@qelos/integrator-nest 4.0.0 → 4.1.0

package/README.md

@@ -1,22 +1,18 @@
 # @qelos/integrator-nest
 
-NestJS module that calls the Qelos SDK to identify the current user and their
-active workspace before your route handler runs, exposing them on
-`request.qelos.user` / `request.qelos.workspace`.
+NestJS module for [Qelos](https://qelos.io). It wires global middleware so your Nest host acts as a same-origin BFF for a managed Qelos app: requests under `/api/**` are proxied to Qelos (unless you opt out), and every other request resolves the current user up front so controllers and request-scoped providers can use `request.qelos` and the `Qelos*` decorators.
 
-This is the NestJS implementation of the Qelos integrator contract — the same
-shape exposed by `@qelos/integrator-express`, `@qelos/integrator-fastify`,
-`@qelos/integrator-nuxt`, `@qelos/plugin-netlify-api`, etc. It works with
-both Nest's Express adapter and its Fastify adapter.
+Works with Nest’s **Express** and **Fastify** HTTP adapters — request/response objects are handled generically.
 
 ## Install
 
 ```sh
-npm install @qelos/integrator-nest @qelos/sdk
-# Nest is a peer dependency
-npm install @nestjs/common @nestjs/core
+pnpm add @qelos/integrator-nest @qelos/sdk
+pnpm add @nestjs/common @nestjs/core
 ```
 
+Requires **Node 18+**. The user-resolution middleware uses [`Response.headers.getSetCookie()`](https://developer.mozilla.org/docs/Web/API/Headers/getSetCookie) when probing `/api/me` so each upstream `Set-Cookie` can be forwarded individually.
+
 ## Quick start
 
 ```ts
@@ -28,7 +24,7 @@ import { QelosModule } from '@qelos/integrator-nest';
   imports: [
     QelosModule.forRoot({
       config: {
-        appUrl: process.env.QELOS_APP_URL!, // e.g. https://yourdomain.com
+        appUrl: process.env.QELOS_APP_URL!, // managed Qelos app origin
       },
     }),
   ],
@@ -36,31 +32,50 @@ import { QelosModule } from '@qelos/integrator-nest';
 export class AppModule {}
 ```
 
-`forRoot` registers `QelosMiddleware` on every route by default. To restrict
-its scope, import the module without `forRoot` and apply the middleware
-yourself in `configure`:
+`forRoot` registers:
 
-```ts
-import {
-  QelosMiddleware,
-  QelosModule,
-  type QelosModuleOptions,
-} from '@qelos/integrator-nest';
-import { type MiddlewareConsumer, Module, type NestModule } from '@nestjs/common';
+1. **`QelosMiddleware`** on `*` — resolves `request.qelos` via `/api/me` cookie pass-through (unless the path is skipped).
+2. **`QelosProxyMiddleware`** on `api/*splat` — reverse-proxies `/api/**` to the same resolved origin, unless `disableProxy: true`.
 
-const options: QelosModuleOptions = {
-  config: { appUrl: process.env.QELOS_APP_URL! },
-};
+User-defined controllers and routes still take precedence for paths they own; the proxy only handles `/api/**` traffic that reaches the middleware stack.
 
-@Module({
-  imports: [QelosModule.forRoot(options)],
-})
-export class AppModule implements NestModule {
-  configure(consumer: MiddlewareConsumer) {
-    consumer.apply(QelosMiddleware).forRoutes('api/*');
-  }
-}
-```
+To narrow where the **resolver** runs, import the module and apply `QelosMiddleware` yourself (see Nest docs on `MiddlewareConsumer`). You still need `QELOS_MODULE_OPTIONS` and `QelosProxyMiddleware` provided if you split registration.
+
+## API proxy
+
+The proxy forwards the inbound request (method, URL path + query, body stream, and headers except hop-by-hop) to `<proxyTarget>` + the same path. Upstream `Set-Cookie` headers are rewritten so `Domain=` matches the inbound `Host` (port stripped), making Qelos session cookies first-party on your Nest host.
+
+### Resolving the proxy target
+
+The managed app URL (`config.appUrl`) is the default target. Env vars are dev-time overrides when `appUrl` is not reachable from localhost:
+
+1. `QELOS_PROXY_TARGET`
+2. `QELOS_IP`
+3. `QELOS_API_IP`
+4. `config.appUrl`
+
+Whitespace-only env values are ignored. If nothing resolves, the proxy responds with **503**. The user resolver uses the same chain; without a target and without `apiToken`, anonymous requests are allowed unless `requireAuth` is set.
+
+### Opting out
+
+Set `disableProxy: true` in config to skip registering `QelosProxyMiddleware` — for example when you implement every `/api/*` route in Nest or terminate the proxy elsewhere.
+
+WebSocket upgrades are **not** proxied.
+
+## User-resolution middleware
+
+On non-skipped paths, the middleware:
+
+1. Builds a per-request SDK (`createRequestSdk`) — with `apiToken`, static auth; otherwise `extraHeaders` forwards the live `Cookie` and `Authorization` headers on every SDK call.
+2. Resolves the proxy target (same priority as above).
+3. If there is no target and no `apiToken`, returns anonymous context (or **401** when `requireAuth` is true).
+4. If there is a target, `GET ${target}/api/me` with cookies and authorization forwarded. Each upstream `Set-Cookie` is appended to the outgoing response with `Domain=` rewritten to the inbound host.
+5. On success, loads workspaces via `sdk.workspaces.getList()` (errors → empty list).
+6. Sets **active workspace** to `resolveWorkspace()` if provided, else `user.workspace` from `/api/me` — **not** `workspaces[0]`.
+
+When `disableProxy !== true`, `/api/` is **prepended** to `skipPaths` automatically so proxied `/api/**` traffic is not double-handled by this `/api/me` probe.
+
+> Rotated cookies may include `Secure`. Over plain HTTP, browsers may drop them — use HTTPS locally or configure Qelos for non-Secure cookies in dev.
 
