@qelos/integrator-nest 4.0.1 → 4.1.1

package/dist/cookies.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Rewrite the `Domain=` attribute of a single `Set-Cookie` header value.
+ *
+ * - If the cookie contains a `Domain=<value>` attribute (case-insensitive), its
+ *   value is replaced with `newDomain`, with any trailing `:port` suffix
+ *   stripped first (cookie `Domain` attributes do not include a port).
+ * - If `newDomain` is `undefined` (or empty), the entire `; Domain=<value>`
+ *   segment is removed so the browser scopes the cookie to the current host.
+ * - If no `Domain=` attribute is present, the input is returned unchanged.
+ *
+ * All other attributes, their casing/order and the original cookie name/value
+ * bytes are preserved.
+ */
+export declare function rewriteSetCookieDomain(setCookie: string, newDomain: string | undefined): string;
+/**
+ * Apply {@link rewriteSetCookieDomain} to each entry of a `Set-Cookie` array
+ * (e.g. the result of `Headers.getSetCookie()`).
+ */
+export declare function rewriteSetCookieDomains(values: string[], newDomain: string | undefined): string[];

package/dist/cookies.js

@@ -0,0 +1,43 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.rewriteSetCookieDomain = rewriteSetCookieDomain;
+exports.rewriteSetCookieDomains = rewriteSetCookieDomains;
+/**
+ * Rewrite the `Domain=` attribute of a single `Set-Cookie` header value.
+ *
+ * - If the cookie contains a `Domain=<value>` attribute (case-insensitive), its
+ *   value is replaced with `newDomain`, with any trailing `:port` suffix
+ *   stripped first (cookie `Domain` attributes do not include a port).
+ * - If `newDomain` is `undefined` (or empty), the entire `; Domain=<value>`
+ *   segment is removed so the browser scopes the cookie to the current host.
+ * - If no `Domain=` attribute is present, the input is returned unchanged.
+ *
+ * All other attributes, their casing/order and the original cookie name/value
+ * bytes are preserved.
+ */
+function rewriteSetCookieDomain(setCookie, newDomain) {
+    const domainSegment = /;\s*Domain\s*=\s*[^;]+/i;
+    if (!domainSegment.test(setCookie))
+        return setCookie;
+    const stripped = newDomain ? stripPort(newDomain) : '';
+    if (!stripped) {
+        return setCookie.replace(domainSegment, '');
+    }
+    return setCookie.replace(/(;\s*Domain\s*=\s*)[^;]+/i, `$1${stripped}`);
+}
+/**
+ * Apply {@link rewriteSetCookieDomain} to each entry of a `Set-Cookie` array
+ * (e.g. the result of `Headers.getSetCookie()`).
+ */
+function rewriteSetCookieDomains(values, newDomain) {
+    return values.map((value) => rewriteSetCookieDomain(value, newDomain));
+}
+function stripPort(host) {
+    if (host.startsWith('[')) {
+        const end = host.indexOf(']');
+        return end === -1 ? host : host.slice(1, end);
+    }
+    const colon = host.indexOf(':');
+    return colon === -1 ? host : host.slice(0, colon);
+}
+//# sourceMappingURL=cookies.js.map

package/dist/cookies.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cookies.js","sourceRoot":"","sources":["../src/cookies.ts"],"names":[],"mappings":";;AAaA,wDAeC;AAMD,0DAKC;AAvCD;;;;;;;;;;;;GAYG;AACH,SAAgB,sBAAsB,CACpC,SAAiB,EACjB,SAA6B;IAE7B,MAAM,aAAa,GAAG,yBAAyB,CAAC;IAChD,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC;QAAE,OAAO,SAAS,CAAC;IAErD,MAAM,QAAQ,GAAG,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACvD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,SAAS,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,SAAS,CAAC,OAAO,CACtB,2BAA2B,EAC3B,KAAK,QAAQ,EAAE,CAChB,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAgB,uBAAuB,CACrC,MAAgB,EAChB,SAA6B;IAE7B,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,sBAAsB,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC;AACzE,CAAC;AAED,SAAS,SAAS,CAAC,IAAY;IAC7B,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC9B,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAChD,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAChC,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;AACpD,CAAC"}

package/dist/cookies.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/cookies.test.js

@@ -0,0 +1,76 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+// Run with: `pnpm -F @qelos/integrator-nest test` (includes src/**/*.test.ts)
+const node_test_1 = require("node:test");
+const strict_1 = __importDefault(require("node:assert/strict"));
+const cookies_1 = require("./cookies");
+(0, node_test_1.describe)('rewriteSetCookieDomain', () => {
+    (0, node_test_1.it)('replaces a leading-dot Domain value', () => {
+        const input = 'sid=abc; Path=/; Domain=.qelos.app; HttpOnly; Secure';
+        strict_1.default.equal((0, cookies_1.rewriteSetCookieDomain)(input, 'example.com'), 'sid=abc; Path=/; Domain=example.com; HttpOnly; Secure');
+    });
+    (0, node_test_1.it)('replaces a wildcard Domain value', () => {
+        const input = 'sid=abc; Path=/; Domain=*.qelos.app; HttpOnly';
+        strict_1.default.equal((0, cookies_1.rewriteSetCookieDomain)(input, 'example.com'), 'sid=abc; Path=/; Domain=example.com; HttpOnly');
+    });
+    (0, node_test_1.it)('returns the cookie unchanged when no Domain attribute is present', () => {
+        const input = 'sid=abc; Path=/; HttpOnly; Secure; SameSite=Lax';
+        strict_1.default.equal((0, cookies_1.rewriteSetCookieDomain)(input, 'example.com'), input);
+    });
+    (0, node_test_1.it)('strips the port from a host:port newDomain before substitution', () => {
+        const input = 'sid=abc; Domain=.qelos.app; Path=/';
+        strict_1.default.equal((0, cookies_1.rewriteSetCookieDomain)(input, 'localhost:3000'), 'sid=abc; Domain=localhost; Path=/');
+    });
+    (0, node_test_1.it)('preserves attribute order and other attributes across replacement', () => {
+        const input = 'sid=abc; Path=/; Domain=.qelos.app; HttpOnly; Secure; SameSite=Lax; Max-Age=3600';
+        strict_1.default.equal((0, cookies_1.rewriteSetCookieDomain)(input, 'example.com'), 'sid=abc; Path=/; Domain=example.com; HttpOnly; Secure; SameSite=Lax; Max-Age=3600');
+    });
+    (0, node_test_1.it)('preserves an Expires attribute (which contains commas) across replacement', () => {
+        const input = 'sid=abc; Domain=.qelos.app; Expires=Wed, 21 Oct 2026 07:28:00 GMT; Path=/';
+        strict_1.default.equal((0, cookies_1.rewriteSetCookieDomain)(input, 'example.com'), 'sid=abc; Domain=example.com; Expires=Wed, 21 Oct 2026 07:28:00 GMT; Path=/');
+    });
+    (0, node_test_1.it)('matches the Domain attribute name case-insensitively and preserves its casing', () => {
+        const input = 'sid=abc; domain=.qelos.app; Path=/';
+        strict_1.default.equal((0, cookies_1.rewriteSetCookieDomain)(input, 'example.com'), 'sid=abc; domain=example.com; Path=/');
+    });
+    (0, node_test_1.it)('strips the entire Domain segment when newDomain is undefined', () => {
+        const input = 'sid=abc; Path=/; Domain=.qelos.app; HttpOnly; Secure; SameSite=Lax';
+        strict_1.default.equal((0, cookies_1.rewriteSetCookieDomain)(input, undefined), 'sid=abc; Path=/; HttpOnly; Secure; SameSite=Lax');
+    });
+    (0, node_test_1.it)('strips the entire Domain segment when newDomain is an empty string', () => {
+        const input = 'sid=abc; Domain=.qelos.app; Path=/';
+        strict_1.default.equal((0, cookies_1.rewriteSetCookieDomain)(input, ''), 'sid=abc; Path=/');
+    });
+    (0, node_test_1.it)('removes the Domain segment when it is the last attribute', () => {
+        const input = 'sid=abc; Path=/; Domain=.qelos.app';
+        strict_1.default.equal((0, cookies_1.rewriteSetCookieDomain)(input, undefined), 'sid=abc; Path=/');
+    });
+});
+(0, node_test_1.describe)('rewriteSetCookieDomains', () => {
+    (0, node_test_1.it)('applies the rewrite to each entry of an array', () => {
+        const values = [
+            'a=1; Domain=.qelos.app; Path=/',
+            'b=2; Path=/; HttpOnly',
+            'c=3; Domain=*.qelos.app; Secure',
+        ];
+        strict_1.default.deepEqual((0, cookies_1.rewriteSetCookieDomains)(values, 'example.com'), [
+            'a=1; Domain=example.com; Path=/',
+            'b=2; Path=/; HttpOnly',
+            'c=3; Domain=example.com; Secure',
+        ]);
+    });
+    (0, node_test_1.it)('strips the Domain segment from each entry when newDomain is undefined', () => {
+        const values = [
+            'a=1; Domain=.qelos.app; Path=/',
+            'b=2; Domain=*.qelos.app; HttpOnly',
+        ];
+        strict_1.default.deepEqual((0, cookies_1.rewriteSetCookieDomains)(values, undefined), [
+            'a=1; Path=/',
+            'b=2; HttpOnly',
+        ]);
+    });
+});
+//# sourceMappingURL=cookies.test.js.map

