@qelos/integrator-nuxt 4.0.0 → 4.1.0

package/README.md

@@ -1,14 +1,10 @@
 # @qelos/integrator-nuxt
 
-Nuxt 3 integrator for [Qelos](https://qelos.io). Adds a server middleware that
-identifies the current user and active workspace via the
-[`@qelos/sdk`](https://www.npmjs.com/package/@qelos/sdk) before your own
-Nitro/Nuxt route handlers run, and exposes them through the H3 event context.
-
-A token-refresh hook keeps the access token fresh: when the SDK detects an
-expired access token, it transparently refreshes it — either through the
-request's refresh token or, for cookie-only sessions, through the access
-cookie itself — and writes the rotated cookie pair back on the response.
+Nuxt 3 integrator for [Qelos](https://qelos.io). It plugs into a Nuxt app's
+Nitro server to make the Nuxt host act as a same-origin BFF for a managed
+Qelos app: requests under `/api/**` are proxied to Qelos, and every other
+request resolves the current user up front so your route handlers and Vue
+components can use them directly.
 
 ## Install
 
@@ -16,6 +12,10 @@ cookie itself — and writes the rotated cookie pair back on the response.
 pnpm add @qelos/integrator-nuxt
 ```
 
+> Requires Node 18+ — the middleware uses
+> [`Response.headers.getSetCookie()`](https://developer.mozilla.org/docs/Web/API/Headers/getSetCookie)
+> to pipe individual upstream `Set-Cookie` headers back to the client.
+
 ## Configure
 
 ```ts
@@ -25,8 +25,6 @@ export default defineNuxtConfig({
   qelos: {
     appUrl: 'https://your-qelos-app.com',
     // Optional — defaults shown:
-    accessTokenCookie: 'q_access_token',
-    refreshTokenCookie: 'q_refresh_token',
     requireAuth: false,
     skipPaths: ['/api/_auth', '/health'],
   },
@@ -36,6 +34,83 @@ export default defineNuxtConfig({
 You can also override any field at runtime via `NUXT_QELOS_*` env vars (Nuxt
 runtime-config conventions apply).
 
+## API proxy
+
+The module registers a catch-all `/api/**` Nitro server handler that
+transparently proxies any request the consuming Nuxt app does not handle
+itself to the configured Qelos managed-app origin. This lets the Nuxt app
+act as a same-origin BFF: `@qelos/sdk` calls from the browser, server, or
+the Qelos web SDK can all hit `/api/...` on the Nuxt host and reach Qelos
+without CORS or cross-site cookie pain.
+
+User-defined `server/api/*.ts` (and `server/routes/*.ts`) routes still
+take precedence — the proxy only catches requests no other handler matched.
+
+### Cookie domain rewrite
+
+The proxy forwards the incoming `Cookie` header as-is (the Qelos session
+cookie name is treated as opaque) and forwards upstream `Set-Cookie`
+headers back to the client, rewriting the `Domain=` attribute on every
+upstream cookie to the inbound request's own host. That way the session
+cookie set by Qelos is valid on the Nuxt app's domain regardless of which
+host Qelos issues cookies from.
+
+### Resolving the proxy target
+
+The managed Qelos app URL (`qelos.appUrl`) is the proxy target. Env vars are
+only dev-time overrides for when the configured `appUrl` isn't reachable from
+the local host:
+
+1. `NUXT_QELOS_PROXY_TARGET` env var.
+2. `QELOS_IP` env var (dev fallback).
+3. `QELOS_API_IP` env var (dev fallback).
+4. `qelos.appUrl`.
+
+If none of these are set, the handler responds with `503` so misconfiguration
+fails loudly.
+
+### Opting out
+
+Set `qelos.disableProxy: true` in `nuxt.config.ts` to skip registration of
+the proxy handler — useful when the Nuxt app implements every `/api/*`
+route itself or terminates the proxy elsewhere (CDN, reverse proxy, etc.).
+
+WebSocket upgrades are not proxied; route them explicitly if needed.
+
+## Middleware
+
+On every non-`/api/` request, the server middleware identifies the current
+user by calling the managed Qelos app directly:
+
+1. Resolve the upstream origin the same way the `/api/**` proxy does
+   (`NUXT_QELOS_PROXY_TARGET` → `QELOS_IP` → `QELOS_API_IP` →
+   `qelos.appUrl`).
+2. Issue `fetch('${upstream}/api/me')` with the incoming request's `Cookie`
+   header forwarded verbatim — the Qelos session cookie name is opaque to
+   the integrator, so the whole header is piped through unchanged. Any
+   incoming `Authorization` header is forwarded too.
+3. For every `Set-Cookie` header on the upstream response, rewrite the
+   `Domain=` attribute to the inbound request's `Host` (port stripped) and
+   append it to the outgoing response. This is how session rotations from
+   Qelos reach the browser when the managed app and the Nuxt host live on
+   different origins.
+4. On `2xx`, parse the JSON body and expose it as
+   `event.context.qelos.user`. On any other status (or a network error),
+   leave `user = null` — and respond with `401` if `qelos.requireAuth` is
+   set.
+
+The middleware is independent from the `/api/**` proxy: the proxy handles
+forwarding of API calls themselves, while the middleware identifies the
+user on every page/non-API request before your route handlers run. To
+avoid double-hitting Qelos for `/api/me` (once for proxying, once for user
+resolution), the module adds `/api/` to `skipPaths` automatically when the
+proxy is enabled.
+
+> The middleware does not attempt to strip the `Secure` attribute from
+> rotated cookies. In local dev over plain HTTP, browsers will drop
+> `Secure` cookies — configure the managed Qelos app to issue non-`Secure`
+> cookies in that environment, or run the Nuxt host over HTTPS.
+
 ## Use in server routes
 
