@qelos/plugin-netlify-api 1.1.3 → 4.1.0

package/README.md

@@ -59,3 +59,78 @@ If your publish directory is not `dist`, set `QELOS_NETLIFY_PUBLISH` to that fol
 - **Unless `use_cdn_proxy`:** copies `qelos-api-proxy.ts` into your Netlify functions directory.
 
 No need to commit redirects yourself; the plugin and `postbuild` maintain them each build.
+
+## Integrator API (`@qelos/plugin-netlify-api/integrators`)
+
+This package implements the same **middleware contract** as other Qelos integrators (e.g. `@qelos/integrator-express`): each wrapped handler receives `event.qelos` shaped as **`QelosRequestContext`** — `QelosContext<QelosSDK, IUser, IWorkspace>` from `@qelos/global-types`, with:
+
+| Field | Meaning |
+| --- | --- |
+| `user` | Authenticated user, or `null` |
+| `workspace` | Active workspace, or `null` |
+| `workspaces` | All workspaces for the user (from `sdk.workspaces.getList()`) |
+| `sdk` | `@qelos/sdk` instance bound to this request’s tokens |
+| `tokens` | `QelosTokenPair`; updated in place if a refresh runs |
+
+Configuration follows **`QelosConfig`** / **`QelosNetlifyConfig`** (same base as Express): use **`appUrl`** as the Qelos backend base URL. For backward compatibility, **`apiHost`** is still accepted and normalized the same way as `QELOS_API_IP`.
+
+Token refresh matches **`@qelos/integrator-express`**: the SDK may refresh access/refresh tokens; by default, refreshed cookies are collected as `Set-Cookie` header values and **merged into your function’s response** so the browser stays in sync. Override with **`onTokenRefresh`** (see `TokenRefreshContext` in the published types).
+
+Peer dependency: **`@netlify/functions`** (declare handler types and install in the project that contains Netlify functions).
+
+```bash
+npm install @netlify/functions @qelos/sdk
+```
+
+```ts
+// netlify/functions/whoami.ts
+import {
+  withQelos,
+  requireUser,
+  type QelosRequestContext,
+} from '@qelos/plugin-netlify-api/integrators';
+
+export const handler = withQelos(
+  async (event) => {
+    const q: QelosRequestContext = event.qelos!;
+    const { user, workspace, workspaces, sdk, tokens } = q;
+    return {
+      statusCode: 200,
+      body: JSON.stringify({ user, workspace, workspaces, tokenPair: tokens }),
+    };
+  },
+  {
+    appUrl: process.env.QELOS_API_IP!,
+  },
+);
+
+export const handlerProtected = requireUser(
+  async (event) => {
+    return { statusCode: 200, body: JSON.stringify(event.qelos!.user) };
+  },
+  { appUrl: process.env.QELOS_API_IP! },
+);
+```
+
+**`skipPaths`:** when the function path matches a prefix in `skipPaths`, the wrapper does **not** attach `event.qelos` (same idea as Express skipping middleware for `/health`, etc.).
+
+Lower-level helpers:
+
+```ts
+import {
+  identifyUser,
+  createRequestSdk,
+  readTokensFromEvent,
+  normalizeIntegratorConfig,
+} from '@qelos/plugin-netlify-api/integrators';
+
+const identity = await identifyUser(event, { appUrl: 'https://api.example.com' });
+// identity includes user, workspace, workspaces, sdk, tokens, refreshedCookies
+
+const config = normalizeIntegratorConfig({ appUrl: 'https://api.example.com' });
+const tokens = readTokensFromEvent(event, config);
+```
+
+### Package layout
+
+The Netlify plugin stays under **`packages/plugin-netlify-api`** (historical location before the `integrators/*` convention). Types and behavior are aligned with **`@qelos/integrator-express`**; only the transport differs (Netlify `HandlerEvent` / response object vs Express `req` / `res`).