package/dist/cookies.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cookies.test.js","sourceRoot":"","sources":["../src/cookies.test.ts"],"names":[],"mappings":";;;;;AAAA,8EAA8E;AAC9E,yCAAyC;AACzC,gEAAwC;AACxC,uCAA4E;AAE5E,IAAA,oBAAQ,EAAC,wBAAwB,EAAE,GAAG,EAAE;IACtC,IAAA,cAAE,EAAC,qCAAqC,EAAE,GAAG,EAAE;QAC7C,MAAM,KAAK,GAAG,sDAAsD,CAAC;QACrE,gBAAM,CAAC,KAAK,CACV,IAAA,gCAAsB,EAAC,KAAK,EAAE,aAAa,CAAC,EAC5C,uDAAuD,CACxD,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,IAAA,cAAE,EAAC,kCAAkC,EAAE,GAAG,EAAE;QAC1C,MAAM,KAAK,GAAG,+CAA+C,CAAC;QAC9D,gBAAM,CAAC,KAAK,CACV,IAAA,gCAAsB,EAAC,KAAK,EAAE,aAAa,CAAC,EAC5C,+CAA+C,CAChD,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,IAAA,cAAE,EAAC,kEAAkE,EAAE,GAAG,EAAE;QAC1E,MAAM,KAAK,GAAG,iDAAiD,CAAC;QAChE,gBAAM,CAAC,KAAK,CAAC,IAAA,gCAAsB,EAAC,KAAK,EAAE,aAAa,CAAC,EAAE,KAAK,CAAC,CAAC;IACpE,CAAC,CAAC,CAAC;IAEH,IAAA,cAAE,EAAC,gEAAgE,EAAE,GAAG,EAAE;QACxE,MAAM,KAAK,GAAG,oCAAoC,CAAC;QACnD,gBAAM,CAAC,KAAK,CACV,IAAA,gCAAsB,EAAC,KAAK,EAAE,gBAAgB,CAAC,EAC/C,mCAAmC,CACpC,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,IAAA,cAAE,EAAC,mEAAmE,EAAE,GAAG,EAAE;QAC3E,MAAM,KAAK,GACT,kFAAkF,CAAC;QACrF,gBAAM,CAAC,KAAK,CACV,IAAA,gCAAsB,EAAC,KAAK,EAAE,aAAa,CAAC,EAC5C,mFAAmF,CACpF,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,IAAA,cAAE,EAAC,2EAA2E,EAAE,GAAG,EAAE;QACnF,MAAM,KAAK,GACT,2EAA2E,CAAC;QAC9E,gBAAM,CAAC,KAAK,CACV,IAAA,gCAAsB,EAAC,KAAK,EAAE,aAAa,CAAC,EAC5C,4EAA4E,CAC7E,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,IAAA,cAAE,EAAC,+EAA+E,EAAE,GAAG,EAAE;QACvF,MAAM,KAAK,GAAG,oCAAoC,CAAC;QACnD,gBAAM,CAAC,KAAK,CACV,IAAA,gCAAsB,EAAC,KAAK,EAAE,aAAa,CAAC,EAC5C,qCAAqC,CACtC,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,IAAA,cAAE,EAAC,8DAA8D,EAAE,GAAG,EAAE;QACtE,MAAM,KAAK,GACT,oEAAoE,CAAC;QACvE,gBAAM,CAAC,KAAK,CACV,IAAA,gCAAsB,EAAC,KAAK,EAAE,SAAS,CAAC,EACxC,iDAAiD,CAClD,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,IAAA,cAAE,EAAC,oEAAoE,EAAE,GAAG,EAAE;QAC5E,MAAM,KAAK,GAAG,oCAAoC,CAAC;QACnD,gBAAM,CAAC,KAAK,CACV,IAAA,gCAAsB,EAAC,KAAK,EAAE,EAAE,CAAC,EACjC,iBAAiB,CAClB,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,IAAA,cAAE,EAAC,0DAA0D,EAAE,GAAG,EAAE;QAClE,MAAM,KAAK,GAAG,oCAAoC,CAAC;QACnD,gBAAM,CAAC,KAAK,CACV,IAAA,gCAAsB,EAAC,KAAK,EAAE,SAAS,CAAC,EACxC,iBAAiB,CAClB,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,IAAA,oBAAQ,EAAC,yBAAyB,EAAE,GAAG,EAAE;IACvC,IAAA,cAAE,EAAC,+CAA+C,EAAE,GAAG,EAAE;QACvD,MAAM,MAAM,GAAG;YACb,gCAAgC;YAChC,uBAAuB;YACvB,iCAAiC;SAClC,CAAC;QACF,gBAAM,CAAC,SAAS,CAAC,IAAA,iCAAuB,EAAC,MAAM,EAAE,aAAa,CAAC,EAAE;YAC/D,iCAAiC;YACjC,uBAAuB;YACvB,iCAAiC;SAClC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,IAAA,cAAE,EAAC,uEAAuE,EAAE,GAAG,EAAE;QAC/E,MAAM,MAAM,GAAG;YACb,gCAAgC;YAChC,mCAAmC;SACpC,CAAC;QACF,gBAAM,CAAC,SAAS,CAAC,IAAA,iCAAuB,EAAC,MAAM,EAAE,SAAS,CAAC,EAAE;YAC3D,aAAa;YACb,eAAe;SAChB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/index.d.ts