 The recommended wrapper, `defineQelosEventHandler`, gives you a typed `qelos`
@@ -76,13 +151,16 @@ export default defineEventHandler((event) => {
 
 `event.context.qelos` is typed as `QelosRequestContext`:
 
-| field        | description                                                |
-|--------------|------------------------------------------------------------|
-| `user`       | `IUser` from `@qelos/sdk` or `null` when anonymous.         |
-| `workspace`  | The active `IWorkspace` for the request, or `null`.         |
-| `workspaces` | All workspaces the user has access to.                      |
-| `sdk`        | A request-scoped `QelosSDK` instance bound to the tokens.   |
-| `tokens`     | The current access/refresh token pair (mutated on refresh). |
+| field        | description                                                      |
+|--------------|------------------------------------------------------------------|
+| `user`       | The `IUser` body returned by `/api/me`, or `null` when anonymous. |
+| `workspace`  | The active `IWorkspace` for the request, or `null`.               |
+| `workspaces` | All workspaces the user has access to.                            |
+| `sdk`        | A request-scoped `QelosSDK` instance bound to the live cookies.   |
+
+The `sdk` reads cookies from the current `H3Event` on every call, so any
+session rotation piped through by the middleware is picked up automatically
+by subsequent SDK requests in the same handler.
 
 ## Use in components / pages
 
@@ -104,7 +182,7 @@ const { user, workspace, workspaces, isAuthenticated } = useQelos();
 ```
 
 For data calls from the browser, prefer hitting your own server routes (so
-refresh-token rotation stays on the server):
+session cookies stay on the server):
 
 ```vue
 <script setup lang="ts">
@@ -117,41 +195,18 @@ If you need direct browser access to the Qelos API, use
 server-side SDK in this package is bound to per-request cookies and isn't
 intended for client use.
 
-## Token refresh
-
-When the access token is rejected, the SDK tries to recover, in order:
+## Workspace resolution
 
-1. The **refresh token** (`q_refresh_token`) via
-   `sdk.authentication.refreshToken()` — issues a new access + refresh pair.
-2. The **cookie token** (the access token cookie itself) via
-   `sdk.authentication.refreshCookieToken()` — used for cookie-only sessions
-   that do not carry a separate refresh token (e.g. social-auth flows).
+`event.context.qelos.workspace` defaults to whatever the managed Qelos app
+reports on `user.workspace` from `/api/me`. That field is non-null only when
+the user has already activated a workspace on the Qelos side; when it is
+`null`, the frontend is expected to prompt the user to either activate an
+existing workspace or create a new one. The middleware deliberately does
+**not** auto-pick `workspaces[0]` — that would silently put the user into
+the wrong workspace.
 
-After a successful refresh the middleware fires the `onTokenRefresh` hook.
-The default implementation writes the new tokens back to the response cookies
-(`HttpOnly`, `SameSite=Lax`).
-
-### Manual cookie refresh
-
-Long-lived integrator-hosted sessions can also call the SDK directly to
-proactively refresh the cookie token, e.g. from a Nitro route handler:
-
-```ts
-// server/api/session/refresh.post.ts
-import { defineQelosEventHandler } from '@qelos/integrator-nuxt';
-
-export default defineQelosEventHandler(async ({ qelos }) => {
-  const result = await qelos.sdk.authentication.refreshCookieToken();
-  // result.headers['set-cookie'] — fresh cookie value to forward
-  return { user: result.payload.user };
-});
-```
-
-## Custom workspace resolution / refresh hook
-
-If the default behavior (first workspace from `sdk.workspaces.getList()` and a
-cookie-based refresh writeback) doesn't fit your app, register your own
-middleware instead of (or in addition to) the module's default handler:
+To override the default (e.g. force a particular workspace per request),
+register your own middleware:
 
 ```ts
 // server/middleware/qelos.ts
@@ -160,12 +215,9 @@ import { createQelosMiddleware } from '@qelos/integrator-nuxt';
 export default createQelosMiddleware({
   config: useRuntimeConfig().qelos,
   resolveWorkspace: ({ user, workspaces }) =>
-    workspaces.find(w => w._id === user.metadata?.activeWorkspace) || workspaces[0] || null,
-  onTokenRefresh: async ({ event, newTokens }) => {
-    // your own persistence — DB, signed cookie, KV, etc.
-    setCookie(event, 'q_access_token', newTokens.accessToken, { httpOnly: true });
-    setCookie(event, 'q_refresh_token', newTokens.refreshToken, { httpOnly: true });
-  },
+    workspaces.find(w => w._id === user.metadata?.activeWorkspace)
+      || user.workspace
+      || null,
 });
 ```
 
