@qelos/integrator-next 4.0.0 → 4.1.0

package/dist/env-config.js

@@ -7,11 +7,11 @@
  * Recognized variables:
  *
  * - `QELOS_APP_URL` (required) — Qelos backend base URL.
- * - `QELOS_API_TOKEN` — service-to-service token (skips refresh logic).
- * - `QELOS_ACCESS_TOKEN_COOKIE` — defaults to `q_access_token`.
- * - `QELOS_REFRESH_TOKEN_COOKIE` — defaults to `q_refresh_token`.
+ * - `QELOS_API_TOKEN` — service-to-service token (skips cookie identity).
  * - `QELOS_REQUIRE_AUTH` — `"true"` to reject anonymous requests.
  * - `QELOS_SKIP_PATHS` — comma-separated path prefixes to bypass.
+ * - `QELOS_DISABLE_PROXY` — `"true"` to disable auto `/api/` skip in middleware
+ *   (when you are not using the BFF catch-all proxy).
  */
 export function loadQelosConfigFromEnv(env = process.env) {
     const appUrl = env.QELOS_APP_URL;
@@ -23,13 +23,12 @@ export function loadQelosConfigFromEnv(env = process.env) {
     const config = { appUrl };
     if (env.QELOS_API_TOKEN)
         config.apiToken = env.QELOS_API_TOKEN;
-    if (env.QELOS_ACCESS_TOKEN_COOKIE)
-        config.accessTokenCookie = env.QELOS_ACCESS_TOKEN_COOKIE;
-    if (env.QELOS_REFRESH_TOKEN_COOKIE)
-        config.refreshTokenCookie = env.QELOS_REFRESH_TOKEN_COOKIE;
     if (env.QELOS_REQUIRE_AUTH === 'true' || env.QELOS_REQUIRE_AUTH === '1') {
         config.requireAuth = true;
     }
+    if (env.QELOS_DISABLE_PROXY === 'true' || env.QELOS_DISABLE_PROXY === '1') {
+        config.disableProxy = true;
+    }
     if (env.QELOS_SKIP_PATHS) {
         config.skipPaths = env.QELOS_SKIP_PATHS.split(',')
             .map((p) => p.trim())

package/dist/env-config.js.map

@@ -1 +1 @@
-{"version":3,"file":"env-config.js","sourceRoot":"","sources":["../src/env-config.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,sBAAsB,CAAC,MAAyB,OAAO,CAAC,GAAG;IACzE,MAAM,MAAM,GAAG,GAAG,CAAC,aAAa,CAAC;IACjC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CACb,2EAA2E;YACzE,0EAA0E;YAC1E,4DAA4D,CAC/D,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAoB,EAAE,MAAM,EAAE,CAAC;IAC3C,IAAI,GAAG,CAAC,eAAe;QAAE,MAAM,CAAC,QAAQ,GAAG,GAAG,CAAC,eAAe,CAAC;IAC/D,IAAI,GAAG,CAAC,yBAAyB;QAAE,MAAM,CAAC,iBAAiB,GAAG,GAAG,CAAC,yBAAyB,CAAC;IAC5F,IAAI,GAAG,CAAC,0BAA0B;QAAE,MAAM,CAAC,kBAAkB,GAAG,GAAG,CAAC,0BAA0B,CAAC;IAC/F,IAAI,GAAG,CAAC,kBAAkB,KAAK,MAAM,IAAI,GAAG,CAAC,kBAAkB,KAAK,GAAG,EAAE,CAAC;QACxE,MAAM,CAAC,WAAW,GAAG,IAAI,CAAC;IAC5B,CAAC;IACD,IAAI,GAAG,CAAC,gBAAgB,EAAE,CAAC;QACzB,MAAM,CAAC,SAAS,GAAG,GAAG,CAAC,gBAAgB,CAAC,KAAK,CAAC,GAAG,CAAC;aAC/C,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;aACpB,MAAM,CAAC,OAAO,CAAC,CAAC;IACrB,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,IAAI,YAAY,GAA2B,IAAI,CAAC;AAEhD;;;;GAIG;AACH,MAAM,UAAU,qBAAqB;IACnC,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,YAAY,GAAG,sBAAsB,EAAE,CAAC;IAC1C,CAAC;IACD,OAAO,YAAY,CAAC;AACtB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,yBAAyB;IACvC,YAAY,GAAG,IAAI,CAAC;AACtB,CAAC"}
+{"version":3,"file":"env-config.js","sourceRoot":"","sources":["../src/env-config.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,sBAAsB,CAAC,MAAyB,OAAO,CAAC,GAAG;IACzE,MAAM,MAAM,GAAG,GAAG,CAAC,aAAa,CAAC;IACjC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CACb,2EAA2E;YACzE,0EAA0E;YAC1E,4DAA4D,CAC/D,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAoB,EAAE,MAAM,EAAE,CAAC;IAC3C,IAAI,GAAG,CAAC,eAAe;QAAE,MAAM,CAAC,QAAQ,GAAG,GAAG,CAAC,eAAe,CAAC;IAC/D,IAAI,GAAG,CAAC,kBAAkB,KAAK,MAAM,IAAI,GAAG,CAAC,kBAAkB,KAAK,GAAG,EAAE,CAAC;QACxE,MAAM,CAAC,WAAW,GAAG,IAAI,CAAC;IAC5B,CAAC;IACD,IAAI,GAAG,CAAC,mBAAmB,KAAK,MAAM,IAAI,GAAG,CAAC,mBAAmB,KAAK,GAAG,EAAE,CAAC;QAC1E,MAAM,CAAC,YAAY,GAAG,IAAI,CAAC;IAC7B,CAAC;IACD,IAAI,GAAG,CAAC,gBAAgB,EAAE,CAAC;QACzB,MAAM,CAAC,SAAS,GAAG,GAAG,CAAC,gBAAgB,CAAC,KAAK,CAAC,GAAG,CAAC;aAC/C,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;aACpB,MAAM,CAAC,OAAO,CAAC,CAAC;IACrB,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,IAAI,YAAY,GAA2B,IAAI,CAAC;AAEhD;;;;GAIG;AACH,MAAM,UAAU,qBAAqB;IACnC,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,YAAY,GAAG,sBAAsB,EAAE,CAAC;IAC1C,CAAC;IACD,OAAO,YAAY,CAAC;AACtB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,yBAAyB;IACvC,YAAY,GAAG,IAAI,CAAC;AACtB,CAAC"}