 ## Use in controllers
 
@@ -79,7 +94,6 @@ import type { IWorkspace } from '@qelos/sdk/workspaces';
 @Controller()
 export class AppController {
   @Get('me')
-  // user/workspace are null when the request is anonymous
   me(
     @QelosUser() user: IUser | null,
     @QelosWorkspace() workspace: IWorkspace | null,
@@ -87,7 +101,6 @@ export class AppController {
     return { user, workspace };
   }
 
-  // Short-circuit with 401 when there is no authenticated user.
   @Get('private')
   @UseGuards(QelosAuthGuard)
   private(@QelosCtx() ctx: QelosRequestContext) {
@@ -96,71 +109,22 @@ export class AppController {
 }
 ```
 
-## What the middleware does
-
-1. Reads the access token from `Authorization: Bearer ...` or the
-   `q_access_token` cookie, and the refresh token from `q_refresh_token`.
-2. Builds a per-request Qelos SDK instance bound to those tokens.
-3. Calls `sdk.authentication.getLoggedInUser()` and
-   `sdk.workspaces.getList()`.
-4. Picks the active workspace (first by default — override with
-   `resolveWorkspace`).
-5. Attaches everything to `request.qelos`.
-
-The middleware never throws for anonymous requests by default — it just
-leaves `request.qelos.user` and `request.qelos.workspace` as `null`. Pass
-`requireAuth: true` to short-circuit anonymous requests with `401`, or use
-the per-route `QelosAuthGuard` for finer-grained control.
-
-## Token refresh
-
-When the access token is rejected, the SDK tries to recover, in order:
-
-1. The **refresh token** (`q_refresh_token`) via
-   `sdk.authentication.refreshToken()` — issues a new access + refresh pair.
-2. The **cookie token** (the access token cookie itself) via
-   `sdk.authentication.refreshCookieToken()` — used for cookie-only sessions
-   that do not carry a separate refresh token (e.g. social-auth flows).
+`QelosRequestContext`:
 
-After a successful refresh the middleware fires the `onTokenRefresh` hook.
-The default implementation writes the new tokens back to the response cookies
-(`HttpOnly`, `SameSite=Lax`, `Secure` whenever `appUrl` is `https://...`).
+| field        | description |
+|--------------|-------------|
+| `user`       | `IUser` from `/api/me`, or `null`. |
+| `workspace`  | Active workspace or `null`. |
+| `workspaces` | Workspaces from `getList()`. |
+| `sdk`        | Request-scoped `QelosSDK` forwarding cookies live. |
 
-You can supply your own — for example, to mint your own session cookie or
-push the new tokens into a session store:
+## API token mode
 
-```ts
-QelosModule.forRoot({
-  config: { appUrl: process.env.QELOS_APP_URL! },
-  onTokenRefresh: async ({ request, response, newTokens }) => {
-    await sessionStore.rotate(request.session.id, newTokens);
-  },
-});
-```
-
-The hook receives `{ request, response, oldTokens, newTokens, sdk }`. The
-`request` and `response` types are intentionally generic since Nest can run
-on either Express or Fastify.
-
-### Manual cookie refresh
-
-Long-lived integrator-hosted sessions can also call the SDK directly to
-proactively refresh the cookie token:
-
-```ts
-@Get('refresh-session')
-async refresh(@QelosCtx() ctx: QelosRequestContext) {
-  const result = await ctx.sdk.authentication.refreshCookieToken();
-  // result.headers['set-cookie'] — fresh cookie value to forward
-  return { user: result.payload.user };
-}
-```
+For service-to-service traffic, set `apiToken` — the middleware skips the `/api/me` cookie flow for identity (you still get an SDK with the static token). Pair with `requireAuth` / `QelosGuard` as needed.
 
 ## Async configuration
 
 ```ts
-import { ConfigModule, ConfigService } from '@nestjs/config';
-
 QelosModule.forRootAsync({
   imports: [ConfigModule],
   inject: [ConfigService],
@@ -173,39 +137,33 @@ QelosModule.forRootAsync({
 });
 ```
 
-## Configuration
+## Configuration reference
 
 ```ts
 QelosModule.forRoot({
   config: {
-    appUrl: 'https://yourdomain.com', // required
+    appUrl: 'https://your-managed-app.com',
 
-    // Service-to-service: use a static API token instead of cookies/refresh.
     apiToken: process.env.QELOS_API_TOKEN,
 
-    // Cookie names. Defaults shown.
-    accessTokenCookie: 'q_access_token',
-    refreshTokenCookie: 'q_refresh_token',
-
-    // Reject anonymous requests with 401. Defaults to false.
     requireAuth: false,
 
-    // Skip the middleware entirely for these path prefixes.
     skipPaths: ['/health', '/metrics'],
 
-    // Anything you want passed through to the per-request SDK.
+    disableProxy: false,
+
     sdkOptions: {},
   },
 