@@ -175,7 +227,8 @@ in `nuxt.config.ts`.
 ## API token mode
 
 For service-to-service deployments where every request shares one Qelos API
-token, set `apiToken` and the middleware will skip the cookie/refresh flow:
+token, set `apiToken` and the middleware will skip the cookie flow entirely
+and build an SDK that authenticates with the static token:
 
 ```ts
 qelos: {

package/dist/cookies.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Rewrite the `Domain=` attribute of a single `Set-Cookie` header value.
+ *
+ * - If the cookie contains a `Domain=<value>` attribute (case-insensitive), its
+ *   value is replaced with `newDomain`, with any trailing `:port` suffix
+ *   stripped first (cookie `Domain` attributes do not include a port).
+ * - If `newDomain` is `undefined` (or empty), the entire `; Domain=<value>`
+ *   segment is removed so the browser scopes the cookie to the current host.
+ * - If no `Domain=` attribute is present, the input is returned unchanged.
+ *
+ * All other attributes, their casing/order and the original cookie name/value
+ * bytes are preserved.
+ */
+export declare function rewriteSetCookieDomain(setCookie: string, newDomain: string | undefined): string;
+/**
+ * Apply {@link rewriteSetCookieDomain} to each entry of a `Set-Cookie` array
+ * (e.g. the result of `Headers.getSetCookie()`).
+ */
+export declare function rewriteSetCookieDomains(values: string[], newDomain: string | undefined): string[];

package/dist/cookies.js

@@ -0,0 +1,39 @@
+/**
+ * Rewrite the `Domain=` attribute of a single `Set-Cookie` header value.
+ *
+ * - If the cookie contains a `Domain=<value>` attribute (case-insensitive), its
+ *   value is replaced with `newDomain`, with any trailing `:port` suffix
+ *   stripped first (cookie `Domain` attributes do not include a port).
+ * - If `newDomain` is `undefined` (or empty), the entire `; Domain=<value>`
+ *   segment is removed so the browser scopes the cookie to the current host.
+ * - If no `Domain=` attribute is present, the input is returned unchanged.
+ *
+ * All other attributes, their casing/order and the original cookie name/value
+ * bytes are preserved.
+ */
+export function rewriteSetCookieDomain(setCookie, newDomain) {
+    const domainSegment = /;\s*Domain\s*=\s*[^;]+/i;
+    if (!domainSegment.test(setCookie))
+        return setCookie;
+    const stripped = newDomain ? stripPort(newDomain) : '';
+    if (!stripped) {
+        return setCookie.replace(domainSegment, '');
+    }
+    return setCookie.replace(/(;\s*Domain\s*=\s*)[^;]+/i, `$1${stripped}`);
+}
+/**
+ * Apply {@link rewriteSetCookieDomain} to each entry of a `Set-Cookie` array
+ * (e.g. the result of `Headers.getSetCookie()`).
+ */
+export function rewriteSetCookieDomains(values, newDomain) {
+    return values.map((value) => rewriteSetCookieDomain(value, newDomain));
+}
+function stripPort(host) {
+    if (host.startsWith('[')) {
+        const end = host.indexOf(']');
+        return end === -1 ? host : host.slice(1, end);
+    }
+    const colon = host.indexOf(':');
+    return colon === -1 ? host : host.slice(0, colon);
+}
+//# sourceMappingURL=cookies.js.map

package/dist/cookies.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cookies.js","sourceRoot":"","sources":["../src/cookies.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,sBAAsB,CACpC,SAAiB,EACjB,SAA6B;IAE7B,MAAM,aAAa,GAAG,yBAAyB,CAAC;IAChD,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC;QAAE,OAAO,SAAS,CAAC;IAErD,MAAM,QAAQ,GAAG,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACvD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,SAAS,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,SAAS,CAAC,OAAO,CACtB,2BAA2B,EAC3B,KAAK,QAAQ,EAAE,CAChB,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CACrC,MAAgB,EAChB,SAA6B;IAE7B,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,sBAAsB,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC;AACzE,CAAC;AAED,SAAS,SAAS,CAAC,IAAY;IAC7B,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC9B,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAChD,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAChC,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;AACpD,CAAC"}

package/dist/middleware.d.ts

@@ -1,17 +1,13 @@
 import { type H3Event } from 'h3';
 import type { IUser } from '@qelos/sdk/dist/authentication';
 import type { IWorkspace } from '@qelos/sdk/workspaces';
-import type { QelosNuxtRuntimeConfig, TokenRefreshHook } from './types';
+import type { QelosNuxtRuntimeConfig } from './types';
 export interface CreateMiddlewareOptions {
     config: QelosNuxtRuntimeConfig;
     /**
-     * Hook invoked after a successful token refresh. The default implementation
