CAAC,CAAC;IACJ,CAAC;IAED,GAAG,GAAG,IAAI,aAAQ,CAAC,OAAO,CAAC,CAAC;IAC5B,OAAO,GAAG,CAAC;AACb,CAAC"}
+{"version":3,"file":"sdk-factory.js","sourceRoot":"","sources":["../src/sdk-factory.ts"],"names":[],"mappings":";;;;;AAUA,4CA4BC;AArCD,qDAAkC;AASlC,SAAgB,gBAAgB,CAAC,EAAE,MAAM,EAAE,GAAG,EAAmB;IAC/D,MAAM,WAAW,GAA6B,MAAM,CAAC,UAAU,IAAI,EAAE,CAAC;IAEtE,MAAM,OAAO,GAAoB;QAC/B,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,KAAK,EAAE,UAAU,CAAC,KAA6B;QAC/C,GAAG,WAAW;KACf,CAAC;IAEF,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACpB,OAAO,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;QACnC,OAAO,IAAI,aAAQ,CAAC,OAAO,CAAC,CAAC;IAC/B,CAAC;IAED,OAAO,CAAC,YAAY,GAAG,KAAK,IAAI,EAAE;QAChC,MAAM,OAAO,GAA2B,EAAE,CAAC;QAC3C,MAAM,YAAY,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC;QACxC,IAAI,YAAY,EAAE,CAAC;YACjB,OAAO,CAAC,MAAM,GAAG,YAAY,CAAC;QAChC,CAAC;QACD,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;QAC7C,IAAI,UAAU,EAAE,CAAC;YACf,OAAO,CAAC,aAAa,GAAG,UAAU,CAAC;QACrC,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC;IAEF,OAAO,IAAI,aAAQ,CAAC,OAAO,CAAC,CAAC;AAC/B,CAAC"}

package/dist/social-auth.d.ts

@@ -1,10 +1,11 @@
+import type { Request, Response } from 'express';
 import type QelosSDK from '@qelos/sdk';
 import type { SocialAuthCallbackPayload } from '@qelos/sdk';
 /**
  * Runs {@link QelosSDK.authentication.socialCallback} for `requestUrl` and
- * forwards session `Set-Cookie` headers to the Express response.
+ * forwards session `Set-Cookie` headers to the Express response, rewriting
+ * the `Domain=` attribute of each cookie to the inbound request's host so
+ * the upstream-issued cookies land as first-party on the integrator host.
  */
-export declare function completeSocialAuthCallback(sdk: QelosSDK, requestUrl: string, res: {
-    setHeader(name: string, value: string | string[]): void;
-}): Promise<SocialAuthCallbackPayload>;
-export { applySocialAuthCookiesToServerResponse, getSocialAuthSetCookieParts, parseSocialCallbackRefreshToken, type SocialAuthCallbackPayload, type SocialCallbackInput, } from '@qelos/sdk';
+export declare function completeSocialAuthCallback(sdk: QelosSDK, req: Pick<Request, 'url' | 'headers'>, res: Pick<Response, 'setHeader'>): Promise<SocialAuthCallbackPayload>;
+export { getSocialAuthSetCookieParts, parseSocialCallbackRefreshToken, type SocialAuthCallbackPayload, type SocialCallbackInput, } from '@qelos/sdk';

package/dist/social-auth.js

@@ -1,19 +1,26 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.parseSocialCallbackRefreshToken = exports.getSocialAuthSetCookieParts = exports.applySocialAuthCookiesToServerResponse = void 0;
+exports.parseSocialCallbackRefreshToken = exports.getSocialAuthSetCookieParts = void 0;
 exports.completeSocialAuthCallback = completeSocialAuthCallback;
 const sdk_1 = require("@qelos/sdk");
+const cookies_1 = require("./cookies");
 /**
  * Runs {@link QelosSDK.authentication.socialCallback} for `requestUrl` and
- * forwards session `Set-Cookie` headers to the Express response.
+ * forwards session `Set-Cookie` headers to the Express response, rewriting
+ * the `Domain=` attribute of each cookie to the inbound request's host so
+ * the upstream-issued cookies land as first-party on the integrator host.
  */
-async function completeSocialAuthCallback(sdk, requestUrl, res) {
-    const result = await sdk.authentication.socialCallback(requestUrl);
-    (0, sdk_1.applySocialAuthCookiesToServerResponse)(res, result);
+async function completeSocialAuthCallback(sdk, req, res) {
+    const result = await sdk.authentication.socialCallback(req.url);
+    const parts = (0, sdk_1.getSocialAuthSetCookieParts)(result);
+    if (parts.length) {
+        const host = req.headers.host;
+        const rewritten = parts.map((value) => (0, cookies_1.rewriteSetCookieDomain)(value, host));
+        res.setHeader('Set-Cookie', rewritten.length === 1 ? rewritten[0] : rewritten);
+    }
     return result;
 }
 var sdk_2 = require("@qelos/sdk");
-Object.defineProperty(exports, "applySocialAuthCookiesToServerResponse", { enumerable: true, get: function () { return sdk_2.applySocialAuthCookiesToServerResponse; } });
 Object.defineProperty(exports, "getSocialAuthSetCookieParts", { enumerable: true, get: function () { return sdk_2.getSocialAuthSetCookieParts; } });
 Object.defineProperty(exports, "parseSocialCallbackRefreshToken", { enumerable: true, get: function () { return sdk_2.parseSocialCallbackRefreshToken; } });
 //# sourceMappingURL=social-auth.js.map

