@qelos/plugin-netlify-api 1.0.1 → 1.0.3

package/README.md

@@ -4,14 +4,29 @@ Netlify build plugin for Qelos frontend apps: proxies `/api/*` to your Qelos API
 
 ## Setup
 
-In your site’s `netlify.toml`:
+In your site’s `netlify.toml`, add the plugin next to your existing `[build]` / `[build.environment]` (same idea as a manual `[functions]` + `[[redirects]]` + `api-proxy.ts`, but without checking in the function or redirect yourself):
 
 ```toml
+[build]
+  command = "npm run build"
+  publish = "dist"
+
+[build.environment]
+  # Used by the injected proxy at runtime (and by your build if you read it in app config)
+  QELOS_API_IP = "http://159.203.152.168"
+
 [[plugins]]
   package = "@qelos/plugin-netlify-api"
 ```
 
-Optional: set the API URL (default `http://159.203.152.168`):
+Minimal variant (defaults API URL inside the plugin if you omit env):
+
+```toml
+[[plugins]]
+  package = "@qelos/plugin-netlify-api"
+```
+
+Optional: set the API URL (default `http://159.203.152.168`) and/or enable bypass-admin header:
 
 ```toml
 [[plugins]]
@@ -19,14 +34,18 @@ Optional: set the API URL (default `http://159.203.152.168`):
 
   [plugins.inputs]
     api_url = "http://159.203.152.168"
+    bypass_admin = true
 ```
 
-Or set the `QELOS_API_IP` environment variable in the Netlify UI (build or runtime).
+- **api_url** — Target for the `/api/*` proxy. You can also set **`QELOS_API_IP`** or **`API_HOST`** in `[build.environment]` or in the Netlify UI (same role as `API_HOST` in a hand-written `netlify/functions/api-proxy.ts`).
+- **bypass_admin** — If `true`, the proxy adds the header `x-bypass-admin: true` to every request so that admin users are scoped as regular users. See root docs: `documentation/docs/plugins/api-proxy.md` and `documentation/docs/sdk/token_refresh.md`.
 
 ## What it does
 
 - **Environment:** Sets `QELOS_API_IP` for the build (and for the proxy function at runtime).
 - **Redirect:** Adds a rewrite so `/api/*` is served by `/.netlify/functions/qelos-api-proxy` (status 200, force).
-- **Function:** Injects a serverless function `qelos-api-proxy` that forwards requests to the host/port from `QELOS_API_IP` (supports a full URL like `http://159.203.152.168` or a hostname).
+- **Function:** Copies `qelos-api-proxy.ts` from the package into your Netlify **functions directory** (default `netlify/functions`, or `[functions] directory` in `netlify.toml`) during `onPreBuild`, so the bundler sees a normal function file. Forwards requests using `QELOS_API_IP` / `API_HOST` (full URL or hostname).
+
+No need to add redirects or commit the proxy yourself; the plugin writes it each build. Optional: add `netlify/functions/qelos-api-proxy.ts` to `.gitignore` if you run local Netlify builds and do not want the copy tracked.
 
-No need to add redirects or the function file to your repo; the plugin does it at build time.
+**Parity with a manual Netlify function** (e.g. `[[redirects]]` → `/.netlify/functions/api-proxy` and a function using `process.env.API_HOST`): use this plugin instead of those entries; set `QELOS_API_IP` or `API_HOST` to the same value you used for `API_HOST`, and set `bypass_admin = true` under `[plugins.inputs]` if your old proxy always sent `x-bypass-admin: true`.

package/functions/qelos-api-proxy.ts

@@ -1,13 +1,31 @@
 import http from "http";
+import https from "https";
 import type { Handler } from "@netlify/functions";
 
-const raw = process.env.QELOS_API_IP ?? "159.203.152.168";
-const parsed =
-  raw.startsWith("http://") || raw.startsWith("https://")
-    ? new URL(raw)
-    : { hostname: raw, port: "80" };
-const PROXY_HOST = parsed.hostname;
-const PROXY_PORT = parseInt(parsed.port || "80", 10);
+/** Same-origin proxy target; mirrors manual setups that use API_HOST (e.g. ai-words api-proxy). */
+const raw =
+  process.env.QELOS_API_IP ?? process.env.API_HOST ?? "159.203.152.168";
+
+let PROXY_HOST: string;
+let PROXY_PORT: number;
+let requestImpl: typeof http.request;
+
+if (raw.startsWith("http://") || raw.startsWith("https://")) {
+  const u = new URL(raw);
+  PROXY_HOST = u.hostname;
+  PROXY_PORT = u.port
+    ? parseInt(u.port, 10)
+    : u.protocol === "https:"
+      ? 443
+      : 80;
+  requestImpl = u.protocol === "https:" ? https.request : http.request;
+} else {
+  PROXY_HOST = raw;
+  PROXY_PORT = 80;
+  requestImpl = http.request;
+}
+const ADD_BYPASS_ADMIN_HEADER =
+  process.env.QELOS_BYPASS_ADMIN_HEADER === "true";
 
