@adonis-agora/payments-dashboard 0.2.1 → 0.3.0

package/CHANGELOG.md

@@ -1,5 +1,36 @@
 # @adonis-agora/payments-dashboard
 
+## 0.3.0
+
+### Minor Changes
+
+- [#14](https://github.com/DavideCarvalho/adonis-agora-payments/pull/14) [`3a885c4`](https://github.com/DavideCarvalho/adonis-agora-payments/commit/3a885c478dec80ca1b112e318ec3890b6a1bd77c) Thanks [@DavideCarvalho](https://github.com/DavideCarvalho)! - Dashboard: survives a strict CSP, fits on a phone, has URLs, and no longer links to a 404.
+  
+  - **Every API request 404 under a nonce CSP — fixed.** The provider used to hand the SPA its
+    mount/API base as an inline `<script>` setting `window.__PAYMENTS_*__`. A host with
+    `script-src 'self' 'nonce-…'` (`@adonisjs/shield`'s `@nonce`) drops that script silently; the SPA
+    then fell back to `/payments-dashboard/api` and every request from a console that rendered fine
+    answered 404. The config now travels as a `<script type="application/json">` data block, which
+    is never executed and so cannot be refused. Nothing to change on the host. The globals are still
+    honoured as a fallback for tests/embedding.
+  
+  - **Hash routes.** The current screen lives in the URL fragment (`#/webhooks`,
+    `#/webhooks?status=failed`, `#/payments?customer=cus_…`, `#/payments/<gatewayId>` for one payment
+    open in full), so the back button works, a reload comes back to the same screen, and a view can be
+    pasted into a ticket. The health panel's buttons write the same hashes they used to set in state.
+    A fragment rather than a path because the provider deliberately registers no SPA catch-all.
+  - **Mobile.** Every pill row (the tab bar, the status filters) scrolls sideways instead of pushing
+    the page wider than the viewport; the detail and confirm dialogs no longer overflow on a long
+    gateway id; tighter page padding under `sm`.
+  - **Sign out only where it can work.** The config block now carries the auth surface
+    (`auth: { modes } | null`), and the SPA shows the Sign out link only
+    when `dashboardAuth` is configured — that is the only configuration that registers
+    `<path>/logout`; on every other deployment the link was a 404 one click away.
+  - **Favicon.** Inline SVG icon, so the browser's automatic `/favicon.ico` probe stops 404ing in the
+    host app's log.
+  
+  `renderIndexHtml` gains an optional fifth argument (`InjectedAuth`) and now emits the JSON block instead of the globals; `CONFIG_ELEMENT_ID`/`InjectedConfig` are exported. Existing callers are unaffected.
+
 ## 0.2.1
 
 ### Patch Changes

package/README.md

@@ -50,6 +50,22 @@ when that variable is unset. Replace `authorize` with your own guard, and/or add
 `dashboardAuth` session gate (a built-in login page and/or an "open the console from your app"
 endpoint) on top of it.
 
+## URLs
+
+The current screen lives in the hash — `#/payments`, `#/webhooks?status=failed`,
+`#/payments/<gatewayId>` for one payment open in full — so the back button, reload and copy-paste
+all work (`src/app/routes.ts`). A fragment and not a path, because the provider registers no SPA
+catch-all: `<path>` is an exact route, and anything under it that is not `/api` or `/assets` is a
+404 by design. It also fits on a phone: every pill row scrolls sideways rather than pushing the page
+wider than the viewport.
+
+## CSP
+
+The provider hands the SPA its config as a `<script type="application/json">` data block, never an
+executable inline script, so `script-src 'self'` (with or without a nonce) is all the console needs.
+The `window.__PAYMENTS_*__` globals `src/client/payments-client.ts` also reads are a test/embedding
+escape hatch, consulted only when the block is absent.
+
 ## Money
 
 Amounts are integer cents everywhere — in the store, in `billingOverview()`, and on the wire. The only