@qelos/integrator-nuxt 4.0.0 → 4.1.0

package/dist/runtime/api-proxy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-proxy.js","sourceRoot":"","sources":["../../src/runtime/api-proxy.ts"],"names":[],"mappings":"AAAA,yEAAyE;AACzE,2EAA2E;AAC3E,uCAAuC;AACvC,iCAAiC;AACjC,OAAO,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AAC5C,OAAO,EACL,WAAW,EACX,kBAAkB,EAClB,gBAAgB,EAChB,YAAY,GACb,MAAM,IAAI,CAAC;AACZ,0DAA0D;AAC1D,OAAO,EAAE,OAAO,EAAE,MAAM,KAAK,CAAC;AAC9B,OAAO,EAAE,uBAAuB,EAAE,MAAM,iBAAiB,CAAC;AAG1D,eAAe,kBAAkB,CAAC,CAAC,KAAK,EAAE,EAAE;IAC1C,MAAM,MAAM,GAAG,CAAC,gBAAgB,EAAE,CAAC,KAAK,IAAI,EAAE,CAA2B,CAAC;IAC1E,MAAM,IAAI,GAAG,uBAAuB,CAAC,MAAM,CAAC,CAAC;IAC7C,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,WAAW,CAAC;YAChB,UAAU,EAAE,GAAG;YACf,aAAa,EACX,qJAAqJ;SACxJ,CAAC,CAAC;IACL,CAAC;IAED,MAAM,YAAY,GAAG,gBAAgB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACrD,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC;IACpD,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAEnC,OAAO,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE;QACjC,KAAK,EAAE,UAAU,CAAC,KAAK;QACvB,mBAAmB,EAAE,EAAE,GAAG,EAAE,YAAY,IAAI,EAAE,EAAE;KACjD,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/sdk-factory.d.ts

@@ -1,15 +1,8 @@
 import QelosSDK from '@qelos/sdk';
-import type { QelosNuxtRuntimeConfig, QelosTokenPair, TokenRefreshHook } from './types';
-import type { H3Event } from 'h3';
+import { type H3Event } from 'h3';
+import type { QelosNuxtRuntimeConfig } from './types';
 export interface CreateSdkParams {
     config: QelosNuxtRuntimeConfig;
-    /**
-     * Tokens for the current request. The factory mutates this object in
-     * place when a token refresh occurs, so callers can read the latest pair
-     * after the SDK has been used.
-     */
-    tokens: QelosTokenPair;
     event: H3Event;
-    onTokenRefresh?: TokenRefreshHook;
 }
-export declare function createRequestSdk({ config, tokens, event, onTokenRefresh }: CreateSdkParams): QelosSDK;
+export declare function createRequestSdk({ config, event }: CreateSdkParams): QelosSDK;