package/dist/index.d.ts

@@ -1,8 +1,11 @@
-export { createQelosMiddleware, qelosMiddleware, type CreateMiddlewareOptions, type MiddlewareRefreshTarget, type PendingCookie, type QelosMiddleware, } from './middleware';
+export { createQelosMiddleware, qelosMiddleware, type CreateMiddlewareOptions, type QelosMiddleware, } from './middleware';
 export { loadQelosConfigFromEnv, getDefaultQelosConfig, } from './env-config';
-export { createRequestSdk, type CreateSdkParams, } from './sdk-factory';
+export { createRequestSdk, type CreateSdkParams } from './sdk-factory';
 export { getQelosContext, withQelosContext, runWithQelosContext, getStoredQelosContext, requireQelosUser, type GetQelosContextOptions, } from './context';
 export { withQelosApi, withQelosSSR, requireQelosApiUser, type PagesIntegratorOptions, } from './pages';
 export { withQelosRoute, type AppRouteHandler, type QelosAppRouteHandler, } from './route';
-export { QELOS_USER_HEADER, QELOS_WORKSPACE_HEADER, type QelosNextConfig, type QelosRequestContext, type QelosTokenPair, type ResolvedTokens, type TokenRefreshContext, type TokenRefreshHook, } from './types';
+export { QELOS_USER_HEADER, QELOS_WORKSPACE_HEADER, type QelosNextConfig, type QelosRequestContext, } from './types';
+export { rewriteSetCookieDomain, rewriteSetCookieDomains } from './cookies';
+export { resolveQelosProxyTarget } from './proxy-target';
+export { createQelosApiProxyHandlers } from './runtime/api-proxy';
 export { completeSocialAuthCallback, applySocialAuthCookiesToServerResponse, getSocialAuthSetCookieParts, parseSocialCallbackRefreshToken, type SocialAuthCallbackPayload, type SocialCallbackInput, } from './social-auth';

