@qelos/integrator-nuxt 4.0.0 → 4.1.0

package/src/proxy-target.test.ts

@@ -0,0 +1,110 @@
+import { describe, it, beforeEach, afterEach } from 'node:test';
+import assert from 'node:assert/strict';
+import { resolveQelosProxyTarget } from './proxy-target';
+import type { QelosNuxtRuntimeConfig } from './types';
+
+const PROXY_ENV_KEYS = [
+  'NUXT_QELOS_PROXY_TARGET',
+  'QELOS_IP',
+  'QELOS_API_IP',
+] as const;
+
+function clearProxyEnv(): void {
+  for (const key of PROXY_ENV_KEYS) {
+    delete process.env[key];
+  }
+}
+
+describe('resolveQelosProxyTarget', () => {
+  const savedEnv: Record<string, string | undefined> = {};
+
+  beforeEach(() => {
+    for (const key of PROXY_ENV_KEYS) {
+      savedEnv[key] = process.env[key];
+    }
+    clearProxyEnv();
+  });
+
+  afterEach(() => {
+    for (const key of PROXY_ENV_KEYS) {
+      if (savedEnv[key] === undefined) {
+        delete process.env[key];
+      } else {
+        process.env[key] = savedEnv[key];
+      }
+    }
+  });
+
+  it('uses NUXT_QELOS_PROXY_TARGET when set, even if other env vars and appUrl exist', () => {
+    process.env.NUXT_QELOS_PROXY_TARGET = 'https://from-nuxt-env.example';
+    process.env.QELOS_IP = 'https://from-qelos-ip.example';
+    process.env.QELOS_API_IP = 'https://from-qelos-api-ip.example';
+    const config: QelosNuxtRuntimeConfig = {
+      appUrl: 'https://from-app-url.example',
+    };
+    assert.equal(
+      resolveQelosProxyTarget(config),
+      'https://from-nuxt-env.example',
+    );
+  });
+
+  it('falls back to QELOS_IP when NUXT_QELOS_PROXY_TARGET is unset', () => {
+    process.env.QELOS_IP = 'https://from-qelos-ip.example';
+    process.env.QELOS_API_IP = 'https://from-qelos-api-ip.example';
+    const config: QelosNuxtRuntimeConfig = {
+      appUrl: 'https://from-app-url.example',
+    };
+    assert.equal(
+      resolveQelosProxyTarget(config),
+      'https://from-qelos-ip.example',
+    );
+  });
+
+  it('falls back to QELOS_API_IP when higher-priority env vars are unset', () => {
+    process.env.QELOS_API_IP = 'https://from-qelos-api-ip.example';
+    const config: QelosNuxtRuntimeConfig = {
+      appUrl: 'https://from-app-url.example',
+    };
+    assert.equal(
+      resolveQelosProxyTarget(config),
+      'https://from-qelos-api-ip.example',
+    );
+  });
+
+  it('falls back to config.appUrl when no env var is set', () => {
+    const config: QelosNuxtRuntimeConfig = {
+      appUrl: 'https://from-app-url.example',
+    };
+    assert.equal(
+      resolveQelosProxyTarget(config),
+      'https://from-app-url.example',
+    );
+  });
+
+  it('returns undefined when nothing is configured', () => {
+    const config: QelosNuxtRuntimeConfig = { appUrl: '' };
+    assert.equal(resolveQelosProxyTarget(config), undefined);
+  });
+
+  it('treats whitespace-only values as unset', () => {
+    process.env.NUXT_QELOS_PROXY_TARGET = '   ';
+    process.env.QELOS_IP = '\t';
+    const config: QelosNuxtRuntimeConfig = {
+      appUrl: 'https://from-app-url.example',
+    };
+    assert.equal(
+      resolveQelosProxyTarget(config),
+      'https://from-app-url.example',
+    );
+  });
+
+  it('trims surrounding whitespace from resolved values', () => {
+    const config: QelosNuxtRuntimeConfig = {
+      appUrl: '  https://trimmed.example  ',
+    };
+    assert.equal(
+      resolveQelosProxyTarget(config),
+      'https://trimmed.example',
+    );
+  });
+});

