@qelos/plugin-netlify-api 4.1.0 → 4.1.2

package/functions/proxy-request.test.ts

@@ -0,0 +1,110 @@
+import assert from 'node:assert/strict';
+import { describe, it } from 'node:test';
+import {
+  buildTargetPath,
+  isExternalOAuthLocation,
+  isUpstreamApiHost,
+  publicHostForUpstream,
+} from './proxy-request.ts';
+
+describe('buildTargetPath', () => {
+  it('uses rawQuery when present', () => {
+    assert.equal(
+      buildTargetPath({
+        path: '/.netlify/functions/qelos-api-proxy',
+        rawUrl: '/api/auth/linkedin',
+        rawQuery: 'redirectUrl=https%3A%2F%2Fapp.example.com%2Fcallback&state=abc',
+      }),
+      '/api/auth/linkedin?redirectUrl=https%3A%2F%2Fapp.example.com%2Fcallback&state=abc',
+    );
+  });
+
+  it('falls back to search embedded in rawUrl', () => {
+    assert.equal(
+      buildTargetPath({
+        rawUrl: '/api/auth/linkedin?redirectUrl=https%3A%2F%2Fapp.example.com%2Fcallback',
+      }),
+      '/api/auth/linkedin?redirectUrl=https%3A%2F%2Fapp.example.com%2Fcallback',
+    );
+  });
+
+  it('falls back to queryStringParameters', () => {
+    assert.equal(
+      buildTargetPath({
+        rawUrl: '/api/auth/linkedin',
+        queryStringParameters: {
+          redirectUrl: 'https://app.example.com/api/auth/linkedin/callback',
+          state: 'abc',
+        },
+      }),
+      '/api/auth/linkedin?redirectUrl=https%3A%2F%2Fapp.example.com%2Fapi%2Fauth%2Flinkedin%2Fcallback&state=abc',
+    );
+  });
+
+  it('prefers /api path and query from event.path when rawUrl targets the function', () => {
+    assert.equal(
+      buildTargetPath({
+        path: '/api/auth/linkedin?redirectUrl=https%3A%2F%2Fapp.example.com%2Fapi%2Fauth%2Flinkedin%2Fcallback&state=abc',
+        rawUrl: 'https://app.example.com/.netlify/functions/qelos-api-proxy',
+        rawQuery: '',
+        queryStringParameters: null,
+      }),
+      '/api/auth/linkedin?redirectUrl=https%3A%2F%2Fapp.example.com%2Fapi%2Fauth%2Flinkedin%2Fcallback&state=abc',
+    );
+  });
+});
+
+describe('publicHostForUpstream', () => {
+  it('prefers x-forwarded-host over host', () => {
+    assert.equal(
+      publicHostForUpstream(
+        {
+          headers: {
+            host: 'admin.example.com',
+            'x-forwarded-host': 'app.example.com',
+          },
+          rawUrl: '/api/me',
+        },
+        '159.203.152.168',
+      ),
+      'app.example.com',
+    );
+  });
+
+  it('prefers rawUrl host over upstream API host header', () => {
+    assert.equal(
+      publicHostForUpstream(
+        {
+          headers: {
+            host: 'admin.example.com',
+          },
+          rawUrl: 'https://app.example.com/api/auth/linkedin',
+        },
+        'admin.example.com',
+      ),
+      'app.example.com',
+    );
+  });
+});
+
+describe('isUpstreamApiHost', () => {
+  it('treats configured upstream host as internal', () => {
+    assert.equal(isUpstreamApiHost('admin.example.com', 'https://admin.example.com'), true);
+    assert.equal(isUpstreamApiHost('app.example.com', 'https://admin.example.com'), false);
+  });
+});
+
+describe('isExternalOAuthLocation', () => {
+  it('detects LinkedIn authorization URLs', () => {
+    assert.equal(
+      isExternalOAuthLocation(
+        'https://www.linkedin.com/oauth/v2/authorization?redirect_uri=https%3A%2F%2Fapp.example.com%2Fcallback',
+      ),
+      true,
+    );
+  });
+
+  it('rejects same-origin API redirects', () => {
+    assert.equal(isExternalOAuthLocation('https://app.example.com/api/me'), false);
+  });
+});