package/dist/sdk-factory.js

@@ -1,84 +1,28 @@
 import QelosSDK from '@qelos/sdk';
-const NO_AUTH_URLS = new Set([
-    '/api/token/refresh',
-    '/api/cookie/refresh',
-    '/api/signin',
-    '/api/signup',
-]);
-export function createRequestSdk({ config, tokens, event, onTokenRefresh }) {
-    let sdk;
-    let refreshInFlight = null;
+import { getRequestHeader } from 'h3';
+export function createRequestSdk({ config, event }) {
     const baseOptions = config.sdkOptions || {};
-    async function performRefresh() {
-        if (!tokens.refreshToken && !tokens.accessToken) {
-            throw new Error('no refresh token available');
-        }
-        const previous = {
-            accessToken: tokens.accessToken,
-            refreshToken: tokens.refreshToken,
-        };
-        let refreshed;
-        if (tokens.refreshToken) {
-            const result = await sdk.authentication.refreshToken(tokens.refreshToken);
-            refreshed = {
-                accessToken: result.payload.token,
-                refreshToken: result.payload.refreshToken,
-            };
-        }
-        else {
-            const result = await sdk.authentication.refreshCookieToken(tokens.accessToken);
-            refreshed = {
-                accessToken: result.payload.cookieToken,
-            };
-        }
-        tokens.accessToken = refreshed.accessToken;
-        tokens.refreshToken = refreshed.refreshToken;
-        if (onTokenRefresh) {
-            await onTokenRefresh({ event, oldTokens: previous, newTokens: refreshed, sdk });
-        }
-    }
-    function ensureRefresh() {
-        if (!refreshInFlight) {
-            refreshInFlight = performRefresh().finally(() => {
-                refreshInFlight = null;
-            });
-        }
-        return refreshInFlight;
-    }
     const options = {
         appUrl: config.appUrl,
         fetch: globalThis.fetch,
-        forceRefresh: !config.apiToken,
         ...baseOptions,
     };
     if (config.apiToken) {
         options.apiToken = config.apiToken;
+        return new QelosSDK(options);
     }
-    else {
-        if (tokens.accessToken) {
-            options.accessToken = tokens.accessToken;
+    options.extraHeaders = async () => {
+        const headers = {};
+        const cookieHeader = getRequestHeader(event, 'cookie');
+        if (cookieHeader) {
+            headers.cookie = cookieHeader;
         }
-        if (tokens.refreshToken) {
-            options.refreshToken = tokens.refreshToken;
+        const authHeader = getRequestHeader(event, 'authorization');
+        if (authHeader) {
+            headers.authorization = authHeader;
         }
-        options.extraHeaders = async (relativeUrl, forceRefresh) => {
-            if (NO_AUTH_URLS.has(relativeUrl)) {
-                return {};
-            }
-            if (forceRefresh && tokens.refreshToken) {
-                await ensureRefresh();
-            }
-            const token = sdk?.authentication?.accessToken || tokens.accessToken;
-            if (token) {
-                return { authorization: 'Bearer ' + token };
-            }
-            return {};
-        };
-        options.onFailedRefreshToken = async () => {
-            await ensureRefresh();
-        };
-    }
-    sdk = new QelosSDK(options);
-    return sdk;
+        return headers;
+    };
+    return new QelosSDK(options);
 }
 //# sourceMappingURL=sdk-factory.js.map