-     * writes the new tokens back to the response cookies.
-     */
-    onTokenRefresh?: TokenRefreshHook;
-    /**
-     * Resolve the active workspace for a request. Defaults to picking the first
-     * workspace returned from `sdk.workspaces.getList()`.
+     * Resolve the active workspace for a request. Defaults to whatever
+     * `/api/me` reports on `user.workspace` (the user's currently activated
+     * workspace, or `null` when none is active).
      */
     resolveWorkspace?: (params: {
         event: H3Event;

package/dist/middleware.js

@@ -1,35 +1,7 @@
-import { defineEventHandler, getCookie, getRequestHeader, setCookie, createError, } from 'h3';
+import { appendResponseHeader, createError, defineEventHandler, getRequestHeader, } from 'h3';
+import { rewriteSetCookieDomain } from './cookies';
+import { resolveQelosProxyTarget } from './proxy-target';
 import { createRequestSdk } from './sdk-factory';
-const DEFAULT_ACCESS_COOKIE = 'q_access_token';
-const DEFAULT_REFRESH_COOKIE = 'q_refresh_token';
-function readTokens(event, config) {
-    const accessCookie = config.accessTokenCookie || DEFAULT_ACCESS_COOKIE;
-    const refreshCookie = config.refreshTokenCookie || DEFAULT_REFRESH_COOKIE;
-    const cookieAccess = getCookie(event, accessCookie);
-    const cookieRefresh = getCookie(event, refreshCookie);
-    const authHeader = getRequestHeader(event, 'authorization');
-    const headerAccess = authHeader && authHeader.toLowerCase().startsWith('bearer ')
-        ? authHeader.slice(7).trim()
-        : undefined;
-    return {
-        accessToken: headerAccess || cookieAccess || undefined,
-        refreshToken: cookieRefresh || undefined,
-    };
-}
-function writeTokensToCookies(event, config, tokens) {
-    const accessCookie = config.accessTokenCookie || DEFAULT_ACCESS_COOKIE;
-    const refreshCookie = config.refreshTokenCookie || DEFAULT_REFRESH_COOKIE;
-    const cookieOptions = {
-        httpOnly: true,
-        secure: true,
-        sameSite: 'lax',
-        path: '/',
-    };
-    setCookie(event, accessCookie, tokens.accessToken, cookieOptions);
-    if (tokens.refreshToken) {
-        setCookie(event, refreshCookie, tokens.refreshToken, cookieOptions);
-    }
-}
 function shouldSkip(event, config) {
     if (!config.skipPaths?.length) {
         return false;
@@ -37,37 +9,67 @@ function shouldSkip(event, config) {
     const path = event.path || event.node?.req?.url || '';
     return config.skipPaths.some((prefix) => path.startsWith(prefix));
 }
+function buildMeUrl(base) {
+    return `${base.replace(/\/+$/, '')}/api/me`;
+}
 export function createQelosMiddleware(options) {
     const { config, resolveWorkspace } = options;
-    const onTokenRefresh = options.onTokenRefresh
-        || (async ({ event, newTokens }) => {
-            writeTokensToCookies(event, config, newTokens);
-        });
     return defineEventHandler(async (event) => {
         if (shouldSkip(event, config)) {
             return;
         }
-        const tokens = readTokens(event, config);
-        const sdk = createRequestSdk({ config, tokens, event, onTokenRefresh });
+        const sdk = createRequestSdk({ config, event });
         const ctx = {
             user: null,
             workspace: null,
             workspaces: [],
             sdk,
-            tokens,
         };
         event.context.qelos = ctx;
-        const hasAuthMaterial = Boolean(config.apiToken || tokens.accessToken || tokens.refreshToken);
-        if (!hasAuthMaterial) {
+        const base = resolveQelosProxyTarget(config);
+        if (!base && !config.apiToken) {
             if (config.requireAuth) {
                 throw createError({ statusCode: 401, statusMessage: 'Unauthorized' });
             }
             return;
         }
-        try {
-            ctx.user = await sdk.authentication.getLoggedInUser();
+        if (base) {
+            const headers = {};
+            const cookieHeader = getRequestHeader(event, 'cookie');
+            if (cookieHeader)
+                headers.cookie = cookieHeader;
+            const authHeader = getRequestHeader(event, 'authorization');
+            if (authHeader)
+                headers.authorization = authHeader;
+            const originalHost = getRequestHeader(event, 'host');
+            let response;
+            try {
+                response = await fetch(buildMeUrl(base), {
+                    method: 'GET',
+                    headers,
+                    redirect: 'manual',
+                });
+            }
+            catch {
+                if (config.requireAuth) {
+                    throw createError({ statusCode: 401, statusMessage: 'Unauthorized' });