-  // Override workspace selection. Defaults to `workspaces[0]`.
   resolveWorkspace: ({ request, user, workspaces }) => {
     const headerId = request.headers['x-qelos-workspace'];
-    return workspaces.find((w) => w._id === headerId) || workspaces[0] || null;
+    const raw = Array.isArray(headerId) ? headerId[0] : headerId;
+    return workspaces.find((w) => w._id === raw) || user.workspace || null;
   },
 });
 ```
 
 ## Requirements
 
-- Node.js >= 18 (uses the global `fetch`).
-- NestJS 9, 10, or 11.
+- Node.js >= 18  
+- NestJS 9, 10, or 11  

package/dist/cookies.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Rewrite the `Domain=` attribute of a single `Set-Cookie` header value.
+ *
+ * - If the cookie contains a `Domain=<value>` attribute (case-insensitive), its
+ *   value is replaced with `newDomain`, with any trailing `:port` suffix
+ *   stripped first (cookie `Domain` attributes do not include a port).
+ * - If `newDomain` is `undefined` (or empty), the entire `; Domain=<value>`
+ *   segment is removed so the browser scopes the cookie to the current host.
+ * - If no `Domain=` attribute is present, the input is returned unchanged.
+ *
+ * All other attributes, their casing/order and the original cookie name/value
+ * bytes are preserved.
+ */
+export declare function rewriteSetCookieDomain(setCookie: string, newDomain: string | undefined): string;
+/**
+ * Apply {@link rewriteSetCookieDomain} to each entry of a `Set-Cookie` array
+ * (e.g. the result of `Headers.getSetCookie()`).
+ */
+export declare function rewriteSetCookieDomains(values: string[], newDomain: string | undefined): string[];

package/dist/cookies.js

@@ -0,0 +1,43 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.rewriteSetCookieDomain = rewriteSetCookieDomain;
+exports.rewriteSetCookieDomains = rewriteSetCookieDomains;
+/**
+ * Rewrite the `Domain=` attribute of a single `Set-Cookie` header value.
+ *
+ * - If the cookie contains a `Domain=<value>` attribute (case-insensitive), its
+ *   value is replaced with `newDomain`, with any trailing `:port` suffix
+ *   stripped first (cookie `Domain` attributes do not include a port).
+ * - If `newDomain` is `undefined` (or empty), the entire `; Domain=<value>`
+ *   segment is removed so the browser scopes the cookie to the current host.
+ * - If no `Domain=` attribute is present, the input is returned unchanged.
+ *
+ * All other attributes, their casing/order and the original cookie name/value
+ * bytes are preserved.
+ */
+function rewriteSetCookieDomain(setCookie, newDomain) {
+    const domainSegment = /;\s*Domain\s*=\s*[^;]+/i;
+    if (!domainSegment.test(setCookie))
+        return setCookie;
+    const stripped = newDomain ? stripPort(newDomain) : '';
+    if (!stripped) {
+        return setCookie.replace(domainSegment, '');
+    }
+    return setCookie.replace(/(;\s*Domain\s*=\s*)[^;]+/i, `$1${stripped}`);
+}
+/**
+ * Apply {@link rewriteSetCookieDomain} to each entry of a `Set-Cookie` array
+ * (e.g. the result of `Headers.getSetCookie()`).
+ */
+function rewriteSetCookieDomains(values, newDomain) {
+    return values.map((value) => rewriteSetCookieDomain(value, newDomain));
+}
+function stripPort(host) {
+    if (host.startsWith('[')) {
+        const end = host.indexOf(']');
+        return end === -1 ? host : host.slice(1, end);
+    }
+    const colon = host.indexOf(':');
+    return colon === -1 ? host : host.slice(0, colon);
+}
+//# sourceMappingURL=cookies.js.map

package/dist/cookies.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cookies.js","sourceRoot":"","sources":["../src/cookies.ts"],"names":[],"mappings":";;AAaA,wDAeC;AAMD,0DAKC;AAvCD;;;;;;;;;;;;GAYG;AACH,SAAgB,sBAAsB,CACpC,SAAiB,EACjB,SAA6B;IAE7B,MAAM,aAAa,GAAG,yBAAyB,CAAC;IAChD,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC;QAAE,OAAO,SAAS,CAAC;IAErD,MAAM,QAAQ,GAAG,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACvD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,SAAS,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,SAAS,CAAC,OAAO,CACtB,2BAA2B,EAC3B,KAAK,QAAQ,EAAE,CAChB,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAgB,uBAAuB,CACrC,MAAgB,EAChB,SAA6B;IAE7B,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,sBAAsB,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC;AACzE,CAAC;AAED,SAAS,SAAS,CAAC,IAAY;IAC7B,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC9B,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAChD,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAChC,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;AACpD,CAAC"}

package/dist/cookies.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/cookies.test.js

@@ -0,0 +1,76 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+// Run with: `pnpm -F @qelos/integrator-nest test` (includes src/**/*.test.ts)
+const node_test_1 = require("node:test");