package/dist/sdk-factory.js.map

@@ -1 +1 @@
-{"version":3,"file":"sdk-factory.js","sourceRoot":"","sources":["../src/sdk-factory.ts"],"names":[],"mappings":"AAAA,OAAO,QAAQ,MAAM,YAAY,CAAC;AAsBlC,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC;IAC3B,oBAAoB;IACpB,qBAAqB;IACrB,aAAa;IACb,aAAa;CACd,CAAC,CAAC;AAEH,MAAM,UAAU,gBAAgB,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,EAAmB;IACzF,IAAI,GAAa,CAAC;IAClB,IAAI,eAAe,GAAyB,IAAI,CAAC;IAEjD,MAAM,WAAW,GAA6B,MAAM,CAAC,UAAU,IAAI,EAAE,CAAC;IAEtE,KAAK,UAAU,cAAc;QAC3B,IAAI,CAAC,MAAM,CAAC,YAAY,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;YAChD,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QAChD,CAAC;QACD,MAAM,QAAQ,GAAmB;YAC/B,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,YAAY,EAAE,MAAM,CAAC,YAAY;SAClC,CAAC;QACF,IAAI,SAAyB,CAAC;QAC9B,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;YACxB,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,cAAc,CAAC,YAAY,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;YAC1E,SAAS,GAAG;gBACV,WAAW,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK;gBACjC,YAAY,EAAE,MAAM,CAAC,OAAO,CAAC,YAAY;aAC1C,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,cAAc,CAAC,kBAAkB,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;YAC/E,SAAS,GAAG;gBACV,WAAW,EAAE,MAAM,CAAC,OAAO,CAAC,WAAW;aACxC,CAAC;QACJ,CAAC;QACD,MAAM,CAAC,WAAW,GAAG,SAAS,CAAC,WAAW,CAAC;QAC3C,MAAM,CAAC,YAAY,GAAG,SAAS,CAAC,YAAY,CAAC;QAC7C,IAAI,cAAc,EAAE,CAAC;YACnB,MAAM,cAAc,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC;QAClF,CAAC;IACH,CAAC;IAED,SAAS,aAAa;QACpB,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,eAAe,GAAG,cAAc,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE;gBAC9C,eAAe,GAAG,IAAI,CAAC;YACzB,CAAC,CAAC,CAAC;QACL,CAAC;QACD,OAAO,eAAe,CAAC;IACzB,CAAC;IAED,MAAM,OAAO,GAAoB;QAC/B,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,KAAK,EAAG,UAAU,CAAC,KAA8B;QACjD,YAAY,EAAE,CAAC,MAAM,CAAC,QAAQ;QAC9B,GAAG,WAAW;KACf,CAAC;IAEF,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACpB,OAAO,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;IACrC,CAAC;SAAM,CAAC;QACN,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;YACvB,OAAO,CAAC,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC;QAC3C,CAAC;QACD,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;YACxB,OAAO,CAAC,YAAY,GAAG,MAAM,CAAC,YAAY,CAAC;QAC7C,CAAC;QAED,OAAO,CAAC,YAAY,GAAG,KAAK,EAAE,WAAmB,EAAE,YAAsB,EAAE,EAAE;YAC3E,IAAI,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;gBAClC,OAAO,EAAE,CAAC;YACZ,CAAC;YACD,IAAI,YAAY,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;gBACxC,MAAM,aAAa,EAAE,CAAC;YACxB,CAAC;YACD,MAAM,KAAK,GAAG,GAAG,EAAE,cAAc,EAAE,WAAW,IAAI,MAAM,CAAC,WAAW,CAAC;YACrE,IAAI,KAAK,EAAE,CAAC;gBACV,OAAO,EAAE,aAAa,EAAE,SAAS,GAAG,KAAK,EAAE,CAAC;YAC9C,CAAC;YACD,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC;QAEF,OAAO,CAAC,oBAAoB,GAAG,KAAK,IAAI,EAAE;YACxC,MAAM,aAAa,EAAE,CAAC;QACxB,CAAC,CAAC;IACJ,CAAC;IAED,GAAG,GAAG,IAAI,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC5B,OAAO,GAAG,CAAC;AACb,CAAC"}
+{"version":3,"file":"sdk-factory.js","sourceRoot":"","sources":["../src/sdk-factory.ts"],"names":[],"mappings":"AAAA,OAAO,QAAQ,MAAM,YAAY,CAAC;AAElC,OAAO,EAAE,gBAAgB,EAAgB,MAAM,IAAI,CAAC;AAQpD,MAAM,UAAU,gBAAgB,CAAC,EAAE,MAAM,EAAE,KAAK,EAAmB;IACjE,MAAM,WAAW,GAA6B,MAAM,CAAC,UAAU,IAAI,EAAE,CAAC;IAEtE,MAAM,OAAO,GAAoB;QAC/B,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,KAAK,EAAG,UAAU,CAAC,KAA8B;QACjD,GAAG,WAAW;KACf,CAAC;IAEF,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACpB,OAAO,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;QACnC,OAAO,IAAI,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC/B,CAAC;IAED,OAAO,CAAC,YAAY,GAAG,KAAK,IAAI,EAAE;QAChC,MAAM,OAAO,GAA2B,EAAE,CAAC;QAC3C,MAAM,YAAY,GAAG,gBAAgB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QACvD,IAAI,YAAY,EAAE,CAAC;YACjB,OAAO,CAAC,MAAM,GAAG,YAAY,CAAC;QAChC,CAAC;QACD,MAAM,UAAU,GAAG,gBAAgB,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC;QAC5D,IAAI,UAAU,EAAE,CAAC;YACf,OAAO,CAAC,aAAa,GAAG,UAAU,CAAC;QACrC,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC;IAEF,OAAO,IAAI,QAAQ,CAAC,OAAO,CAAC,CAAC;AAC/B,CAAC"}