+                }
+                return;
+            }
+            const setCookieValues = response.headers.getSetCookie?.() ?? [];
+            for (const value of setCookieValues) {
+                appendResponseHeader(event, 'set-cookie', rewriteSetCookieDomain(value, originalHost));
+            }
+            if (response.ok) {
+                try {
+                    ctx.user = (await response.json());
+                }
+                catch {
+                    ctx.user = null;
+                }
+            }
         }
-        catch (err) {
+        if (!ctx.user) {
             if (config.requireAuth) {
                 throw createError({ statusCode: 401, statusMessage: 'Unauthorized' });
             }
@@ -79,17 +81,19 @@ export function createQelosMiddleware(options) {
         catch {
             ctx.workspaces = [];
         }
-        if (ctx.user && ctx.workspaces.length) {
-            if (resolveWorkspace) {
-                ctx.workspace = await resolveWorkspace({
-                    event,
-                    user: ctx.user,
-                    workspaces: ctx.workspaces,
-                }) || null;
-            }
-            else {
-                ctx.workspace = ctx.workspaces[0] || null;
-            }
+        if (resolveWorkspace) {
+            ctx.workspace = (await resolveWorkspace({
+                event,
+                user: ctx.user,
+                workspaces: ctx.workspaces,
+            })) || null;
+        }
+        else {
+            // `/api/me` carries `user.workspace` (`{ _id, name, roles }`) only when
+            // the user has activated a workspace. Null means the frontend must
+            // prompt to activate/create one — don't silently pick workspaces[0].
+            ctx.workspace =
+                ctx.user.workspace || null;
         }
     });
 }

package/dist/middleware.js.map

@@ -1 +1 @@
-{"version":3,"file":"middleware.js","sourceRoot":"","sources":["../src/middleware.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,kBAAkB,EAClB,SAAS,EACT,gBAAgB,EAChB,SAAS,EACT,WAAW,GAEZ,MAAM,IAAI,CAAC;AAGZ,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAQjD,MAAM,qBAAqB,GAAG,gBAAgB,CAAC;AAC/C,MAAM,sBAAsB,GAAG,iBAAiB,CAAC;AAoBjD,SAAS,UAAU,CAAC,KAAc,EAAE,MAA8B;IAChE,MAAM,YAAY,GAAG,MAAM,CAAC,iBAAiB,IAAI,qBAAqB,CAAC;IACvE,MAAM,aAAa,GAAG,MAAM,CAAC,kBAAkB,IAAI,sBAAsB,CAAC;IAE1E,MAAM,YAAY,GAAG,SAAS,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;IACpD,MAAM,aAAa,GAAG,SAAS,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;IAEtD,MAAM,UAAU,GAAG,gBAAgB,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC;IAC5D,MAAM,YAAY,GAAG,UAAU,IAAI,UAAU,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC;QAC/E,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE;QAC5B,CAAC,CAAC,SAAS,CAAC;IAEd,OAAO;QACL,WAAW,EAAE,YAAY,IAAI,YAAY,IAAI,SAAS;QACtD,YAAY,EAAE,aAAa,IAAI,SAAS;KACzC,CAAC;AACJ,CAAC;AAED,SAAS,oBAAoB,CAC3B,KAAc,EACd,MAA8B,EAC9B,MAAsD;IAEtD,MAAM,YAAY,GAAG,MAAM,CAAC,iBAAiB,IAAI,qBAAqB,CAAC;IACvE,MAAM,aAAa,GAAG,MAAM,CAAC,kBAAkB,IAAI,sBAAsB,CAAC;IAC1E,MAAM,aAAa,GAAG;QACpB,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE,IAAI;QACZ,QAAQ,EAAE,KAAc;QACxB,IAAI,EAAE,GAAG;KACV,CAAC;IACF,SAAS,CAAC,KAAK,EAAE,YAAY,EAAE,MAAM,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;IAClE,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;QACxB,SAAS,CAAC,KAAK,EAAE,aAAa,EAAE,MAAM,CAAC,YAAY,EAAE,aAAa,CAAC,CAAC;IACtE,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,KAAc,EAAE,MAA8B;IAChE,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,CAAC;QAC9B,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC;IACtD,OAAO,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;AACpE,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,OAAgC;IACpE,MAAM,EAAE,MAAM,EAAE,gBAAgB,EAAE,GAAG,OAAO,CAAC;IAC7C,MAAM,cAAc,GAAqB,OAAO,CAAC,cAAc;WAC1D,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE;YACjC,oBAAoB,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;QACjD,CAAC,CAAC,CAAC;IAEL,OAAO,kBAAkB,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QACxC,IAAI,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC;YAC9B,OAAO;QACT,CAAC;QAED,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QACzC,MAAM,GAAG,GAAG,gBAAgB,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;QAExE,MAAM,GAAG,GAAwB;YAC/B,IAAI,EAAE,IAAI;YACV,SAAS,EAAE,IAAI;YACf,UAAU,EAAE,EAAE;YACd,GAAG;YACH,MAAM;SACP,CAAC;QACF,KAAK,CAAC,OAAO,CAAC,KAAK,GAAG,GAAG,CAAC;QAE1B,MAAM,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,YAAY,CAAC,CAAC;QAC9F,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;gBACvB,MAAM,WAAW,CAAC,EAAE,UAAU,EAAE,GAAG,EAAE,aAAa,EAAE,cAAc,EAAE,CAAC,CAAC;YACxE,CAAC;YACD,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