@qelos/integrator-nuxt 4.0.1 → 4.1.0

package/dist/cookies.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Rewrite the `Domain=` attribute of a single `Set-Cookie` header value.
+ *
+ * - If the cookie contains a `Domain=<value>` attribute (case-insensitive), its
+ *   value is replaced with `newDomain`, with any trailing `:port` suffix
+ *   stripped first (cookie `Domain` attributes do not include a port).
+ * - If `newDomain` is `undefined` (or empty), the entire `; Domain=<value>`
+ *   segment is removed so the browser scopes the cookie to the current host.
+ * - If no `Domain=` attribute is present, the input is returned unchanged.
+ *
+ * All other attributes, their casing/order and the original cookie name/value
+ * bytes are preserved.
+ */
+export declare function rewriteSetCookieDomain(setCookie: string, newDomain: string | undefined): string;
+/**
+ * Apply {@link rewriteSetCookieDomain} to each entry of a `Set-Cookie` array
+ * (e.g. the result of `Headers.getSetCookie()`).
+ */
+export declare function rewriteSetCookieDomains(values: string[], newDomain: string | undefined): string[];

package/dist/cookies.js

@@ -0,0 +1,39 @@
+/**
+ * Rewrite the `Domain=` attribute of a single `Set-Cookie` header value.
+ *
+ * - If the cookie contains a `Domain=<value>` attribute (case-insensitive), its
+ *   value is replaced with `newDomain`, with any trailing `:port` suffix
+ *   stripped first (cookie `Domain` attributes do not include a port).
+ * - If `newDomain` is `undefined` (or empty), the entire `; Domain=<value>`
+ *   segment is removed so the browser scopes the cookie to the current host.
+ * - If no `Domain=` attribute is present, the input is returned unchanged.
+ *
+ * All other attributes, their casing/order and the original cookie name/value
+ * bytes are preserved.
+ */
+export function rewriteSetCookieDomain(setCookie, newDomain) {
+    const domainSegment = /;\s*Domain\s*=\s*[^;]+/i;
+    if (!domainSegment.test(setCookie))
+        return setCookie;
+    const stripped = newDomain ? stripPort(newDomain) : '';
+    if (!stripped) {
+        return setCookie.replace(domainSegment, '');
+    }
+    return setCookie.replace(/(;\s*Domain\s*=\s*)[^;]+/i, `$1${stripped}`);
+}
+/**
+ * Apply {@link rewriteSetCookieDomain} to each entry of a `Set-Cookie` array
+ * (e.g. the result of `Headers.getSetCookie()`).
+ */
+export function rewriteSetCookieDomains(values, newDomain) {
+    return values.map((value) => rewriteSetCookieDomain(value, newDomain));
+}
+function stripPort(host) {
+    if (host.startsWith('[')) {
+        const end = host.indexOf(']');
+        return end === -1 ? host : host.slice(1, end);
+    }
+    const colon = host.indexOf(':');
+    return colon === -1 ? host : host.slice(0, colon);
+}
+//# sourceMappingURL=cookies.js.map

package/dist/cookies.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cookies.js","sourceRoot":"","sources":["../src/cookies.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,sBAAsB,CACpC,SAAiB,EACjB,SAA6B;IAE7B,MAAM,aAAa,GAAG,yBAAyB,CAAC;IAChD,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC;QAAE,OAAO,SAAS,CAAC;IAErD,MAAM,QAAQ,GAAG,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACvD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,SAAS,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,SAAS,CAAC,OAAO,CACtB,2BAA2B,EAC3B,KAAK,QAAQ,EAAE,CAChB,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CACrC,MAAgB,EAChB,SAA6B;IAE7B,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,sBAAsB,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC;AACzE,CAAC;AAED,SAAS,SAAS,CAAC,IAAY;IAC7B,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC9B,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAChD,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAChC,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;AACpD,CAAC"}

package/dist/middleware.d.ts

@@ -1,17 +1,13 @@
 import { type H3Event } from 'h3';
 import type { IUser } from '@qelos/sdk/dist/authentication';
 import type { IWorkspace } from '@qelos/sdk/workspaces';
-import type { QelosNuxtRuntimeConfig, TokenRefreshHook } from './types';
+import type { QelosNuxtRuntimeConfig } from './types';
 export interface CreateMiddlewareOptions {
     config: QelosNuxtRuntimeConfig;
     /**
-     * Hook invoked after a successful token refresh. The default implementation
-     * writes the new tokens back to the response cookies.
-     */
-    onTokenRefresh?: TokenRefreshHook;
-    /**
-     * Resolve the active workspace for a request. Defaults to picking the first
-     * workspace returned from `sdk.workspaces.getList()`.
+     * Resolve the active workspace for a request. Defaults to whatever
+     * `/api/me` reports on `user.workspace` (the user's currently activated
+     * workspace, or `null` when none is active).
      */
     resolveWorkspace?: (params: {
         event: H3Event;