package/dist/types.d.ts

@@ -2,10 +2,6 @@ import type QelosSDK from '@qelos/sdk';
 import type { IUser } from '@qelos/sdk/dist/authentication';
 import type { IWorkspace } from '@qelos/sdk/workspaces';
 import type { QelosSDKOptions } from '@qelos/sdk/types';
-export interface QelosTokenPair {
-    accessToken?: string;
-    refreshToken?: string;
-}
 export interface QelosNuxtRuntimeConfig {
     /**
      * Base URL of the Qelos backend (e.g. https://yourdomain.com).
@@ -13,17 +9,9 @@ export interface QelosNuxtRuntimeConfig {
     appUrl: string;
     /**
      * Static API token used for service-to-service calls. When provided, no
-     * cookie/refresh-token handling is performed.
+     * cookie-based authentication is performed.
      */
     apiToken?: string;
-    /**
-     * Cookie name carrying the Qelos access token. Defaults to `q_access_token`.
-     */
-    accessTokenCookie?: string;
-    /**
-     * Cookie name carrying the Qelos refresh token. Defaults to `q_refresh_token`.
-     */
-    refreshTokenCookie?: string;
     /**
      * Path to mount the server middleware on. Defaults to `''` (every request).
      */
@@ -42,18 +30,12 @@ export interface QelosNuxtRuntimeConfig {
      * Optional extra options merged into the per-request SDK instance.
      */
     sdkOptions?: Partial<QelosSDKOptions>;
+    /**
+     * If true, the catch-all `/api/**` proxy handler is not registered.
+     * Defaults to `false`.
+     */
+    disableProxy?: boolean;
 }
-export interface ResolvedTokens {
-    accessToken: string;
-    refreshToken?: string;
-}
-export interface TokenRefreshContext {
-    event: import('h3').H3Event;
-    oldTokens: QelosTokenPair;
-    newTokens: ResolvedTokens;
-    sdk: QelosSDK;
-}
-export type TokenRefreshHook = (ctx: TokenRefreshContext) => void | Promise<void>;
 export interface QelosRequestContext {
     /**
      * The authenticated user, or `null` when anonymous.
@@ -69,13 +51,11 @@ export interface QelosRequestContext {
      */
     workspaces: IWorkspace[];
     /**
-     * SDK instance bound to the current request's tokens.
+     * SDK instance bound to the current request's cookies. `extraHeaders`
+     * re-reads cookies live on each call, so cookie rotations applied by the
+     * middleware are picked up automatically.
      */
     sdk: QelosSDK;
-    /**
-     * Tokens read from the request. Mutated when a refresh occurs.
-     */
-    tokens: QelosTokenPair;
 }
 declare module 'h3' {
     interface H3EventContext {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@qelos/integrator-nuxt",
-  "version": "4.0.0",
+  "version": "4.1.0",
   "type": "module",
   "description": "Nuxt integrator for Qelos: server middleware/module that identifies the user and workspace from the Qelos SDK before your handlers run.",
   "main": "./dist/module.js",
@@ -59,7 +59,7 @@
     }
   },
   "dependencies": {
-    "@qelos/sdk": "4.0.0"
+    "@qelos/sdk": "4.1.0"
   },
   "devDependencies": {
     "@nuxt/kit": "^3.13.0",