package/dist/index.js

@@ -1,9 +1,12 @@
 export { createQelosMiddleware, qelosMiddleware, } from './middleware';
 export { loadQelosConfigFromEnv, getDefaultQelosConfig, } from './env-config';
-export { createRequestSdk, } from './sdk-factory';
+export { createRequestSdk } from './sdk-factory';
 export { getQelosContext, withQelosContext, runWithQelosContext, getStoredQelosContext, requireQelosUser, } from './context';
 export { withQelosApi, withQelosSSR, requireQelosApiUser, } from './pages';
 export { withQelosRoute, } from './route';
 export { QELOS_USER_HEADER, QELOS_WORKSPACE_HEADER, } from './types';
+export { rewriteSetCookieDomain, rewriteSetCookieDomains } from './cookies';
+export { resolveQelosProxyTarget } from './proxy-target';
+export { createQelosApiProxyHandlers } from './runtime/api-proxy';
 export { completeSocialAuthCallback, applySocialAuthCookiesToServerResponse, getSocialAuthSetCookieParts, parseSocialCallbackRefreshToken, } from './social-auth';
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,qBAAqB,EACrB,eAAe,GAKhB,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,sBAAsB,EACtB,qBAAqB,GACtB,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,gBAAgB,GAEjB,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,eAAe,EACf,gBAAgB,EAChB,mBAAmB,EACnB,qBAAqB,EACrB,gBAAgB,GAEjB,MAAM,WAAW,CAAC;AAEnB,OAAO,EACL,YAAY,EACZ,YAAY,EACZ,mBAAmB,GAEpB,MAAM,SAAS,CAAC;AAEjB,OAAO,EACL,cAAc,GAGf,MAAM,SAAS,CAAC;AAEjB,OAAO,EACL,iBAAiB,EACjB,sBAAsB,GAOvB,MAAM,SAAS,CAAC;AAEjB,OAAO,EACL,0BAA0B,EAC1B,sCAAsC,EACtC,2BAA2B,EAC3B,+BAA+B,GAGhC,MAAM,eAAe,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,qBAAqB,EACrB,eAAe,GAGhB,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,sBAAsB,EACtB,qBAAqB,GACtB,MAAM,cAAc,CAAC;AAEtB,OAAO,EAAE,gBAAgB,EAAwB,MAAM,eAAe,CAAC;AAEvE,OAAO,EACL,eAAe,EACf,gBAAgB,EAChB,mBAAmB,EACnB,qBAAqB,EACrB,gBAAgB,GAEjB,MAAM,WAAW,CAAC;AAEnB,OAAO,EACL,YAAY,EACZ,YAAY,EACZ,mBAAmB,GAEpB,MAAM,SAAS,CAAC;AAEjB,OAAO,EACL,cAAc,GAGf,MAAM,SAAS,CAAC;AAEjB,OAAO,EACL,iBAAiB,EACjB,sBAAsB,GAGvB,MAAM,SAAS,CAAC;AAEjB,OAAO,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,MAAM,WAAW,CAAC;AAC5E,OAAO,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AACzD,OAAO,EAAE,2BAA2B,EAAE,MAAM,qBAAqB,CAAC;AAElE,OAAO,EACL,0BAA0B,EAC1B,sCAAsC,EACtC,2BAA2B,EAC3B,+BAA+B,GAGhC,MAAM,eAAe,CAAC"}

package/dist/me-client.d.ts

@@ -0,0 +1,15 @@
+import type { IUser } from '@qelos/sdk/dist/authentication';
+export declare function buildMeUrl(base: string): string;
+export interface FetchMeIdentityParams {
+    base: string;
+    cookie?: string;
+    authorization?: string;
+}
+/**
+ * Server-side `GET /api/me` against Qelos with inbound auth material forwarded.
+ * Does not rewrite `Set-Cookie`; callers apply {@link rewriteSetCookieDomain}.
+ */
+export declare function fetchMeIdentity(params: FetchMeIdentityParams): Promise<{
+    response: Response;
+    user: IUser | null;
+}>;

package/dist/me-client.js

@@ -0,0 +1,35 @@
+export function buildMeUrl(base) {
+    return `${base.replace(/\/+$/, '')}/api/me`;
+}
+/**
+ * Server-side `GET /api/me` against Qelos with inbound auth material forwarded.
+ * Does not rewrite `Set-Cookie`; callers apply {@link rewriteSetCookieDomain}.
+ */
+export async function fetchMeIdentity(params) {
+    const headers = {};
+    if (params.cookie)
+        headers.cookie = params.cookie;
+    if (params.authorization)
+        headers.authorization = params.authorization;
+    let response;
+    try {
+        response = await fetch(buildMeUrl(params.base), {
+            method: 'GET',
+            headers,
+            redirect: 'manual',
+        });
+    }
+    catch {
+        return { response: new Response(null, { status: 502 }), user: null };
+    }
+    if (!response.ok) {
+        return { response, user: null };
+    }
+    try {
+        return { response, user: (await response.json()) };
+    }
+    catch {
+        return { response, user: null };
+    }
+}
+//# sourceMappingURL=me-client.js.map

package/dist/me-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"me-client.js","sourceRoot":"","sources":["../src/me-client.ts"],"names":[],"mappings":"AAEA,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,SAAS,CAAC;AAC9C,CAAC;AAQD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,MAA6B;IAE7B,MAAM,OAAO,GAA2B,EAAE,CAAC;IAC3C,IAAI,MAAM,CAAC,MAAM;QAAE,OAAO,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;IAClD,IAAI,MAAM,CAAC,aAAa;QAAE,OAAO,CAAC,aAAa,GAAG,MAAM,CAAC,aAAa,CAAC;IAEvE,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE;YAC9C,MAAM,EAAE,KAAK;YACb,OAAO;YACP,QAAQ,EAAE,QAAQ;SACnB,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,QAAQ,EAAE,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACvE,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAClC,CAAC;IAED,IAAI,CAAC;QACH,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAU,EAAE,CAAC;IAC9D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAClC,CAAC;AACH,CAAC"}