package/dist/middleware.js

@@ -1,35 +1,7 @@
-import { defineEventHandler, getCookie, getRequestHeader, setCookie, createError, } from 'h3';
+import { appendResponseHeader, createError, defineEventHandler, getRequestHeader, } from 'h3';
+import { rewriteSetCookieDomain } from './cookies';
+import { resolveQelosProxyTarget } from './proxy-target';
 import { createRequestSdk } from './sdk-factory';
-const DEFAULT_ACCESS_COOKIE = 'q_access_token';
-const DEFAULT_REFRESH_COOKIE = 'q_refresh_token';
-function readTokens(event, config) {
-    const accessCookie = config.accessTokenCookie || DEFAULT_ACCESS_COOKIE;
-    const refreshCookie = config.refreshTokenCookie || DEFAULT_REFRESH_COOKIE;
-    const cookieAccess = getCookie(event, accessCookie);
-    const cookieRefresh = getCookie(event, refreshCookie);
-    const authHeader = getRequestHeader(event, 'authorization');
-    const headerAccess = authHeader && authHeader.toLowerCase().startsWith('bearer ')
-        ? authHeader.slice(7).trim()
-        : undefined;
-    return {
-        accessToken: headerAccess || cookieAccess || undefined,
-        refreshToken: cookieRefresh || undefined,
-    };
-}
-function writeTokensToCookies(event, config, tokens) {
-    const accessCookie = config.accessTokenCookie || DEFAULT_ACCESS_COOKIE;
-    const refreshCookie = config.refreshTokenCookie || DEFAULT_REFRESH_COOKIE;
-    const cookieOptions = {
-        httpOnly: true,
-        secure: true,
-        sameSite: 'lax',
-        path: '/',
-    };
-    setCookie(event, accessCookie, tokens.accessToken, cookieOptions);
-    if (tokens.refreshToken) {
-        setCookie(event, refreshCookie, tokens.refreshToken, cookieOptions);
-    }
-}
 function shouldSkip(event, config) {
     if (!config.skipPaths?.length) {
         return false;
@@ -37,37 +9,67 @@ function shouldSkip(event, config) {
     const path = event.path || event.node?.req?.url || '';
     return config.skipPaths.some((prefix) => path.startsWith(prefix));
 }
+function buildMeUrl(base) {
+    return `${base.replace(/\/+$/, '')}/api/me`;
+}
 export function createQelosMiddleware(options) {
     const { config, resolveWorkspace } = options;
-    const onTokenRefresh = options.onTokenRefresh
-        || (async ({ event, newTokens }) => {
-            writeTokensToCookies(event, config, newTokens);
-        });
     return defineEventHandler(async (event) => {
         if (shouldSkip(event, config)) {
             return;
         }
-        const tokens = readTokens(event, config);
-        const sdk = createRequestSdk({ config, tokens, event, onTokenRefresh });
+        const sdk = createRequestSdk({ config, event });
         const ctx = {
             user: null,
             workspace: null,
             workspaces: [],
             sdk,
-            tokens,
         };
         event.context.qelos = ctx;
-        const hasAuthMaterial = Boolean(config.apiToken || tokens.accessToken || tokens.refreshToken);
-        if (!hasAuthMaterial) {
+        const base = resolveQelosProxyTarget(config);
+        if (!base && !config.apiToken) {
             if (config.requireAuth) {
                 throw createError({ statusCode: 401, statusMessage: 'Unauthorized' });
             }
             return;
         }
-        try {
-            ctx.user = await sdk.authentication.getLoggedInUser();
+        if (base) {
+            const headers = {};
+            const cookieHeader = getRequestHeader(event, 'cookie');
+            if (cookieHeader)
+                headers.cookie = cookieHeader;
+            const authHeader = getRequestHeader(event, 'authorization');
+            if (authHeader)
+                headers.authorization = authHeader;
+            const originalHost = getRequestHeader(event, 'host');
+            let response;
+            try {
+                response = await fetch(buildMeUrl(base), {
+                    method: 'GET',
+                    headers,
+                    redirect: 'manual',
+                });
+            }
+            catch {
+                if (config.requireAuth) {
+                    throw createError({ statusCode: 401, statusMessage: 'Unauthorized' });
+                }
+                return;
+            }
+            const setCookieValues = response.headers.getSetCookie?.() ?? [];
+            for (const value of setCookieValues) {
+                appendResponseHeader(event, 'set-cookie', rewriteSetCookieDomain(value, originalHost));
+            }
+            if (response.ok) {
+                try {
+                    ctx.user = (await response.json());
+                }
+                catch {
+                    ctx.user = null;
+                }
+            }
         }
-        catch (err) {
+        if (!ctx.user) {
             if (config.requireAuth) {
                 throw createError({ statusCode: 401, statusMessage: 'Unauthorized' });
             }
@@ -79,17 +81,19 @@ export function createQelosMiddleware(options) {
         catch {
             ctx.workspaces = [];
         }
-        if (ctx.user && ctx.workspaces.length) {
-            if (resolveWorkspace) {
-                ctx.workspace = await resolveWorkspace({
-                    event,
-                    user: ctx.user,
-                    workspaces: ctx.workspaces,
-                }) || null;
-            }
-            else {
-                ctx.workspace = ctx.workspaces[0] || null;
-            }
+        if (resolveWorkspace) {
+            ctx.workspace = (await resolveWorkspace({
+                event,
+                user: ctx.user,
+                workspaces: ctx.workspaces,
+            })) || null;
+        }
+        else {
+            // `/api/me` carries `user.workspace` (`{ _id, name, roles }`) only when
+            // the user has activated a workspace. Null means the frontend must
+            // prompt to activate/create one — don't silently pick workspaces[0].
+            ctx.workspace =
+                ctx.user.workspace || null;
         }
     });
 }