@@ -2,8 +2,11 @@ export { QELOS_MODULE_OPTIONS, QELOS_SDK } from './constants';
 export { QelosModule } from './module';
 export type { QelosModuleAsyncOptions, QelosOptionsFactory, } from './module';
 export { QelosMiddleware } from './middleware';
+export { QelosProxyMiddleware } from './proxy.middleware';
 export { QelosAuthGuard, QelosGuard } from './guard';
 export { QelosCtx, QelosSdk, QelosUser, QelosWorkspace } from './decorators';
 export { createRequestSdk } from './sdk-factory';
 export type { CreateSdkParams } from './sdk-factory';
-export type { AnyRequest, AnyResponse, QelosModuleOptions, QelosNestConfig, QelosRequestContext, QelosTokenPair, ResolvedTokens, TokenRefreshContext, TokenRefreshHook, WorkspaceResolver, } from './types';
+export { rewriteSetCookieDomain, rewriteSetCookieDomains } from './cookies';
+export { resolveQelosProxyTarget } from './proxy-target';
+export type { AnyRequest, AnyResponse, QelosModuleOptions, QelosNestConfig, QelosRequestContext, WorkspaceResolver, } from './types';

package/dist/index.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.createRequestSdk = exports.QelosWorkspace = exports.QelosUser = exports.QelosSdk = exports.QelosCtx = exports.QelosGuard = exports.QelosAuthGuard = exports.QelosMiddleware = exports.QelosModule = exports.QELOS_SDK = exports.QELOS_MODULE_OPTIONS = void 0;
+exports.resolveQelosProxyTarget = exports.rewriteSetCookieDomains = exports.rewriteSetCookieDomain = exports.createRequestSdk = exports.QelosWorkspace = exports.QelosUser = exports.QelosSdk = exports.QelosCtx = exports.QelosGuard = exports.QelosAuthGuard = exports.QelosProxyMiddleware = exports.QelosMiddleware = exports.QelosModule = exports.QELOS_SDK = exports.QELOS_MODULE_OPTIONS = void 0;
 var constants_1 = require("./constants");
 Object.defineProperty(exports, "QELOS_MODULE_OPTIONS", { enumerable: true, get: function () { return constants_1.QELOS_MODULE_OPTIONS; } });
 Object.defineProperty(exports, "QELOS_SDK", { enumerable: true, get: function () { return constants_1.QELOS_SDK; } });
@@ -8,6 +8,8 @@ var module_1 = require("./module");
 Object.defineProperty(exports, "QelosModule", { enumerable: true, get: function () { return module_1.QelosModule; } });
 var middleware_1 = require("./middleware");
 Object.defineProperty(exports, "QelosMiddleware", { enumerable: true, get: function () { return middleware_1.QelosMiddleware; } });
+var proxy_middleware_1 = require("./proxy.middleware");
+Object.defineProperty(exports, "QelosProxyMiddleware", { enumerable: true, get: function () { return proxy_middleware_1.QelosProxyMiddleware; } });
 var guard_1 = require("./guard");
 Object.defineProperty(exports, "QelosAuthGuard", { enumerable: true, get: function () { return guard_1.QelosAuthGuard; } });
 Object.defineProperty(exports, "QelosGuard", { enumerable: true, get: function () { return guard_1.QelosGuard; } });
@@ -18,4 +20,9 @@ Object.defineProperty(exports, "QelosUser", { enumerable: true, get: function ()
 Object.defineProperty(exports, "QelosWorkspace", { enumerable: true, get: function () { return decorators_1.QelosWorkspace; } });
 var sdk_factory_1 = require("./sdk-factory");
 Object.defineProperty(exports, "createRequestSdk", { enumerable: true, get: function () { return sdk_factory_1.createRequestSdk; } });
+var cookies_1 = require("./cookies");
+Object.defineProperty(exports, "rewriteSetCookieDomain", { enumerable: true, get: function () { return cookies_1.rewriteSetCookieDomain; } });
+Object.defineProperty(exports, "rewriteSetCookieDomains", { enumerable: true, get: function () { return cookies_1.rewriteSetCookieDomains; } });
+var proxy_target_1 = require("./proxy-target");
+Object.defineProperty(exports, "resolveQelosProxyTarget", { enumerable: true, get: function () { return proxy_target_1.resolveQelosProxyTarget; } });
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;AAAA,yCAA8D;AAArD,iHAAA,oBAAoB,OAAA;AAAE,sGAAA,SAAS,OAAA;AACxC,mCAAuC;AAA9B,qGAAA,WAAW,OAAA;AAKpB,2CAA+C;AAAtC,6GAAA,eAAe,OAAA;AACxB,iCAAqD;AAA5C,uGAAA,cAAc,OAAA;AAAE,mGAAA,UAAU,OAAA;AACnC,2CAA6E;AAApE,sGAAA,QAAQ,OAAA;AAAE,sGAAA,QAAQ,OAAA;AAAE,uGAAA,SAAS,OAAA;AAAE,4GAAA,cAAc,OAAA;AACtD,6CAAiD;AAAxC,+GAAA,gBAAgB,OAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;AAAA,yCAA8D;AAArD,iHAAA,oBAAoB,OAAA;AAAE,sGAAA,SAAS,OAAA;AACxC,mCAAuC;AAA9B,qGAAA,WAAW,OAAA;AAKpB,2CAA+C;AAAtC,6GAAA,eAAe,OAAA;AACxB,uDAA0D;AAAjD,wHAAA,oBAAoB,OAAA;AAC7B,iCAAqD;AAA5C,uGAAA,cAAc,OAAA;AAAE,mGAAA,UAAU,OAAA;AACnC,2CAA6E;AAApE,sGAAA,QAAQ,OAAA;AAAE,sGAAA,QAAQ,OAAA;AAAE,uGAAA,SAAS,OAAA;AAAE,4GAAA,cAAc,OAAA;AACtD,6CAAiD;AAAxC,+GAAA,gBAAgB,OAAA;AAEzB,qCAA4E;AAAnE,iHAAA,sBAAsB,OAAA;AAAE,kHAAA,uBAAuB,OAAA;AACxD,+CAAyD;AAAhD,uHAAA,uBAAuB,OAAA"}