package/dist/middleware.d.ts

@@ -1,38 +1,13 @@
 import { NextResponse, type NextRequest } from 'next/server';
 import type { IUser } from '@qelos/sdk/dist/authentication';
 import type { IWorkspace } from '@qelos/sdk/workspaces';
-import type { QelosNextConfig, TokenRefreshHook } from './types';
-export interface PendingCookie {
-    name: string;
-    value: string;
-    options: {
-        httpOnly: boolean;
-        secure: boolean;
-        sameSite: 'lax' | 'strict' | 'none';
-        path: string;
-    };
-}
-/**
- * Carrier passed to the App Router middleware token-refresh hook. Cookies
- * pushed onto `pendingCookies` are written to the outbound `NextResponse`
- * after identification completes — Next.js does not let us mutate the
- * response headers after `NextResponse.next()` has been constructed, so we
- * stage them here and flush them once the response object exists.
- */
-export interface MiddlewareRefreshTarget {
-    req: NextRequest;
-    pendingCookies: PendingCookie[];
-}
+import type { QelosNextConfig } from './types';
 export interface CreateMiddlewareOptions {
     config: QelosNextConfig;
     /**
-     * Hook invoked after a successful token refresh. The default implementation
-     * stages new cookies for the outbound response.
-     */
-    onTokenRefresh?: TokenRefreshHook<MiddlewareRefreshTarget>;
-    /**
-     * Resolve the active workspace for a request. Defaults to picking the first
-     * workspace returned from `sdk.workspaces.getList()`.
+     * Resolve the active workspace for a request. Defaults to whatever
+     * `/api/me` reports on `user.workspace` (the user's currently activated
+     * workspace, or `null` when none is active).
      */
     resolveWorkspace?: (params: {
         req: NextRequest;
@@ -43,11 +18,12 @@ export interface CreateMiddlewareOptions {
 export type QelosMiddleware = (req: NextRequest) => Promise<NextResponse>;
 /**
  * Create a Next.js (App Router) edge middleware that identifies the user and
- * the active workspace via the Qelos SDK before the request reaches the
- * application's own handler. Resolved identity is forwarded to downstream
- * handlers via request headers (`x-qelos-user-id`, `x-qelos-workspace-id`);
- * use `getQelosContext()` from `@qelos/integrator-next/context` to obtain the
- * full user / workspace objects inside server components or route handlers.
+ * the active workspace via a same-origin BFF round-trip to Qelos `GET /api/me`
+ * before the request reaches the application's own handler. Resolved identity
+ * is forwarded to downstream handlers via request headers (`x-qelos-user-id`,
+ * `x-qelos-workspace-id`); use `getQelosContext()` from
+ * `@qelos/integrator-next/context` to obtain the full user / workspace objects
+ * inside server components or route handlers.
  */
 export declare function createQelosMiddleware(options: CreateMiddlewareOptions): QelosMiddleware;
 /**

