@adonis-agora/durable 0.27.0 → 0.29.0

package/CHANGELOG.md

@@ -1,5 +1,56 @@
 # @adonis-agora/durable
 
+## 0.29.0
+
+### Minor Changes
+
+- [#88](https://github.com/DavideCarvalho/adonis-agora-durable/pull/88) [`8873c6b`](https://github.com/DavideCarvalho/adonis-agora-durable/commit/8873c6b9f0a8c6a90af046368b8aa6309a2c7ad6) Thanks [@DavideCarvalho](https://github.com/DavideCarvalho)! - Dashboard: a refused page navigation now gets a real page instead of `{"error":"forbidden"}`.
+  
+  Opening the console without permission used to answer the browser with the same JSON the API
+  gets. It now serves a built-in access-denied page in the console's own visual language — the
+  status, a sentence explaining the refusal, a "Back to app" link and, when `dashboardAuth.login`
+  is configured, a "Sign in" button. The Mode-A-only "Open this console from your application."
+  notice uses the same page. API requests are unchanged (the SPA still relies on their JSON), and
+  an `authorize` hook that redirects still wins.
+  
+  The page carries no inline `<script>`, so a nonce'd `script-src` CSP cannot break it; its inline
+  `<style>` takes `@adonisjs/shield`'s request nonce when one exists.
+  
+  New `accessDenied` option on `config/durable_dashboard.ts` to customise it — an object
+  (`brand`, `title`, `message`, `homeHref`, `loginHref`, `accent`, labels) to tweak the built-in
+  page, or a function `(info, ctx) => html | void` to render it yourself or redirect.
+  
+  Also: the built-in `dashboardAuth` login page no longer dies under a nonce'd CSP. It is now a real
+  HTML form that works without JavaScript — a form submit is answered with a redirect (to the page
+  the operator came from, or back to the form with the error shown) while the page's own `fetch`
+  keeps getting JSON — and its inline script/style carry `@adonisjs/shield`'s request nonce.
+  `renderLoginPage` takes an optional `{ nonce, error, returnTo }`.
+
+## 0.28.0
+
+### Minor Changes
+
+- [#84](https://github.com/DavideCarvalho/adonis-agora-durable/pull/84) [`5f8c6bd`](https://github.com/DavideCarvalho/adonis-agora-durable/commit/5f8c6bd7dbd9e9afd723ce5dd0a0f29a706059b2) Thanks [@DavideCarvalho](https://github.com/DavideCarvalho)! - Remove the `GET <path>/legacy` route and the `renderDashboard` export behind it.
+  
+  `/legacy` served the console as it was before the React SPA: one self-contained page whose whole
+  UI was an inline `<script>`. It was kept "for an environment where the SPA bundle cannot be
+  served", but it could not have worked under the CSP a shield-hardened host runs
+  (`script-src 'self' 'nonce-…'` drops that script whole, leaving a blank page behind a live,
+  guarded route). The JSON API it called is unchanged — `GET /api/health` in particular stays — so
+  a hand-written client keeps working; only the page is gone.
+
+### Patch Changes
+
+- [#84](https://github.com/DavideCarvalho/adonis-agora-durable/pull/84) [`5f8c6bd`](https://github.com/DavideCarvalho/adonis-agora-durable/commit/5f8c6bd7dbd9e9afd723ce5dd0a0f29a706059b2) Thanks [@DavideCarvalho](https://github.com/DavideCarvalho)! - Dashboard: every API request 404 under a nonce CSP — fixed.
+  
+  The provider used to hand the SPA its mount/API base as an inline `<script>` setting
+  `window.__DURABLE_BASE__`/`__DURABLE_API__`. A host with `script-src 'self' 'nonce-…'`
+  (`@adonisjs/shield`'s `@nonce`, the recommended setup) drops that script silently; the SPA then fell
+  back to `/durable/api`, and on any other mount path every request from a console that rendered
+  perfectly well answered 404. The config now travels as a `<script type="application/json">` data
+  block, which is never executed and so cannot be refused. Nothing to change on the host; the globals
+  are still honoured as a fallback for tests and hand-embedding.
+
 ## 0.27.0
 
 ### Minor Changes