package/dist/middleware.js

@@ -15,8 +15,13 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.QelosMiddleware = void 0;
 const common_1 = require("@nestjs/common");
 const constants_1 = require("./constants");
-const sdk_factory_1 = require("./sdk-factory");
+const cookies_1 = require("./cookies");
+const proxy_target_1 = require("./proxy-target");
 const request_utils_1 = require("./request-utils");
+const sdk_factory_1 = require("./sdk-factory");
+function buildMeUrl(base) {
+    return `${base.replace(/\/+$/, '')}/api/me`;
+}
 let QelosMiddleware = class QelosMiddleware {
     constructor(options) {
         this.options = options;
@@ -25,32 +30,21 @@ let QelosMiddleware = class QelosMiddleware {
         const request = req;
         const response = res;
         const { config, resolveWorkspace } = this.options;
-        const onTokenRefresh = this.options.onTokenRefresh ||
-            (async ({ response: r, newTokens }) => {
-                (0, request_utils_1.writeTokensToCookies)(r, config, newTokens);
-            });
+        const sdkFetch = (config.sdkOptions?.fetch ?? globalThis.fetch);
         if ((0, request_utils_1.shouldSkip)(request, config)) {
             next();
             return;
         }
-        const tokens = (0, request_utils_1.readTokens)(request, config);
-        const sdk = (0, sdk_factory_1.createRequestSdk)({
-            config,
-            tokens,
-            request,
-            response,
-            onTokenRefresh,
-        });
+        const sdk = (0, sdk_factory_1.createRequestSdk)({ config, request });
         const ctx = {
             user: null,
             workspace: null,
             workspaces: [],
             sdk,
-            tokens,
         };
         request.qelos = ctx;
-        const hasAuthMaterial = Boolean(config.apiToken || tokens.accessToken || tokens.refreshToken);
-        if (!hasAuthMaterial) {
+        const base = (0, proxy_target_1.resolveQelosProxyTarget)(config);
+        if (!base && !config.apiToken) {
             if (config.requireAuth) {
                 next(new common_1.UnauthorizedException());
                 return;
@@ -58,10 +52,56 @@ let QelosMiddleware = class QelosMiddleware {
             next();
             return;
         }
-        try {
-            ctx.user = await sdk.authentication.getLoggedInUser();
+        if (base) {
+            const headers = {};
+            const cookieHeader = request.headers.cookie;
+            const cookie = typeof cookieHeader === 'string'
+                ? cookieHeader
+                : Array.isArray(cookieHeader)
+                    ? cookieHeader.join('; ')
+                    : undefined;
+            if (cookie)
+                headers.cookie = cookie;
+            const rawAuth = request.headers.authorization;
+            const authHeader = Array.isArray(rawAuth) ? rawAuth[0] : rawAuth;
+            if (authHeader)
+                headers.authorization = authHeader;
+            const hostHeader = request.headers.host;
+            const originalHost = typeof hostHeader === 'string'
+                ? hostHeader
+                : Array.isArray(hostHeader)
+                    ? hostHeader[0]
+                    : undefined;
+            let upstream;
+            try {
+                upstream = await sdkFetch(buildMeUrl(base), {
+                    method: 'GET',
+                    headers,
+                    redirect: 'manual',
+                });
+            }
+            catch {
+                if (config.requireAuth) {
+                    next(new common_1.UnauthorizedException());
+                    return;
+                }
+                next();
+                return;
+            }
+            const setCookieValues = upstream.headers.getSetCookie?.() ?? [];
+            for (const value of setCookieValues) {
+                (0, request_utils_1.appendSetCookie)(response, (0, cookies_1.rewriteSetCookieDomain)(value, originalHost));
+            }
+            if (upstream.ok) {
+                try {
+                    ctx.user = (await upstream.json());
+                }
+                catch {
+                    ctx.user = null;
+                }
+            }
         }
-        catch {
+        if (!ctx.user) {
             if (config.requireAuth) {
                 next(new common_1.UnauthorizedException());
                 return;
@@ -75,18 +115,18 @@ let QelosMiddleware = class QelosMiddleware {
         catch {
             ctx.workspaces = [];
         }
-        if (ctx.user && ctx.workspaces.length) {
-            if (resolveWorkspace) {
-                ctx.workspace =
-                    (await resolveWorkspace({
-                        request,
-                        user: ctx.user,
-                        workspaces: ctx.workspaces,
-                    })) || null;
-            }
-            else {
-                ctx.workspace = ctx.workspaces[0] || null;
-            }
+        if (resolveWorkspace) {
+            ctx.workspace =
+                (await resolveWorkspace({
+                    request,
+                    user: ctx.user,
+                    workspaces: ctx.workspaces,
+                })) || null;
+        }
+        else {
+            ctx.workspace =
+                ctx.user.workspace ||
+                    null;
         }
         next();
     }