package/dist/middleware.js

@@ -1,43 +1,25 @@
 import { NextResponse } from 'next/server';
+import { rewriteSetCookieDomain } from './cookies';
 import { applyQelosForwardHeaders } from './forward-headers';
 import { getDefaultQelosConfig } from './env-config';
+import { fetchMeIdentity } from './me-client';
+import { resolveQelosProxyTarget } from './proxy-target';
 import { createRequestSdk } from './sdk-factory';
-const DEFAULT_ACCESS_COOKIE = 'q_access_token';
-const DEFAULT_REFRESH_COOKIE = 'q_refresh_token';
-function readTokens(req, config) {
-    const accessCookie = config.accessTokenCookie || DEFAULT_ACCESS_COOKIE;
-    const refreshCookie = config.refreshTokenCookie || DEFAULT_REFRESH_COOKIE;
-    const cookieAccess = req.cookies.get(accessCookie)?.value;
-    const cookieRefresh = req.cookies.get(refreshCookie)?.value;
-    const authHeader = req.headers.get('authorization');
-    const headerAccess = authHeader && authHeader.toLowerCase().startsWith('bearer ')
-        ? authHeader.slice(7).trim()
-        : undefined;
-    return {
-        accessToken: headerAccess || cookieAccess || undefined,
-        refreshToken: cookieRefresh || undefined,
-    };
-}
-function stagePendingCookies(pending, config, tokens) {
-    const accessCookie = config.accessTokenCookie || DEFAULT_ACCESS_COOKIE;
-    const refreshCookie = config.refreshTokenCookie || DEFAULT_REFRESH_COOKIE;
-    const secure = !/^http:\/\//i.test(config.appUrl);
-    const options = {
-        httpOnly: true,
-        secure,
-        sameSite: 'lax',
-        path: '/',
-    };
-    pending.push({ name: accessCookie, value: tokens.accessToken, options });
-    if (tokens.refreshToken) {
-        pending.push({ name: refreshCookie, value: tokens.refreshToken, options });
+function mergeProxySkipPaths(config) {
+    const merged = [...(config.skipPaths ?? [])];
+    if (config.disableProxy !== true) {
+        const hasApiPrefix = merged.some((p) => p === '/api' || p === '/api/' || p.startsWith('/api/'));
+        if (!hasApiPrefix) {
+            merged.unshift('/api/');
+        }
     }
+    return merged.length ? merged : undefined;
 }
-function shouldSkip(req, config) {
-    if (!config.skipPaths?.length)
+function shouldSkip(req, skipPaths) {
+    if (!skipPaths?.length)
         return false;
     const path = req.nextUrl.pathname;
-    return config.skipPaths.some((prefix) => path.startsWith(prefix));
+    return skipPaths.some((prefix) => path.startsWith(prefix));
 }
 function unauthorized() {
     return new NextResponse(JSON.stringify({ code: 'UNAUTHORIZED' }), {
@@ -47,72 +29,85 @@ function unauthorized() {
 }
 /**
  * Create a Next.js (App Router) edge middleware that identifies the user and
- * the active workspace via the Qelos SDK before the request reaches the
- * application's own handler. Resolved identity is forwarded to downstream
- * handlers via request headers (`x-qelos-user-id`, `x-qelos-workspace-id`);
- * use `getQelosContext()` from `@qelos/integrator-next/context` to obtain the
- * full user / workspace objects inside server components or route handlers.
+ * the active workspace via a same-origin BFF round-trip to Qelos `GET /api/me`
+ * before the request reaches the application's own handler. Resolved identity
+ * is forwarded to downstream handlers via request headers (`x-qelos-user-id`,
+ * `x-qelos-workspace-id`); use `getQelosContext()` from
+ * `@qelos/integrator-next/context` to obtain the full user / workspace objects
+ * inside server components or route handlers.
  */
 export function createQelosMiddleware(options) {
     const { config, resolveWorkspace } = options;
-    const onTokenRefresh = options.onTokenRefresh ||
-        (async ({ target, newTokens }) => {
-            stagePendingCookies(target.pendingCookies, config, newTokens);
-        });
+    const skipPathsEffective = mergeProxySkipPaths(config);
     return async function qelosMiddleware(req) {
-        if (shouldSkip(req, config)) {
+        if (shouldSkip(req, skipPathsEffective)) {
             return NextResponse.next();
         }
-        const tokens = readTokens(req, config);
-        const pendingCookies = [];
-        const forwardedHeaders = new Headers(req.headers);
-        const sdk = createRequestSdk({
-            config,
-            tokens,
-            refreshTarget: { req, pendingCookies },
-            onTokenRefresh,
+        const getHeaders = () => ({
+            cookie: req.headers.get('cookie') ?? undefined,
+            authorization: req.headers.get('authorization') ?? undefined,
         });
-        const hasAuthMaterial = Boolean(config.apiToken || tokens.accessToken || tokens.refreshToken);
+        const sdk = createRequestSdk({ config, getHeaders });
+        const base = resolveQelosProxyTarget(config);
+        if (!base && !config.apiToken) {
+            if (config.requireAuth) {
+                return unauthorized();
+            }
+            const forwardedHeaders = new Headers(req.headers);
+            applyQelosForwardHeaders(forwardedHeaders, null, null);
+            return NextResponse.next({ request: { headers: forwardedHeaders } });
+        }
         let user = null;
-        let workspaces = [];
+        let setCookieValues = [];
+        const originalHost = req.headers.get('host');
+        if (base) {
+            const h = getHeaders();
+            const { response, user: meUser } = await fetchMeIdentity({
+                base,
+                cookie: h.cookie,
+                authorization: h.authorization,
+            });
+            user = meUser;
+            setCookieValues = response.headers.getSetCookie?.() ?? [];
+        }
         let workspace = null;
-        let identifyFailed = false;
-        if (hasAuthMaterial) {
+        let workspaces = [];
+        if (user) {
             try {
-                user = await sdk.authentication.getLoggedInUser();
+                workspaces = await sdk.workspaces.getList();
             }
             catch {
-                identifyFailed = true;
+                workspaces = [];
+            }
+            if (resolveWorkspace) {
+                workspace =
+                    (await resolveWorkspace({ req, user, workspaces })) || null;
             }
-            if (user) {
-                try {
-                    workspaces = await sdk.workspaces.getList();
-                }
-                catch {
-                    workspaces = [];
-                }
-                if (workspaces.length) {
-                    if (resolveWorkspace) {
-                        workspace =
-                            (await resolveWorkspace({ req, user, workspaces })) || null;
-                    }
-                    else {
-                        workspace = workspaces[0] || null;
-                    }
-                }
+            else {
+                workspace =
+                    user.workspace ||
+                        null;
             }
         }
-        if (config.requireAuth && (!hasAuthMaterial || identifyFailed)) {
-            return unauthorized();
+        if (!user) {
+            if (config.requireAuth) {
+                return unauthorized();
+            }
+            const forwardedHeaders = new Headers(req.headers);
+            applyQelosForwardHeaders(forwardedHeaders, null, null);
+            const res = NextResponse.next({ request: { headers: forwardedHeaders } });
+            for (const value of setCookieValues) {
+                res.headers.append('set-cookie', rewriteSetCookieDomain(value, originalHost ?? undefined));
+            }
+            return res;
         }
+        const forwardedHeaders = new Headers(req.headers);
         applyQelosForwardHeaders(forwardedHeaders, user, workspace);
-        const response = NextResponse.next({
-            request: { headers: forwardedHeaders },
-        });
-        for (const cookie of pendingCookies) {
-            response.cookies.set(cookie.name, cookie.value, cookie.options);
+        const res = NextResponse.next({ request: { headers: forwardedHeaders } });
+        for (const value of setCookieValues) {
+            res.headers.append('set-cookie', rewriteSetCookieDomain(value, originalHost ?? undefined));
         }
-        return response;
+        return res;
     };
 }
 let defaultMiddleware = null;