,GAAG,CAAC,IAAI,GAAG,MAAM,GAAG,CAAC,cAAc,CAAC,eAAe,EAAE,CAAC;QACxD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;gBACvB,MAAM,WAAW,CAAC,EAAE,UAAU,EAAE,GAAG,EAAE,aAAa,EAAE,cAAc,EAAE,CAAC,CAAC;YACxE,CAAC;YACD,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,GAAG,CAAC,UAAU,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;QAClD,CAAC;QAAC,MAAM,CAAC;YACP,GAAG,CAAC,UAAU,GAAG,EAAE,CAAC;QACtB,CAAC;QAED,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC;YACtC,IAAI,gBAAgB,EAAE,CAAC;gBACrB,GAAG,CAAC,SAAS,GAAG,MAAM,gBAAgB,CAAC;oBACrC,KAAK;oBACL,IAAI,EAAE,GAAG,CAAC,IAAI;oBACd,UAAU,EAAE,GAAG,CAAC,UAAU;iBAC3B,CAAC,IAAI,IAAI,CAAC;YACb,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,SAAS,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;YAC5C,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"middleware.js","sourceRoot":"","sources":["../src/middleware.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,oBAAoB,EACpB,WAAW,EACX,kBAAkB,EAClB,gBAAgB,GAEjB,MAAM,IAAI,CAAC;AAGZ,OAAO,EAAE,sBAAsB,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AACzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAiBjD,SAAS,UAAU,CAAC,KAAc,EAAE,MAA8B;IAChE,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,CAAC;QAC9B,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC;IACtD,OAAO,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;AACpE,CAAC;AAED,SAAS,UAAU,CAAC,IAAY;IAC9B,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,SAAS,CAAC;AAC9C,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,OAAgC;IACpE,MAAM,EAAE,MAAM,EAAE,gBAAgB,EAAE,GAAG,OAAO,CAAC;IAE7C,OAAO,kBAAkB,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QACxC,IAAI,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC;YAC9B,OAAO;QACT,CAAC;QAED,MAAM,GAAG,GAAG,gBAAgB,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QAEhD,MAAM,GAAG,GAAwB;YAC/B,IAAI,EAAE,IAAI;YACV,SAAS,EAAE,IAAI;YACf,UAAU,EAAE,EAAE;YACd,GAAG;SACJ,CAAC;QACF,KAAK,CAAC,OAAO,CAAC,KAAK,GAAG,GAAG,CAAC;QAE1B,MAAM,IAAI,GAAG,uBAAuB,CAAC,MAAM,CAAC,CAAC;QAC7C,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;YAC9B,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;gBACvB,MAAM,WAAW,CAAC,EAAE,UAAU,EAAE,GAAG,EAAE,aAAa,EAAE,cAAc,EAAE,CAAC,CAAC;YACxE,CAAC;YACD,OAAO;QACT,CAAC;QAED,IAAI,IAAI,EAAE,CAAC;YACT,MAAM,OAAO,GAA2B,EAAE,CAAC;YAC3C,MAAM,YAAY,GAAG,gBAAgB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;YACvD,IAAI,YAAY;gBAAE,OAAO,CAAC,MAAM,GAAG,YAAY,CAAC;YAChD,MAAM,UAAU,GAAG,gBAAgB,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC;YAC5D,IAAI,UAAU;gBAAE,OAAO,CAAC,aAAa,GAAG,UAAU,CAAC;YAEnD,MAAM,YAAY,GAAG,gBAAgB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YAErD,IAAI,QAA8B,CAAC;YACnC,IAAI,CAAC;gBACH,QAAQ,GAAG,MAAM,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE;oBACvC,MAAM,EAAE,KAAK;oBACb,OAAO;oBACP,QAAQ,EAAE,QAAQ;iBACnB,CAAC,CAAC;YACL,CAAC;YAAC,MAAM,CAAC;gBACP,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;oBACvB,MAAM,WAAW,CAAC,EAAE,UAAU,EAAE,GAAG,EAAE,aAAa,EAAE,cAAc,EAAE,CAAC,CAAC;gBACxE,CAAC;gBACD,OAAO;YACT,CAAC;YAED,MAAM,eAAe,GAAG,QAAQ,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,CAAC;YAChE,KAAK,MAAM,KAAK,IAAI,eAAe,EAAE,CAAC;gBACpC,oBAAoB,CAAC,KAAK,EAAE,YAAY,EAAE,sBAAsB,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC,CAAC;YACzF,CAAC;YAED,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;gBAChB,IAAI,CAAC;oBACH,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAU,CAAC;gBAC9C,CAAC;gBAAC,MAAM,CAAC;oBACP,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;gBAClB,CAAC;YACH,CAAC;QACH,CAAC;QAED,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;YACd,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;gBACvB,MAAM,WAAW,CAAC,EAAE,UAAU,EAAE,GAAG,EAAE,aAAa,EAAE,cAAc,EAAE,CAAC,CAAC;YACxE,CAAC;YACD,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,GAAG,CAAC,UAAU,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;QAClD,CAAC;QAAC,MAAM,CAAC;YACP,GAAG,CAAC,UAAU,GAAG,EAAE,CAAC;QACtB,CAAC;QAED,IAAI,gBAAgB,EAAE,CAAC;YACrB,GAAG,CAAC,SAAS,GAAG,CAAC,MAAM,gBAAgB,CAAC;gBACtC,KAAK;gBACL,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,UAAU,EAAE,GAAG,CAAC,UAAU;aAC3B,CAAC,CAAC,IAAI,IAAI,CAAC;QACd,CAAC;aAAM,CAAC;YACN,wEAAwE;YACxE,mEAAmE;YACnE,qEAAqE;YACrE,GAAG,CAAC,SAAS;gBACV,GAAG,CAAC,IAAqD,CAAC,SAAS,IAAI,IAAI,CAAC;QACjF,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/module.d.ts

@@ -5,6 +5,11 @@ export interface QelosNuxtModuleOptions extends QelosNuxtRuntimeConfig {
      * want to call `createQelosMiddleware` yourself from your own server route.
      */
     disableMiddleware?: boolean;
+    /**
+     * Disable registration of the catch-all `/api/**` proxy server handler.
+     * Defaults to `false`.
+     */