package/src/cookies.test.ts

@@ -0,0 +1,112 @@
+// Run with: `tsx --test integrators/nuxt/src/cookies.test.ts`
+import { describe, it } from 'node:test';
+import assert from 'node:assert/strict';
+import { rewriteSetCookieDomain, rewriteSetCookieDomains } from './cookies';
+
+describe('rewriteSetCookieDomain', () => {
+  it('replaces a leading-dot Domain value', () => {
+    const input = 'sid=abc; Path=/; Domain=.qelos.app; HttpOnly; Secure';
+    assert.equal(
+      rewriteSetCookieDomain(input, 'example.com'),
+      'sid=abc; Path=/; Domain=example.com; HttpOnly; Secure',
+    );
+  });
+
+  it('replaces a wildcard Domain value', () => {
+    const input = 'sid=abc; Path=/; Domain=*.qelos.app; HttpOnly';
+    assert.equal(
+      rewriteSetCookieDomain(input, 'example.com'),
+      'sid=abc; Path=/; Domain=example.com; HttpOnly',
+    );
+  });
+
+  it('returns the cookie unchanged when no Domain attribute is present', () => {
+    const input = 'sid=abc; Path=/; HttpOnly; Secure; SameSite=Lax';
+    assert.equal(rewriteSetCookieDomain(input, 'example.com'), input);
+  });
+
+  it('strips the port from a host:port newDomain before substitution', () => {
+    const input = 'sid=abc; Domain=.qelos.app; Path=/';
+    assert.equal(
+      rewriteSetCookieDomain(input, 'localhost:3000'),
+      'sid=abc; Domain=localhost; Path=/',
+    );
+  });
+
+  it('preserves attribute order and other attributes across replacement', () => {
+    const input =
+      'sid=abc; Path=/; Domain=.qelos.app; HttpOnly; Secure; SameSite=Lax; Max-Age=3600';
+    assert.equal(
+      rewriteSetCookieDomain(input, 'example.com'),
+      'sid=abc; Path=/; Domain=example.com; HttpOnly; Secure; SameSite=Lax; Max-Age=3600',
+    );
+  });
+
+  it('preserves an Expires attribute (which contains commas) across replacement', () => {
+    const input =
+      'sid=abc; Domain=.qelos.app; Expires=Wed, 21 Oct 2026 07:28:00 GMT; Path=/';
+    assert.equal(
+      rewriteSetCookieDomain(input, 'example.com'),
+      'sid=abc; Domain=example.com; Expires=Wed, 21 Oct 2026 07:28:00 GMT; Path=/',
+    );
+  });
+
+  it('matches the Domain attribute name case-insensitively and preserves its casing', () => {
+    const input = 'sid=abc; domain=.qelos.app; Path=/';
+    assert.equal(
+      rewriteSetCookieDomain(input, 'example.com'),
+      'sid=abc; domain=example.com; Path=/',
+    );
+  });
+
+  it('strips the entire Domain segment when newDomain is undefined', () => {
+    const input =
+      'sid=abc; Path=/; Domain=.qelos.app; HttpOnly; Secure; SameSite=Lax';
+    assert.equal(
+      rewriteSetCookieDomain(input, undefined),
+      'sid=abc; Path=/; HttpOnly; Secure; SameSite=Lax',
+    );
+  });
+
+  it('strips the entire Domain segment when newDomain is an empty string', () => {
+    const input = 'sid=abc; Domain=.qelos.app; Path=/';
+    assert.equal(
+      rewriteSetCookieDomain(input, ''),
+      'sid=abc; Path=/',
+    );
+  });
+
+  it('removes the Domain segment when it is the last attribute', () => {
+    const input = 'sid=abc; Path=/; Domain=.qelos.app';
+    assert.equal(
+      rewriteSetCookieDomain(input, undefined),
+      'sid=abc; Path=/',
+    );
+  });
+});
+
+describe('rewriteSetCookieDomains', () => {
+  it('applies the rewrite to each entry of an array', () => {
+    const values = [
+      'a=1; Domain=.qelos.app; Path=/',
+      'b=2; Path=/; HttpOnly',
+      'c=3; Domain=*.qelos.app; Secure',
+    ];
+    assert.deepEqual(rewriteSetCookieDomains(values, 'example.com'), [
+      'a=1; Domain=example.com; Path=/',
+      'b=2; Path=/; HttpOnly',
+      'c=3; Domain=example.com; Secure',
+    ]);
+  });
+
+  it('strips the Domain segment from each entry when newDomain is undefined', () => {
+    const values = [
+      'a=1; Domain=.qelos.app; Path=/',
+      'b=2; Domain=*.qelos.app; HttpOnly',
+    ];
+    assert.deepEqual(rewriteSetCookieDomains(values, undefined), [
+      'a=1; Path=/',
+      'b=2; HttpOnly',
+    ]);
+  });
+});