package/dist/middleware.js.map

@@ -1 +1 @@
-{"version":3,"file":"middleware.js","sourceRoot":"","sources":["../src/middleware.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAoB,MAAM,aAAa,CAAC;AAG7D,OAAO,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAQjD,MAAM,qBAAqB,GAAG,gBAAgB,CAAC;AAC/C,MAAM,sBAAsB,GAAG,iBAAiB,CAAC;AA6CjD,SAAS,UAAU,CAAC,GAAgB,EAAE,MAAuB;IAC3D,MAAM,YAAY,GAAG,MAAM,CAAC,iBAAiB,IAAI,qBAAqB,CAAC;IACvE,MAAM,aAAa,GAAG,MAAM,CAAC,kBAAkB,IAAI,sBAAsB,CAAC;IAC1E,MAAM,YAAY,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,KAAK,CAAC;IAC1D,MAAM,aAAa,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,KAAK,CAAC;IAC5D,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IACpD,MAAM,YAAY,GAChB,UAAU,IAAI,UAAU,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC;QAC1D,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE;QAC5B,CAAC,CAAC,SAAS,CAAC;IAChB,OAAO;QACL,WAAW,EAAE,YAAY,IAAI,YAAY,IAAI,SAAS;QACtD,YAAY,EAAE,aAAa,IAAI,SAAS;KACzC,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAC1B,OAAwB,EACxB,MAAuB,EACvB,MAAsB;IAEtB,MAAM,YAAY,GAAG,MAAM,CAAC,iBAAiB,IAAI,qBAAqB,CAAC;IACvE,MAAM,aAAa,GAAG,MAAM,CAAC,kBAAkB,IAAI,sBAAsB,CAAC;IAC1E,MAAM,MAAM,GAAG,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAClD,MAAM,OAAO,GAAG;QACd,QAAQ,EAAE,IAAI;QACd,MAAM;QACN,QAAQ,EAAE,KAAc;QACxB,IAAI,EAAE,GAAG;KACV,CAAC;IACF,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,CAAC,WAAW,EAAE,OAAO,EAAE,CAAC,CAAC;IACzE,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;QACxB,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,CAAC,YAAY,EAAE,OAAO,EAAE,CAAC,CAAC;IAC7E,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,GAAgB,EAAE,MAAuB;IAC3D,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM;QAAE,OAAO,KAAK,CAAC;IAC5C,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC;IAClC,OAAO,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;AACpE,CAAC;AAED,SAAS,YAAY;IACnB,OAAO,IAAI,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,EAAE;QAChE,MAAM,EAAE,GAAG;QACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;KAChD,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CACnC,OAAgC;IAEhC,MAAM,EAAE,MAAM,EAAE,gBAAgB,EAAE,GAAG,OAAO,CAAC;IAC7C,MAAM,cAAc,GAClB,OAAO,CAAC,cAAc;QACtB,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE;YAC/B,mBAAmB,CAAC,MAAM,CAAC,cAAc,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;QAChE,CAAC,CAAC,CAAC;IAEL,OAAO,KAAK,UAAU,eAAe,CAAC,GAAG;QACvC,IAAI,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,CAAC;YAC5B,OAAO,YAAY,CAAC,IAAI,EAAE,CAAC;QAC7B,CAAC;QAED,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QACvC,MAAM,cAAc,GAAoB,EAAE,CAAC;QAC3C,MAAM,gBAAgB,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAElD,MAAM,GAAG,GAAG,gBAAgB,CAA0B;YACpD,MAAM;YACN,MAAM;YACN,aAAa,EAAE,EAAE,GAAG,EAAE,cAAc,EAAE;YACtC,cAAc;SACf,CAAC,CAAC;QAEH,MAAM,eAAe,GAAG,OAAO,CAC7B,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,YAAY,CAC7D,CAAC;QAEF,IAAI,IAAI,GAAiB,IAAI,CAAC;QAC9B,IAAI,UAAU,GAAiB,EAAE,CAAC;QAClC,IAAI,SAAS,GAAsB,IAAI,CAAC;QACxC,IAAI,cAAc,GAAG,KAAK,CAAC;QAE3B,IAAI,eAAe,EAAE,CAAC;YACpB,IAAI,CAAC;gBACH,IAAI,GAAG,MAAM,GAAG,CAAC,cAAc,CAAC,eAAe,EAAE,CAAC;YACpD,CAAC;YAAC,MAAM,CAAC;gBACP,cAAc,GAAG,IAAI,CAAC;YACxB,CAAC;YACD,IAAI,IAAI,EAAE,CAAC;gBACT,IAAI,CAAC;oBACH,UAAU,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;gBAC9C,CAAC;gBAAC,MAAM,CAAC;oBACP,UAAU,GAAG,EAAE,CAAC;gBAClB,CAAC;gBACD,IAAI,UAAU,CAAC,MAAM,EAAE,CAAC;oBACtB,IAAI,gBAAgB,EAAE,CAAC;wBACrB,SAAS;4BACP,CAAC,MAAM,gBAAgB,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC;oBAChE,CAAC;yBAAM,CAAC;wBACN,SAAS,GAAG,UAAU,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;oBACpC,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,IAAI,MAAM,CAAC,WAAW,IAAI,CAAC,CAAC,eAAe,IAAI,cAAc,CAAC,EAAE,CAAC;YAC/D,OAAO,YAAY,EAAE,CAAC;QACxB,CAAC;QAED,wBAAwB,CAAC,gBAAgB,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;QAE5D,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC;YACjC,OAAO,EAAE,EAAE,OAAO,EAAE,gBAAgB,EAAE;SACvC,CAAC,CAAC;QAEH,KAAK,MAAM,MAAM,IAAI,cAAc,EAAE,CAAC;YACpC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;QAClE,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC,CAAC;AACJ,CAAC;AAED,IAAI,iBAAiB,GAA2B,IAAI,CAAC;AAErD;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,eAAe,GAAoB,CAAC,GAAG,EAAE,EAAE;IACtD,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACvB,iBAAiB,GAAG,qBAAqB,CAAC,EAAE,MAAM,EAAE,qBAAqB,EAAE,EAAE,CAAC,CAAC;IACjF,CAAC;IACD,OAAO,iBAAiB,CAAC,GAAG,CAAC,CAAC;AAChC,CAAC,CAAC"}