 export const handler: Handler = (event) =>
   new Promise((resolve) => {
@@ -17,6 +35,9 @@ export const handler: Handler = (event) =>
       if (val) headers[key] = val;
     }
     headers["host"] = event.headers["host"] ?? PROXY_HOST;
+    if (ADD_BYPASS_ADMIN_HEADER) {
+      headers["x-bypass-admin"] = "true";
+    }
     // Lambda buffers the body, so chunked encoding is not applicable
     delete headers["transfer-encoding"];
 
@@ -28,7 +49,7 @@ export const handler: Handler = (event) =>
       ? Buffer.from(event.body, event.isBase64Encoded ? "base64" : "utf8")
       : undefined;
 
-    const proxyReq = http.request(
+    const proxyReq = requestImpl(
       {
         hostname: PROXY_HOST,
         port: PROXY_PORT,

package/index.js

@@ -1,31 +1,50 @@
-const path = require("node:path");
+const fs = require('node:fs/promises');
+const path = require('node:path');
 
-const DEFAULT_API_URL = "http://159.203.152.168";
+const DEFAULT_API_URL = 'http://159.203.152.168';
+
+function resolveFunctionsDirectory(netlifyConfig) {
+  const dir = netlifyConfig.functions?.directory ?? 'netlify/functions';
+  return path.isAbsolute(dir) ? dir : path.join(process.cwd(), dir);
+}
 
 module.exports = {
-  async onPreBuild({ netlifyConfig, utils, inputs }) {
-    const apiUrl = inputs.api_url ?? process.env.QELOS_API_IP ?? DEFAULT_API_URL;
+  async onPreBuild({ netlifyConfig, inputs }) {
+    const apiUrl =
+      inputs.api_url ?? process.env.QELOS_API_IP ?? DEFAULT_API_URL;
+    const bypassAdmin =
+      inputs.bypass_admin === true || inputs.bypass_admin === 'true';
 
     // Ensure build.environment exists
     if (!netlifyConfig.build.environment) {
       netlifyConfig.build.environment = {};
     }
     netlifyConfig.build.environment.QELOS_API_IP = apiUrl;
+    if (bypassAdmin) {
+      netlifyConfig.build.environment.QELOS_BYPASS_ADMIN_HEADER = 'true';
+    }
+
+    if (!netlifyConfig.functions) {
+      netlifyConfig.functions = { directory: 'netlify/functions' };
+    }
+
+    // Copy the proxy into the site's functions dir so Netlify bundles it like any
+    // checked-in function (utils.functions.add from node_modules is unreliable for .ts).
+    const destDir = resolveFunctionsDirectory(netlifyConfig);
+    const destFile = path.join(destDir, 'qelos-api-proxy.ts');
+    const srcFile = path.join(__dirname, 'functions', 'qelos-api-proxy.ts');
+    await fs.mkdir(destDir, { recursive: true });
+    await fs.copyFile(srcFile, destFile);
 
     // Add redirect: /api/* -> Netlify function (proxy)
     if (!netlifyConfig.redirects) {
       netlifyConfig.redirects = [];
     }
     netlifyConfig.redirects.push({
-      from: "/api/*",
-      to: "/.netlify/functions/qelos-api-proxy",
+      from: '/api/*',
+      to: '/.netlify/functions/qelos-api-proxy',
       status: 200,
       force: true,
     });
-
-    // Inject the proxy function (must run in onPreBuild so it's bundled)
-    const pluginRoot = __dirname;
-    const functionPath = path.join(pluginRoot, "functions", "qelos-api-proxy.ts");
-    await utils.functions.add(functionPath);
   },
 };

package/manifest.yml

@@ -4,3 +4,7 @@ inputs:
     required: false
     description: "Qelos API base URL (e.g. http://159.203.152.168). Used as QELOS_API_IP and for /api/* proxy."
     default: "http://159.203.152.168"
+  - name: bypass_admin
+    required: false
+    description: "If true, the proxy adds header x-bypass-admin: true to every request (so admins are scoped as regular users)."
+    default: false

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@qelos/plugin-netlify-api",
-  "version": "1.0.1",
+  "version": "1.0.3",
   "description": "Netlify build plugin: proxy /api/* to Qelos API and inject config",
   "main": "index.js",
   "files": [