package/integrators/index.d.ts

@@ -0,0 +1,135 @@
+import type QelosSDK from '@qelos/sdk';
+import type { IUser } from '@qelos/sdk/dist/authentication';
+import type { IWorkspace } from '@qelos/sdk/workspaces';
+import type { QelosSDKOptions } from '@qelos/sdk/types';
+import type {
+  Handler,
+  HandlerContext,
+  HandlerEvent,
+} from '@netlify/functions';
+import type {
+  QelosConfig,
+  QelosContext,
+  QelosTokenPair,
+  ResolvedTokens,
+} from '@qelos/global-types';
+
+export type { QelosTokenPair, ResolvedTokens } from '@qelos/global-types';
+
+/**
+ * Same per-request context type as `@qelos/integrator-express` (`req.qelos`).
+ */
+export type QelosRequestContext = QelosContext<QelosSDK, IUser, IWorkspace>;
+
+export interface QelosNetlifyConfig extends QelosConfig {
+  /**
+   * Optional extra options merged into the per-request SDK instance.
+   */
+  sdkOptions?: Partial<QelosSDKOptions>;
+}
+
+export interface TokenRefreshContext {
+  event: HandlerEvent;
+  /**
+   * Collector for `Set-Cookie` header values; merged into the function response by
+   * `withQelos` / `requireUser` (same semantics as writing cookies on Express `res`).
+   */
+  responseCookies: string[];
+  oldTokens: QelosTokenPair;
+  newTokens: ResolvedTokens;
+  sdk: QelosSDK;
+}
+
+export type TokenRefreshHook = (ctx: TokenRefreshContext) => void | Promise<void>;
+
+export interface NetlifyIntegratorOptions extends Partial<QelosNetlifyConfig> {
+  /**
+   * Override tenant resolved via `tenant` header / `QELOS_TENANT`.
+   */
+  tenant?: string;
+  /**
+   * Public host forwarded as `tenanthost` on SDK requests. Defaults to
+   * `x-forwarded-host`, then `host`, then `rawUrl`.
+   */
+  tenantHost?: string;
+  /**
+   * @deprecated Prefer {@link QelosConfig.appUrl}. Resolved via {@link resolveApiHost}
+   * when `appUrl` is omitted (same as legacy `QELOS_API_IP`).
+   */
+  apiHost?: string;
+  /**
+   * Called after a successful token refresh. Defaults to appending refreshed tokens as
+   * `Set-Cookie` entries on {@link TokenRefreshContext.responseCookies}.
+   */
+  onTokenRefresh?: TokenRefreshHook;
+  /**
+   * Resolve the active workspace. Defaults to the first workspace from
+   * `sdk.workspaces.getList()` (same as Express).
+   */
+  resolveWorkspace?: (params: {
+    event: HandlerEvent;
+    user: IUser;
+    workspaces: IWorkspace[];
+  }) => IWorkspace | null | Promise<IWorkspace | null>;
+}
+
+/** Backward-compatible alias for {@link NetlifyIntegratorOptions}. */
+export type IntegratorOptions = NetlifyIntegratorOptions;
+
+export interface CreateNetlifySdkParams {
+  config: QelosNetlifyConfig;
+  tokens: QelosTokenPair;
+  event: HandlerEvent;
+  /** Mutable list of `Set-Cookie` header line values for the outgoing function response */
+  responseCookies: string[];
+  onTokenRefresh?: TokenRefreshHook;
+  /** Merged into each SDK request (e.g. `tenanthost`, impersonation headers) */
+  staticRequestHeaders?: Record<string, string>;
+}
+
+/** Alias mirroring `@qelos/integrator-express` naming */
+export type CreateSdkParams = CreateNetlifySdkParams;
+
+export interface QelosHandlerEvent extends HandlerEvent {
+  qelos?: QelosRequestContext;
+}
+
+export type QelosHandler = (
+  event: QelosHandlerEvent,
+  context: HandlerContext,
+) => ReturnType<Handler>;
+
+export function normalizeIntegratorConfig(
+  options?: NetlifyIntegratorOptions,
+): QelosNetlifyConfig;
+
+export function readTokensFromEvent(
+  event: HandlerEvent,
+  config: QelosNetlifyConfig,
+): QelosTokenPair;
+
+export function createRequestSdk(params: CreateNetlifySdkParams): QelosSDK;
+
+export function identifyUser(
+  event: HandlerEvent,
+  options?: NetlifyIntegratorOptions,
+): Promise<{
+  user: IUser;
+  workspace: IWorkspace | null;
+  workspaces: IWorkspace[];
+  sdk: QelosSDK;
+  tokens: QelosTokenPair;
+  refreshedCookies: string[];
+} | null>;
+
+export function withQelos(
+  handler: QelosHandler,
+  options?: NetlifyIntegratorOptions,
+): Handler;
+
+export function requireUser(
+  handler: QelosHandler,
+  options?: NetlifyIntegratorOptions,
+): Handler;
+
+export function resolveApiHost(override?: string): string;