+{"version":3,"file":"middleware.js","sourceRoot":"","sources":["../src/middleware.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAoB,MAAM,aAAa,CAAC;AAG7D,OAAO,EAAE,sBAAsB,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AACzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAmBjD,SAAS,mBAAmB,CAAC,MAAuB;IAClD,MAAM,MAAM,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,CAAC;IAC7C,IAAI,MAAM,CAAC,YAAY,KAAK,IAAI,EAAE,CAAC;QACjC,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAC9B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,OAAO,IAAI,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAC9D,CAAC;QACF,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;AAC5C,CAAC;AAED,SAAS,UAAU,CAAC,GAAgB,EAAE,SAA+B;IACnE,IAAI,CAAC,SAAS,EAAE,MAAM;QAAE,OAAO,KAAK,CAAC;IACrC,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC;IAClC,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;AAC7D,CAAC;AAED,SAAS,YAAY;IACnB,OAAO,IAAI,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,EAAE;QAChE,MAAM,EAAE,GAAG;QACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;KAChD,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,qBAAqB,CACnC,OAAgC;IAEhC,MAAM,EAAE,MAAM,EAAE,gBAAgB,EAAE,GAAG,OAAO,CAAC;IAC7C,MAAM,kBAAkB,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAEvD,OAAO,KAAK,UAAU,eAAe,CAAC,GAAG;QACvC,IAAI,UAAU,CAAC,GAAG,EAAE,kBAAkB,CAAC,EAAE,CAAC;YACxC,OAAO,YAAY,CAAC,IAAI,EAAE,CAAC;QAC7B,CAAC;QAED,MAAM,UAAU,GAAG,GAAG,EAAE,CAAC,CAAC;YACxB,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,SAAS;YAC9C,aAAa,EAAE,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,SAAS;SAC7D,CAAC,CAAC;QAEH,MAAM,GAAG,GAAG,gBAAgB,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;QAErD,MAAM,IAAI,GAAG,uBAAuB,CAAC,MAAM,CAAC,CAAC;QAC7C,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;YAC9B,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;gBACvB,OAAO,YAAY,EAAE,CAAC;YACxB,CAAC;YACD,MAAM,gBAAgB,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAClD,wBAAwB,CAAC,gBAAgB,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;YACvD,OAAO,YAAY,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,gBAAgB,EAAE,EAAE,CAAC,CAAC;QACvE,CAAC;QAED,IAAI,IAAI,GAAiB,IAAI,CAAC;QAC9B,IAAI,eAAe,GAAa,EAAE,CAAC;QACnC,MAAM,YAAY,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAE7C,IAAI,IAAI,EAAE,CAAC;YACT,MAAM,CAAC,GAAG,UAAU,EAAE,CAAC;YACvB,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,eAAe,CAAC;gBACvD,IAAI;gBACJ,MAAM,EAAE,CAAC,CAAC,MAAM;gBAChB,aAAa,EAAE,CAAC,CAAC,aAAa;aAC/B,CAAC,CAAC;YACH,IAAI,GAAG,MAAM,CAAC;YACd,eAAe,GAAG,QAAQ,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,CAAC;QAC5D,CAAC;QAED,IAAI,SAAS,GAAsB,IAAI,CAAC;QACxC,IAAI,UAAU,GAAiB,EAAE,CAAC;QAElC,IAAI,IAAI,EAAE,CAAC;YACT,IAAI,CAAC;gBACH,UAAU,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;YAC9C,CAAC;YAAC,MAAM,CAAC;gBACP,UAAU,GAAG,EAAE,CAAC;YAClB,CAAC;YACD,IAAI,gBAAgB,EAAE,CAAC;gBACrB,SAAS;oBACP,CAAC,MAAM,gBAAgB,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC;YAChE,CAAC;iBAAM,CAAC;gBACN,SAAS;oBACN,IAAqD,CAAC,SAAS;wBAChE,IAAI,CAAC;YACT,CAAC;QACH,CAAC;QAED,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;gBACvB,OAAO,YAAY,EAAE,CAAC;YACxB,CAAC;YACD,MAAM,gBAAgB,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAClD,wBAAwB,CAAC,gBAAgB,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;YACvD,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,gBAAgB,EAAE,EAAE,CAAC,CAAC;YAC1E,KAAK,MAAM,KAAK,IAAI,eAAe,EAAE,CAAC;gBACpC,GAAG,CAAC,OAAO,CAAC,MAAM,CAChB,YAAY,EACZ,sBAAsB,CAAC,KAAK,EAAE,YAAY,IAAI,SAAS,CAAC,CACzD,CAAC;YACJ,CAAC;YACD,OAAO,GAAG,CAAC;QACb,CAAC;QAED,MAAM,gBAAgB,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAClD,wBAAwB,CAAC,gBAAgB,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;QAC5D,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,gBAAgB,EAAE,EAAE,CAAC,CAAC;QAC1E,KAAK,MAAM,KAAK,IAAI,eAAe,EAAE,CAAC;YACpC,GAAG,CAAC,OAAO,CAAC,MAAM,CAChB,YAAY,EACZ,sBAAsB,CAAC,KAAK,EAAE,YAAY,IAAI,SAAS,CAAC,CACzD,CAAC;QACJ,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC,CAAC;AACJ,CAAC;AAED,IAAI,iBAAiB,GAA2B,IAAI,CAAC;AAErD;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,eAAe,GAAoB,CAAC,GAAG,EAAE,EAAE;IACtD,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACvB,iBAAiB,GAAG,qBAAqB,CAAC,EAAE,MAAM,EAAE,qBAAqB,EAAE,EAAE,CAAC,CAAC;IACjF,CAAC;IACD,OAAO,iBAAiB,CAAC,GAAG,CAAC,CAAC;AAChC,CAAC,CAAC"}