package/src/cookies.ts

@@ -0,0 +1,49 @@
+/**
+ * Rewrite the `Domain=` attribute of a single `Set-Cookie` header value.
+ *
+ * - If the cookie contains a `Domain=<value>` attribute (case-insensitive), its
+ *   value is replaced with `newDomain`, with any trailing `:port` suffix
+ *   stripped first (cookie `Domain` attributes do not include a port).
+ * - If `newDomain` is `undefined` (or empty), the entire `; Domain=<value>`
+ *   segment is removed so the browser scopes the cookie to the current host.
+ * - If no `Domain=` attribute is present, the input is returned unchanged.
+ *
+ * All other attributes, their casing/order and the original cookie name/value
+ * bytes are preserved.
+ */
+export function rewriteSetCookieDomain(
+  setCookie: string,
+  newDomain: string | undefined,
+): string {
+  const domainSegment = /;\s*Domain\s*=\s*[^;]+/i;
+  if (!domainSegment.test(setCookie)) return setCookie;
+
+  const stripped = newDomain ? stripPort(newDomain) : '';
+  if (!stripped) {
+    return setCookie.replace(domainSegment, '');
+  }
+  return setCookie.replace(
+    /(;\s*Domain\s*=\s*)[^;]+/i,
+    `$1${stripped}`,
+  );
+}
+
+/**
+ * Apply {@link rewriteSetCookieDomain} to each entry of a `Set-Cookie` array
+ * (e.g. the result of `Headers.getSetCookie()`).
+ */
+export function rewriteSetCookieDomains(
+  values: string[],
+  newDomain: string | undefined,
+): string[] {
+  return values.map((value) => rewriteSetCookieDomain(value, newDomain));
+}
+
+function stripPort(host: string): string {
+  if (host.startsWith('[')) {
+    const end = host.indexOf(']');
+    return end === -1 ? host : host.slice(1, end);
+  }
+  const colon = host.indexOf(':');
+  return colon === -1 ? host : host.slice(0, colon);
+}

package/src/middleware.ts

@@ -1,34 +1,23 @@
 import {
+  appendResponseHeader,
+  createError,
   defineEventHandler,
-  getCookie,
   getRequestHeader,
-  setCookie,
-  createError,
   type H3Event,
 } from 'h3';
 import type { IUser } from '@qelos/sdk/dist/authentication';
 import type { IWorkspace } from '@qelos/sdk/workspaces';
+import { rewriteSetCookieDomain } from './cookies';
+import { resolveQelosProxyTarget } from './proxy-target';
 import { createRequestSdk } from './sdk-factory';
-import type {
-  QelosNuxtRuntimeConfig,
-  QelosRequestContext,
-  QelosTokenPair,
-  TokenRefreshHook,
-} from './types';
-
-const DEFAULT_ACCESS_COOKIE = 'q_access_token';
-const DEFAULT_REFRESH_COOKIE = 'q_refresh_token';
+import type { QelosNuxtRuntimeConfig, QelosRequestContext } from './types';
 
 export interface CreateMiddlewareOptions {
   config: QelosNuxtRuntimeConfig;
   /**
-   * Hook invoked after a successful token refresh. The default implementation
-   * writes the new tokens back to the response cookies.
-   */
-  onTokenRefresh?: TokenRefreshHook;
-  /**
-   * Resolve the active workspace for a request. Defaults to picking the first
-   * workspace returned from `sdk.workspaces.getList()`.
+   * Resolve the active workspace for a request. Defaults to whatever
+   * `/api/me` reports on `user.workspace` (the user's currently activated
+   * workspace, or `null` when none is active).
    */
   resolveWorkspace?: (params: {
     event: H3Event;
@@ -37,43 +26,6 @@ export interface CreateMiddlewareOptions {
   }) => IWorkspace | null | Promise<IWorkspace | null>;
 }
 
