src/pages/api

What’s here

• [...proxy].ts: catch-all reverse proxy to BACKEND_URL. Reads the auth cookie (authorization ?? auth ?? token) and injects Authorization: Bearer <cookie>; strips hop-by-hop request headers (host, connection, accept-encoding, transfer-encoding, content-length, cookie) and response headers (content-encoding, transfer-encoding, connection). Forwards all methods, streams the body.
• funnel-auth.ts: JSON register/login for the lp/e funnel. A specific route file wins over the catch-all. Sets the SAME httpOnly auth cookies as login/action.ts (imports AUTH_COOKIES_OPTIONS), returns JSON so the island can react without a redirect.

Depends on / used by

• The browser client src/client/solid_api.ts has baseUrl: '/api/', so every island request flows through [...proxy].ts.
• funnel-auth.ts imports AUTH_COOKIES_OPTIONS from ../login/action.ts and login/register from ../../client/api.ts.

Safe vs dangerous to change

• DANGER: auth semantics. The cookie→Bearer translation is what keeps the access token httpOnly (never JS-readable). Do NOT add endpoints that reach the backend bypassing this proxy pattern, and do NOT weaken the httpOnly cookie handling.
• Safe: adjusting the stripped-header list only with a clear reason; adding backend-error→German-copy mappings in funnel-auth.ts.