package/dist/middleware.js.map

@@ -1 +1 @@
-{"version":3,"file":"middleware.js","sourceRoot":"","sources":["../src/middleware.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAKwB;AACxB,2CAAmD;AACnD,+CAAiD;AACjD,mDAIyB;AAUlB,IAAM,eAAe,GAArB,MAAM,eAAe;IAC1B,YAEmB,OAA2B;QAA3B,YAAO,GAAP,OAAO,CAAoB;IAC3C,CAAC;IAEJ,KAAK,CAAC,GAAG,CAAC,GAAY,EAAE,GAAY,EAAE,IAA6B;QACjE,MAAM,OAAO,GAAG,GAAiB,CAAC;QAClC,MAAM,QAAQ,GAAG,GAAkB,CAAC;QACpC,MAAM,EAAE,MAAM,EAAE,gBAAgB,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC;QAClD,MAAM,cAAc,GAClB,IAAI,CAAC,OAAO,CAAC,cAAc;YAC3B,CAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE;gBACpC,IAAA,oCAAoB,EAAC,CAAC,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;YAC7C,CAAC,CAAC,CAAC;QAEL,IAAI,IAAA,0BAAU,EAAC,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC;YAChC,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QAED,MAAM,MAAM,GAAG,IAAA,0BAAU,EAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC3C,MAAM,GAAG,GAAG,IAAA,8BAAgB,EAAC;YAC3B,MAAM;YACN,MAAM;YACN,OAAO;YACP,QAAQ;YACR,cAAc;SACf,CAAC,CAAC;QAEH,MAAM,GAAG,GAAwB;YAC/B,IAAI,EAAE,IAAI;YACV,SAAS,EAAE,IAAI;YACf,UAAU,EAAE,EAAE;YACd,GAAG;YACH,MAAM;SACP,CAAC;QACF,OAAO,CAAC,KAAK,GAAG,GAAG,CAAC;QAEpB,MAAM,eAAe,GAAG,OAAO,CAC7B,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,YAAY,CAC7D,CAAC;QACF,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;gBACvB,IAAI,CAAC,IAAI,8BAAqB,EAAE,CAAC,CAAC;gBAClC,OAAO;YACT,CAAC;YACD,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,GAAG,CAAC,IAAI,GAAG,MAAM,GAAG,CAAC,cAAc,CAAC,eAAe,EAAE,CAAC;QACxD,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;gBACvB,IAAI,CAAC,IAAI,8BAAqB,EAAE,CAAC,CAAC;gBAClC,OAAO;YACT,CAAC;YACD,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,GAAG,CAAC,UAAU,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;QAClD,CAAC;QAAC,MAAM,CAAC;YACP,GAAG,CAAC,UAAU,GAAG,EAAE,CAAC;QACtB,CAAC;QAED,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC;YACtC,IAAI,gBAAgB,EAAE,CAAC;gBACrB,GAAG,CAAC,SAAS;oBACX,CAAC,MAAM,gBAAgB,CAAC;wBACtB,OAAO;wBACP,IAAI,EAAE,GAAG,CAAC,IAAI;wBACd,UAAU,EAAE,GAAG,CAAC,UAAU;qBAC3B,CAAC,CAAC,IAAI,IAAI,CAAC;YAChB,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,SAAS,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;YAC5C,CAAC;QACH,CAAC;QAED,IAAI,EAAE,CAAC;IACT,CAAC;CACF,CAAA;AAnFY,0CAAe;0BAAf,eAAe;IAD3B,IAAA,mBAAU,GAAE;IAGR,WAAA,IAAA,eAAM,EAAC,gCAAoB,CAAC,CAAA;;GAFpB,eAAe,CAmF3B"}
+{"version":3,"file":"middleware.js","sourceRoot":"","sources":["../src/middleware.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAKwB;AAGxB,2CAAmD;AACnD,uCAAmD;AACnD,iDAAyD;AACzD,mDAA8D;AAC9D,+CAAiD;AAQjD,SAAS,UAAU,CAAC,IAAY;IAC9B,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,SAAS,CAAC;AAC9C,CAAC;AAGM,IAAM,eAAe,GAArB,MAAM,eAAe;IAC1B,YAEmB,OAA2B;QAA3B,YAAO,GAAP,OAAO,CAAoB;IAC3C,CAAC;IAEJ,KAAK,CAAC,GAAG,CAAC,GAAY,EAAE,GAAY,EAAE,IAA6B;QACjE,MAAM,OAAO,GAAG,GAAiB,CAAC;QAClC,MAAM,QAAQ,GAAG,GAAkB,CAAC;QACpC,MAAM,EAAE,MAAM,EAAE,gBAAgB,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC;QAClD,MAAM,QAAQ,GAAG,CAAC,MAAM,CAAC,UAAU,EAAE,KAAK,IAAI,UAAU,CAAC,KAAK,CAA4B,CAAC;QAE3F,IAAI,IAAA,0BAAU,EAAC,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC;YAChC,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QAED,MAAM,GAAG,GAAG,IAAA,8BAAgB,EAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QAElD,MAAM,GAAG,GAAwB;YAC/B,IAAI,EAAE,IAAI;YACV,SAAS,EAAE,IAAI;YACf,UAAU,EAAE,EAAE;YACd,GAAG;SACJ,CAAC;QACF,OAAO,CAAC,KAAK,GAAG,GAAG,CAAC;QAEpB,MAAM,IAAI,GAAG,IAAA,sCAAuB,EAAC,MAAM,CAAC,CAAC;QAC7C,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;YAC9B,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;gBACvB,IAAI,CAAC,IAAI,8BAAqB,EAAE,CAAC,CAAC;gBAClC,OAAO;YACT,CAAC;YACD,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QAED,IAAI,IAAI,EAAE,CAAC;YACT,MAAM,OAAO,GAA2B,EAAE,CAAC;YAC3C,MAAM,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC;YAC5C,MAAM,MAAM,GACV,OAAO,YAAY,KAAK,QAAQ;gBAC9B,CAAC,CAAC,YAAY;gBACd,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC;oBAC3B,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC;oBACzB,CAAC,CAAC,SAAS,CAAC;YAClB,IAAI,MAAM;gBAAE,OAAO,CAAC,MAAM,GAAG,MAAM,CAAC;YACpC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC;YAC9C,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;YACjE,IAAI,UAAU;gBAAE,OAAO,CAAC,aAAa,GAAG,UAAU,CAAC;YAEnD,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC;YACxC,MAAM,YAAY,GAChB,OAAO,UAAU,KAAK,QAAQ;gBAC5B,CAAC,CAAC,UAAU;gBACZ,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC;oBACzB,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;oBACf,CAAC,CAAC,SAAS,CAAC;YAElB,IAAI,QAAyC,CAAC;YAC9C,IAAI,CAAC;gBACH,QAAQ,GAAG,MAAM,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE;oBAC1C,MAAM,EAAE,KAAK;oBACb,OAAO;oBACP,QAAQ,EAAE,QAAQ;iBACnB,CAAC,CAAC;YACL,CAAC;YAAC,MAAM,CAAC;gBACP,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;oBACvB,IAAI,CAAC,IAAI,8BAAqB,EAAE,CAAC,CAAC;oBAClC,OAAO;gBACT,CAAC;gBACD,IAAI,EAAE,CAAC;gBACP,OAAO;YACT,CAAC;YAED,MAAM,eAAe,GAAG,QAAQ,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,CAAC;YAChE,KAAK,MAAM,KAAK,IAAI,eAAe,EAAE,CAAC;gBACpC,IAAA,+BAAe,EAAC,QAAQ,EAAE,IAAA,gCAAsB,EAAC,KAAK,EAAE,YAAY,CAAC,CAAC,CAAC;YACzE,CAAC;YAED,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;gBAChB,IAAI,CAAC;oBACH,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAU,CAAC;gBAC9C,CAAC;gBAAC,MAAM,CAAC;oBACP,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;gBAClB,CAAC;YACH,CAAC;QACH,CAAC;QAED,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;YACd,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;gBACvB,IAAI,CAAC,IAAI,8BAAqB,EAAE,CAAC,CAAC;gBAClC,OAAO;YACT,CAAC;YACD,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,GAAG,CAAC,UAAU,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;QAClD,CAAC;QAAC,MAAM,CAAC;YACP,GAAG,CAAC,UAAU,GAAG,EAAE,CAAC;QACtB,CAAC;QAED,IAAI,gBAAgB,EAAE,CAAC;YACrB,GAAG,CAAC,SAAS;gBACX,CAAC,MAAM,gBAAgB,CAAC;oBACtB,OAAO;oBACP,IAAI,EAAE,GAAG,CAAC,IAAI;oBACd,UAAU,EAAE,GAAG,CAAC,UAAU;iBAC3B,CAAC,CAAC,IAAI,IAAI,CAAC;QAChB,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,SAAS;gBACV,GAAG,CAAC,IAAqD,CAAC,SAAS;oBACpE,IAAI,CAAC;QACT,CAAC;QAED,IAAI,EAAE,CAAC;IACT,CAAC;CACF,CAAA;AAvHY,0CAAe;0BAAf,eAAe;IAD3B,IAAA,mBAAU,GAAE;IAGR,WAAA,IAAA,eAAM,EAAC,gCAAoB,CAAC,CAAA;;GAFpB,eAAe,CAuH3B"}