+    disableProxy?: boolean;
 }
 declare const _default: import("nuxt/schema").NuxtModule<QelosNuxtModuleOptions, QelosNuxtModuleOptions, false>;
 export default _default;
@@ -12,4 +17,4 @@ export { createQelosMiddleware } from './middleware';
 export { createRequestSdk } from './sdk-factory';
 export { defineQelosEventHandler } from './event-handler';
 export type { DefineQelosEventHandlerOptions, QelosEventContext, QelosEventHandler, } from './event-handler';
-export type { QelosNuxtRuntimeConfig, QelosRequestContext, QelosTokenPair, ResolvedTokens, TokenRefreshContext, TokenRefreshHook, } from './types';
+export type { QelosNuxtRuntimeConfig, QelosRequestContext, } from './types';

package/dist/module.js

@@ -15,7 +15,21 @@ export default defineNuxtModule({
             throw new Error('[@qelos/integrator-nuxt] `qelos.appUrl` must be set in nuxt.config');
         }
         const { resolve } = createResolver(import.meta.url);
-        const { disableMiddleware, ...runtimeConfig } = options;
+        const { disableMiddleware, disableProxy, ...runtimeConfig } = options;
+        if (!disableProxy) {
+            // When the catch-all `/api/**` proxy is enabled, the user-resolution
+            // middleware MUST skip `/api/` requests. The middleware itself calls
+            // `${appUrl}/api/me` to identify the user, so without this skip
+            // every inbound `/api/me` would be both proxied AND used as the
+            // identification probe — a duplicate upstream hit and a potential
+            // cookie-rewrite loop. Users can extend `skipPaths` further but
+            // `/api/` must remain covered whenever `disableProxy` is false.
+            const existingSkipPaths = runtimeConfig.skipPaths ?? [];
+            const alreadyCovered = existingSkipPaths.some((prefix) => '/api/'.startsWith(prefix));
+            if (!alreadyCovered) {
+                runtimeConfig.skipPaths = ['/api/', ...existingSkipPaths];
+            }
+        }
         nuxt.options.runtimeConfig.qelos = {
             ...nuxt.options.runtimeConfig.qelos,
             ...runtimeConfig,
@@ -26,6 +40,12 @@ export default defineNuxtModule({
                 middleware: true,
             });
         }
+        if (!disableProxy) {
+            addServerHandler({
+                route: '/api/**',
+                handler: resolve('./runtime/api-proxy'),
+            });
+        }
         addImportsDir(resolve('./runtime/composables'));
         addTypeTemplate({
             filename: 'types/qelos-nuxt.d.ts',

package/dist/module.js.map

@@ -1 +1 @@
-{"version":3,"file":"module.js","sourceRoot":"","sources":["../src/module.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,gBAAgB,EAChB,gBAAgB,EAChB,aAAa,EACb,cAAc,EACd,eAAe,GAChB,MAAM,WAAW,CAAC;AAWnB,eAAe,gBAAgB,CAAyB;IACtD,IAAI,EAAE;QACJ,IAAI,EAAE,wBAAwB;QAC9B,SAAS,EAAE,OAAO;QAClB,aAAa,EAAE;YACb,IAAI,EAAE,QAAQ;SACf;KACF;IACD,QAAQ,EAAE;QACR,MAAM,EAAE,EAAE;KACX;IACD,KAAK,CAAC,OAAO,EAAE,IAAI;QACjB,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,oEAAoE,CAAC,CAAC;QACxF,CAAC;QAED,MAAM,EAAE,OAAO,EAAE,GAAG,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAEpD,MAAM,EAAE,iBAAiB,EAAE,GAAG,aAAa,EAAE,GAAG,OAAO,CAAC;QAExD,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,KAAK,GAAG;YACjC,GAAI,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,KAA6C;YAC5E,GAAG,aAAa;SACjB,CAAC;QAEF,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACvB,gBAAgB,CAAC;gBACf,OAAO,EAAE,OAAO,CAAC,0BAA0B,CAAC;gBAC5C,UAAU,EAAE,IAAI;aACjB,CAAC,CAAC;QACL,CAAC;QAED,aAAa,CAAC,OAAO,CAAC,uBAAuB,CAAC,CAAC,CAAC;QAEhD,eAAe,CAAC;YACd,QAAQ,EAAE,uBAAuB;YACjC,WAAW,EAAE,GAAG,EAAE,CAAC;;;;;;;;;;CAUxB;SACI,CAAC,CAAC;IACL,CAAC;CACF,CAAC,CAAC;AAEH,OAAO,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACjD,OAAO,EAAE,uBAAuB,EAAE,MAAM,iBAAiB,CAAC"}
+{"version":3,"file":"module.js","sourceRoot":"","sources":["../src/module.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,gBAAgB,EAChB,gBAAgB,EAChB,aAAa,EACb,cAAc,EACd,eAAe,GAChB,MAAM,WAAW,CAAC;AAgBnB,eAAe,gBAAgB,CAAyB;IACtD,IAAI,EAAE;QACJ,IAAI,EAAE,wBAAwB;QAC9B,SAAS,EAAE,OAAO;QAClB,aAAa,EAAE;YACb,IAAI,EAAE,QAAQ;SACf;KACF;IACD,QAAQ,EAAE;QACR,MAAM,EAAE,EAAE;KACX;IACD,KAAK,CAAC,OAAO,EAAE,IAAI;QACjB,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,oEAAoE,CAAC,CAAC;QACxF,CAAC;QAED,MAAM,EAAE,OAAO,EAAE,GAAG,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAEpD,MAAM,EAAE,iBAAiB,EAAE,YAAY,EAAE,GAAG,aAAa,EAAE,GAAG,OAAO,CAAC;QAEtE,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,qEAAqE;YACrE,qEAAqE;YACrE,gEAAgE;YAChE,gEAAgE;YAChE,kEAAkE;YAClE,gEAAgE;YAChE,gEAAgE;YAChE,MAAM,iBAAiB,GAAG,aAAa,CAAC,SAAS,IAAI,EAAE,CAAC;YACxD,MAAM,cAAc,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