@qelos/plugin-netlify-api 4.1.1 → 4.1.2

package/functions/proxy-request.test.ts

@@ -3,6 +3,7 @@ import { describe, it } from 'node:test';
 import {
   buildTargetPath,
   isExternalOAuthLocation,
+  isUpstreamApiHost,
   publicHostForUpstream,
 } from './proxy-request.ts';
 
@@ -10,6 +11,7 @@ describe('buildTargetPath', () => {
   it('uses rawQuery when present', () => {
     assert.equal(
       buildTargetPath({
+        path: '/.netlify/functions/qelos-api-proxy',
         rawUrl: '/api/auth/linkedin',
         rawQuery: 'redirectUrl=https%3A%2F%2Fapp.example.com%2Fcallback&state=abc',
       }),
@@ -38,6 +40,18 @@ describe('buildTargetPath', () => {
       '/api/auth/linkedin?redirectUrl=https%3A%2F%2Fapp.example.com%2Fapi%2Fauth%2Flinkedin%2Fcallback&state=abc',
     );
   });
+
+  it('prefers /api path and query from event.path when rawUrl targets the function', () => {
+    assert.equal(
+      buildTargetPath({
+        path: '/api/auth/linkedin?redirectUrl=https%3A%2F%2Fapp.example.com%2Fapi%2Fauth%2Flinkedin%2Fcallback&state=abc',
+        rawUrl: 'https://app.example.com/.netlify/functions/qelos-api-proxy',
+        rawQuery: '',
+        queryStringParameters: null,
+      }),
+      '/api/auth/linkedin?redirectUrl=https%3A%2F%2Fapp.example.com%2Fapi%2Fauth%2Flinkedin%2Fcallback&state=abc',
+    );
+  });
 });
 
 describe('publicHostForUpstream', () => {
@@ -56,6 +70,28 @@ describe('publicHostForUpstream', () => {
       'app.example.com',
     );
   });
+
+  it('prefers rawUrl host over upstream API host header', () => {
+    assert.equal(
+      publicHostForUpstream(
+        {
+          headers: {
+            host: 'admin.example.com',
+          },
+          rawUrl: 'https://app.example.com/api/auth/linkedin',
+        },
+        'admin.example.com',
+      ),
+      'app.example.com',
+    );
+  });
+});
+
+describe('isUpstreamApiHost', () => {
+  it('treats configured upstream host as internal', () => {
+    assert.equal(isUpstreamApiHost('admin.example.com', 'https://admin.example.com'), true);
+    assert.equal(isUpstreamApiHost('app.example.com', 'https://admin.example.com'), false);
+  });
 });
 
 describe('isExternalOAuthLocation', () => {

package/functions/proxy-request.ts

@@ -24,6 +24,25 @@ export function pickHeader(
   return undefined;
 }
 
+export function isUpstreamApiHost(host: string, upstreamFallback: string): boolean {
+  const normalized = host.split(',')[0].trim().split(':')[0].toLowerCase();
+  if (!normalized) return true;
+  if (/^\d{1,3}(\.\d{1,3}){3}$/.test(normalized)) return true;
+  if (normalized.includes('auth-service') || normalized.includes('gateway')) return true;
+
+  const upstream = upstreamFallback.trim();
+  if (!upstream) return false;
+
+  try {
+    const upstreamHost = (
+      upstream.includes('://') ? new URL(upstream).hostname : upstream.split('/')[0].split(':')[0]
+    ).toLowerCase();
+    return normalized === upstreamHost;
+  } catch {
+    return normalized === upstream.toLowerCase();
+  }
+}
+
 export function publicHostForUpstream(
   event: Pick<HandlerEvent, 'headers' | 'rawUrl'>,
   fallbackHost: string,
@@ -32,15 +51,22 @@ export function publicHostForUpstream(
   if (forwarded) {
     return forwarded.split(',')[0].trim();
   }
-  const host = pickHeader(event.headers, 'host');
-  if (host) {
-    return host;
-  }
+
   try {
-    return new URL(event.rawUrl, 'http://qelos.local').hostname;
+    const fromRawUrl = new URL(event.rawUrl || '/', 'http://qelos.local').host;
+    if (fromRawUrl && !isUpstreamApiHost(fromRawUrl, fallbackHost)) {
+      return fromRawUrl;
+    }
   } catch {
-    return fallbackHost;
+    // fall through
+  }
+
+  const host = pickHeader(event.headers, 'host');
+  if (host && !isUpstreamApiHost(host, fallbackHost)) {
+    return host;
   }
+
+  return fallbackHost;
 }
 