package/integrators/index.js

@@ -0,0 +1,296 @@
+'use strict';
+
+/**
+ * Netlify implementation of the Qelos integrator contract — same per-request
+ * {@link QelosRequestContext} shape as `@qelos/integrator-express` (`user`,
+ * `workspace`, `workspaces`, `sdk`, `tokens`).
+ */
+
+const { createRequestSdk } = require('./sdk-factory');
+const {
+  resolveApiHost,
+  normalizeIntegratorConfig,
+  pickHeader,
+  readTokensFromEvent,
+} = require('./request-parse');
+
+function publicHostForEvent(event) {
+  const forwarded = pickHeader(event.headers, 'x-forwarded-host');
+  if (forwarded) return forwarded.split(',')[0].trim();
+  const host = pickHeader(event.headers, 'host');
+  if (host) return host;
+  if (event.rawUrl) {
+    try {
+      return new URL(event.rawUrl).hostname;
+    } catch {
+      // fall through
+    }
+  }
+  return '';
+}
+
+/**
+ * Headers forwarded on every SDK request for multi-tenant / impersonation
+ * (matches the former `/api/me` integration identity headers).
+ */
+function buildStaticRequestHeaders(event, options) {
+  const headers = {};
+  const tenantHost = options.tenantHost || publicHostForEvent(event);
+  if (tenantHost) headers.tenanthost = tenantHost;
+
+  const tenant =
+    options.tenant ||
+    pickHeader(event.headers, 'tenant') ||
+    process.env.QELOS_TENANT;
+  if (tenant) headers.tenant = tenant;
+
+  for (const passthrough of [
+    'x-impersonate-tenant',
+    'x-impersonate-user',
+    'x-impersonate-workspace',
+  ]) {
+    const value = pickHeader(event.headers, passthrough);
+    if (value) headers[passthrough] = value;
+  }
+
+  return headers;
+}
+
+function shouldSkip(event, config) {
+  if (!config.skipPaths?.length) return false;
+  let path = event.path;
+  if (!path && event.rawUrl) {
+    try {
+      path = new URL(event.rawUrl).pathname;
+    } catch {
+      path = '';
+    }
+  }
+  return config.skipPaths.some((prefix) => path.startsWith(prefix));
+}
+
+function mergeResponseCookies(result, responseCookies) {
+  if (!responseCookies.length) return result;
+  const base = result && typeof result === 'object' ? result : {};
+  const headers = { ...(base.headers || {}) };
+  const existing = headers['set-cookie'];
+  const merged = Array.isArray(existing)
+    ? [...existing, ...responseCookies]
+    : existing
+      ? [existing, ...responseCookies]
+      : [...responseCookies];
+  headers['set-cookie'] = merged;
+  return { ...base, headers };
+}
+
+function attachQelosContext(event, ctx) {
+  Object.defineProperty(event, 'qelos', {
+    value: ctx,
+    enumerable: true,
+    configurable: true,
+    writable: true,
+  });
+  return event;
+}
+
+async function populateUserAndWorkspaces(ctx, event, options) {
+  try {
+    ctx.user = await ctx.sdk.authentication.getLoggedInUser();
+  } catch {
+    ctx.user = null;
+    return false;
+  }
+
+  try {
+    ctx.workspaces = await ctx.sdk.workspaces.getList();
+  } catch {
+    ctx.workspaces = [];
+  }
+
+  if (ctx.user && ctx.workspaces.length) {
+    if (options.resolveWorkspace) {
+      ctx.workspace =
+        (await options.resolveWorkspace({
+          event,
+          user: ctx.user,
+          workspaces: ctx.workspaces,
+        })) || null;
+    } else {
+      ctx.workspace = ctx.workspaces[0] || null;
+    }
+  }
+  return true;
+}
+
+/**
+ * Resolve user/workspace/workspaces using the same SDK flow as Express.
+ * Returns `null` when there is no auth material or identity cannot be resolved.
+ */
+async function identifyUser(event, options = {}) {
+  if (!event) return null;
+
+  const config = normalizeIntegratorConfig(options);
+  const tokens = readTokensFromEvent(event, config);
+  const responseCookies = [];
+  const staticRequestHeaders = buildStaticRequestHeaders(event, options);
+
+  const hasAuthMaterial = Boolean(
+    config.apiToken || tokens.accessToken || tokens.refreshToken,