package/src/proxy-target.ts

@@ -0,0 +1,30 @@
+import type { QelosNuxtRuntimeConfig } from './types';
+
+/**
+ * Resolve the origin to which `/api/**` requests are proxied. The managed
+ * Qelos app URL (`config.appUrl`) is the proxy target — env vars are only
+ * dev-time overrides when the configured `appUrl` is not reachable from
+ * the local host.
+ *
+ * Priority (highest first):
+ *   1. `process.env.NUXT_QELOS_PROXY_TARGET`
+ *   2. `process.env.QELOS_IP`
+ *   3. `process.env.QELOS_API_IP`
+ *   4. `config.appUrl`
+ *
+ * Empty / whitespace-only values are skipped, and `undefined` is returned when
+ * nothing is configured so the caller can surface a clear error.
+ */
+export function resolveQelosProxyTarget(
+  config: QelosNuxtRuntimeConfig,
+): string | undefined {
+  const env = process.env;
+  const fromEnv =
+    env.NUXT_QELOS_PROXY_TARGET?.trim() ||
+    env.QELOS_IP?.trim() ||
+    env.QELOS_API_IP?.trim();
+  if (fromEnv) return fromEnv;
+
+  const fromAppUrl = config.appUrl?.trim();
+  return fromAppUrl || undefined;
+}

package/src/runtime/api-proxy.ts

@@ -0,0 +1,36 @@
+// This file is registered as a Nuxt server handler by `module.ts`. It is
+// bundled by Nitro, so `#imports` resolves at the consuming-app build time
+// (not at this package's `tsc` build).
+// @ts-ignore - resolved by Nitro
+import { useRuntimeConfig } from '#imports';
+import {
+  createError,
+  defineEventHandler,
+  getRequestHeader,
+  proxyRequest,
+} from 'h3';
+// @ts-ignore - resolved by Nitro (transitive dep of Nuxt)
+import { joinURL } from 'ufo';
+import { resolveQelosProxyTarget } from '../proxy-target';
+import type { QelosNuxtRuntimeConfig } from '../types';
+
+export default defineEventHandler((event) => {
+  const config = (useRuntimeConfig().qelos || {}) as QelosNuxtRuntimeConfig;
+  const base = resolveQelosProxyTarget(config);
+  if (!base) {
+    throw createError({
+      statusCode: 503,
+      statusMessage:
+        '[@qelos/integrator-nuxt] Qelos API proxy is not configured. Set qelos.appUrl (or NUXT_QELOS_PROXY_TARGET / QELOS_IP / QELOS_API_IP in development).',
+    });
+  }
+
+  const originalHost = getRequestHeader(event, 'host');
+  const path = event.path.split('?')[0] ?? event.path;
+  const target = joinURL(base, path);
+
+  return proxyRequest(event, target, {
+    fetch: globalThis.fetch,
+    cookieDomainRewrite: { '*': originalHost ?? '' },
+  });
+});

package/src/sdk-factory.ts

@@ -1,111 +1,39 @@
 import QelosSDK from '@qelos/sdk';
 import type { QelosSDKOptions, FetchLike } from '@qelos/sdk/types';
-import type {
-  QelosNuxtRuntimeConfig,
-  QelosTokenPair,
-  ResolvedTokens,
-  TokenRefreshHook,
-} from './types';
-import type { H3Event } from 'h3';
+import { getRequestHeader, type H3Event } from 'h3';
+import type { QelosNuxtRuntimeConfig } from './types';
 
 export interface CreateSdkParams {
   config: QelosNuxtRuntimeConfig;
-  /**
-   * Tokens for the current request. The factory mutates this object in
-   * place when a token refresh occurs, so callers can read the latest pair
-   * after the SDK has been used.
-   */
-  tokens: QelosTokenPair;
   event: H3Event;
-  onTokenRefresh?: TokenRefreshHook;
 }
 
-const NO_AUTH_URLS = new Set([
-  '/api/token/refresh',
-  '/api/cookie/refresh',
-  '/api/signin',
-  '/api/signup',
-]);
-
-export function createRequestSdk({ config, tokens, event, onTokenRefresh }: CreateSdkParams): QelosSDK {
-  let sdk: QelosSDK;
-  let refreshInFlight: Promise<void> | null = null;
-
+export function createRequestSdk({ config, event }: CreateSdkParams): QelosSDK {
   const baseOptions: Partial<QelosSDKOptions> = config.sdkOptions || {};
 
-  async function performRefresh(): Promise<void> {
-    if (!tokens.refreshToken && !tokens.accessToken) {
-      throw new Error('no refresh token available');
-    }
-    const previous: QelosTokenPair = {
-      accessToken: tokens.accessToken,
-      refreshToken: tokens.refreshToken,
-    };
-    let refreshed: ResolvedTokens;
-    if (tokens.refreshToken) {
-      const result = await sdk.authentication.refreshToken(tokens.refreshToken);
-      refreshed = {
-        accessToken: result.payload.token,
-        refreshToken: result.payload.refreshToken,
-      };
-    } else {
-      const result = await sdk.authentication.refreshCookieToken(tokens.accessToken);
-      refreshed = {
-        accessToken: result.payload.cookieToken,
-      };
-    }
-    tokens.accessToken = refreshed.accessToken;
-    tokens.refreshToken = refreshed.refreshToken;
-    if (onTokenRefresh) {
-      await onTokenRefresh({ event, oldTokens: previous, newTokens: refreshed, sdk });
-    }
-  }
-
-  function ensureRefresh(): Promise<void> {
-    if (!refreshInFlight) {
-      refreshInFlight = performRefresh().finally(() => {
-        refreshInFlight = null;
-      });
-    }
-    return refreshInFlight;
-  }
-
   const options: QelosSDKOptions = {
     appUrl: config.appUrl,
     fetch: (globalThis.fetch as unknown as FetchLike),
-    forceRefresh: !config.apiToken,
     ...baseOptions,
   };
 