package/dist/middleware.js.map

@@ -1 +1 @@
-{"version":3,"file":"middleware.js","sourceRoot":"","sources":["../src/middleware.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,kBAAkB,EAClB,SAAS,EACT,gBAAgB,EAChB,SAAS,EACT,WAAW,GAEZ,MAAM,IAAI,CAAC;AAGZ,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAQjD,MAAM,qBAAqB,GAAG,gBAAgB,CAAC;AAC/C,MAAM,sBAAsB,GAAG,iBAAiB,CAAC;AAoBjD,SAAS,UAAU,CAAC,KAAc,EAAE,MAA8B;IAChE,MAAM,YAAY,GAAG,MAAM,CAAC,iBAAiB,IAAI,qBAAqB,CAAC;IACvE,MAAM,aAAa,GAAG,MAAM,CAAC,kBAAkB,IAAI,sBAAsB,CAAC;IAE1E,MAAM,YAAY,GAAG,SAAS,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;IACpD,MAAM,aAAa,GAAG,SAAS,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;IAEtD,MAAM,UAAU,GAAG,gBAAgB,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC;IAC5D,MAAM,YAAY,GAAG,UAAU,IAAI,UAAU,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC;QAC/E,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE;QAC5B,CAAC,CAAC,SAAS,CAAC;IAEd,OAAO;QACL,WAAW,EAAE,YAAY,IAAI,YAAY,IAAI,SAAS;QACtD,YAAY,EAAE,aAAa,IAAI,SAAS;KACzC,CAAC;AACJ,CAAC;AAED,SAAS,oBAAoB,CAC3B,KAAc,EACd,MAA8B,EAC9B,MAAsD;IAEtD,MAAM,YAAY,GAAG,MAAM,CAAC,iBAAiB,IAAI,qBAAqB,CAAC;IACvE,MAAM,aAAa,GAAG,MAAM,CAAC,kBAAkB,IAAI,sBAAsB,CAAC;IAC1E,MAAM,aAAa,GAAG;QACpB,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE,IAAI;QACZ,QAAQ,EAAE,KAAc;QACxB,IAAI,EAAE,GAAG;KACV,CAAC;IACF,SAAS,CAAC,KAAK,EAAE,YAAY,EAAE,MAAM,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;IAClE,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;QACxB,SAAS,CAAC,KAAK,EAAE,aAAa,EAAE,MAAM,CAAC,YAAY,EAAE,aAAa,CAAC,CAAC;IACtE,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,KAAc,EAAE,MAA8B;IAChE,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,CAAC;QAC9B,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC;IACtD,OAAO,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;AACpE,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,OAAgC;IACpE,MAAM,EAAE,MAAM,EAAE,gBAAgB,EAAE,GAAG,OAAO,CAAC;IAC7C,MAAM,cAAc,GAAqB,OAAO,CAAC,cAAc;WAC1D,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE;YACjC,oBAAoB,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;QACjD,CAAC,CAAC,CAAC;IAEL,OAAO,kBAAkB,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QACxC,IAAI,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC;YAC9B,OAAO;QACT,CAAC;QAED,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QACzC,MAAM,GAAG,GAAG,gBAAgB,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;QAExE,MAAM,GAAG,GAAwB;YAC/B,IAAI,EAAE,IAAI;YACV,SAAS,EAAE,IAAI;YACf,UAAU,EAAE,EAAE;YACd,GAAG;YACH,MAAM;SACP,CAAC;QACF,KAAK,CAAC,OAAO,CAAC,KAAK,GAAG,GAAG,CAAC;QAE1B,MAAM,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,YAAY,CAAC,CAAC;QAC9F,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;gBACvB,MAAM,WAAW,CAAC,EAAE,UAAU,EAAE,GAAG,EAAE,aAAa,EAAE,cAAc,EAAE,CAAC,CAAC;YACxE,CAAC;YACD,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,GAAG,CAAC,IAAI,GAAG,MAAM,GAAG,CAAC,cAAc,CAAC,eAAe,EAAE,CAAC;QACxD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;gBACvB,MAAM,WAAW,CAAC,EAAE,UAAU,EAAE,GAAG,EAAE,aAAa,EAAE,cAAc,EAAE,CAAC,CAAC;YACxE,CAAC;YACD,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,GAAG,CAAC,UAAU,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;QAClD,CAAC;QAAC,MAAM,CAAC;YACP,GAAG,CAAC,UAAU,GAAG,EAAE,CAAC;QACtB,CAAC;QAED,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC;YACtC,IAAI,gBAAgB,EAAE,CAAC;gBACrB,GAAG,CAAC,SAAS,GAAG,MAAM,gBAAgB,CAAC;oBACrC,KAAK;oBACL,IAAI,EAAE,GAAG,CAAC,IAAI;oBACd,UAAU,EAAE,GAAG,CAAC,UAAU;iBAC3B,CAAC,IAAI,IAAI,CAAC;YACb,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,SAAS,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;YAC5C,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"middleware.js","sourceRoot":"","sources":["../src/middleware.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,oBAAoB,EACpB,WAAW,EACX,kBAAkB,EAClB,gBAAgB,GAEjB,MAAM,IAAI,CAAC;AAGZ,OAAO,EAAE,sBAAsB,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AACzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAiBjD,SAAS,UAAU,CAAC,KAAc,EAAE,MAA8B;IAChE,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,CAAC;QAC9B,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC;IACtD,OAAO,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;AACpE,CAAC;AAED,SAAS,UAAU,CAAC,IAAY;IAC9B,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,SAAS,CAAC;AAC9C,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,OAAgC;IACpE,MAAM,EAAE,MAAM,EAAE,gBAAgB,EAAE,GAAG,OAAO,CAAC;IAE7C,OAAO,kBAAkB,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QACxC,IAAI,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC;YAC9B,OAAO;QACT,CAAC;QAED,MAAM,GAAG,GAAG,gBAAgB,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QAEhD,MAAM,GAAG,GAAwB;YAC/B,IAAI,EAAE,IAAI;YACV,SAAS,EAAE,IAAI;YACf,UAAU,EAAE,EAAE;YACd,GAAG;SACJ,CAAC;QACF,KAAK,CAAC,OAAO,CAAC,KAAK,GAAG,GAAG,CAAC;QAE1B,MAAM,IAAI,GAAG,uBAAuB,CAAC,MAAM,CAAC,CAAC;QAC7C,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;YAC9B,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;gBACvB,MAAM,WAAW,CAAC,EAAE,UAAU,EAAE,GAAG,EAAE,aAAa,EAAE,cAAc,EAAE,CAAC,CAAC;YACxE,CAAC;YACD,OAAO;QACT,CAAC;QAED,IAAI,IAAI,EAAE,CAAC;YACT,MAAM,OAAO,GAA2B,EAAE,CAAC;YAC3C,MAAM,YAAY,GAAG,gBAAgB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;YACvD,IAAI,YAAY;gBAAE,OAAO,CAAC,MAAM,GAAG,YAAY,CAAC;YAChD,MAAM,UAAU,GAAG,gBAAgB,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC;YAC5D,IAAI,UAAU;gBAAE,OAAO,CAAC,aAAa,GAAG,UAAU,CAAC;YAEnD,MAAM,YAAY,GAAG,gBAAgB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YAErD,IAAI,QAA8B,CAAC;YACnC,IAAI,CAAC;gBACH,QAAQ,GAAG,MAAM,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE;oBACvC,MAAM,EAAE,KAAK;oBACb,OAAO;oBACP,QAAQ,EAAE,QAAQ;iBACnB,CAAC,CAAC;YACL,CAAC;YAAC,MAAM,CAAC;gBACP,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;oBACvB,MAAM,WAAW,CAAC,EAAE,UAAU,EAAE,GAAG,EAAE,aAAa,EAAE,cAAc,EAAE,CAAC,CAAC;gBACxE,CAAC;gBACD,OAAO;YACT,CAAC;YAED,MAAM,eAAe,GAAG,QAAQ,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,CAAC;YAChE,KAAK,MAAM,KAAK,IAAI,eAAe,EAAE,CAAC;gBACpC,oBAAoB,CAAC,KAAK,EAAE,YAAY,EAAE,sBAAsB,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC,CAAC;YACzF,CAAC;YAED,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;gBAChB,IAAI,CAAC;oBACH,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAU,CAAC;gBAC9C,CAAC;gBAAC,MAAM,CAAC;oBACP,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;gBAClB,CAAC;YACH,CAAC;QACH,CAAC;QAED,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;YACd,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;gBACvB,MAAM,WAAW,CAAC,EAAE,UAAU,EAAE,GAAG,EAAE,aAAa,EAAE,cAAc,EAAE,CAAC,CAAC;YACxE,CAAC;YACD,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,GAAG,CAAC,UAAU,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;QAClD,CAAC;QAAC,MAAM,CAAC;YACP,GAAG,CAAC,UAAU,GAAG,EAAE,CAAC;QACtB,CAAC;QAED,IAAI,gBAAgB,EAAE,CAAC;YACrB,GAAG,CAAC,SAAS,GAAG,CAAC,MAAM,gBAAgB,CAAC;gBACtC,KAAK;gBACL,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,UAAU,EAAE,GAAG,CAAC,UAAU;aAC3B,CAAC,CAAC,IAAI,IAAI,CAAC;QACd,CAAC;aAAM,CAAC;YACN,wEAAwE;YACxE,mEAAmE;YACnE,qEAAqE;YACrE,GAAG,CAAC,SAAS;gBACV,GAAG,CAAC,IAAqD,CAAC,SAAS,IAAI,IAAI,CAAC;QACjF,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/module.d.ts