+  );
+  if (!hasAuthMaterial) return null;
+
+  const sdk = createRequestSdk({
+    config,
+    tokens,
+    event,
+    responseCookies,
+    onTokenRefresh: options.onTokenRefresh,
+    staticRequestHeaders,
+  });
+
+  const ctx = {
+    user: null,
+    workspace: null,
+    workspaces: [],
+    sdk,
+    tokens,
+  };
+
+  await populateUserAndWorkspaces(ctx, event, options);
+  if (!ctx.user) return null;
+
+  return {
+    user: ctx.user,
+    workspace: ctx.workspace,
+    workspaces: ctx.workspaces,
+    sdk: ctx.sdk,
+    tokens: ctx.tokens,
+    refreshedCookies: responseCookies,
+  };
+}
+
+function withQelos(handler, options = {}) {
+  return async function qelosWrappedHandler(event, context) {
+    if (shouldSkip(event, normalizeIntegratorConfig(options))) {
+      return handler(event, context);
+    }
+
+    const config = normalizeIntegratorConfig(options);
+    const tokens = readTokensFromEvent(event, config);
+    const responseCookies = [];
+    const staticRequestHeaders = buildStaticRequestHeaders(event, options);
+
+    const sdk = createRequestSdk({
+      config,
+      tokens,
+      event,
+      responseCookies,
+      onTokenRefresh: options.onTokenRefresh,
+      staticRequestHeaders,
+    });
+
+    const ctx = {
+      user: null,
+      workspace: null,
+      workspaces: [],
+      sdk,
+      tokens,
+    };
+    attachQelosContext(event, ctx);
+
+    const hasAuthMaterial = Boolean(
+      config.apiToken || tokens.accessToken || tokens.refreshToken,
+    );
+
+    if (!hasAuthMaterial) {
+      if (config.requireAuth) {
+        return {
+          statusCode: 401,
+          headers: { 'content-type': 'application/json' },
+          body: JSON.stringify({ code: 'UNAUTHORIZED' }),
+        };
+      }
+      return mergeResponseCookies(
+        await handler(event, context),
+        responseCookies,
+      );
+    }
+
+    const ok = await populateUserAndWorkspaces(ctx, event, options);
+    if (!ok) {
+      if (config.requireAuth) {
+        return {
+          statusCode: 401,
+          headers: { 'content-type': 'application/json' },
+          body: JSON.stringify({ code: 'UNAUTHORIZED' }),
+        };
+      }
+      return mergeResponseCookies(
+        await handler(event, context),
+        responseCookies,
+      );
+    }
+
+    return mergeResponseCookies(
+      await handler(event, context),
+      responseCookies,
+    );
+  };
+}
+
+function requireUser(handler, options = {}) {
+  return async function qelosRequireUserHandler(event, context) {
+    if (shouldSkip(event, normalizeIntegratorConfig(options))) {
+      return handler(event, context);
+    }
+
+    const config = normalizeIntegratorConfig(options);
+    const tokens = readTokensFromEvent(event, config);
+    const responseCookies = [];
+    const staticRequestHeaders = buildStaticRequestHeaders(event, options);
+
+    const sdk = createRequestSdk({
+      config,
+      tokens,
+      event,
+      responseCookies,
+      onTokenRefresh: options.onTokenRefresh,
+      staticRequestHeaders,
+    });
+
+    const ctx = {
+      user: null,
+      workspace: null,
+      workspaces: [],
+      sdk,
+      tokens,
+    };
+    attachQelosContext(event, ctx);
+
+    const hasAuthMaterial = Boolean(
+      config.apiToken || tokens.accessToken || tokens.refreshToken,
+    );
+    if (!hasAuthMaterial || !(await populateUserAndWorkspaces(ctx, event, options))) {
+      return {
+        statusCode: 401,
+        headers: { 'content-type': 'application/json' },
+        body: JSON.stringify({ code: 'UNAUTHORIZED' }),
+      };
+    }
+
+    return mergeResponseCookies(
+      await handler(event, context),
+      responseCookies,
+    );
+  };
+}
+
+module.exports = {
+  identifyUser,
+  withQelos,
+  requireUser,
+  resolveApiHost,
+  normalizeIntegratorConfig,
+  readTokensFromEvent,
+  createRequestSdk,
+};