package/functions/proxy-request.ts

@@ -0,0 +1,168 @@
+import type { HandlerEvent } from '@netlify/functions';
+
+const OAUTH_PROVIDER_HOSTS = new Set([
+  'linkedin.com',
+  'www.linkedin.com',
+  'accounts.google.com',
+  'www.facebook.com',
+  'github.com',
+]);
+
+export function pickHeader(
+  headers: Record<string, string | string[] | undefined>,
+  name: string,
+): string | undefined {
+  const want = name.toLowerCase();
+  for (const [key, value] of Object.entries(headers)) {
+    if (key.toLowerCase() !== want) continue;
+    if (value == null) continue;
+    const normalized = Array.isArray(value) ? value[0] : value;
+    if (typeof normalized === 'string' && normalized.length > 0) {
+      return normalized;
+    }
+  }
+  return undefined;
+}
+
+export function isUpstreamApiHost(host: string, upstreamFallback: string): boolean {
+  const normalized = host.split(',')[0].trim().split(':')[0].toLowerCase();
+  if (!normalized) return true;
+  if (/^\d{1,3}(\.\d{1,3}){3}$/.test(normalized)) return true;
+  if (normalized.includes('auth-service') || normalized.includes('gateway')) return true;
+
+  const upstream = upstreamFallback.trim();
+  if (!upstream) return false;
+
+  try {
+    const upstreamHost = (
+      upstream.includes('://') ? new URL(upstream).hostname : upstream.split('/')[0].split(':')[0]
+    ).toLowerCase();
+    return normalized === upstreamHost;
+  } catch {
+    return normalized === upstream.toLowerCase();
+  }
+}
+
+export function publicHostForUpstream(
+  event: Pick<HandlerEvent, 'headers' | 'rawUrl'>,
+  fallbackHost: string,
+): string {
+  const forwarded = pickHeader(event.headers, 'x-forwarded-host');
+  if (forwarded) {
+    return forwarded.split(',')[0].trim();
+  }
+
+  try {
+    const fromRawUrl = new URL(event.rawUrl || '/', 'http://qelos.local').host;
+    if (fromRawUrl && !isUpstreamApiHost(fromRawUrl, fallbackHost)) {
+      return fromRawUrl;
+    }
+  } catch {
+    // fall through
+  }
+
+  const host = pickHeader(event.headers, 'host');
+  if (host && !isUpstreamApiHost(host, fallbackHost)) {
+    return host;
+  }
+
+  return fallbackHost;
+}
+
+function queryStringFromParameters(
+  params: Record<string, string | undefined> | null | undefined,
+): string {
+  if (!params) return '';
+  const search = new URLSearchParams();
+  for (const [key, value] of Object.entries(params)) {
+    if (value != null) search.append(key, value);
+  }
+  return search.toString();
+}
+
+function queryStringFromMultiValue(
+  params: Record<string, string[] | undefined> | null | undefined,
+): string {
+  if (!params) return '';
+  const search = new URLSearchParams();
+  for (const [key, values] of Object.entries(params)) {
+    if (!values) continue;
+    for (const value of values) {
+      if (value != null) search.append(key, value);
+    }
+  }
+  return search.toString();
+}
+
+function queryFromPath(path: string | undefined): { pathname: string; query: string } {
+  if (!path) return { pathname: '', query: '' };
+  const qIndex = path.indexOf('?');
+  if (qIndex === -1) return { pathname: path, query: '' };
+  return {
+    pathname: path.slice(0, qIndex),
+    query: path.slice(qIndex + 1),
+  };
+}
+
+/**
+ * Preserve the inbound query string when forwarding to the Qelos API.
+ * Netlify may provide `rawQuery`, embed search in `rawUrl` or `path`, or only expose
+ * `queryStringParameters` — OAuth social-login flows require `redirectUrl`.
+ */
+export function buildTargetPath(
+  event: Pick<
+    HandlerEvent,
+    'path' | 'rawUrl' | 'rawQuery' | 'queryStringParameters' | 'multiValueQueryStringParameters'
+  >,
+): string {
+  const fromPath = queryFromPath(typeof event.path === 'string' ? event.path : '');
+  const parsed = new URL(event.rawUrl || '/', 'http://qelos.local');
+
+  const pathname =
+    (fromPath.pathname.startsWith('/api') ? fromPath.pathname : '') ||
+    (parsed.pathname.startsWith('/api') ? parsed.pathname : '') ||
+    fromPath.pathname ||
+    parsed.pathname;
+
+  const query =
+    event.rawQuery?.trim() ||
+    fromPath.query ||
+    (parsed.search ? parsed.search.slice(1) : '') ||
+    queryStringFromParameters(event.queryStringParameters) ||
+    queryStringFromMultiValue(event.multiValueQueryStringParameters);
+
+  return query ? `${pathname}?${query}` : pathname;
+}
+
+export function isExternalOAuthLocation(location: string): boolean {
+  try {
+    const host = new URL(location).hostname.toLowerCase();
+    if (OAUTH_PROVIDER_HOSTS.has(host)) return true;
+    return host.endsWith('.linkedin.com')
+      || host.endsWith('.google.com')
+      || host.endsWith('.facebook.com')
+      || host.endsWith('.github.com');
+  } catch {
+    return false;
+  }
+}
+
+export function buildHtmlRedirectResponse(location: string) {
+  const html = `<!DOCTYPE html><html><head><meta charset="utf-8"><meta http-equiv="refresh" content="0;url=${escapeHtmlAttribute(location)}"><script>location.replace(${JSON.stringify(location)})</script></head><body>Redirecting…</body></html>`;
+  return {
+    statusCode: 200,
+    headers: {
+      'content-type': 'text/html; charset=utf-8',
+      'cache-control': 'no-store',
+    },
+    body: html,
+  };
+}
+
+function escapeHtmlAttribute(value: string): string {
+  return value
+    .replace(/&/g, '&amp;')
+    .replace(/"/g, '&quot;')
+    .replace(/</g, '&lt;')
+    .replace(/>/g, '&gt;');
+}