@@ -5,6 +5,11 @@ export interface QelosNuxtModuleOptions extends QelosNuxtRuntimeConfig {
      * want to call `createQelosMiddleware` yourself from your own server route.
      */
     disableMiddleware?: boolean;
+    /**
+     * Disable registration of the catch-all `/api/**` proxy server handler.
+     * Defaults to `false`.
+     */
+    disableProxy?: boolean;
 }
 declare const _default: import("nuxt/schema").NuxtModule<QelosNuxtModuleOptions, QelosNuxtModuleOptions, false>;
 export default _default;
@@ -12,4 +17,4 @@ export { createQelosMiddleware } from './middleware';
 export { createRequestSdk } from './sdk-factory';
 export { defineQelosEventHandler } from './event-handler';
 export type { DefineQelosEventHandlerOptions, QelosEventContext, QelosEventHandler, } from './event-handler';
-export type { QelosNuxtRuntimeConfig, QelosRequestContext, QelosTokenPair, ResolvedTokens, TokenRefreshContext, TokenRefreshHook, } from './types';
+export type { QelosNuxtRuntimeConfig, QelosRequestContext, } from './types';

package/dist/module.js

@@ -15,7 +15,21 @@ export default defineNuxtModule({
             throw new Error('[@qelos/integrator-nuxt] `qelos.appUrl` must be set in nuxt.config');
         }
         const { resolve } = createResolver(import.meta.url);
-        const { disableMiddleware, ...runtimeConfig } = options;
+        const { disableMiddleware, disableProxy, ...runtimeConfig } = options;
+        if (!disableProxy) {
+            // When the catch-all `/api/**` proxy is enabled, the user-resolution
+            // middleware MUST skip `/api/` requests. The middleware itself calls
+            // `${appUrl}/api/me` to identify the user, so without this skip
+            // every inbound `/api/me` would be both proxied AND used as the
+            // identification probe — a duplicate upstream hit and a potential
+            // cookie-rewrite loop. Users can extend `skipPaths` further but
+            // `/api/` must remain covered whenever `disableProxy` is false.
+            const existingSkipPaths = runtimeConfig.skipPaths ?? [];
+            const alreadyCovered = existingSkipPaths.some((prefix) => '/api/'.startsWith(prefix));
+            if (!alreadyCovered) {
+                runtimeConfig.skipPaths = ['/api/', ...existingSkipPaths];
+            }
+        }
         nuxt.options.runtimeConfig.qelos = {
             ...nuxt.options.runtimeConfig.qelos,
             ...runtimeConfig,
@@ -26,6 +40,12 @@ export default defineNuxtModule({
                 middleware: true,
             });
         }
+        if (!disableProxy) {
+            addServerHandler({
+                route: '/api/**',
+                handler: resolve('./runtime/api-proxy'),
+            });
+        }
         addImportsDir(resolve('./runtime/composables'));
         addTypeTemplate({
             filename: 'types/qelos-nuxt.d.ts',