package/integrators/read-tokens.test.cjs

@@ -0,0 +1,34 @@
+'use strict';
+
+const test = require('node:test');
+const assert = require('node:assert/strict');
+const {
+  readTokensFromEvent,
+  normalizeIntegratorConfig,
+} = require('./request-parse.js');
+
+test('readTokensFromEvent prefers Authorization bearer over cookie token', () => {
+  const event = {
+    headers: {
+      authorization: 'Bearer from-header',
+      cookie: 'q_access_token=from-cookie',
+    },
+  };
+  const config = normalizeIntegratorConfig({
+    appUrl: 'http://localhost',
+  });
+  const tokens = readTokensFromEvent(event, config);
+  assert.equal(tokens.accessToken, 'from-header');
+});
+
+test('readTokensFromEvent reads refresh cookie', () => {
+  const event = {
+    headers: {
+      cookie: 'q_refresh_token=abc; q_access_token=def',
+    },
+  };
+  const config = normalizeIntegratorConfig({ appUrl: 'http://localhost' });
+  const tokens = readTokensFromEvent(event, config);
+  assert.equal(tokens.accessToken, 'def');
+  assert.equal(tokens.refreshToken, 'abc');
+});

package/integrators/request-parse.js

@@ -0,0 +1,82 @@
+'use strict';
+
+const DEFAULT_API_URL = 'http://159.203.152.168';
+
+const DEFAULT_ACCESS_COOKIE = 'q_access_token';
+const DEFAULT_REFRESH_COOKIE = 'q_refresh_token';
+
+function resolveApiHost(override) {
+  const raw =
+    override ?? process.env.QELOS_API_IP ?? process.env.API_HOST ?? DEFAULT_API_URL;
+  const trimmed = String(raw).trim().replace(/\/$/, '');
+  if (!trimmed) return DEFAULT_API_URL;
+  if (/^https?:\/\//i.test(trimmed)) return trimmed;
+  return `http://${trimmed}`;
+}
+
+function normalizeIntegratorConfig(options = {}) {
+  const appUrl =
+    (typeof options.appUrl === 'string' && options.appUrl.trim()) ||
+    resolveApiHost(options.apiHost);
+  return {
+    appUrl,
+    apiToken: options.apiToken,
+    accessTokenCookie: options.accessTokenCookie,
+    refreshTokenCookie: options.refreshTokenCookie,
+    requireAuth: options.requireAuth,
+    skipPaths: options.skipPaths,
+    sdkOptions: options.sdkOptions,
+  };
+}
+
+function pickHeader(headers, name) {
+  if (!headers) return undefined;
+  const want = name.toLowerCase();
+  for (const [k, v] of Object.entries(headers)) {
+    if (k.toLowerCase() !== want) continue;
+    if (v == null) continue;
+    const value = Array.isArray(v) ? v[0] : v;
+    if (typeof value === 'string' && value.length > 0) return value;
+  }
+  return undefined;
+}
+
+function readCookie(headers, name) {
+  const header = pickHeader(headers, 'cookie');
+  if (!header) return undefined;
+  const prefix = `${name}=`;
+  for (const part of header.split(';')) {
+    const trimmed = part.trim();
+    if (trimmed.startsWith(prefix)) {
+      try {
+        return decodeURIComponent(trimmed.slice(prefix.length));
+      } catch {
+        return trimmed.slice(prefix.length);
+      }
+    }
+  }
+  return undefined;
+}
+
+function readTokensFromEvent(event, config) {
+  const accessCookie = config.accessTokenCookie || DEFAULT_ACCESS_COOKIE;
+  const refreshCookie = config.refreshTokenCookie || DEFAULT_REFRESH_COOKIE;
+  const cookieAccess = readCookie(event.headers, accessCookie);
+  const cookieRefresh = readCookie(event.headers, refreshCookie);
+  const authHeader = pickHeader(event.headers, 'authorization');
+  const headerAccess =
+    authHeader && authHeader.toLowerCase().startsWith('bearer ')
+      ? authHeader.slice(7).trim()
+      : undefined;
+  return {
+    accessToken: headerAccess || cookieAccess || undefined,
+    refreshToken: cookieRefresh || undefined,
+  };
+}
+
+module.exports = {
+  resolveApiHost,
+  normalizeIntegratorConfig,
+  pickHeader,
+  readTokensFromEvent,
+};