-function readTokens(event: H3Event, config: QelosNuxtRuntimeConfig): QelosTokenPair {
-  const accessCookie = config.accessTokenCookie || DEFAULT_ACCESS_COOKIE;
-  const refreshCookie = config.refreshTokenCookie || DEFAULT_REFRESH_COOKIE;
-
-  const cookieAccess = getCookie(event, accessCookie);
-  const cookieRefresh = getCookie(event, refreshCookie);
-
-  const authHeader = getRequestHeader(event, 'authorization');
-  const headerAccess = authHeader && authHeader.toLowerCase().startsWith('bearer ')
-    ? authHeader.slice(7).trim()
-    : undefined;
-
-  return {
-    accessToken: headerAccess || cookieAccess || undefined,
-    refreshToken: cookieRefresh || undefined,
-  };
-}
-
-function writeTokensToCookies(
-  event: H3Event,
-  config: QelosNuxtRuntimeConfig,
-  tokens: { accessToken: string; refreshToken?: string },
-) {
-  const accessCookie = config.accessTokenCookie || DEFAULT_ACCESS_COOKIE;
-  const refreshCookie = config.refreshTokenCookie || DEFAULT_REFRESH_COOKIE;
-  const cookieOptions = {
-    httpOnly: true,
-    secure: true,
-    sameSite: 'lax' as const,
-    path: '/',
-  };
-  setCookie(event, accessCookie, tokens.accessToken, cookieOptions);
-  if (tokens.refreshToken) {
-    setCookie(event, refreshCookie, tokens.refreshToken, cookieOptions);
-  }
-}
-
 function shouldSkip(event: H3Event, config: QelosNuxtRuntimeConfig): boolean {
   if (!config.skipPaths?.length) {
     return false;
@@ -82,41 +34,74 @@ function shouldSkip(event: H3Event, config: QelosNuxtRuntimeConfig): boolean {
   return config.skipPaths.some((prefix) => path.startsWith(prefix));
 }
 
+function buildMeUrl(base: string): string {
+  return `${base.replace(/\/+$/, '')}/api/me`;
+}
+
 export function createQelosMiddleware(options: CreateMiddlewareOptions) {
   const { config, resolveWorkspace } = options;
-  const onTokenRefresh: TokenRefreshHook = options.onTokenRefresh
-    || (async ({ event, newTokens }) => {
-      writeTokensToCookies(event, config, newTokens);
-    });
 
   return defineEventHandler(async (event) => {
     if (shouldSkip(event, config)) {
       return;
     }
 
-    const tokens = readTokens(event, config);
-    const sdk = createRequestSdk({ config, tokens, event, onTokenRefresh });
+    const sdk = createRequestSdk({ config, event });
 
     const ctx: QelosRequestContext = {
       user: null,
       workspace: null,
       workspaces: [],
       sdk,
-      tokens,
     };
     event.context.qelos = ctx;
 
-    const hasAuthMaterial = Boolean(config.apiToken || tokens.accessToken || tokens.refreshToken);
-    if (!hasAuthMaterial) {
+    const base = resolveQelosProxyTarget(config);
+    if (!base && !config.apiToken) {
       if (config.requireAuth) {
         throw createError({ statusCode: 401, statusMessage: 'Unauthorized' });
       }
       return;
     }
 
-    try {
-      ctx.user = await sdk.authentication.getLoggedInUser();
-    } catch (err) {
+    if (base) {
+      const headers: Record<string, string> = {};
+      const cookieHeader = getRequestHeader(event, 'cookie');
+      if (cookieHeader) headers.cookie = cookieHeader;
+      const authHeader = getRequestHeader(event, 'authorization');
+      if (authHeader) headers.authorization = authHeader;
+
+      const originalHost = getRequestHeader(event, 'host');
+
+      let response: Response | undefined;
+      try {
+        response = await fetch(buildMeUrl(base), {
+          method: 'GET',
+          headers,
+          redirect: 'manual',
+        });
+      } catch {
+        if (config.requireAuth) {
+          throw createError({ statusCode: 401, statusMessage: 'Unauthorized' });
+        }
+        return;
+      }
+
+      const setCookieValues = response.headers.getSetCookie?.() ?? [];
+      for (const value of setCookieValues) {
+        appendResponseHeader(event, 'set-cookie', rewriteSetCookieDomain(value, originalHost));
+      }
+
+      if (response.ok) {
+        try {
+          ctx.user = (await response.json()) as IUser;
+        } catch {
+          ctx.user = null;
+        }
+      }
+    }
+
+    if (!ctx.user) {
       if (config.requireAuth) {
         throw createError({ statusCode: 401, statusMessage: 'Unauthorized' });
       }
@@ -129,16 +114,18 @@ export function createQelosMiddleware(options: CreateMiddlewareOptions) {
       ctx.workspaces = [];
     }
 
