fix: express proxy chain (#3112)

src/backend/core/http/expressAugmentation.ts

@@ -80,6 +80,9 @@ declare global {
 
             /** True when the request's Host is a custom domain (not one of the configured Puter domains). */
             is_custom_domain?: boolean;
+
+            /** Parsed cookies, populated by the global `cookie-parser` middleware. */
+            cookies?: Record<string, string>;
         }
     }
 }

src/backend/core/http/middleware/authProbe.ts

@@ -131,8 +131,8 @@ const extractToken = (req: Request, cookieName?: string): string | null => {
     // credentialed API CORS surface; bearer/body/x-api-key tokens remain
     // available for cross-origin SDK requests.
     if (cookieName && !isCrossOriginBrowserRequest(req)) {
-        const cookieToken = readCookie(req, cookieName);
-        if (cookieToken) {
+        const cookieToken = req.cookies?.[cookieName];
+        if (typeof cookieToken === 'string' && cookieToken.length > 0) {
             return stripBearer(cookieToken);
         }
     }
@@ -180,28 +180,3 @@ const isCrossOriginBrowserRequest = (req: Request): boolean => {
         return true;
     }
 };
-
-/**
- * Minimal cookie reader. Avoids pulling in `cookie-parser` for the one
- * lookup the probe needs. Handles quoted values and URL-decodes the result.
- */
-const readCookie = (req: Request, name: string): string | null => {
-    const header =
-        typeof req.header === 'function' ? req.header('cookie') : undefined;
-    if (!header || typeof header !== 'string') return null;
-    const target = `${name}=`;
-    for (const rawPair of header.split(';')) {
-        const pair = rawPair.trim();
-        if (!pair.startsWith(target)) continue;
-        let value = pair.slice(target.length);
-        if (value.startsWith('"') && value.endsWith('"')) {
-            value = value.slice(1, -1);
-        }
-        try {
-            return decodeURIComponent(value);
-        } catch {
-            return value;
-        }
-    }
-    return null;
-};

src/backend/drivers/ai-chat/providers/deepseek/models.ts

@@ -32,6 +32,7 @@ export const DEEPSEEK_MODELS: IChatModel[] = [
         name: 'DeepSeek Chat',
         aliases: [
             'deepseek-v4-flash',
+            'deepseek/deepseek-v4-flash',
             'deepseek-chat',
             'deepseek/deepseek-chat',
             'deepseek/deepseek-reasoner',

src/backend/server.ts

@@ -948,9 +948,9 @@ export class PuterServer {
                 };
             }
             if (fullPath !== undefined) {
-                app.use(fullPath as any, ...mwChain, handler);
+                app.use(fullPath as any, ...mwChain.flat(), handler);
             } else {
-                app.use(...mwChain, handler);
+                app.use(...mwChain.flat(), handler);
             }
             return;
         }

src/gui/src/UI/Settings/UIWindowFinalizeUserDeletion.js

@@ -126,7 +126,6 @@ async function UIWindowFinalizeUserDeletion (options) {
                 credentials: 'include',
                 headers: {
                     'Content-Type': 'application/json',
-                    'Authorization': `Bearer ${puter.authToken}`,
                 },
                 body: JSON.stringify(body),
             });