package/integrators/sdk-factory.js

@@ -0,0 +1,153 @@
+'use strict';
+
+const sdkModule = require('@qelos/sdk');
+const QelosSDK = sdkModule.default || sdkModule;
+
+const NO_AUTH_URLS = new Set([
+  '/api/token/refresh',
+  '/api/cookie/refresh',
+  '/api/signin',
+  '/api/signup',
+]);
+
+const DEFAULT_ACCESS_COOKIE = 'q_access_token';
+const DEFAULT_REFRESH_COOKIE = 'q_refresh_token';
+
+function serializeCookie(name, value, secure) {
+  const parts = [
+    `${name}=${encodeURIComponent(value)}`,
+    'Path=/',
+    'HttpOnly',
+    'SameSite=Lax',
+  ];
+  if (secure) parts.push('Secure');
+  return parts.join('; ');
+}
+
+/**
+ * Serializes refreshed tokens as Set-Cookie header value strings (same rules as
+ * @qelos/integrator-express writeTokensToCookies).
+ */
+function tokensToSetCookieHeaderValues(config, resolved) {
+  const accessCookie = config.accessTokenCookie || DEFAULT_ACCESS_COOKIE;
+  const refreshCookie = config.refreshTokenCookie || DEFAULT_REFRESH_COOKIE;
+  const secure = !/^http:\/\//i.test(config.appUrl);
+  const out = [
+    serializeCookie(accessCookie, resolved.accessToken, secure),
+  ];
+  if (resolved.refreshToken) {
+    out.push(serializeCookie(refreshCookie, resolved.refreshToken, secure));
+  }
+  return out;
+}
+
+/** @param {Record<string, unknown>} params */
+function createRequestSdk(params) {
+  const {
+    config,
+    tokens,
+    event,
+    responseCookies,
+    onTokenRefresh,
+    staticRequestHeaders,
+  } = params;
+  let sdk;
+  let refreshInFlight = null;
+  const baseOptions = config.sdkOptions || {};
+  const forwarded = staticRequestHeaders || {};
+
+  async function performRefresh() {
+    if (!tokens.refreshToken && !tokens.accessToken) {
+      throw new Error('no refresh token available');
+    }
+    const previous = {
+      accessToken: tokens.accessToken,
+      refreshToken: tokens.refreshToken,
+    };
+    let refreshed;
+    if (tokens.refreshToken) {
+      const result = await sdk.authentication.refreshToken(tokens.refreshToken);
+      refreshed = {
+        accessToken: result.payload.token,
+        refreshToken: result.payload.refreshToken,
+      };
+    } else {
+      const result = await sdk.authentication.refreshCookieToken(
+        tokens.accessToken,
+      );
+      refreshed = {
+        accessToken: result.payload.cookieToken,
+      };
+    }
+    tokens.accessToken = refreshed.accessToken;
+    tokens.refreshToken = refreshed.refreshToken;
+    const hook = onTokenRefresh || defaultNetlifyTokenRefresh;
+    await hook({
+      event,
+      responseCookies,
+      oldTokens: previous,
+      newTokens: refreshed,
+      sdk,
+    });
+  }
+
+  async function defaultNetlifyTokenRefresh(ctx) {
