@adonis-agora/agent 0.25.4 → 0.25.5
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +15 -0
- package/dist/assets/spa/assets/index-Cfi3g3b2.js +9 -0
- package/dist/assets/spa/index.html +1 -1
- package/dist/src/dashboard/index.d.ts +1 -1
- package/dist/src/dashboard/index.d.ts.map +1 -1
- package/dist/src/dashboard/index.js +1 -1
- package/dist/src/dashboard/index.js.map +1 -1
- package/dist/src/dashboard/paths.d.ts +12 -3
- package/dist/src/dashboard/paths.d.ts.map +1 -1
- package/dist/src/dashboard/paths.js +16 -4
- package/dist/src/dashboard/paths.js.map +1 -1
- package/dist/src/index.d.ts +1 -1
- package/dist/src/index.js +1 -1
- package/package.json +1 -1
- package/dist/assets/spa/assets/index-C1YrXiT7.js +0 -9
package/CHANGELOG.md
CHANGED
|
@@ -1,5 +1,20 @@
|
|
|
1
1
|
# @adonis-agora/agent
|
|
2
2
|
|
|
3
|
+
## 0.25.5
|
|
4
|
+
|
|
5
|
+
### Patch Changes
|
|
6
|
+
|
|
7
|
+
- [#86](https://github.com/DavideCarvalho/adonis-agora-agent/pull/86) [`98b9c4f`](https://github.com/DavideCarvalho/adonis-agora-agent/commit/98b9c4f97c1a04dd58bde67346cc194ef07a8e5f) Thanks [@DavideCarvalho](https://github.com/DavideCarvalho)! - Dashboard: every API request 404 under a nonce CSP — fixed.
|
|
8
|
+
|
|
9
|
+
The providers used to hand the SPA the agent API base as an inline `<script>` setting
|
|
10
|
+
`window.__AGENT_DASHBOARD_BASE__`. A host with `script-src 'self' 'nonce-…'` (`@adonisjs/shield`'s
|
|
11
|
+
`@nonce`, the recommended setup) drops that script silently; the SPA then derived a base from its
|
|
12
|
+
own URL, which is right only for the default `<agent>/dashboard` mount, and on any other every
|
|
13
|
+
request from a console that rendered perfectly well answered 404. `injectApiBase` now emits a
|
|
14
|
+
`<script type="application/json">` data block, which is never executed and so cannot be refused,
|
|
15
|
+
and `resolveApiBase` reads it first (the global is still honoured after it). Nothing to change on
|
|
16
|
+
the host.
|
|
17
|
+
|
|
3
18
|
## 0.25.4
|
|
4
19
|
|
|
5
20
|
### Patch Changes
|