   if (config.apiToken) {
     options.apiToken = config.apiToken;
-  } else {
-    if (tokens.accessToken) {
-      options.accessToken = tokens.accessToken;
+    return new QelosSDK(options);
+  }
+
+  options.extraHeaders = async () => {
+    const headers: Record<string, string> = {};
+    const cookieHeader = getRequestHeader(event, 'cookie');
+    if (cookieHeader) {
+      headers.cookie = cookieHeader;
     }
-    if (tokens.refreshToken) {
-      options.refreshToken = tokens.refreshToken;
+    const authHeader = getRequestHeader(event, 'authorization');
+    if (authHeader) {
+      headers.authorization = authHeader;
     }
+    return headers;
+  };
 
-    options.extraHeaders = async (relativeUrl: string, forceRefresh?: boolean) => {
-      if (NO_AUTH_URLS.has(relativeUrl)) {
-        return {};
-      }
-      if (forceRefresh && tokens.refreshToken) {
-        await ensureRefresh();
-      }
-      const token = sdk?.authentication?.accessToken || tokens.accessToken;
-      if (token) {
-        return { authorization: 'Bearer ' + token };
-      }
-      return {};
-    };
-
-    options.onFailedRefreshToken = async () => {
-      await ensureRefresh();
-    };
-  }
-
-  sdk = new QelosSDK(options);
-  return sdk;
+  return new QelosSDK(options);
 }

package/src/types.ts

@@ -3,11 +3,6 @@ import type { IUser } from '@qelos/sdk/dist/authentication';
 import type { IWorkspace } from '@qelos/sdk/workspaces';
 import type { QelosSDKOptions } from '@qelos/sdk/types';
 
-export interface QelosTokenPair {
-  accessToken?: string;
-  refreshToken?: string;
-}
-
 export interface QelosNuxtRuntimeConfig {
   /**
    * Base URL of the Qelos backend (e.g. https://yourdomain.com).
@@ -15,17 +10,9 @@ export interface QelosNuxtRuntimeConfig {
   appUrl: string;
   /**
    * Static API token used for service-to-service calls. When provided, no
-   * cookie/refresh-token handling is performed.
+   * cookie-based authentication is performed.
    */
   apiToken?: string;
-  /**
-   * Cookie name carrying the Qelos access token. Defaults to `q_access_token`.
-   */
-  accessTokenCookie?: string;
-  /**
-   * Cookie name carrying the Qelos refresh token. Defaults to `q_refresh_token`.
-   */
-  refreshTokenCookie?: string;
   /**
    * Path to mount the server middleware on. Defaults to `''` (every request).
    */
@@ -44,22 +31,13 @@ export interface QelosNuxtRuntimeConfig {
    * Optional extra options merged into the per-request SDK instance.
    */
   sdkOptions?: Partial<QelosSDKOptions>;
+  /**
+   * If true, the catch-all `/api/**` proxy handler is not registered.
+   * Defaults to `false`.
+   */
+  disableProxy?: boolean;
 }
 
-export interface ResolvedTokens {
-  accessToken: string;
-  refreshToken?: string;
-}
-
-export interface TokenRefreshContext {
-  event: import('h3').H3Event;
-  oldTokens: QelosTokenPair;
-  newTokens: ResolvedTokens;
-  sdk: QelosSDK;
-}
-
-export type TokenRefreshHook = (ctx: TokenRefreshContext) => void | Promise<void>;
-
 export interface QelosRequestContext {
   /**
    * The authenticated user, or `null` when anonymous.
@@ -75,13 +53,11 @@ export interface QelosRequestContext {
    */
   workspaces: IWorkspace[];
   /**
-   * SDK instance bound to the current request's tokens.
+   * SDK instance bound to the current request's cookies. `extraHeaders`
+   * re-reads cookies live on each call, so cookie rotations applied by the
+   * middleware are picked up automatically.
    */
   sdk: QelosSDK;
-  /**
-   * Tokens read from the request. Mutated when a refresh occurs.
-   */
-  tokens: QelosTokenPair;
 }
 
 declare module 'h3' {