+const strict_1 = __importDefault(require("node:assert/strict"));
+const cookies_1 = require("./cookies");
+(0, node_test_1.describe)('rewriteSetCookieDomain', () => {
+    (0, node_test_1.it)('replaces a leading-dot Domain value', () => {
+        const input = 'sid=abc; Path=/; Domain=.qelos.app; HttpOnly; Secure';
+        strict_1.default.equal((0, cookies_1.rewriteSetCookieDomain)(input, 'example.com'), 'sid=abc; Path=/; Domain=example.com; HttpOnly; Secure');
+    });
+    (0, node_test_1.it)('replaces a wildcard Domain value', () => {
+        const input = 'sid=abc; Path=/; Domain=*.qelos.app; HttpOnly';
+        strict_1.default.equal((0, cookies_1.rewriteSetCookieDomain)(input, 'example.com'), 'sid=abc; Path=/; Domain=example.com; HttpOnly');
+    });
+    (0, node_test_1.it)('returns the cookie unchanged when no Domain attribute is present', () => {
+        const input = 'sid=abc; Path=/; HttpOnly; Secure; SameSite=Lax';
+        strict_1.default.equal((0, cookies_1.rewriteSetCookieDomain)(input, 'example.com'), input);
+    });
+    (0, node_test_1.it)('strips the port from a host:port newDomain before substitution', () => {
+        const input = 'sid=abc; Domain=.qelos.app; Path=/';
+        strict_1.default.equal((0, cookies_1.rewriteSetCookieDomain)(input, 'localhost:3000'), 'sid=abc; Domain=localhost; Path=/');
+    });
+    (0, node_test_1.it)('preserves attribute order and other attributes across replacement', () => {
+        const input = 'sid=abc; Path=/; Domain=.qelos.app; HttpOnly; Secure; SameSite=Lax; Max-Age=3600';
+        strict_1.default.equal((0, cookies_1.rewriteSetCookieDomain)(input, 'example.com'), 'sid=abc; Path=/; Domain=example.com; HttpOnly; Secure; SameSite=Lax; Max-Age=3600');
+    });
+    (0, node_test_1.it)('preserves an Expires attribute (which contains commas) across replacement', () => {
+        const input = 'sid=abc; Domain=.qelos.app; Expires=Wed, 21 Oct 2026 07:28:00 GMT; Path=/';
+        strict_1.default.equal((0, cookies_1.rewriteSetCookieDomain)(input, 'example.com'), 'sid=abc; Domain=example.com; Expires=Wed, 21 Oct 2026 07:28:00 GMT; Path=/');
+    });
+    (0, node_test_1.it)('matches the Domain attribute name case-insensitively and preserves its casing', () => {
+        const input = 'sid=abc; domain=.qelos.app; Path=/';
+        strict_1.default.equal((0, cookies_1.rewriteSetCookieDomain)(input, 'example.com'), 'sid=abc; domain=example.com; Path=/');
+    });
+    (0, node_test_1.it)('strips the entire Domain segment when newDomain is undefined', () => {
+        const input = 'sid=abc; Path=/; Domain=.qelos.app; HttpOnly; Secure; SameSite=Lax';
+        strict_1.default.equal((0, cookies_1.rewriteSetCookieDomain)(input, undefined), 'sid=abc; Path=/; HttpOnly; Secure; SameSite=Lax');
+    });
+    (0, node_test_1.it)('strips the entire Domain segment when newDomain is an empty string', () => {
+        const input = 'sid=abc; Domain=.qelos.app; Path=/';
+        strict_1.default.equal((0, cookies_1.rewriteSetCookieDomain)(input, ''), 'sid=abc; Path=/');
+    });
+    (0, node_test_1.it)('removes the Domain segment when it is the last attribute', () => {
+        const input = 'sid=abc; Path=/; Domain=.qelos.app';
+        strict_1.default.equal((0, cookies_1.rewriteSetCookieDomain)(input, undefined), 'sid=abc; Path=/');
+    });
+});
+(0, node_test_1.describe)('rewriteSetCookieDomains', () => {
+    (0, node_test_1.it)('applies the rewrite to each entry of an array', () => {
+        const values = [
+            'a=1; Domain=.qelos.app; Path=/',
+            'b=2; Path=/; HttpOnly',
+            'c=3; Domain=*.qelos.app; Secure',
+        ];
+        strict_1.default.deepEqual((0, cookies_1.rewriteSetCookieDomains)(values, 'example.com'), [
+            'a=1; Domain=example.com; Path=/',
+            'b=2; Path=/; HttpOnly',
+            'c=3; Domain=example.com; Secure',
+        ]);
+    });
+    (0, node_test_1.it)('strips the Domain segment from each entry when newDomain is undefined', () => {
+        const values = [
+            'a=1; Domain=.qelos.app; Path=/',
+            'b=2; Domain=*.qelos.app; HttpOnly',
+        ];
+        strict_1.default.deepEqual((0, cookies_1.rewriteSetCookieDomains)(values, undefined), [
+            'a=1; Path=/',
+            'b=2; HttpOnly',
+        ]);
+    });
+});
+//# sourceMappingURL=cookies.test.js.map