package/dist/module-options.d.ts

@@ -3,5 +3,8 @@ import type { QelosModuleOptions, QelosNestConfig } from './types';
  * `forRoot` / `forRootAsync` accept either a full {@link QelosModuleOptions}
  * object or a shorthand {@link QelosNestConfig} (same shape as Express
  * `createQelosMiddleware({ config })`).
+ *
+ * When `disableProxy` is not `true`, `/api/` is prepended to `skipPaths` so
+ * the user resolver does not shadow the `/api/**` proxy.
  */
 export declare function normalizeModuleOptions(input: QelosNestConfig | QelosModuleOptions): QelosModuleOptions;

package/dist/module-options.js

@@ -1,12 +1,25 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.normalizeModuleOptions = normalizeModuleOptions;
+function applyProxySkipPaths(config) {
+    if (config.disableProxy === true)
+        return config;
+    const existingSkipPaths = config.skipPaths ?? [];
+    const alreadyCovered = existingSkipPaths.some((prefix) => '/api/'.startsWith(prefix));
+    if (alreadyCovered)
+        return config;
+    return { ...config, skipPaths: ['/api/', ...existingSkipPaths] };
+}
 /**
  * `forRoot` / `forRootAsync` accept either a full {@link QelosModuleOptions}
  * object or a shorthand {@link QelosNestConfig} (same shape as Express
  * `createQelosMiddleware({ config })`).
+ *
+ * When `disableProxy` is not `true`, `/api/` is prepended to `skipPaths` so
+ * the user resolver does not shadow the `/api/**` proxy.
  */
 function normalizeModuleOptions(input) {
+    let wrapped;
     if (input !== null &&
         typeof input === 'object' &&
         'config' in input &&
@@ -14,8 +27,14 @@ function normalizeModuleOptions(input) {
         typeof input.config === 'object' &&
         input.config !== null &&
         'appUrl' in input.config) {
-        return input;
+        wrapped = input;
+    }
+    else {
+        wrapped = { config: input };
     }
-    return { config: input };
+    const mergedConfig = applyProxySkipPaths(wrapped.config);
+    if (mergedConfig === wrapped.config)
+        return wrapped;
+    return { ...wrapped, config: mergedConfig };
 }
 //# sourceMappingURL=module-options.js.map

package/dist/module-options.js.map

@@ -1 +1 @@
-{"version":3,"file":"module-options.js","sourceRoot":"","sources":["../src/module-options.ts"],"names":[],"mappings":";;AAOA,wDAeC;AApBD;;;;GAIG;AACH,SAAgB,sBAAsB,CACpC,KAA2C;IAE3C,IACE,KAAK,KAAK,IAAI;QACd,OAAO,KAAK,KAAK,QAAQ;QACzB,QAAQ,IAAI,KAAK;QAChB,KAA4B,CAAC,MAAM,KAAK,SAAS;QAClD,OAAQ,KAA4B,CAAC,MAAM,KAAK,QAAQ;QACvD,KAA4B,CAAC,MAAM,KAAK,IAAI;QAC7C,QAAQ,IAAK,KAA4B,CAAC,MAAM,EAChD,CAAC;QACD,OAAO,KAA2B,CAAC;IACrC,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,KAAwB,EAAE,CAAC;AAC9C,CAAC"}
+{"version":3,"file":"module-options.js","sourceRoot":"","sources":["../src/module-options.ts"],"names":[],"mappings":";;AAoBA,wDAoBC;AAtCD,SAAS,mBAAmB,CAAC,MAAuB;IAClD,IAAI,MAAM,CAAC,YAAY,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC;IAChD,MAAM,iBAAiB,GAAG,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC;IACjD,MAAM,cAAc,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CACvD,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,CAC3B,CAAC;IACF,IAAI,cAAc;QAAE,OAAO,MAAM,CAAC;IAClC,OAAO,EAAE,GAAG,MAAM,EAAE,SAAS,EAAE,CAAC,OAAO,EAAE,GAAG,iBAAiB,CAAC,EAAE,CAAC;AACnE,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,sBAAsB,CACpC,KAA2C;IAE3C,IAAI,OAA2B,CAAC;IAChC,IACE,KAAK,KAAK,IAAI;QACd,OAAO,KAAK,KAAK,QAAQ;QACzB,QAAQ,IAAI,KAAK;QAChB,KAA4B,CAAC,MAAM,KAAK,SAAS;QAClD,OAAQ,KAA4B,CAAC,MAAM,KAAK,QAAQ;QACvD,KAA4B,CAAC,MAAM,KAAK,IAAI;QAC7C,QAAQ,IAAK,KAA4B,CAAC,MAAM,EAChD,CAAC;QACD,OAAO,GAAG,KAA2B,CAAC;IACxC,CAAC;SAAM,CAAC;QACN,OAAO,GAAG,EAAE,MAAM,EAAE,KAAwB,EAAE,CAAC;IACjD,CAAC;IACD,MAAM,YAAY,GAAG,mBAAmB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACzD,IAAI,YAAY,KAAK,OAAO,CAAC,MAAM;QAAE,OAAO,OAAO,CAAC;IACpD,OAAO,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;AAC9C,CAAC"}

package/dist/module.d.ts

@@ -10,6 +10,8 @@ export interface QelosOptionsFactory {
     createQelosOptions(): Promise<QelosNestConfig | QelosModuleOptions> | QelosNestConfig | QelosModuleOptions;
 }
 export declare class QelosModule implements NestModule {
+    private readonly moduleOptions;
+    constructor(moduleOptions: QelosModuleOptions);
     private static readonly sdkProvider;
     /**
      * Register the module with statically-known options.
@@ -17,9 +19,10 @@ export declare class QelosModule implements NestModule {
      * Pass either a full {@link QelosModuleOptions} object or a shorthand
      * {@link QelosNestConfig} (e.g. `{ appUrl, apiToken }`).
      *
-     * The middleware is wired to `forRoutes('*')` by default. Override by
-     * importing the module without `forRoot` and applying `QelosMiddleware`
-     * directly inside your own `MiddlewareConsumer`.
+     * By default, {@link QelosMiddleware} runs on `forRoutes('*')` and
+     * {@link QelosProxyMiddleware} on `api/*splat` unless `disableProxy: true`.
+     * Override by importing the module without `forRoot` and applying the
+     * middlewares yourself in `MiddlewareConsumer`.
      */
     static forRoot(config: QelosNestConfig): DynamicModule;
     static forRoot(options: QelosModuleOptions): DynamicModule;

