proxy
The reverse proxy that makes the wrapper path possible.
The wrapper claims the PUBLIC port and the wrapped app runs as a child process on a private loopback port, so - unlike the in-process plugin - there is no middleware chain to insert the gate into. This proxy is that insertion point: it answers the login routes itself, applies the gate to everything else, and forwards what survives to the child.
The gating DECISION is not reimplemented here. @dbx-tools/tunnel’s
gate.gateRequest makes it - the same function the Express middleware calls -
and this module only differs in how the outcome is written: a proxied request
instead of next(), a writeHead instead of res.json. That is deliberate:
two independent implementations of “which requests are gated and which headers
are stripped” is the one way this package could become a security bug.