package/dist/module.js.map

@@ -1 +1 @@
-{"version":3,"file":"module.js","sourceRoot":"","sources":["../src/module.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,gBAAgB,EAChB,gBAAgB,EAChB,aAAa,EACb,cAAc,EACd,eAAe,GAChB,MAAM,WAAW,CAAC;AAWnB,eAAe,gBAAgB,CAAyB;IACtD,IAAI,EAAE;QACJ,IAAI,EAAE,wBAAwB;QAC9B,SAAS,EAAE,OAAO;QAClB,aAAa,EAAE;YACb,IAAI,EAAE,QAAQ;SACf;KACF;IACD,QAAQ,EAAE;QACR,MAAM,EAAE,EAAE;KACX;IACD,KAAK,CAAC,OAAO,EAAE,IAAI;QACjB,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,oEAAoE,CAAC,CAAC;QACxF,CAAC;QAED,MAAM,EAAE,OAAO,EAAE,GAAG,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAEpD,MAAM,EAAE,iBAAiB,EAAE,GAAG,aAAa,EAAE,GAAG,OAAO,CAAC;QAExD,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,KAAK,GAAG;YACjC,GAAI,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,KAA6C;YAC5E,GAAG,aAAa;SACjB,CAAC;QAEF,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACvB,gBAAgB,CAAC;gBACf,OAAO,EAAE,OAAO,CAAC,0BAA0B,CAAC;gBAC5C,UAAU,EAAE,IAAI;aACjB,CAAC,CAAC;QACL,CAAC;QAED,aAAa,CAAC,OAAO,CAAC,uBAAuB,CAAC,CAAC,CAAC;QAEhD,eAAe,CAAC;YACd,QAAQ,EAAE,uBAAuB;YACjC,WAAW,EAAE,GAAG,EAAE,CAAC;;;;;;;;;;CAUxB;SACI,CAAC,CAAC;IACL,CAAC;CACF,CAAC,CAAC;AAEH,OAAO,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACjD,OAAO,EAAE,uBAAuB,EAAE,MAAM,iBAAiB,CAAC"}
+{"version":3,"file":"module.js","sourceRoot":"","sources":["../src/module.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,gBAAgB,EAChB,gBAAgB,EAChB,aAAa,EACb,cAAc,EACd,eAAe,GAChB,MAAM,WAAW,CAAC;AAgBnB,eAAe,gBAAgB,CAAyB;IACtD,IAAI,EAAE;QACJ,IAAI,EAAE,wBAAwB;QAC9B,SAAS,EAAE,OAAO;QAClB,aAAa,EAAE;YACb,IAAI,EAAE,QAAQ;SACf;KACF;IACD,QAAQ,EAAE;QACR,MAAM,EAAE,EAAE;KACX;IACD,KAAK,CAAC,OAAO,EAAE,IAAI;QACjB,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,oEAAoE,CAAC,CAAC;QACxF,CAAC;QAED,MAAM,EAAE,OAAO,EAAE,GAAG,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAEpD,MAAM,EAAE,iBAAiB,EAAE,YAAY,EAAE,GAAG,aAAa,EAAE,GAAG,OAAO,CAAC;QAEtE,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,qEAAqE;YACrE,qEAAqE;YACrE,gEAAgE;YAChE,gEAAgE;YAChE,kEAAkE;YAClE,gEAAgE;YAChE,gEAAgE;YAChE,MAAM,iBAAiB,GAAG,aAAa,CAAC,SAAS,IAAI,EAAE,CAAC;YACxD,MAAM,cAAc,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;YACtF,IAAI,CAAC,cAAc,EAAE,CAAC;gBACpB,aAAa,CAAC,SAAS,GAAG,CAAC,OAAO,EAAE,GAAG,iBAAiB,CAAC,CAAC;YAC5D,CAAC;QACH,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,KAAK,GAAG;YACjC,GAAI,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,KAA6C;YAC5E,GAAG,aAAa;SACjB,CAAC;QAEF,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACvB,gBAAgB,CAAC;gBACf,OAAO,EAAE,OAAO,CAAC,0BAA0B,CAAC;gBAC5C,UAAU,EAAE,IAAI;aACjB,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,gBAAgB,CAAC;gBACf,KAAK,EAAE,SAAS;gBAChB,OAAO,EAAE,OAAO,CAAC,qBAAqB,CAAC;aACxC,CAAC,CAAC;QACL,CAAC;QAED,aAAa,CAAC,OAAO,CAAC,uBAAuB,CAAC,CAAC,CAAC;QAEhD,eAAe,CAAC;YACd,QAAQ,EAAE,uBAAuB;YACjC,WAAW,EAAE,GAAG,EAAE,CAAC;;;;;;;;;;CAUxB;SACI,CAAC,CAAC;IACL,CAAC;CACF,CAAC,CAAC;AAEH,OAAO,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACjD,OAAO,EAAE,uBAAuB,EAAE,MAAM,iBAAiB,CAAC"}

package/dist/proxy-target.d.ts

@@ -0,0 +1,17 @@
+import type { QelosNuxtRuntimeConfig } from './types';
+/**
+ * Resolve the origin to which `/api/**` requests are proxied. The managed
+ * Qelos app URL (`config.appUrl`) is the proxy target — env vars are only
+ * dev-time overrides when the configured `appUrl` is not reachable from
+ * the local host.
+ *
+ * Priority (highest first):
+ *   1. `process.env.NUXT_QELOS_PROXY_TARGET`
+ *   2. `process.env.QELOS_IP`
+ *   3. `process.env.QELOS_API_IP`
+ *   4. `config.appUrl`
+ *
+ * Empty / whitespace-only values are skipped, and `undefined` is returned when
+ * nothing is configured so the caller can surface a clear error.
+ */
+export declare function resolveQelosProxyTarget(config: QelosNuxtRuntimeConfig): string | undefined;

package/dist/proxy-target.js

@@ -0,0 +1,26 @@
+/**
+ * Resolve the origin to which `/api/**` requests are proxied. The managed
+ * Qelos app URL (`config.appUrl`) is the proxy target — env vars are only
+ * dev-time overrides when the configured `appUrl` is not reachable from
+ * the local host.
+ *
+ * Priority (highest first):
+ *   1. `process.env.NUXT_QELOS_PROXY_TARGET`
+ *   2. `process.env.QELOS_IP`
+ *   3. `process.env.QELOS_API_IP`
+ *   4. `config.appUrl`
+ *
+ * Empty / whitespace-only values are skipped, and `undefined` is returned when
+ * nothing is configured so the caller can surface a clear error.
+ */
+export function resolveQelosProxyTarget(config) {
+    const env = process.env;
+    const fromEnv = env.NUXT_QELOS_PROXY_TARGET?.trim() ||
+        env.QELOS_IP?.trim() ||
+        env.QELOS_API_IP?.trim();
+    if (fromEnv)
+        return fromEnv;
+    const fromAppUrl = config.appUrl?.trim();
+    return fromAppUrl || undefined;
+}
+//# sourceMappingURL=proxy-target.js.map