package/dist/cookies.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cookies.test.js","sourceRoot":"","sources":["../src/cookies.test.ts"],"names":[],"mappings":";;;;;AAAA,8EAA8E;AAC9E,yCAAyC;AACzC,gEAAwC;AACxC,uCAA4E;AAE5E,IAAA,oBAAQ,EAAC,wBAAwB,EAAE,GAAG,EAAE;IACtC,IAAA,cAAE,EAAC,qCAAqC,EAAE,GAAG,EAAE;QAC7C,MAAM,KAAK,GAAG,sDAAsD,CAAC;QACrE,gBAAM,CAAC,KAAK,CACV,IAAA,gCAAsB,EAAC,KAAK,EAAE,aAAa,CAAC,EAC5C,uDAAuD,CACxD,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,IAAA,cAAE,EAAC,kCAAkC,EAAE,GAAG,EAAE;QAC1C,MAAM,KAAK,GAAG,+CAA+C,CAAC;QAC9D,gBAAM,CAAC,KAAK,CACV,IAAA,gCAAsB,EAAC,KAAK,EAAE,aAAa,CAAC,EAC5C,+CAA+C,CAChD,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,IAAA,cAAE,EAAC,kEAAkE,EAAE,GAAG,EAAE;QAC1E,MAAM,KAAK,GAAG,iDAAiD,CAAC;QAChE,gBAAM,CAAC,KAAK,CAAC,IAAA,gCAAsB,EAAC,KAAK,EAAE,aAAa,CAAC,EAAE,KAAK,CAAC,CAAC;IACpE,CAAC,CAAC,CAAC;IAEH,IAAA,cAAE,EAAC,gEAAgE,EAAE,GAAG,EAAE;QACxE,MAAM,KAAK,GAAG,oCAAoC,CAAC;QACnD,gBAAM,CAAC,KAAK,CACV,IAAA,gCAAsB,EAAC,KAAK,EAAE,gBAAgB,CAAC,EAC/C,mCAAmC,CACpC,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,IAAA,cAAE,EAAC,mEAAmE,EAAE,GAAG,EAAE;QAC3E,MAAM,KAAK,GACT,kFAAkF,CAAC;QACrF,gBAAM,CAAC,KAAK,CACV,IAAA,gCAAsB,EAAC,KAAK,EAAE,aAAa,CAAC,EAC5C,mFAAmF,CACpF,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,IAAA,cAAE,EAAC,2EAA2E,EAAE,GAAG,EAAE;QACnF,MAAM,KAAK,GACT,2EAA2E,CAAC;QAC9E,gBAAM,CAAC,KAAK,CACV,IAAA,gCAAsB,EAAC,KAAK,EAAE,aAAa,CAAC,EAC5C,4EAA4E,CAC7E,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,IAAA,cAAE,EAAC,+EAA+E,EAAE,GAAG,EAAE;QACvF,MAAM,KAAK,GAAG,oCAAoC,CAAC;QACnD,gBAAM,CAAC,KAAK,CACV,IAAA,gCAAsB,EAAC,KAAK,EAAE,aAAa,CAAC,EAC5C,qCAAqC,CACtC,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,IAAA,cAAE,EAAC,8DAA8D,EAAE,GAAG,EAAE;QACtE,MAAM,KAAK,GACT,oEAAoE,CAAC;QACvE,gBAAM,CAAC,KAAK,CACV,IAAA,gCAAsB,EAAC,KAAK,EAAE,SAAS,CAAC,EACxC,iDAAiD,CAClD,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,IAAA,cAAE,EAAC,oEAAoE,EAAE,GAAG,EAAE;QAC5E,MAAM,KAAK,GAAG,oCAAoC,CAAC;QACnD,gBAAM,CAAC,KAAK,CACV,IAAA,gCAAsB,EAAC,KAAK,EAAE,EAAE,CAAC,EACjC,iBAAiB,CAClB,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,IAAA,cAAE,EAAC,0DAA0D,EAAE,GAAG,EAAE;QAClE,MAAM,KAAK,GAAG,oCAAoC,CAAC;QACnD,gBAAM,CAAC,KAAK,CACV,IAAA,gCAAsB,EAAC,KAAK,EAAE,SAAS,CAAC,EACxC,iBAAiB,CAClB,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,IAAA,oBAAQ,EAAC,yBAAyB,EAAE,GAAG,EAAE;IACvC,IAAA,cAAE,EAAC,+CAA+C,EAAE,GAAG,EAAE;QACvD,MAAM,MAAM,GAAG;YACb,gCAAgC;YAChC,uBAAuB;YACvB,iCAAiC;SAClC,CAAC;QACF,gBAAM,CAAC,SAAS,CAAC,IAAA,iCAAuB,EAAC,MAAM,EAAE,aAAa,CAAC,EAAE;YAC/D,iCAAiC;YACjC,uBAAuB;YACvB,iCAAiC;SAClC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,IAAA,cAAE,EAAC,uEAAuE,EAAE,GAAG,EAAE;QAC/E,MAAM,MAAM,GAAG;YACb,gCAAgC;YAChC,mCAAmC;SACpC,CAAC;QACF,gBAAM,CAAC,SAAS,CAAC,IAAA,iCAAuB,EAAC,MAAM,EAAE,SAAS,CAAC,EAAE;YAC3D,aAAa;YACb,eAAe;SAChB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/index.d.ts

@@ -2,8 +2,11 @@ export { QELOS_MODULE_OPTIONS, QELOS_SDK } from './constants';
 export { QelosModule } from './module';
 export type { QelosModuleAsyncOptions, QelosOptionsFactory, } from './module';
 export { QelosMiddleware } from './middleware';
+export { QelosProxyMiddleware } from './proxy.middleware';
 export { QelosAuthGuard, QelosGuard } from './guard';
 export { QelosCtx, QelosSdk, QelosUser, QelosWorkspace } from './decorators';
 export { createRequestSdk } from './sdk-factory';
 export type { CreateSdkParams } from './sdk-factory';
-export type { AnyRequest, AnyResponse, QelosModuleOptions, QelosNestConfig, QelosRequestContext, QelosTokenPair, ResolvedTokens, TokenRefreshContext, TokenRefreshHook, WorkspaceResolver, } from './types';
+export { rewriteSetCookieDomain, rewriteSetCookieDomains } from './cookies';
+export { resolveQelosProxyTarget } from './proxy-target';
+export type { AnyRequest, AnyResponse, QelosModuleOptions, QelosNestConfig, QelosRequestContext, WorkspaceResolver, } from './types';

package/dist/index.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.createRequestSdk = exports.QelosWorkspace = exports.QelosUser = exports.QelosSdk = exports.QelosCtx = exports.QelosGuard = exports.QelosAuthGuard = exports.QelosMiddleware = exports.QelosModule = exports.QELOS_SDK = exports.QELOS_MODULE_OPTIONS = void 0;
+exports.resolveQelosProxyTarget = exports.rewriteSetCookieDomains = exports.rewriteSetCookieDomain = exports.createRequestSdk = exports.QelosWorkspace = exports.QelosUser = exports.QelosSdk = exports.QelosCtx = exports.QelosGuard = exports.QelosAuthGuard = exports.QelosProxyMiddleware = exports.QelosMiddleware = exports.QelosModule = exports.QELOS_SDK = exports.QELOS_MODULE_OPTIONS = void 0;
 var constants_1 = require("./constants");
 Object.defineProperty(exports, "QELOS_MODULE_OPTIONS", { enumerable: true, get: function () { return constants_1.QELOS_MODULE_OPTIONS; } });
 Object.defineProperty(exports, "QELOS_SDK", { enumerable: true, get: function () { return constants_1.QELOS_SDK; } });
@@ -8,6 +8,8 @@ var module_1 = require("./module");
 Object.defineProperty(exports, "QelosModule", { enumerable: true, get: function () { return module_1.QelosModule; } });
 var middleware_1 = require("./middleware");
 Object.defineProperty(exports, "QelosMiddleware", { enumerable: true, get: function () { return middleware_1.QelosMiddleware; } });
