@adonis-agora/payments-dashboard 1.0.0-rc.0 → 1.0.0-rc.2

package/CHANGELOG.md

@@ -1,5 +1,28 @@
 # @adonis-agora/payments-dashboard
 
+## 1.0.0-rc.2
+
+### Minor Changes
+
+- [#225](https://github.com/DavideCarvalho/adonis-agora-payments/pull/225) [`da2bcf4`](https://github.com/DavideCarvalho/adonis-agora-payments/commit/da2bcf4419969d8f2b30baddca089db33a18a8aa) Thanks [@DavideCarvalho](https://github.com/DavideCarvalho)! - Organizations as tenants. With tenancy on in `@adonis-agora/context` (payments' new `tenancy` option defaults to `'inherit'`; nothing changes while it is off): `ensureCustomer` with a store and no `owner` records the active organization as the owner; `payments.currentOwner()` / `payments.currentCustomer()` answer the active organization's customer, else the signed-in user's (`userOwnerType`, default `'User'`); metered usage with no `customerId` is the current customer's; `payments.scopedStore()` confines reads to the current organization; app webhook handlers run inside the organization that owns the customer. The console's `authorize` may answer `tenants: '*' | string[]`; reads are confined to the viewer's organizations, `?tenant=` picks one (a pick outside the grant reads as empty and is audited), and the SPA gains an Organization picker. Store reads accept `owners` (custom stores opt in with `ownerScoping: true`). `payments:sync` gains `--tenant`, `--backfill-owner`, `--owner-id` and `--owner-key`.
+
+## 1.0.0-rc.1
+
+### Major Changes
+
+- [#222](https://github.com/DavideCarvalho/adonis-agora-payments/pull/222) [`b57fa20`](https://github.com/DavideCarvalho/adonis-agora-payments/commit/b57fa209cf7da05b6c26eebb8ced5341d85eaa67) Thanks [@DavideCarvalho](https://github.com/DavideCarvalho)! - Dashboard `authorize` adopts the shared Agora console contract, and the console behaves like every other Agora console.
+  
+  - `authorize` takes an inline function, an authorizer class (built through the container, so `@inject()` works), or a lazy import `() => import('#policies/console_access')`. An authorizer may answer `{ redirectTo }`: a `302` for page navigations, `401 { error: 'unauthenticated', redirectTo }` for API calls. A throw is a `403`.
+  - With `authorize` omitted the console is open outside production and answers every request with `403` in production, and the app logs one warning at boot: ``[@adonis-agora/payments] console has no `authorize` configured: it is open outside production and denies every request in production. Set `authorize` in config/payments_dashboard.ts.``
+  - `PAYMENTS_DASHBOARD_TOKEN` is removed, with the `x-payments-token` header and the `?token=` query param, and `defaultAuthorize` is no longer exported. For token access use the new `authorizeByToken({ token: env.get('CONSOLE_TOKEN') })`, which checks `Authorization: Bearer <token>` in constant time and answers `401` otherwise. An empty token throws when the config loads.
+  - API denials from `authorize` answer `{ error: 'forbidden' }` (`403`) or `{ error: 'unauthenticated' }` (`401`, was `'unauthorized'`).
+  - `dashboardAuth` is removed, with no alias: the built-in login page, `GET|POST <path>/login`, `POST <path>/session`, `GET <path>/logout`, the signed session cookie and its `login`/`session` hooks, and the exports `resolveDashboardAuth`, `performLogin`, `performSession`, `readSession`, `sanitizeReturnTo`, `SESSION_COOKIE_NAME`, `signSessionCookie`, `verifySessionCookie`, `renderLoginPage` and the types `DashboardAuthOptions`, `ResolvedDashboardAuth`, `AuthMode`, `LoginHook`, `LoginOutcome`, `SessionHook`, `SessionOutcome`, `DashboardSession`, `DashboardSessionUser`, `SignOptions`, `VerifyOptions`, `InjectedAuth`. Sign-in is your app's own: gate the console in `authorize` and return `{ redirectTo: '/login' }` for a signed-out visitor. `ResolvedPaymentsDashboardConfig` has no `dashboardAuth`, and the injected page config no `auth`.
+  - The console UI has no Sign out link. On a `401` from its API it follows the body's `redirectTo`, or reloads the console page so the server answers the navigation.
+  - Refunds and dispute resolutions are recorded against the app's signed-in user (`ctx.auth.user`'s `email`, `name` or `id`), `bearer` for a token caller, else unattributed.
+  - The access-denied page drops the `session-required` reason; `loginHref` is only what you pass in `accessDenied`.
+  
+  Exported from `@adonis-agora/payments/dashboard`: `ConsoleAuthorize`, `ConsoleAuthorizer`, `ConsoleAuthorizerClass`, `ConsoleAuthorizeResult`, `resolveConsoleAuthorize`, `authorizeByToken`. `ResolvedPaymentsDashboardConfig['authorize']` is now `ConsoleAuthorize | null`. The payments client endpoint (`config/payments_client.ts`) and payment-driver tokens are unchanged.
+
 ## 1.0.0-rc.0
 
 ### Major Changes

package/README.md

@@ -44,13 +44,15 @@ export default defineConfig({
 })
 ```
 
-**Auth defaults to the same posture as `@adonis-agora/durable`'s console**: open outside production;
-in production it requires a bearer token equal to `PAYMENTS_DASHBOARD_TOKEN`, and denies everything
-when that variable is unset. Replace `authorize` with your own guard — it returns `true`/`false` or
+**Without `authorize` the console is open outside production and answers `403` to every request in
+production** (with a warning at boot). Set `authorize` to your own guard: an inline
+function, an authorizer class (built through the container, so `@inject()` works), or a lazy import
+`() => import('#policies/console_access')`. It answers `true`/`false`,
 `{ allowed, reason?: 'unauthenticated' | 'forbidden' }` (`401` for `unauthenticated`, `403` for any
-other denial or a throw) — and/or add the optional
-`dashboardAuth` session gate (a built-in login page and/or an "open the console from your app"
-endpoint) on top of it.
+other denial or a throw) or `{ redirectTo }`. For machine access use
+`authorizeByToken({ token: env.get('CONSOLE_TOKEN') })` (bearer header only). Sign-in is your app's
+own: return `{ redirectTo: '/login' }` for a signed-out visitor. When an API call answers `401`, the
+console follows its `redirectTo`, or reloads so the server answers the navigation.
 
 ## URLs
 
@@ -65,7 +67,7 @@ wider than the viewport.
 
 The provider hands the SPA its config as a `<script type="application/json">` data block, never an
 executable inline script, so `script-src 'self'` (with or without a nonce) is all the console needs.
-That block is the only way the SPA learns its mount, API base, currency and auth surface.
+That block is the only way the SPA learns its mount, API base and currency.
 
 ## Money