 function queryStringFromParameters(
@@ -54,27 +80,58 @@ function queryStringFromParameters(
   return search.toString();
 }
 
+function queryStringFromMultiValue(
+  params: Record<string, string[] | undefined> | null | undefined,
+): string {
+  if (!params) return '';
+  const search = new URLSearchParams();
+  for (const [key, values] of Object.entries(params)) {
+    if (!values) continue;
+    for (const value of values) {
+      if (value != null) search.append(key, value);
+    }
+  }
+  return search.toString();
+}
+
+function queryFromPath(path: string | undefined): { pathname: string; query: string } {
+  if (!path) return { pathname: '', query: '' };
+  const qIndex = path.indexOf('?');
+  if (qIndex === -1) return { pathname: path, query: '' };
+  return {
+    pathname: path.slice(0, qIndex),
+    query: path.slice(qIndex + 1),
+  };
+}
+
 /**
  * Preserve the inbound query string when forwarding to the Qelos API.
- * Netlify may provide `rawQuery`, embed search in `rawUrl`, or only expose
+ * Netlify may provide `rawQuery`, embed search in `rawUrl` or `path`, or only expose
  * `queryStringParameters` — OAuth social-login flows require `redirectUrl`.
  */
 export function buildTargetPath(
-  event: Pick<HandlerEvent, 'rawUrl' | 'rawQuery' | 'queryStringParameters'>,
+  event: Pick<
+    HandlerEvent,
+    'path' | 'rawUrl' | 'rawQuery' | 'queryStringParameters' | 'multiValueQueryStringParameters'
+  >,
 ): string {
+  const fromPath = queryFromPath(typeof event.path === 'string' ? event.path : '');
   const parsed = new URL(event.rawUrl || '/', 'http://qelos.local');
-  const pathname = parsed.pathname;
 
-  const fromRawQuery = event.rawQuery?.trim();
-  if (fromRawQuery) {
-    return `${pathname}?${fromRawQuery}`;
-  }
-  if (parsed.search) {
-    return `${pathname}${parsed.search}`;
-  }
+  const pathname =
+    (fromPath.pathname.startsWith('/api') ? fromPath.pathname : '') ||
+    (parsed.pathname.startsWith('/api') ? parsed.pathname : '') ||
+    fromPath.pathname ||
+    parsed.pathname;
+
+  const query =
+    event.rawQuery?.trim() ||
+    fromPath.query ||
+    (parsed.search ? parsed.search.slice(1) : '') ||
+    queryStringFromParameters(event.queryStringParameters) ||
+    queryStringFromMultiValue(event.multiValueQueryStringParameters);
 
-  const fromParams = queryStringFromParameters(event.queryStringParameters);
-  return fromParams ? `${pathname}?${fromParams}` : pathname;
+  return query ? `${pathname}?${query}` : pathname;
 }
 
 export function isExternalOAuthLocation(location: string): boolean {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@qelos/plugin-netlify-api",
-  "version": "4.1.1",
+  "version": "4.1.2",
   "description": "Netlify build plugin: proxy /api/* to Qelos API and inject config",
   "main": "index.js",
   "bin": {
@@ -35,8 +35,8 @@
     "node": ">=18"
   },
   "dependencies": {
-    "@qelos/sdk": "^4.1.1",
-    "@qelos/global-types": "^4.1.1"
+    "@qelos/global-types": "^4.1.1",
+    "@qelos/sdk": "^4.1.1"
   },
   "peerDependencies": {
     "@netlify/functions": ">=2.0.0"