package/dist/pages.d.ts

@@ -1,8 +1,8 @@
-import type { IncomingMessage, ServerResponse } from 'node:http';
+import type { IncomingMessage } from 'node:http';
 import type { GetServerSideProps, GetServerSidePropsContext, GetServerSidePropsResult, NextApiHandler } from 'next';
 import type { IUser } from '@qelos/sdk/dist/authentication';
 import type { IWorkspace } from '@qelos/sdk/workspaces';
-import type { QelosNextConfig, QelosRequestContext, TokenRefreshHook } from './types';
+import type { QelosNextConfig, QelosRequestContext } from './types';
 type CookieMap = Partial<Record<string, string>>;
 interface RequestWithCookies extends IncomingMessage {
     cookies?: CookieMap;
@@ -15,13 +15,9 @@ declare module 'http' {
 export interface PagesIntegratorOptions {
     config: QelosNextConfig;
     /**
-     * Hook invoked after a successful token refresh. The default implementation
-     * writes the new tokens back to the response cookies.
-     */
-    onTokenRefresh?: TokenRefreshHook<ServerResponse>;
-    /**
-     * Resolve the active workspace for a request. Defaults to picking the first
-     * workspace returned from `sdk.workspaces.getList()`.
+     * Resolve the active workspace for a request. Defaults to whatever
+     * `/api/me` reports on `user.workspace` (the user's currently activated
+     * workspace, or `null` when none is active).
      */
     resolveWorkspace?: (params: {
         req: RequestWithCookies;