package/functions/qelos-api-proxy.ts

@@ -1,6 +1,12 @@
 import http from "http";
 import https from "https";
 import type { Handler } from "@netlify/functions";
+import {
+  buildHtmlRedirectResponse,
+  buildTargetPath,
+  isExternalOAuthLocation,
+  publicHostForUpstream,
+} from "./proxy-request";
 
 /** Same-origin proxy target; mirrors manual setups that use API_HOST (e.g. ai-words api-proxy). */
 const raw =
@@ -29,8 +35,7 @@ const ADD_BYPASS_ADMIN_HEADER =
 
 export const handler: Handler = (event) =>
   new Promise((resolve) => {
-    // Build forwarded headers. Upstream Qelos expects Host = public app domain (e.g. app.auto.qelos.io),
-    // not the raw API IP — use the visitor-facing host (case-insensitive headers; rawUrl fallback).
+    const publicHost = publicHostForUpstream(event, PROXY_HOST);
     const headers: Record<string, string> = {};
     for (const [key, val] of Object.entries(event.headers ?? {})) {
       if (val == null || val === "") continue;
@@ -40,16 +45,14 @@ export const handler: Handler = (event) =>
         headers[key] = val;
       }
     }
-    headers["host"] = publicHostForUpstream(event);
+    headers["host"] = publicHost;
+    headers["x-forwarded-host"] = publicHost;
     if (ADD_BYPASS_ADMIN_HEADER) {
       headers["x-bypass-admin"] = "true";
     }
-    // Lambda buffers the body, so chunked encoding is not applicable
     delete headers["transfer-encoding"];
 
-    const targetPath =
-      new URL(event.rawUrl).pathname +
-      (event.rawQuery ? `?${event.rawQuery}` : "");
+    const targetPath = buildTargetPath(event);
 
