fix(qbittorrent): rewrite cookie name on Request objects for qBT 5.x (#208)

qBT 5.x renames the session cookie from `SID` to `QBT_SID_<port>`.
The previous wrapper captured the new cookie name on login but only
rewrote outgoing Cookie headers when fetch was called as
(url, init) — the generated SDK actually passes a pre-built Request,
so the rewrite branch never ran and every authenticated call went
out with `Cookie: SID=…` and got 403.

Handle both call shapes: when input is a Request, clone it with a
rewritten Cookie header; otherwise fall back to the init.headers
path. Verified end-to-end against a real qBT 5.2.0 container.

Closes #205

Author: robbeverhelst

src/clients/qbittorrent.ts

@@ -67,14 +67,27 @@ export class QBittorrentClient {
     input: RequestInfo | URL,
     init?: RequestInit
   ): Promise<Response> {
-    if (!init?.headers || this.cookieName === 'SID') {
+    if (this.cookieName === 'SID') {
       return baseFetch(input, init);
     }
-    const headers = new Headers(init.headers);
-    const cookie = headers.get('cookie');
-    if (cookie?.includes('SID=')) {
-      headers.set('cookie', cookie.replace(/(^|;\s*)SID=/, `$1${this.cookieName}=`));
-      return baseFetch(input, { ...init, headers });
+    // The generated SDK may pass either (url, init) or a pre-built Request.
+    // Rewrite the Cookie header in whichever form actually carries it.
+    if (input instanceof Request) {
+      const cookie = input.headers.get('cookie');
+      if (cookie?.includes('SID=')) {
+        const headers = new Headers(input.headers);
+        headers.set('cookie', cookie.replace(/(^|;\s*)SID=/, `$1${this.cookieName}=`));
+        return baseFetch(new Request(input, { headers }), init);
+      }
+      return baseFetch(input, init);
+    }
+    if (init?.headers) {
+      const headers = new Headers(init.headers);
+      const cookie = headers.get('cookie');
+      if (cookie?.includes('SID=')) {
+        headers.set('cookie', cookie.replace(/(^|;\s*)SID=/, `$1${this.cookieName}=`));
+        return baseFetch(input, { ...init, headers });
+      }
     }
     return baseFetch(input, init);
   }

tests/clients.test.ts

@@ -156,4 +156,56 @@ describe('Tsarr Client Tests', () => {
       expect(typeof qbit.deleteTorrents).toBe('function');
     });
   });
+
+  describe('QBittorrentClient auth flow', () => {
+    type LoginResponse = () => Response;
+
+    async function captureCookieOnApiCall(loginResponse: LoginResponse): Promise<string | null> {
+      const calls: { url: string; cookie: string | null }[] = [];
+      const originalFetch = globalThis.fetch;
+      globalThis.fetch = (async (input: RequestInfo | URL, init?: RequestInit) => {
+        const url = input instanceof Request ? input.url : input.toString();
+        const cookie =
+          input instanceof Request
+            ? input.headers.get('cookie')
+            : init?.headers
+              ? new Headers(init.headers).get('cookie')
+              : null;
+        calls.push({ url, cookie });
+        if (url.endsWith('/api/v2/auth/login')) return loginResponse();
+        if (url.endsWith('/api/v2/app/version')) return new Response('v5.0.0', { status: 200 });
+        return new Response('not mocked', { status: 500 });
+      }) as typeof globalThis.fetch;
+      try {
+        const client = new QBittorrentClient({
+          baseUrl: 'http://localhost:8080',
+          username: 'admin',
+          password: 'adminadmin',
+        });
+        await client.getAppVersion();
+        return calls.find(c => c.url.endsWith('/api/v2/app/version'))?.cookie ?? null;
+      } finally {
+        globalThis.fetch = originalFetch;
+      }
+    }
+
+    it('sends SID cookie against qBT 4.x (200 + "Ok." + SID=)', async () => {
+      const cookie = await captureCookieOnApiCall(
+        () => new Response('Ok.', { status: 200, headers: { 'set-cookie': 'SID=abc123; path=/' } })
+      );
+      expect(cookie).toContain('SID=abc123');
+    });
+
+    it('sends QBT_SID_<port> cookie against qBT 5.x (204 + empty + QBT_SID_8080=)', async () => {
+      const cookie = await captureCookieOnApiCall(
+        () =>
+          new Response(null, {
+            status: 204,
+            headers: { 'set-cookie': 'QBT_SID_8080=xyz789; path=/; HttpOnly' },
+          })
+      );
+      expect(cookie).toContain('QBT_SID_8080=xyz789');
+      expect(cookie).not.toContain('SID=xyz789');
+    });
+  });
 });