igrantio-backend-proxylisted

# iGrant.io backend proxy (API-key hiding, per-tenant) ## When to use Whenever the browser must call OWS but must not hold the API key - which is always. This is the "manages API key for a specific tenant organisation" piece. Compose it into an issuer or verifier backend (see `igrantio-issuer-backend` / `igrantio-verifier-backend`) or mount it in an existing Express app. **Before you build**: run the integrator intake in `igrantio-ows-overview` - environment, API key, tenancy, backend host, webhooks, frontend - one question at a time, a recommended default with each. ## What it does `GET|POST|PUT ${proxyPrefix}/{tenant}/{owsPath...}`: 1. resolves `{tenant}` → OWS API key via a **TenantStore** (env or pluggable), 2. rejects any path not on the caller-supplied allow-list (least privilege, 404), 3. sets `Authorization: ApiKey <key>` and forwards to OWS, 4. streams the response back, stripping hop-by-hop headers. The browser targets `${proxyPrefix}/{tenant}` as its base URL with **no** key. ## Reference [`./references`](./references): - `proxy.ts` - `proxyRouter(store, permittedPrefixes)` Express router. - `tenants.ts` - `TenantStore` interface + `EnvTenantStore` / `MapTenantStore`. - `config.ts` - OWS base URL (OWS_ENV demo|staging, default demo) + timeout. ## Usage ```ts import express from "express"; import { proxyRouter } from "./proxy"; import { EnvTenantStore } from "./tenants"; import { config } from "./config"; const ISSUER = [ "v2/config/digital-wallet/openid/sd