@adonis-agora/payments 0.4.0 → 0.5.0

package/CHANGELOG.md

@@ -1,5 +1,62 @@
 # @adonis-agora/payments
 
+## 0.5.0
+
+### Minor Changes
+
+- [#18](https://github.com/DavideCarvalho/adonis-agora-payments/pull/18) [`7513756`](https://github.com/DavideCarvalho/adonis-agora-payments/commit/7513756cc6e85cf2b7763737da27bb7599d03878) Thanks [@DavideCarvalho](https://github.com/DavideCarvalho)! - Dashboard: a refused page navigation now gets a real page instead of `{"error":"forbidden"}`.
+  
+  Opening the console without permission used to answer the browser with the same JSON the API
+  gets. It now serves a built-in access-denied page in the console's own visual language — the
+  status, a sentence explaining the refusal, a "Back to app" link and, when `dashboardAuth.login`
+  is configured, a "Sign in" button. The Mode-A-only "Open this console from your application."
+  notice uses the same page. API requests are unchanged (the SPA still relies on their JSON), and
+  an `authorize` hook that redirects still wins.
+  
+  The page carries no inline `<script>`, so a nonce'd `script-src` CSP cannot break it; its inline
+  `<style>` takes `@adonisjs/shield`'s request nonce when one exists.
+  
+  New `accessDenied` option on `config/payments_dashboard.ts` to customise it — an object
+  (`brand`, `title`, `message`, `homeHref`, `loginHref`, `accent`, labels) to tweak the built-in
+  page, or a function `(info, ctx) => html | void` to render it yourself or redirect.
+  
+  Also: the built-in `dashboardAuth` login page no longer dies under a nonce'd CSP. It is now a real
+  HTML form that works without JavaScript — a form submit is answered with a redirect (to the page
+  the operator came from, or back to the form with the error shown) while the page's own `fetch`
+  keeps getting JSON — and its inline script/style carry `@adonisjs/shield`'s request nonce.
+  `renderLoginPage` takes an optional `{ nonce, error, returnTo }`.
+
+## 0.4.1
+
+### Patch Changes
+
+- [#14](https://github.com/DavideCarvalho/adonis-agora-payments/pull/14) [`3a885c4`](https://github.com/DavideCarvalho/adonis-agora-payments/commit/3a885c478dec80ca1b112e318ec3890b6a1bd77c) Thanks [@DavideCarvalho](https://github.com/DavideCarvalho)! - Dashboard: survives a strict CSP, fits on a phone, has URLs, and no longer links to a 404.
+  
+  - **Every API request 404 under a nonce CSP — fixed.** The provider used to hand the SPA its
+    mount/API base as an inline `<script>` setting `window.__PAYMENTS_*__`. A host with
+    `script-src 'self' 'nonce-…'` (`@adonisjs/shield`'s `@nonce`) drops that script silently; the SPA
+    then fell back to `/payments-dashboard/api` and every request from a console that rendered fine
+    answered 404. The config now travels as a `<script type="application/json">` data block, which
+    is never executed and so cannot be refused. Nothing to change on the host. The globals are still
+    honoured as a fallback for tests/embedding.
+  
+  - **Hash routes.** The current screen lives in the URL fragment (`#/webhooks`,
+    `#/webhooks?status=failed`, `#/payments?customer=cus_…`, `#/payments/<gatewayId>` for one payment
+    open in full), so the back button works, a reload comes back to the same screen, and a view can be
+    pasted into a ticket. The health panel's buttons write the same hashes they used to set in state.
+    A fragment rather than a path because the provider deliberately registers no SPA catch-all.
+  - **Mobile.** Every pill row (the tab bar, the status filters) scrolls sideways instead of pushing
+    the page wider than the viewport; the detail and confirm dialogs no longer overflow on a long
+    gateway id; tighter page padding under `sm`.
+  - **Sign out only where it can work.** The config block now carries the auth surface
+    (`auth: { modes } | null`), and the SPA shows the Sign out link only
+    when `dashboardAuth` is configured — that is the only configuration that registers
+    `<path>/logout`; on every other deployment the link was a 404 one click away.
+  - **Favicon.** Inline SVG icon, so the browser's automatic `/favicon.ico` probe stops 404ing in the
+    host app's log.
+  
+  `renderIndexHtml` gains an optional fifth argument (`InjectedAuth`) and now emits the JSON block instead of the globals; `CONFIG_ELEMENT_ID`/`InjectedConfig` are exported. Existing callers are unaffected.
+
 ## 0.4.0
 
 ### Minor Changes