package/dist/proxy-target.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"proxy-target.js","sourceRoot":"","sources":["../src/proxy-target.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,uBAAuB,CACrC,MAA8B;IAE9B,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;IACxB,MAAM,OAAO,GACX,GAAG,CAAC,uBAAuB,EAAE,IAAI,EAAE;QACnC,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE;QACpB,GAAG,CAAC,YAAY,EAAE,IAAI,EAAE,CAAC;IAC3B,IAAI,OAAO;QAAE,OAAO,OAAO,CAAC;IAE5B,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC;IACzC,OAAO,UAAU,IAAI,SAAS,CAAC;AACjC,CAAC"}

package/dist/runtime/api-proxy.d.ts

@@ -0,0 +1,2 @@
+declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<any>>;
+export default _default;

package/dist/runtime/api-proxy.js

@@ -0,0 +1,27 @@
+// This file is registered as a Nuxt server handler by `module.ts`. It is
+// bundled by Nitro, so `#imports` resolves at the consuming-app build time
+// (not at this package's `tsc` build).
+// @ts-ignore - resolved by Nitro
+import { useRuntimeConfig } from '#imports';
+import { createError, defineEventHandler, getRequestHeader, proxyRequest, } from 'h3';
+// @ts-ignore - resolved by Nitro (transitive dep of Nuxt)
+import { joinURL } from 'ufo';
+import { resolveQelosProxyTarget } from '../proxy-target';
+export default defineEventHandler((event) => {
+    const config = (useRuntimeConfig().qelos || {});
+    const base = resolveQelosProxyTarget(config);
+    if (!base) {
+        throw createError({
+            statusCode: 503,
+            statusMessage: '[@qelos/integrator-nuxt] Qelos API proxy is not configured. Set qelos.appUrl (or NUXT_QELOS_PROXY_TARGET / QELOS_IP / QELOS_API_IP in development).',
+        });
+    }
+    const originalHost = getRequestHeader(event, 'host');
+    const path = event.path.split('?')[0] ?? event.path;
+    const target = joinURL(base, path);
+    return proxyRequest(event, target, {
+        fetch: globalThis.fetch,
+        cookieDomainRewrite: { '*': originalHost ?? '' },
+    });
+});
+//# sourceMappingURL=api-proxy.js.map

package/dist/runtime/api-proxy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-proxy.js","sourceRoot":"","sources":["../../src/runtime/api-proxy.ts"],"names":[],"mappings":"AAAA,yEAAyE;AACzE,2EAA2E;AAC3E,uCAAuC;AACvC,iCAAiC;AACjC,OAAO,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AAC5C,OAAO,EACL,WAAW,EACX,kBAAkB,EAClB,gBAAgB,EAChB,YAAY,GACb,MAAM,IAAI,CAAC;AACZ,0DAA0D;AAC1D,OAAO,EAAE,OAAO,EAAE,MAAM,KAAK,CAAC;AAC9B,OAAO,EAAE,uBAAuB,EAAE,MAAM,iBAAiB,CAAC;AAG1D,eAAe,kBAAkB,CAAC,CAAC,KAAK,EAAE,EAAE;IAC1C,MAAM,MAAM,GAAG,CAAC,gBAAgB,EAAE,CAAC,KAAK,IAAI,EAAE,CAA2B,CAAC;IAC1E,MAAM,IAAI,GAAG,uBAAuB,CAAC,MAAM,CAAC,CAAC;IAC7C,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,WAAW,CAAC;YAChB,UAAU,EAAE,GAAG;YACf,aAAa,EACX,qJAAqJ;SACxJ,CAAC,CAAC;IACL,CAAC;IAED,MAAM,YAAY,GAAG,gBAAgB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACrD,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC;IACpD,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAEnC,OAAO,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE;QACjC,KAAK,EAAE,UAAU,CAAC,KAAK;QACvB,mBAAmB,EAAE,EAAE,GAAG,EAAE,YAAY,IAAI,EAAE,EAAE;KACjD,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/sdk-factory.d.ts

@@ -1,15 +1,8 @@
 import QelosSDK from '@qelos/sdk';
-import type { QelosNuxtRuntimeConfig, QelosTokenPair, TokenRefreshHook } from './types';
-import type { H3Event } from 'h3';
+import { type H3Event } from 'h3';
+import type { QelosNuxtRuntimeConfig } from './types';
 export interface CreateSdkParams {
     config: QelosNuxtRuntimeConfig;
-    /**
-     * Tokens for the current request. The factory mutates this object in
-     * place when a token refresh occurs, so callers can read the latest pair
-     * after the SDK has been used.
-     */
-    tokens: QelosTokenPair;
     event: H3Event;
-    onTokenRefresh?: TokenRefreshHook;
 }
-export declare function createRequestSdk({ config, tokens, event, onTokenRefresh }: CreateSdkParams): QelosSDK;
+export declare function createRequestSdk({ config, event }: CreateSdkParams): QelosSDK;