;YACtF,IAAI,CAAC,cAAc,EAAE,CAAC;gBACpB,aAAa,CAAC,SAAS,GAAG,CAAC,OAAO,EAAE,GAAG,iBAAiB,CAAC,CAAC;YAC5D,CAAC;QACH,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,KAAK,GAAG;YACjC,GAAI,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,KAA6C;YAC5E,GAAG,aAAa;SACjB,CAAC;QAEF,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACvB,gBAAgB,CAAC;gBACf,OAAO,EAAE,OAAO,CAAC,0BAA0B,CAAC;gBAC5C,UAAU,EAAE,IAAI;aACjB,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,gBAAgB,CAAC;gBACf,KAAK,EAAE,SAAS;gBAChB,OAAO,EAAE,OAAO,CAAC,qBAAqB,CAAC;aACxC,CAAC,CAAC;QACL,CAAC;QAED,aAAa,CAAC,OAAO,CAAC,uBAAuB,CAAC,CAAC,CAAC;QAEhD,eAAe,CAAC;YACd,QAAQ,EAAE,uBAAuB;YACjC,WAAW,EAAE,GAAG,EAAE,CAAC;;;;;;;;;;CAUxB;SACI,CAAC,CAAC;IACL,CAAC;CACF,CAAC,CAAC;AAEH,OAAO,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACjD,OAAO,EAAE,uBAAuB,EAAE,MAAM,iBAAiB,CAAC"}

package/dist/proxy-target.d.ts

@@ -0,0 +1,17 @@
+import type { QelosNuxtRuntimeConfig } from './types';
+/**
+ * Resolve the origin to which `/api/**` requests are proxied. The managed
+ * Qelos app URL (`config.appUrl`) is the proxy target — env vars are only
+ * dev-time overrides when the configured `appUrl` is not reachable from
+ * the local host.
+ *
+ * Priority (highest first):
+ *   1. `process.env.NUXT_QELOS_PROXY_TARGET`
+ *   2. `process.env.QELOS_IP`
+ *   3. `process.env.QELOS_API_IP`
+ *   4. `config.appUrl`
+ *
+ * Empty / whitespace-only values are skipped, and `undefined` is returned when
+ * nothing is configured so the caller can surface a clear error.
+ */
+export declare function resolveQelosProxyTarget(config: QelosNuxtRuntimeConfig): string | undefined;

package/dist/proxy-target.js

@@ -0,0 +1,26 @@
+/**
+ * Resolve the origin to which `/api/**` requests are proxied. The managed
+ * Qelos app URL (`config.appUrl`) is the proxy target — env vars are only
+ * dev-time overrides when the configured `appUrl` is not reachable from
+ * the local host.
+ *
+ * Priority (highest first):
+ *   1. `process.env.NUXT_QELOS_PROXY_TARGET`
+ *   2. `process.env.QELOS_IP`
+ *   3. `process.env.QELOS_API_IP`
+ *   4. `config.appUrl`
+ *
+ * Empty / whitespace-only values are skipped, and `undefined` is returned when
+ * nothing is configured so the caller can surface a clear error.
+ */
+export function resolveQelosProxyTarget(config) {
+    const env = process.env;
+    const fromEnv = env.NUXT_QELOS_PROXY_TARGET?.trim() ||
+        env.QELOS_IP?.trim() ||
+        env.QELOS_API_IP?.trim();
+    if (fromEnv)
+        return fromEnv;
+    const fromAppUrl = config.appUrl?.trim();
+    return fromAppUrl || undefined;
+}
+//# sourceMappingURL=proxy-target.js.map

package/dist/proxy-target.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"proxy-target.js","sourceRoot":"","sources":["../src/proxy-target.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,uBAAuB,CACrC,MAA8B;IAE9B,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;IACxB,MAAM,OAAO,GACX,GAAG,CAAC,uBAAuB,EAAE,IAAI,EAAE;QACnC,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE;QACpB,GAAG,CAAC,YAAY,EAAE,IAAI,EAAE,CAAC;IAC3B,IAAI,OAAO;QAAE,OAAO,OAAO,CAAC;IAE5B,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC;IACzC,OAAO,UAAU,IAAI,SAAS,CAAC;AACjC,CAAC"}

package/dist/runtime/api-proxy.d.ts

@@ -0,0 +1,2 @@
+declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<any>>;
+export default _default;

package/dist/runtime/api-proxy.js

@@ -0,0 +1,27 @@
+// This file is registered as a Nuxt server handler by `module.ts`. It is
+// bundled by Nitro, so `#imports` resolves at the consuming-app build time
+// (not at this package's `tsc` build).
+// @ts-ignore - resolved by Nitro
+import { useRuntimeConfig } from '#imports';
+import { createError, defineEventHandler, getRequestHeader, proxyRequest, } from 'h3';
+// @ts-ignore - resolved by Nitro (transitive dep of Nuxt)
+import { joinURL } from 'ufo';
+import { resolveQelosProxyTarget } from '../proxy-target';
+export default defineEventHandler((event) => {
+    const config = (useRuntimeConfig().qelos || {});
+    const base = resolveQelosProxyTarget(config);
+    if (!base) {
+        throw createError({
+            statusCode: 503,
+            statusMessage: '[@qelos/integrator-nuxt] Qelos API proxy is not configured. Set qelos.appUrl (or NUXT_QELOS_PROXY_TARGET / QELOS_IP / QELOS_API_IP in development).',
+        });
+    }
+    const originalHost = getRequestHeader(event, 'host');
+    const path = event.path.split('?')[0] ?? event.path;
+    const target = joinURL(base, path);
+    return proxyRequest(event, target, {
+        fetch: globalThis.fetch,
+        cookieDomainRewrite: { '*': originalHost ?? '' },
+    });
+});
+//# sourceMappingURL=api-proxy.js.map