@adonis-agora/agent 0.25.4 → 0.26.0

package/CHANGELOG.md

@@ -1,5 +1,41 @@
 # @adonis-agora/agent
 
+## 0.26.0
+
+### Minor Changes
+
+- [#90](https://github.com/DavideCarvalho/adonis-agora-agent/pull/90) [`c540ed5`](https://github.com/DavideCarvalho/adonis-agora-agent/commit/c540ed5884d8dc2ad4a22c0f29f9ec9c68ace6be) Thanks [@DavideCarvalho](https://github.com/DavideCarvalho)! - Governance console: a refused request now gets a real page instead of `{"error":"forbidden"}`.
+  
+  Opening the console without permission used to answer the browser with JSON. Both providers
+  (the embedded `@adonis-agora/agent/dashboard_provider` and the standalone
+  `@adonis-agora/agent-dashboard`) now serve a built-in access-denied page in the console's own
+  visual language — the status, a sentence explaining the refusal and a "Back to app" link.
+  Statuses are unchanged (`401` when no actor resolves, `403` when `authorize` denies), and a
+  redirect written by `onUnauthenticated`/`authorize` still wins.
+  
+  The page carries no inline `<script>`, so a nonce'd `script-src` CSP cannot break it; its inline
+  `<style>` takes `@adonisjs/shield`'s request nonce when one exists.
+  
+  New `dashboard.accessDenied` option on `config/agent.ts` to customise it — an object (`brand`,
+  `title`, `message`, `homeHref`, `accent`, labels) to tweak the built-in page, or a function
+  `(info, ctx) => html | void` to render it yourself or redirect. `@adonis-agora/agent/dashboard`
+  exports the shared `answerDashboardDenial` + `renderAccessDeniedPage`.
+
+## 0.25.5
+
+### Patch Changes
+
+- [#86](https://github.com/DavideCarvalho/adonis-agora-agent/pull/86) [`98b9c4f`](https://github.com/DavideCarvalho/adonis-agora-agent/commit/98b9c4f97c1a04dd58bde67346cc194ef07a8e5f) Thanks [@DavideCarvalho](https://github.com/DavideCarvalho)! - Dashboard: every API request 404 under a nonce CSP — fixed.
+  
+  The providers used to hand the SPA the agent API base as an inline `<script>` setting
+  `window.__AGENT_DASHBOARD_BASE__`. A host with `script-src 'self' 'nonce-…'` (`@adonisjs/shield`'s
+  `@nonce`, the recommended setup) drops that script silently; the SPA then derived a base from its
+  own URL, which is right only for the default `<agent>/dashboard` mount, and on any other every
+  request from a console that rendered perfectly well answered 404. `injectApiBase` now emits a
+  `<script type="application/json">` data block, which is never executed and so cannot be refused,
+  and `resolveApiBase` reads it first (the global is still honoured after it). Nothing to change on
+  the host.
+
 ## 0.25.4
 
 ### Patch Changes