     const body = event.body
       ? Buffer.from(event.body, event.isBase64Encoded ? "base64" : "utf8")
@@ -64,6 +67,18 @@ export const handler: Handler = (event) =>
         headers,
       },
       (proxyRes) => {
+        const status = proxyRes.statusCode ?? 200;
+        const location = proxyRes.headers.location;
+        if (
+          status >= 300 &&
+          status < 400 &&
+          typeof location === "string" &&
+          isExternalOAuthLocation(location)
+        ) {
+          resolve(buildHtmlRedirectResponse(location));
+          return;
+        }
+
         const chunks: Buffer[] = [];
         proxyRes.on("data", (chunk: Buffer) => chunks.push(chunk));
         proxyRes.on("end", () => {
@@ -74,7 +89,7 @@ export const handler: Handler = (event) =>
             }
           }
           resolve({
-            statusCode: proxyRes.statusCode ?? 200,
+            statusCode: status,
             headers: resHeaders,
             body: Buffer.concat(chunks).toString("base64"),
             isBase64Encoded: true,
@@ -92,38 +107,3 @@ export const handler: Handler = (event) =>
     if (body) proxyReq.write(body);
     proxyReq.end();
   });
-
-function publicHostForUpstream(event: {
-  headers: Record<string, string | string[] | undefined>;
-  rawUrl: string;
-}): string {
-  const forwarded = pickHeader(event.headers, "x-forwarded-host");
-  if (forwarded) {
-    return forwarded.split(",")[0].trim();
-  }
-  const h = pickHeader(event.headers, "host");
-  if (h) {
-    return h;
-  }
-  try {
-    return new URL(event.rawUrl).hostname;
-  } catch {
-    return PROXY_HOST;
-  }
-}
-
-function pickHeader(
-  headers: Record<string, string | string[] | undefined>,
-  name: string,
-): string | undefined {
-  const want = name.toLowerCase();
-  for (const [k, v] of Object.entries(headers)) {
-    if (k.toLowerCase() !== want) continue;
-    if (v == null) continue;
-    const s = Array.isArray(v) ? v[0] : v;
-    if (typeof s === "string" && s.length > 0) {
-      return s;
-    }
-  }
-  return undefined;
-}

package/index.js

@@ -71,9 +71,12 @@ module.exports = {
       }
       const destDir = resolveFunctionsDirectory(netlifyConfig);
       const destFile = path.join(destDir, 'qelos-api-proxy.ts');
+      const destHelper = path.join(destDir, 'proxy-request.ts');
       const srcFile = path.join(__dirname, 'functions', 'qelos-api-proxy.ts');
+      const srcHelper = path.join(__dirname, 'functions', 'proxy-request.ts');
       await fs.mkdir(destDir, { recursive: true });
       await fs.copyFile(srcFile, destFile);
+      await fs.copyFile(srcHelper, destHelper);
 
       netlifyConfig.redirects.unshift({
         from: '/api/*',
@@ -88,6 +91,9 @@ module.exports = {
         to: `${origin}/api/:splat`,
         status: 200,
         force: true,
+        headers: {
+          'x-forwarded-host': ':host',
+        },
       };
       if (bypassAdmin) {
         redirect.headers = { 'x-bypass-admin': 'true' };

package/integrators/{read-tokens.test.cjs → read-tokens.test.ts}

@@ -1,11 +1,9 @@
-'use strict';
-
-const test = require('node:test');
-const assert = require('node:assert/strict');
-const {
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import {
   readTokensFromEvent,
   normalizeIntegratorConfig,
-} = require('./request-parse.js');
+} from './request-parse.js';
 
 test('readTokensFromEvent prefers Authorization bearer over cookie token', () => {
   const event = {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@qelos/plugin-netlify-api",
-  "version": "4.1.0",
+  "version": "4.1.2",
   "description": "Netlify build plugin: proxy /api/* to Qelos API and inject config",
   "main": "index.js",
   "bin": {
@@ -35,16 +35,17 @@
     "node": ">=18"
   },
   "dependencies": {
-    "@qelos/global-types": "^4.1.0",
-    "@qelos/sdk": "^4.1.0"
+    "@qelos/global-types": "^4.1.1",
+    "@qelos/sdk": "^4.1.1"
   },
   "peerDependencies": {
     "@netlify/functions": ">=2.0.0"
   },
   "devDependencies": {
-    "@netlify/functions": "^2.8.2"
+    "@netlify/functions": "^2.8.2",
+    "tsx": "^4.20.4"
   },
   "scripts": {
-    "test": "node --test integrators/read-tokens.test.cjs"
+    "test": "node --import tsx --test \"**/*.test.ts\""
   }
 }