-    if (ctx.user && ctx.workspaces.length) {
-      if (resolveWorkspace) {
-        ctx.workspace = await resolveWorkspace({
-          event,
-          user: ctx.user,
-          workspaces: ctx.workspaces,
-        }) || null;
-      } else {
-        ctx.workspace = ctx.workspaces[0] || null;
-      }
+    if (resolveWorkspace) {
+      ctx.workspace = (await resolveWorkspace({
+        event,
+        user: ctx.user,
+        workspaces: ctx.workspaces,
+      })) || null;
+    } else {
+      // `/api/me` carries `user.workspace` (`{ _id, name, roles }`) only when
+      // the user has activated a workspace. Null means the frontend must
+      // prompt to activate/create one — don't silently pick workspaces[0].
+      ctx.workspace =
+        (ctx.user as unknown as { workspace?: IWorkspace | null }).workspace || null;
     }
   });
 }

package/src/module.ts

@@ -13,6 +13,11 @@ export interface QelosNuxtModuleOptions extends QelosNuxtRuntimeConfig {
    * want to call `createQelosMiddleware` yourself from your own server route.
    */
   disableMiddleware?: boolean;
+  /**
+   * Disable registration of the catch-all `/api/**` proxy server handler.
+   * Defaults to `false`.
+   */
+  disableProxy?: boolean;
 }
 
 export default defineNuxtModule<QelosNuxtModuleOptions>({
@@ -33,7 +38,22 @@ export default defineNuxtModule<QelosNuxtModuleOptions>({
 
     const { resolve } = createResolver(import.meta.url);
 
-    const { disableMiddleware, ...runtimeConfig } = options;
+    const { disableMiddleware, disableProxy, ...runtimeConfig } = options;
+
+    if (!disableProxy) {
+      // When the catch-all `/api/**` proxy is enabled, the user-resolution
+      // middleware MUST skip `/api/` requests. The middleware itself calls
+      // `${appUrl}/api/me` to identify the user, so without this skip
+      // every inbound `/api/me` would be both proxied AND used as the
+      // identification probe — a duplicate upstream hit and a potential
+      // cookie-rewrite loop. Users can extend `skipPaths` further but
+      // `/api/` must remain covered whenever `disableProxy` is false.
+      const existingSkipPaths = runtimeConfig.skipPaths ?? [];
+      const alreadyCovered = existingSkipPaths.some((prefix) => '/api/'.startsWith(prefix));
+      if (!alreadyCovered) {
+        runtimeConfig.skipPaths = ['/api/', ...existingSkipPaths];
+      }
+    }
 
     nuxt.options.runtimeConfig.qelos = {
       ...(nuxt.options.runtimeConfig.qelos as Record<string, unknown> | undefined),
@@ -47,6 +67,13 @@ export default defineNuxtModule<QelosNuxtModuleOptions>({
       });
     }
 
+    if (!disableProxy) {
+      addServerHandler({
+        route: '/api/**',
+        handler: resolve('./runtime/api-proxy'),
+      });
+    }
+
     addImportsDir(resolve('./runtime/composables'));
 
     addTypeTemplate({
@@ -77,8 +104,4 @@ export type {
 export type {
   QelosNuxtRuntimeConfig,
   QelosRequestContext,
-  QelosTokenPair,
-  ResolvedTokens,
-  TokenRefreshContext,
-  TokenRefreshHook,
 } from './types';