+var proxy_middleware_1 = require("./proxy.middleware");
+Object.defineProperty(exports, "QelosProxyMiddleware", { enumerable: true, get: function () { return proxy_middleware_1.QelosProxyMiddleware; } });
 var guard_1 = require("./guard");
 Object.defineProperty(exports, "QelosAuthGuard", { enumerable: true, get: function () { return guard_1.QelosAuthGuard; } });
 Object.defineProperty(exports, "QelosGuard", { enumerable: true, get: function () { return guard_1.QelosGuard; } });
@@ -18,4 +20,9 @@ Object.defineProperty(exports, "QelosUser", { enumerable: true, get: function ()
 Object.defineProperty(exports, "QelosWorkspace", { enumerable: true, get: function () { return decorators_1.QelosWorkspace; } });
 var sdk_factory_1 = require("./sdk-factory");
 Object.defineProperty(exports, "createRequestSdk", { enumerable: true, get: function () { return sdk_factory_1.createRequestSdk; } });
+var cookies_1 = require("./cookies");
+Object.defineProperty(exports, "rewriteSetCookieDomain", { enumerable: true, get: function () { return cookies_1.rewriteSetCookieDomain; } });
+Object.defineProperty(exports, "rewriteSetCookieDomains", { enumerable: true, get: function () { return cookies_1.rewriteSetCookieDomains; } });
+var proxy_target_1 = require("./proxy-target");
+Object.defineProperty(exports, "resolveQelosProxyTarget", { enumerable: true, get: function () { return proxy_target_1.resolveQelosProxyTarget; } });
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;AAAA,yCAA8D;AAArD,iHAAA,oBAAoB,OAAA;AAAE,sGAAA,SAAS,OAAA;AACxC,mCAAuC;AAA9B,qGAAA,WAAW,OAAA;AAKpB,2CAA+C;AAAtC,6GAAA,eAAe,OAAA;AACxB,iCAAqD;AAA5C,uGAAA,cAAc,OAAA;AAAE,mGAAA,UAAU,OAAA;AACnC,2CAA6E;AAApE,sGAAA,QAAQ,OAAA;AAAE,sGAAA,QAAQ,OAAA;AAAE,uGAAA,SAAS,OAAA;AAAE,4GAAA,cAAc,OAAA;AACtD,6CAAiD;AAAxC,+GAAA,gBAAgB,OAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;AAAA,yCAA8D;AAArD,iHAAA,oBAAoB,OAAA;AAAE,sGAAA,SAAS,OAAA;AACxC,mCAAuC;AAA9B,qGAAA,WAAW,OAAA;AAKpB,2CAA+C;AAAtC,6GAAA,eAAe,OAAA;AACxB,uDAA0D;AAAjD,wHAAA,oBAAoB,OAAA;AAC7B,iCAAqD;AAA5C,uGAAA,cAAc,OAAA;AAAE,mGAAA,UAAU,OAAA;AACnC,2CAA6E;AAApE,sGAAA,QAAQ,OAAA;AAAE,sGAAA,QAAQ,OAAA;AAAE,uGAAA,SAAS,OAAA;AAAE,4GAAA,cAAc,OAAA;AACtD,6CAAiD;AAAxC,+GAAA,gBAAgB,OAAA;AAEzB,qCAA4E;AAAnE,iHAAA,sBAAsB,OAAA;AAAE,kHAAA,uBAAuB,OAAA;AACxD,+CAAyD;AAAhD,uHAAA,uBAAuB,OAAA"}

package/dist/middleware.js

@@ -15,8 +15,13 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.QelosMiddleware = void 0;
 const common_1 = require("@nestjs/common");
 const constants_1 = require("./constants");
-const sdk_factory_1 = require("./sdk-factory");
+const cookies_1 = require("./cookies");
+const proxy_target_1 = require("./proxy-target");
 const request_utils_1 = require("./request-utils");
+const sdk_factory_1 = require("./sdk-factory");
+function buildMeUrl(base) {
+    return `${base.replace(/\/+$/, '')}/api/me`;
+}
 let QelosMiddleware = class QelosMiddleware {
     constructor(options) {
         this.options = options;
@@ -25,32 +30,21 @@ let QelosMiddleware = class QelosMiddleware {
         const request = req;
         const response = res;
         const { config, resolveWorkspace } = this.options;
-        const onTokenRefresh = this.options.onTokenRefresh ||
-            (async ({ response: r, newTokens }) => {
-                (0, request_utils_1.writeTokensToCookies)(r, config, newTokens);
-            });
+        const sdkFetch = (config.sdkOptions?.fetch ?? globalThis.fetch);
         if ((0, request_utils_1.shouldSkip)(request, config)) {
             next();
             return;
         }
-        const tokens = (0, request_utils_1.readTokens)(request, config);
-        const sdk = (0, sdk_factory_1.createRequestSdk)({
-            config,
-            tokens,
-            request,
-            response,
-            onTokenRefresh,
-        });
+        const sdk = (0, sdk_factory_1.createRequestSdk)({ config, request });
         const ctx = {
             user: null,
             workspace: null,
             workspaces: [],
             sdk,
-            tokens,
         };
         request.qelos = ctx;
-        const hasAuthMaterial = Boolean(config.apiToken || tokens.accessToken || tokens.refreshToken);
-        if (!hasAuthMaterial) {
+        const base = (0, proxy_target_1.resolveQelosProxyTarget)(config);
+        if (!base && !config.apiToken) {
             if (config.requireAuth) {
                 next(new common_1.UnauthorizedException());
                 return;
@@ -58,10 +52,56 @@ let QelosMiddleware = class QelosMiddleware {
             next();
             return;
         }
-        try {
-            ctx.user = await sdk.authentication.getLoggedInUser();
+        if (base) {
+            const headers = {};
+            const cookieHeader = request.headers.cookie;
+            const cookie = typeof cookieHeader === 'string'