package/dist/module.js

@@ -5,6 +5,12 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
     else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
     return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
 var QelosModule_1;
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.QelosModule = void 0;
@@ -13,7 +19,11 @@ const core_1 = require("@nestjs/core");
 const constants_1 = require("./constants");
 const module_options_1 = require("./module-options");
 const middleware_1 = require("./middleware");
+const proxy_middleware_1 = require("./proxy.middleware");
 let QelosModule = QelosModule_1 = class QelosModule {
+    constructor(moduleOptions) {
+        this.moduleOptions = moduleOptions;
+    }
     static forRoot(configOrOptions) {
         const options = (0, module_options_1.normalizeModuleOptions)(configOrOptions);
         const optionsProvider = {
@@ -22,8 +32,18 @@ let QelosModule = QelosModule_1 = class QelosModule {
         };
         return {
             module: QelosModule_1,
-            providers: [optionsProvider, middleware_1.QelosMiddleware, QelosModule_1.sdkProvider],
-            exports: [optionsProvider, middleware_1.QelosMiddleware, constants_1.QELOS_SDK],
+            providers: [
+                optionsProvider,
+                middleware_1.QelosMiddleware,
+                proxy_middleware_1.QelosProxyMiddleware,
+                QelosModule_1.sdkProvider,
+            ],
+            exports: [
+                optionsProvider,
+                middleware_1.QelosMiddleware,
+                proxy_middleware_1.QelosProxyMiddleware,
+                constants_1.QELOS_SDK,
+            ],
             global: true,
         };
     }
@@ -35,13 +55,19 @@ let QelosModule = QelosModule_1 = class QelosModule {
         const providers = [
             ...this.createAsyncProviders(options),
             middleware_1.QelosMiddleware,
+            proxy_middleware_1.QelosProxyMiddleware,
             QelosModule_1.sdkProvider,
         ];
         return {
             module: QelosModule_1,
             imports: options.imports || [],
             providers,
-            exports: [constants_1.QELOS_MODULE_OPTIONS, middleware_1.QelosMiddleware, constants_1.QELOS_SDK],
+            exports: [
+                constants_1.QELOS_MODULE_OPTIONS,
+                middleware_1.QelosMiddleware,
+                proxy_middleware_1.QelosProxyMiddleware,
+                constants_1.QELOS_SDK,
+            ],
             global: true,
         };
     }
@@ -73,6 +99,12 @@ let QelosModule = QelosModule_1 = class QelosModule {
     }
     configure(consumer) {
         consumer.apply(middleware_1.QelosMiddleware).forRoutes('*');
+        if (this.moduleOptions.config.disableProxy !== true) {
+            consumer.apply(proxy_middleware_1.QelosProxyMiddleware).forRoutes({
+                path: 'api/*splat',
+                method: common_1.RequestMethod.ALL,
+            });
+        }
     }
 };
 exports.QelosModule = QelosModule;
@@ -83,6 +115,8 @@ QelosModule.sdkProvider = {
     inject: [core_1.REQUEST],
 };
 exports.QelosModule = QelosModule = QelosModule_1 = __decorate([
-    (0, common_1.Module)({})
+    (0, common_1.Module)({}),
+    __param(0, (0, common_1.Inject)(constants_1.QELOS_MODULE_OPTIONS)),
+    __metadata("design:paramtypes", [Object])
 ], QelosModule);
 //# sourceMappingURL=module.js.map

package/dist/module.js.map

@@ -1 +1 @@
-{"version":3,"file":"module.js","sourceRoot":"","sources":["../src/module.ts"],"names":[],"mappings":";;;;;;;;;;AAAA,2CAUwB;AACxB,uCAAuC;AACvC,2CAA8D;AAC9D,qDAA0D;AAC1D,6CAA+C;AAwBxC,IAAM,WAAW,mBAAjB,MAAM,WAAW;IAoBtB,MAAM,CAAC,OAAO,CAAC,eAAqD;QAClE,MAAM,OAAO,GAAG,IAAA,uCAAsB,EAAC,eAAe,CAAC,CAAC;QACxD,MAAM,eAAe,GAAa;YAChC,OAAO,EAAE,gCAAoB;YAC7B,QAAQ,EAAE,OAAO;SAClB,CAAC;QACF,OAAO;YACL,MAAM,EAAE,aAAW;YACnB,SAAS,EAAE,CAAC,eAAe,EAAE,4BAAe,EAAE,aAAW,CAAC,WAAW,CAAC;YACtE,OAAO,EAAE,CAAC,eAAe,EAAE,4BAAe,EAAE,qBAAS,CAAC;YACtD,MAAM,EAAE,IAAI;SACb,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,MAAM,CAAC,YAAY,CAAC,OAAgC;QAClD,MAAM,SAAS,GAAe;YAC5B,GAAG,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC;YACrC,4BAAe;YACf,aAAW,CAAC,WAAW;SACxB,CAAC;QACF,OAAO;YACL,MAAM,EAAE,aAAW;YACnB,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,EAAE;YAC9B,SAAS;YACT,OAAO,EAAE,CAAC,gCAAoB,EAAE,4BAAe,EAAE,qBAAS,CAAC;YAC3D,MAAM,EAAE,IAAI;SACb,CAAC;IACJ,CAAC;IAEO,MAAM,CAAC,oBAAoB,CACjC,OAAgC;QAEhC,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;YACvB,MAAM,eAAe,GAAwC;gBAC3D,OAAO,EAAE,gCAAoB;gBAC7B,UAAU,EAAE,KAAK,EAAE,GAAG,IAAe,EAAE,EAAE,CACvC,IAAA,uCAAsB,EAAC,MAAM,OAAO,CAAC,UAAW,CAAC,GAAG,IAAI,CAAC,CAAC;gBAC5D,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,EAAE;aAC7B,CAAC;YACF,OAAO,CAAC,eAAe,CAAC,CAAC;QAC3B,CAAC;QACD,MAAM,YAAY,GAAG,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC,QAAQ,CAAC;QAC7D,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CACb,mFAAmF,CACpF,CAAC;QACJ,CAAC;QACD,MAAM,eAAe,GAAwC;YAC3D,OAAO,EAAE,gCAAoB;YAC7B,UAAU,EAAE,KAAK,EAAE,OAA4B,EAAE,EAAE,CACjD,IAAA,uCAAsB,EAAC,MAAM,OAAO,CAAC,kBAAkB,EAAE,CAAC;YAC5D,MAAM,EAAE,CAAC,YAAY,CAAC;SACvB,CAAC;QACF,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;YACrB,OAAO;gBACL,eAAe;gBACf,EAAE,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,YAAY,EAAc;aAC9D,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,eAAe,CAAC,CAAC;IAC3B,CAAC;IAED,SAAS,CAAC,QAA4B;QACpC,QAAQ,CAAC,KAAK,CAAC,4BAAe,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IACjD,CAAC;;AAxFU,kCAAW;AACE,uBAAW,GAAa;IAC9C,OAAO,EAAE,qBAAS;IAClB,KAAK,EAAE,cAAK,CAAC,OAAO;IACpB,UAAU,EAAE,CAAC,OAAmB,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG;IACvD,MAAM,EAAE,CAAC,cAAO,CAAC;CAClB,AALkC,CAKjC;sBANS,WAAW;IADvB,IAAA,eAAM,EAAC,EAAE,CAAC;GACE,WAAW,CAyFvB"}
+{"version":3,"file":"module.js","sourceRoot":"","sources":["../src/module.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,2CAYwB;AACxB,uCAAuC;AACvC,2CAA8D;AAC9D,qDAA0D;AAC1D,6CAA+C;AAC/C,yDAA0D;AAwBnD,IAAM,WAAW,mBAAjB,MAAM,WAAW;IACtB,YAEmB,aAAiC;QAAjC,kBAAa,GAAb,aAAa,CAAoB;IACjD,CAAC;IAsBJ,MAAM,CAAC,OAAO,CAAC,eAAqD;QAClE,MAAM,OAAO,GAAG,IAAA,uCAAsB,EAAC,eAAe,CAAC,CAAC;QACxD,MAAM,eAAe,GAAa;YAChC,OAAO,EAAE,gCAAoB;YAC7B,QAAQ,EAAE,OAAO;SAClB,CAAC;QACF,OAAO;YACL,MAAM,EAAE,aAAW;YACnB,SAAS,EAAE;gBACT,eAAe;gBACf,4BAAe;gBACf,uCAAoB;gBACpB,aAAW,CAAC,WAAW;aACxB;YACD,OAAO,EAAE;gBACP,eAAe;gBACf,4BAAe;gBACf,uCAAoB;gBACpB,qBAAS;aACV;YACD,MAAM,EAAE,IAAI;SACb,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,MAAM,CAAC,YAAY,CAAC,OAAgC;QAClD,MAAM,SAAS,GAAe;YAC5B,GAAG,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC;YACrC,4BAAe;YACf,uCAAoB;YACpB,aAAW,CAAC,WAAW;SACxB,CAAC;QACF,OAAO;YACL,MAAM,EAAE,aAAW;YACnB,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,EAAE;YAC9B,SAAS;YACT,OAAO,EAAE;gBACP,gCAAoB;gBACpB,4BAAe;gBACf,uCAAoB;gBACpB,qBAAS;aACV;YACD,MAAM,EAAE,IAAI;SACb,CAAC;IACJ,CAAC;IAEO,MAAM,CAAC,oBAAoB,CACjC,OAAgC;QAEhC,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;YACvB,MAAM,eAAe,GAAwC;gBAC3D,OAAO,EAAE,gCAAoB;gBAC7B,UAAU,EAAE,KAAK,EAAE,GAAG,IAAe,EAAE,EAAE,CACvC,IAAA,uCAAsB,EAAC,MAAM,OAAO,CAAC,UAAW,CAAC,GAAG,IAAI,CAAC,CAAC;gBAC5D,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,EAAE;aAC7B,CAAC;YACF,OAAO,CAAC,eAAe,CAAC,CAAC;QAC3B,CAAC;QACD,MAAM,YAAY,GAAG,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC,QAAQ,CAAC;QAC7D,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CACb,mFAAmF,CACpF,CAAC;QACJ,CAAC;QACD,MAAM,eAAe,GAAwC;YAC3D,OAAO,EAAE,gCAAoB;YAC7B,UAAU,EAAE,KAAK,EAAE,OAA4B,EAAE,EAAE,CACjD,IAAA,uCAAsB,EAAC,MAAM,OAAO,CAAC,kBAAkB,EAAE,CAAC;YAC5D,MAAM,EAAE,CAAC,YAAY,CAAC;SACvB,CAAC;QACF,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;YACrB,OAAO;gBACL,eAAe;gBACf,EAAE,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,YAAY,EAAc;aAC9D,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,eAAe,CAAC,CAAC;IAC3B,CAAC;IAED,SAAS,CAAC,QAA4B;QACpC,QAAQ,CAAC,KAAK,CAAC,4BAAe,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QAC/C,IAAI,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,YAAY,KAAK,IAAI,EAAE,CAAC;YACpD,QAAQ,CAAC,KAAK,CAAC,uCAAoB,CAAC,CAAC,SAAS,CAAC;gBAC7C,IAAI,EAAE,YAAY;gBAClB,MAAM,EAAE,sBAAa,CAAC,GAAG;aAC1B,CAAC,CAAC;QACL,CAAC;IACH,CAAC;;AApHU,kCAAW;AAME,uBAAW,GAAa;IAC9C,OAAO,EAAE,qBAAS;IAClB,KAAK,EAAE,cAAK,CAAC,OAAO;IACpB,UAAU,EAAE,CAAC,OAAmB,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG;IACvD,MAAM,EAAE,CAAC,cAAO,CAAC;CAClB,AALkC,CAKjC;sBAXS,WAAW;IADvB,IAAA,eAAM,EAAC,EAAE,CAAC;IAGN,WAAA,IAAA,eAAM,EAAC,gCAAoB,CAAC,CAAA;;GAFpB,WAAW,CAqHvB"}