package/dist/sdk-factory.js

@@ -1,84 +1,28 @@
 import QelosSDK from '@qelos/sdk';
-const NO_AUTH_URLS = new Set([
-    '/api/token/refresh',
-    '/api/cookie/refresh',
-    '/api/signin',
-    '/api/signup',
-]);
-export function createRequestSdk({ config, tokens, event, onTokenRefresh }) {
-    let sdk;
-    let refreshInFlight = null;
+import { getRequestHeader } from 'h3';
+export function createRequestSdk({ config, event }) {
     const baseOptions = config.sdkOptions || {};
-    async function performRefresh() {
-        if (!tokens.refreshToken && !tokens.accessToken) {
-            throw new Error('no refresh token available');
-        }
-        const previous = {
-            accessToken: tokens.accessToken,
-            refreshToken: tokens.refreshToken,
-        };
-        let refreshed;
-        if (tokens.refreshToken) {
-            const result = await sdk.authentication.refreshToken(tokens.refreshToken);
-            refreshed = {
-                accessToken: result.payload.token,
-                refreshToken: result.payload.refreshToken,
-            };
-        }
-        else {
-            const result = await sdk.authentication.refreshCookieToken(tokens.accessToken);
-            refreshed = {
-                accessToken: result.payload.cookieToken,
-            };
-        }
-        tokens.accessToken = refreshed.accessToken;
-        tokens.refreshToken = refreshed.refreshToken;
-        if (onTokenRefresh) {
-            await onTokenRefresh({ event, oldTokens: previous, newTokens: refreshed, sdk });
-        }
-    }
-    function ensureRefresh() {
-        if (!refreshInFlight) {
-            refreshInFlight = performRefresh().finally(() => {
-                refreshInFlight = null;
-            });
-        }
-        return refreshInFlight;
-    }
     const options = {
         appUrl: config.appUrl,
         fetch: globalThis.fetch,
-        forceRefresh: !config.apiToken,
         ...baseOptions,
     };
     if (config.apiToken) {
         options.apiToken = config.apiToken;
+        return new QelosSDK(options);
     }
-    else {
-        if (tokens.accessToken) {
-            options.accessToken = tokens.accessToken;
+    options.extraHeaders = async () => {
+        const headers = {};
+        const cookieHeader = getRequestHeader(event, 'cookie');
+        if (cookieHeader) {
+            headers.cookie = cookieHeader;
         }
-        if (tokens.refreshToken) {
-            options.refreshToken = tokens.refreshToken;
+        const authHeader = getRequestHeader(event, 'authorization');
+        if (authHeader) {
+            headers.authorization = authHeader;
         }
-        options.extraHeaders = async (relativeUrl, forceRefresh) => {
-            if (NO_AUTH_URLS.has(relativeUrl)) {
-                return {};
-            }
-            if (forceRefresh && tokens.refreshToken) {
-                await ensureRefresh();
-            }
-            const token = sdk?.authentication?.accessToken || tokens.accessToken;
-            if (token) {
-                return { authorization: 'Bearer ' + token };
-            }
-            return {};
-        };
-        options.onFailedRefreshToken = async () => {
-            await ensureRefresh();
-        };
-    }
-    sdk = new QelosSDK(options);
-    return sdk;
+        return headers;
+    };
+    return new QelosSDK(options);
 }
 //# sourceMappingURL=sdk-factory.js.map

package/dist/sdk-factory.js.map

@@ -1 +1 @@
-{"version":3,"file":"sdk-factory.js","sourceRoot":"","sources":["../src/sdk-factory.ts"],"names":[],"mappings":"AAAA,OAAO,QAAQ,MAAM,YAAY,CAAC;AAsBlC,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC;IAC3B,oBAAoB;IACpB,qBAAqB;IACrB,aAAa;IACb,aAAa;CACd,CAAC,CAAC;AAEH,MAAM,UAAU,gBAAgB,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,EAAmB;IACzF,IAAI,GAAa,CAAC;IAClB,IAAI,eAAe,GAAyB,IAAI,CAAC;IAEjD,MAAM,WAAW,GAA6B,MAAM,CAAC,UAAU,IAAI,EAAE,CAAC;IAEtE,KAAK,UAAU,cAAc;QAC3B,IAAI,CAAC,MAAM,CAAC,YAAY,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;YAChD,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QAChD,CAAC;QACD,MAAM,QAAQ,GAAmB;YAC/B,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,YAAY,EAAE,MAAM,CAAC,YAAY;SAClC,CAAC;QACF,IAAI,SAAyB,CAAC;QAC9B,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;YACxB,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,cAAc,CAAC,YAAY,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;YAC1E,SAAS,GAAG;gBACV,WAAW,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK;gBACjC,YAAY,EAAE,MAAM,CAAC,OAAO,CAAC,YAAY;aAC1C,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,cAAc,CAAC,kBAAkB,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;YAC/E,SAAS,GAAG;gBACV,WAAW,EAAE,MAAM,CAAC,OAAO,CAAC,WAAW;aACxC,CAAC;QACJ,CAAC;QACD,MAAM,CAAC,WAAW,GAAG,SAAS,CAAC,WAAW,CAAC;QAC3C,MAAM,CAAC,YAAY,GAAG,SAAS,CAAC,YAAY,CAAC;QAC7C,IAAI,cAAc,EAAE,CAAC;YACnB,MAAM,cAAc,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC;QAClF,CAAC;IACH,CAAC;IAED,SAAS,aAAa;QACpB,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,eAAe,GAAG,cAAc,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE;gBAC9C,eAAe,GAAG,IAAI,CAAC;YACzB,CAAC,CAAC,CAAC;QACL,CAAC;QACD,OAAO,eAAe,CAAC;IACzB,CAAC;IAED,MAAM,OAAO,GAAoB;QAC/B,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,KAAK,EAAG,UAAU,CAAC,KAA8B;QACjD,YAAY,EAAE,CAAC,MAAM,CAAC,QAAQ;QAC9B,GAAG,WAAW;KACf,CAAC;IAEF,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACpB,OAAO,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;IACrC,CAAC;SAAM,CAAC;QACN,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;YACvB,OAAO,CAAC,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC;QAC3C,CAAC;QACD,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;YACxB,OAAO,CAAC,YAAY,GAAG,MAAM,CAAC,YAAY,CAAC;QAC7C,CAAC;QAED,OAAO,CAAC,YAAY,GAAG,KAAK,EAAE,WAAmB,EAAE,YAAsB,EAAE,EAAE;YAC3E,IAAI,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;gBAClC,OAAO,EAAE,CAAC;YACZ,CAAC;YACD,IAAI,YAAY,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;gBACxC,MAAM,aAAa,EAAE,CAAC;YACxB,CAAC;YACD,MAAM,KAAK,GAAG,GAAG,EAAE,cAAc,EAAE,WAAW,IAAI,MAAM,CAAC,WAAW,CAAC;YACrE,IAAI,KAAK,EAAE,CAAC;gBACV,OAAO,EAAE,aAAa,EAAE,SAAS,GAAG,KAAK,EAAE,CAAC;YAC9C,CAAC;YACD,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC;QAEF,OAAO,CAAC,oBAAoB,GAAG,KAAK,IAAI,EAAE;YACxC,MAAM,aAAa,EAAE,CAAC;QACxB,CAAC,CAAC;IACJ,CAAC;IAED,GAAG,GAAG,IAAI,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC5B,OAAO,GAAG,CAAC;AACb,CAAC"}
+{"version":3,"file":"sdk-factory.js","sourceRoot":"","sources":["../src/sdk-factory.ts"],"names":[],"mappings":"AAAA,OAAO,QAAQ,MAAM,YAAY,CAAC;AAElC,OAAO,EAAE,gBAAgB,EAAgB,MAAM,IAAI,CAAC;AAQpD,MAAM,UAAU,gBAAgB,CAAC,EAAE,MAAM,EAAE,KAAK,EAAmB;IACjE,MAAM,WAAW,GAA6B,MAAM,CAAC,UAAU,IAAI,EAAE,CAAC;IAEtE,MAAM,OAAO,GAAoB;QAC/B,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,KAAK,EAAG,UAAU,CAAC,KAA8B;QACjD,GAAG,WAAW;KACf,CAAC;IAEF,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACpB,OAAO,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;QACnC,OAAO,IAAI,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC/B,CAAC;IAED,OAAO,CAAC,YAAY,GAAG,KAAK,IAAI,EAAE;QAChC,MAAM,OAAO,GAA2B,EAAE,CAAC;QAC3C,MAAM,YAAY,GAAG,gBAAgB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QACvD,IAAI,YAAY,EAAE,CAAC;YACjB,OAAO,CAAC,MAAM,GAAG,YAAY,CAAC;QAChC,CAAC;QACD,MAAM,UAAU,GAAG,gBAAgB,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC;QAC5D,IAAI,UAAU,EAAE,CAAC;YACf,OAAO,CAAC,aAAa,GAAG,UAAU,CAAC;QACrC,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC;IAEF,OAAO,IAAI,QAAQ,CAAC,OAAO,CAAC,CAAC;AAC/B,CAAC"}

