# quiXzoom Passwordless Auth — Nginx konfiguration
# Lägg till i /etc/nginx/conf.d/ eller inkludera från huvudkonfig

upstream quixzoom_passwordless {
    server 127.0.0.1:8082;
    keepalive 16;
}

# Passwordless auth endpoints
location /v1/auth/passwordless {
    proxy_pass http://quixzoom_passwordless;
    proxy_http_version 1.1;
    proxy_set_header Connection "";
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
    
    # CORS
    add_header Access-Control-Allow-Origin "https://quixzoom.se" always;
    add_header Access-Control-Allow-Methods "GET, POST, OPTIONS" always;
    add_header Access-Control-Allow-Headers "Content-Type, Authorization" always;
    
    # Handle preflight
    if ($request_method = OPTIONS) {
        add_header Access-Control-Allow-Origin "https://quixzoom.se";
        add_header Access-Control-Allow-Methods "GET, POST, OPTIONS";
        add_header Access-Control-Allow-Headers "Content-Type, Authorization";
        add_header Access-Control-Max-Age 86400;
        return 204;
    }
    
    # Rate limiting
    limit_req zone=general burst=20 nodelay;
    
    # Timeouts
    proxy_connect_timeout 5s;
    proxy_send_timeout 10s;
    proxy_read_timeout 10s;
}