package/dist/proxy-target.d.ts

@@ -0,0 +1,17 @@
+import type { QelosNestConfig } from './types';
+/**
+ * Resolve the origin to which `/api/**` requests are proxied. The managed
+ * Qelos app URL (`config.appUrl`) is the proxy target — env vars are only
+ * dev-time overrides when the configured `appUrl` is not reachable from
+ * the local host.
+ *
+ * Priority (highest first):
+ *   1. `process.env.QELOS_PROXY_TARGET`
+ *   2. `process.env.QELOS_IP`
+ *   3. `process.env.QELOS_API_IP`
+ *   4. `config.appUrl`
+ *
+ * Empty / whitespace-only values are skipped, and `undefined` is returned when
+ * nothing is configured so the caller can surface a clear error.
+ */
+export declare function resolveQelosProxyTarget(config: QelosNestConfig): string | undefined;

package/dist/proxy-target.js

@@ -0,0 +1,29 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveQelosProxyTarget = resolveQelosProxyTarget;
+/**
+ * Resolve the origin to which `/api/**` requests are proxied. The managed
+ * Qelos app URL (`config.appUrl`) is the proxy target — env vars are only
+ * dev-time overrides when the configured `appUrl` is not reachable from
+ * the local host.
+ *
+ * Priority (highest first):
+ *   1. `process.env.QELOS_PROXY_TARGET`
+ *   2. `process.env.QELOS_IP`
+ *   3. `process.env.QELOS_API_IP`
+ *   4. `config.appUrl`
+ *
+ * Empty / whitespace-only values are skipped, and `undefined` is returned when
+ * nothing is configured so the caller can surface a clear error.
+ */
+function resolveQelosProxyTarget(config) {
+    const env = process.env;
+    const fromEnv = env.QELOS_PROXY_TARGET?.trim() ||
+        env.QELOS_IP?.trim() ||
+        env.QELOS_API_IP?.trim();
+    if (fromEnv)
+        return fromEnv;
+    const fromAppUrl = config.appUrl?.trim();
+    return fromAppUrl || undefined;
+}
+//# sourceMappingURL=proxy-target.js.map

package/dist/proxy-target.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"proxy-target.js","sourceRoot":"","sources":["../src/proxy-target.ts"],"names":[],"mappings":";;AAiBA,0DAYC;AA3BD;;;;;;;;;;;;;;GAcG;AACH,SAAgB,uBAAuB,CACrC,MAAuB;IAEvB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;IACxB,MAAM,OAAO,GACX,GAAG,CAAC,kBAAkB,EAAE,IAAI,EAAE;QAC9B,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE;QACpB,GAAG,CAAC,YAAY,EAAE,IAAI,EAAE,CAAC;IAC3B,IAAI,OAAO;QAAE,OAAO,OAAO,CAAC;IAE5B,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC;IACzC,OAAO,UAAU,IAAI,SAAS,CAAC;AACjC,CAAC"}

package/dist/proxy-target.test.d.ts

@@ -0,0 +1 @@
+export {};