package/dist/types.d.ts

@@ -2,10 +2,6 @@ import type QelosSDK from '@qelos/sdk';
 import type { IUser } from '@qelos/sdk/dist/authentication';
 import type { IWorkspace } from '@qelos/sdk/workspaces';
 import type { QelosSDKOptions } from '@qelos/sdk/types';
-export interface QelosTokenPair {
-    accessToken?: string;
-    refreshToken?: string;
-}
 export interface QelosNuxtRuntimeConfig {
     /**
      * Base URL of the Qelos backend (e.g. https://yourdomain.com).
@@ -13,17 +9,9 @@ export interface QelosNuxtRuntimeConfig {
     appUrl: string;
     /**
      * Static API token used for service-to-service calls. When provided, no
-     * cookie/refresh-token handling is performed.
+     * cookie-based authentication is performed.
      */
     apiToken?: string;
-    /**
-     * Cookie name carrying the Qelos access token. Defaults to `q_access_token`.
-     */
-    accessTokenCookie?: string;
-    /**
-     * Cookie name carrying the Qelos refresh token. Defaults to `q_refresh_token`.
-     */
-    refreshTokenCookie?: string;
     /**
      * Path to mount the server middleware on. Defaults to `''` (every request).
      */
@@ -42,18 +30,12 @@ export interface QelosNuxtRuntimeConfig {
      * Optional extra options merged into the per-request SDK instance.
      */
     sdkOptions?: Partial<QelosSDKOptions>;
+    /**
+     * If true, the catch-all `/api/**` proxy handler is not registered.
+     * Defaults to `false`.
+     */
+    disableProxy?: boolean;
 }
-export interface ResolvedTokens {
-    accessToken: string;
-    refreshToken?: string;
-}
-export interface TokenRefreshContext {
-    event: import('h3').H3Event;
-    oldTokens: QelosTokenPair;
-    newTokens: ResolvedTokens;
-    sdk: QelosSDK;
-}
-export type TokenRefreshHook = (ctx: TokenRefreshContext) => void | Promise<void>;
 export interface QelosRequestContext {
     /**
      * The authenticated user, or `null` when anonymous.
@@ -69,13 +51,11 @@ export interface QelosRequestContext {
      */
     workspaces: IWorkspace[];
     /**
-     * SDK instance bound to the current request's tokens.
+     * SDK instance bound to the current request's cookies. `extraHeaders`
+     * re-reads cookies live on each call, so cookie rotations applied by the
+     * middleware are picked up automatically.
      */
     sdk: QelosSDK;
-    /**
-     * Tokens read from the request. Mutated when a refresh occurs.
-     */
-    tokens: QelosTokenPair;
 }
 declare module 'h3' {
     interface H3EventContext {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@qelos/integrator-nuxt",
-  "version": "4.0.1",
+  "version": "4.1.0",
   "type": "module",
   "description": "Nuxt integrator for Qelos: server middleware/module that identifies the user and workspace from the Qelos SDK before your handlers run.",
   "main": "./dist/module.js",
@@ -59,7 +59,7 @@
     }
   },
   "dependencies": {
-    "@qelos/sdk": "4.0.0"
+    "@qelos/sdk": "4.1.0"
   },
   "devDependencies": {
     "@nuxt/kit": "^3.13.0",