+                ? cookieHeader
+                : Array.isArray(cookieHeader)
+                    ? cookieHeader.join('; ')
+                    : undefined;
+            if (cookie)
+                headers.cookie = cookie;
+            const rawAuth = request.headers.authorization;
+            const authHeader = Array.isArray(rawAuth) ? rawAuth[0] : rawAuth;
+            if (authHeader)
+                headers.authorization = authHeader;
+            const hostHeader = request.headers.host;
+            const originalHost = typeof hostHeader === 'string'
+                ? hostHeader
+                : Array.isArray(hostHeader)
+                    ? hostHeader[0]
+                    : undefined;
+            let upstream;
+            try {
+                upstream = await sdkFetch(buildMeUrl(base), {
+                    method: 'GET',
+                    headers,
+                    redirect: 'manual',
+                });
+            }
+            catch {
+                if (config.requireAuth) {
+                    next(new common_1.UnauthorizedException());
+                    return;
+                }
+                next();
+                return;
+            }
+            const setCookieValues = upstream.headers.getSetCookie?.() ?? [];
+            for (const value of setCookieValues) {
+                (0, request_utils_1.appendSetCookie)(response, (0, cookies_1.rewriteSetCookieDomain)(value, originalHost));
+            }
+            if (upstream.ok) {
+                try {
+                    ctx.user = (await upstream.json());
+                }
+                catch {
+                    ctx.user = null;
+                }
+            }
         }
-        catch {
+        if (!ctx.user) {
             if (config.requireAuth) {
                 next(new common_1.UnauthorizedException());
                 return;
@@ -75,18 +115,18 @@ let QelosMiddleware = class QelosMiddleware {
         catch {
             ctx.workspaces = [];
         }
-        if (ctx.user && ctx.workspaces.length) {
-            if (resolveWorkspace) {
-                ctx.workspace =
-                    (await resolveWorkspace({
-                        request,
-                        user: ctx.user,
-                        workspaces: ctx.workspaces,
-                    })) || null;
-            }
-            else {
-                ctx.workspace = ctx.workspaces[0] || null;
-            }
+        if (resolveWorkspace) {
+            ctx.workspace =
+                (await resolveWorkspace({
+                    request,
+                    user: ctx.user,
+                    workspaces: ctx.workspaces,
+                })) || null;
+        }
+        else {
+            ctx.workspace =
+                ctx.user.workspace ||
+                    null;
         }
         next();
     }

package/dist/middleware.js.map

@@ -1 +1 @@
-{"version":3,"file":"middleware.js","sourceRoot":"","sources":["../src/middleware.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAKwB;AACxB,2CAAmD;AACnD,+CAAiD;AACjD,mDAIyB;AAUlB,IAAM,eAAe,GAArB,MAAM,eAAe;IAC1B,YAEmB,OAA2B;QAA3B,YAAO,GAAP,OAAO,CAAoB;IAC3C,CAAC;IAEJ,KAAK,CAAC,GAAG,CAAC,GAAY,EAAE,GAAY,EAAE,IAA6B;QACjE,MAAM,OAAO,GAAG,GAAiB,CAAC;QAClC,MAAM,QAAQ,GAAG,GAAkB,CAAC;QACpC,MAAM,EAAE,MAAM,EAAE,gBAAgB,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC;QAClD,MAAM,cAAc,GAClB,IAAI,CAAC,OAAO,CAAC,cAAc;YAC3B,CAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE;gBACpC,IAAA,oCAAoB,EAAC,CAAC,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;YAC7C,CAAC,CAAC,CAAC;QAEL,IAAI,IAAA,0BAAU,EAAC,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC;YAChC,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QAED,MAAM,MAAM,GAAG,IAAA,0BAAU,EAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC3C,MAAM,GAAG,GAAG,IAAA,8BAAgB,EAAC;YAC3B,MAAM;YACN,MAAM;YACN,OAAO;YACP,QAAQ;YACR,cAAc;SACf,CAAC,CAAC;QAEH,MAAM,GAAG,GAAwB;YAC/B,IAAI,EAAE,IAAI;YACV,SAAS,EAAE,IAAI;YACf,UAAU,EAAE,EAAE;YACd,GAAG;YACH,MAAM;SACP,CAAC;QACF,OAAO,CAAC,KAAK,GAAG,GAAG,CAAC;QAEpB,MAAM,eAAe,GAAG,OAAO,CAC7B,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,YAAY,CAC7D,CAAC;QACF,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;gBACvB,IAAI,CAAC,IAAI,8BAAqB,EAAE,CAAC,CAAC;gBAClC,OAAO;YACT,CAAC;YACD,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,GAAG,CAAC,IAAI,GAAG,MAAM,GAAG,CAAC,cAAc,CAAC,eAAe,EAAE,CAAC;QACxD,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;gBACvB,IAAI,CAAC,IAAI,8BAAqB,EAAE,CAAC,CAAC;gBAClC,OAAO;YACT,CAAC;YACD,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,GAAG,CAAC,UAAU,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;QAClD,CAAC;QAAC,MAAM,CAAC;YACP,GAAG,CAAC,UAAU,GAAG,EAAE,CAAC;QACtB,CAAC;QAED,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC;YACtC,IAAI,gBAAgB,EAAE,CAAC;gBACrB,GAAG,CAAC,SAAS;oBACX,CAAC,MAAM,gBAAgB,CAAC;wBACtB,OAAO;wBACP,IAAI,EAAE,GAAG,CAAC,IAAI;wBACd,UAAU,EAAE,GAAG,CAAC,UAAU;qBAC3B,CAAC,CAAC,IAAI,IAAI,CAAC;YAChB,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,SAAS,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;YAC5C,CAAC;QACH,CAAC;QAED,IAAI,EAAE,CAAC;IACT,CAAC;CACF,CAAA;AAnFY,0CAAe;0BAAf,eAAe;IAD3B,IAAA,mBAAU,GAAE;IAGR,WAAA,IAAA,eAAM,EAAC,gCAAoB,CAAC,CAAA;;GAFpB,eAAe,CAmF3B"}