+    const values = tokensToSetCookieHeaderValues(config, ctx.newTokens);
+    for (const v of values) {
+      ctx.responseCookies.push(v);
+    }
+  }
+
+  function ensureRefresh() {
+    if (!refreshInFlight) {
+      refreshInFlight = performRefresh().finally(() => {
+        refreshInFlight = null;
+      });
+    }
+    return refreshInFlight;
+  }
+
+  const options = {
+    appUrl: config.appUrl,
+    fetch: globalThis.fetch.bind(globalThis),
+    forceRefresh: !config.apiToken,
+    ...baseOptions,
+  };
+
+  if (config.apiToken) {
+    options.apiToken = config.apiToken;
+  } else {
+    if (tokens.accessToken) {
+      options.accessToken = tokens.accessToken;
+    }
+    if (tokens.refreshToken) {
+      options.refreshToken = tokens.refreshToken;
+    }
+    options.extraHeaders = async (relativeUrl, forceRefresh) => {
+      const headers = { ...forwarded };
+      if (NO_AUTH_URLS.has(relativeUrl)) {
+        return headers;
+      }
+      if (forceRefresh && tokens.refreshToken) {
+        await ensureRefresh();
+      }
+      const token =
+        sdk?.authentication?.accessToken || tokens.accessToken;
+      if (token) {
+        headers.authorization = 'Bearer ' + token;
+      }
+      return headers;
+    };
+    options.onFailedRefreshToken = async () => {
+      await ensureRefresh();
+    };
+  }
+
+  sdk = new QelosSDK(options);
+  return sdk;
+}
+
+module.exports = {
+  createRequestSdk,
+  tokensToSetCookieHeaderValues,
+};

package/package.json

@@ -1,15 +1,29 @@
 {
   "name": "@qelos/plugin-netlify-api",
-  "version": "1.1.3",
+  "version": "4.1.0",
   "description": "Netlify build plugin: proxy /api/* to Qelos API and inject config",
   "main": "index.js",
   "bin": {
     "qelos-netlify-patch-redirects": "./scripts/patch-redirects.cjs"
   },
+  "exports": {
+    ".": {
+      "require": "./index.js",
+      "default": "./index.js"
+    },
+    "./integrators": {
+      "types": "./integrators/index.d.ts",
+      "import": "./integrators/index.js",
+      "require": "./integrators/index.js",
+      "default": "./integrators/index.js"
+    },
+    "./package.json": "./package.json"
+  },
   "files": [
     "index.js",
     "manifest.yml",
     "functions",
+    "integrators",
     "scripts"
   ],
   "author": "David Meir-Levy <davidmeirlevy@gmail.com>",
@@ -19,5 +33,18 @@
   },
   "engines": {
     "node": ">=18"
+  },
+  "dependencies": {
+    "@qelos/global-types": "^4.1.0",
+    "@qelos/sdk": "^4.1.0"
+  },
+  "peerDependencies": {
+    "@netlify/functions": ">=2.0.0"
+  },
+  "devDependencies": {
+    "@netlify/functions": "^2.8.2"
+  },
+  "scripts": {
+    "test": "node --test integrators/read-tokens.test.cjs"
   }
 }