package/dist/social-auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"social-auth.js","sourceRoot":"","sources":["../src/social-auth.ts"],"names":[],"mappings":";;;AAQA,gEAQC;AAdD,oCAAoE;AAEpE;;;GAGG;AACI,KAAK,UAAU,0BAA0B,CAC9C,GAAa,EACb,UAAkB,EAClB,GAAgE;IAEhE,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,cAAc,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;IACnE,IAAA,4CAAsC,EAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACpD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,kCAMoB;AALlB,6HAAA,sCAAsC,OAAA;AACtC,kHAAA,2BAA2B,OAAA;AAC3B,sHAAA,+BAA+B,OAAA"}
+{"version":3,"file":"social-auth.js","sourceRoot":"","sources":["../src/social-auth.ts"],"names":[],"mappings":";;;AAYA,gEAaC;AAtBD,oCAAyD;AACzD,uCAAmD;AAEnD;;;;;GAKG;AACI,KAAK,UAAU,0BAA0B,CAC9C,GAAa,EACb,GAAqC,EACrC,GAAgC;IAEhC,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,cAAc,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAChE,MAAM,KAAK,GAAG,IAAA,iCAA2B,EAAC,MAAM,CAAC,CAAC;IAClD,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QACjB,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC;QAC9B,MAAM,SAAS,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAA,gCAAsB,EAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;QAC5E,GAAG,CAAC,SAAS,CAAC,YAAY,EAAE,SAAS,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAClF,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,kCAKoB;AAJlB,kHAAA,2BAA2B,OAAA;AAC3B,sHAAA,+BAA+B,OAAA"}

package/dist/types.d.ts

@@ -1,25 +1,59 @@
-import type { Request, Response } from 'express';
 import type QelosSDK from '@qelos/sdk';
 import type { IUser } from '@qelos/sdk/dist/authentication';
 import type { IWorkspace } from '@qelos/sdk/workspaces';
 import type { QelosSDKOptions } from '@qelos/sdk/types';
-import type { QelosConfig, QelosContext, QelosTokenPair, ResolvedTokens } from '@qelos/global-types';
-export type { QelosTokenPair, ResolvedTokens } from '@qelos/global-types';
-export interface QelosExpressConfig extends QelosConfig {
+export interface QelosExpressConfig {
+    /**
+     * Base URL of the Qelos backend (e.g. https://yourdomain.com).
+     */
+    appUrl: string;
+    /**
+     * Static API token used for service-to-service calls. When provided, no
+     * cookie-based authentication is performed.
+     */
+    apiToken?: string;
+    /**
+     * If true, the request is rejected (401) when the user cannot be resolved.
+     * Defaults to `false` — anonymous requests pass through with
+     * `req.qelos.user = null`.
+     */
+    requireAuth?: boolean;
+    /**
+     * Skip the middleware entirely for requests matching any of these path
+     * prefixes. Useful for `/api/_auth`, `/health`, etc.
+     */
+    skipPaths?: string[];
+    /**
+     * If true, the catch-all `/api/**` proxy handler is not registered when
+     * using `createQelosIntegrator`. Defaults to `false`.
+     */
+    disableProxy?: boolean;
     /**
      * Optional extra options merged into the per-request SDK instance.
      */
     sdkOptions?: Partial<QelosSDKOptions>;
 }
-export interface TokenRefreshContext {
-    req: Request;
-    res: Response;
-    oldTokens: QelosTokenPair;
-    newTokens: ResolvedTokens;
+export interface QelosRequestContext {
+    /**
+     * The authenticated user, or `null` when anonymous.
+     */
+    user: IUser | null;
+    /**
+     * The active workspace for the request, or `null` when none is active /
+     * the user is anonymous.
+     */
+    workspace: IWorkspace | null;
+    /**
+     * The full list of workspaces the user has access to.
+     */
+    workspaces: IWorkspace[];
+    /**
+     * SDK instance bound to the current request's cookies. `extraHeaders`
+     * re-reads cookies live on each call, so cookie rotations applied by the
+     * middleware are picked up automatically.
+     */
     sdk: QelosSDK;
 }
-export type TokenRefreshHook = (ctx: TokenRefreshContext) => void | Promise<void>;
-export type QelosRequestContext = QelosContext<QelosSDK, IUser, IWorkspace>;
 declare module 'express' {
     interface Request {
         qelos: QelosRequestContext;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@qelos/integrator-express",
-  "version": "4.0.0",
+  "version": "4.1.0",
   "description": "Express middleware that identifies the Qelos user and active workspace before your route handlers run",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
@@ -47,8 +47,8 @@
     }
   },
   "dependencies": {
-    "@qelos/global-types": "^4.0.0",
-    "@qelos/sdk": "^4.0.0"
+    "@qelos/global-types": "4.1.0",
+    "@qelos/sdk": "4.1.0"
   },
   "devDependencies": {
     "@types/express": "^4.17.21",
@@ -61,6 +61,6 @@
     "type-check": "tsc --noEmit",
     "build": "tsc",
     "pre-build": "tsc",
-    "test": "node --import tsx --test test/**/*.test.ts"
+    "test": "node --import tsx --test src/**/*.test.ts test/**/*.test.ts"
   }
 }