+{"version":3,"file":"middleware.js","sourceRoot":"","sources":["../src/middleware.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAKwB;AAGxB,2CAAmD;AACnD,uCAAmD;AACnD,iDAAyD;AACzD,mDAA8D;AAC9D,+CAAiD;AAQjD,SAAS,UAAU,CAAC,IAAY;IAC9B,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,SAAS,CAAC;AAC9C,CAAC;AAGM,IAAM,eAAe,GAArB,MAAM,eAAe;IAC1B,YAEmB,OAA2B;QAA3B,YAAO,GAAP,OAAO,CAAoB;IAC3C,CAAC;IAEJ,KAAK,CAAC,GAAG,CAAC,GAAY,EAAE,GAAY,EAAE,IAA6B;QACjE,MAAM,OAAO,GAAG,GAAiB,CAAC;QAClC,MAAM,QAAQ,GAAG,GAAkB,CAAC;QACpC,MAAM,EAAE,MAAM,EAAE,gBAAgB,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC;QAClD,MAAM,QAAQ,GAAG,CAAC,MAAM,CAAC,UAAU,EAAE,KAAK,IAAI,UAAU,CAAC,KAAK,CAA4B,CAAC;QAE3F,IAAI,IAAA,0BAAU,EAAC,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC;YAChC,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QAED,MAAM,GAAG,GAAG,IAAA,8BAAgB,EAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QAElD,MAAM,GAAG,GAAwB;YAC/B,IAAI,EAAE,IAAI;YACV,SAAS,EAAE,IAAI;YACf,UAAU,EAAE,EAAE;YACd,GAAG;SACJ,CAAC;QACF,OAAO,CAAC,KAAK,GAAG,GAAG,CAAC;QAEpB,MAAM,IAAI,GAAG,IAAA,sCAAuB,EAAC,MAAM,CAAC,CAAC;QAC7C,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;YAC9B,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;gBACvB,IAAI,CAAC,IAAI,8BAAqB,EAAE,CAAC,CAAC;gBAClC,OAAO;YACT,CAAC;YACD,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QAED,IAAI,IAAI,EAAE,CAAC;YACT,MAAM,OAAO,GAA2B,EAAE,CAAC;YAC3C,MAAM,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC;YAC5C,MAAM,MAAM,GACV,OAAO,YAAY,KAAK,QAAQ;gBAC9B,CAAC,CAAC,YAAY;gBACd,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC;oBAC3B,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC;oBACzB,CAAC,CAAC,SAAS,CAAC;YAClB,IAAI,MAAM;gBAAE,OAAO,CAAC,MAAM,GAAG,MAAM,CAAC;YACpC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC;YAC9C,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;YACjE,IAAI,UAAU;gBAAE,OAAO,CAAC,aAAa,GAAG,UAAU,CAAC;YAEnD,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC;YACxC,MAAM,YAAY,GAChB,OAAO,UAAU,KAAK,QAAQ;gBAC5B,CAAC,CAAC,UAAU;gBACZ,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC;oBACzB,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;oBACf,CAAC,CAAC,SAAS,CAAC;YAElB,IAAI,QAAyC,CAAC;YAC9C,IAAI,CAAC;gBACH,QAAQ,GAAG,MAAM,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE;oBAC1C,MAAM,EAAE,KAAK;oBACb,OAAO;oBACP,QAAQ,EAAE,QAAQ;iBACnB,CAAC,CAAC;YACL,CAAC;YAAC,MAAM,CAAC;gBACP,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;oBACvB,IAAI,CAAC,IAAI,8BAAqB,EAAE,CAAC,CAAC;oBAClC,OAAO;gBACT,CAAC;gBACD,IAAI,EAAE,CAAC;gBACP,OAAO;YACT,CAAC;YAED,MAAM,eAAe,GAAG,QAAQ,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,CAAC;YAChE,KAAK,MAAM,KAAK,IAAI,eAAe,EAAE,CAAC;gBACpC,IAAA,+BAAe,EAAC,QAAQ,EAAE,IAAA,gCAAsB,EAAC,KAAK,EAAE,YAAY,CAAC,CAAC,CAAC;YACzE,CAAC;YAED,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;gBAChB,IAAI,CAAC;oBACH,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAU,CAAC;gBAC9C,CAAC;gBAAC,MAAM,CAAC;oBACP,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;gBAClB,CAAC;YACH,CAAC;QACH,CAAC;QAED,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;YACd,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;gBACvB,IAAI,CAAC,IAAI,8BAAqB,EAAE,CAAC,CAAC;gBAClC,OAAO;YACT,CAAC;YACD,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,GAAG,CAAC,UAAU,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;QAClD,CAAC;QAAC,MAAM,CAAC;YACP,GAAG,CAAC,UAAU,GAAG,EAAE,CAAC;QACtB,CAAC;QAED,IAAI,gBAAgB,EAAE,CAAC;YACrB,GAAG,CAAC,SAAS;gBACX,CAAC,MAAM,gBAAgB,CAAC;oBACtB,OAAO;oBACP,IAAI,EAAE,GAAG,CAAC,IAAI;oBACd,UAAU,EAAE,GAAG,CAAC,UAAU;iBAC3B,CAAC,CAAC,IAAI,IAAI,CAAC;QAChB,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,SAAS;gBACV,GAAG,CAAC,IAAqD,CAAC,SAAS;oBACpE,IAAI,CAAC;QACT,CAAC;QAED,IAAI,EAAE,CAAC;IACT,CAAC;CACF,CAAA;AAvHY,0CAAe;0BAAf,eAAe;IAD3B,IAAA,mBAAU,GAAE;IAGR,WAAA,IAAA,eAAM,EAAC,gCAAoB,CAAC,CAAA;;GAFpB,eAAe,CAuH3B"}

package/dist/module-options.d.ts

@@ -3,5 +3,8 @@ import type { QelosModuleOptions, QelosNestConfig } from './types';
  * `forRoot` / `forRootAsync` accept either a full {@link QelosModuleOptions}
  * object or a shorthand {@link QelosNestConfig} (same shape as Express
  * `createQelosMiddleware({ config })`).
+ *
+ * When `disableProxy` is not `true`, `/api/` is prepended to `skipPaths` so
+ * the user resolver does not shadow the `/api/**` proxy.
  */
 export declare function normalizeModuleOptions(input: QelosNestConfig | QelosModuleOptions): QelosModuleOptions;