@assembly-js/app-foundation 0.3.6 → 0.3.7
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/CHANGELOG.md
CHANGED
|
@@ -19,6 +19,9 @@ A patch release never changes what an app's build requires; a minor release may
|
|
|
19
19
|
not by hand; see `changes/README.md`. CI fails a PR that changes a check script without a
|
|
20
20
|
`bump: minor` change file.
|
|
21
21
|
|
|
22
|
+
## 0.3.7
|
|
23
|
+
- [guidance] The `assembly-api-contract` skill now tells the build agent that every documented route must admit an app caller, so other apps' calls are not refused with a 403.
|
|
24
|
+
|
|
22
25
|
## 0.3.6
|
|
23
26
|
- [behavior] `.assembly/app-deps.json` now also records the calls an app makes through another app's generated client (`installerClient.GET('/projects/{id}')`), with `client` in that app's `via`. A client use the scan cannot follow counts as every operation that app exposes. Nothing in the app changes.
|
|
24
27
|
|
package/package.json
CHANGED
|
@@ -26,6 +26,12 @@ A route is not callable by other apps, so it must not appear, when it is:
|
|
|
26
26
|
- wrapped in `cronRoute` or `automationActionRoute`
|
|
27
27
|
- matched by a glob in `privateRoutes` in `.assembly/app.json` (matched against the route template, not the file path). The scanner records these as excluded, so documenting one is reported as a drift.
|
|
28
28
|
|
|
29
|
+
## Who may call a documented route
|
|
30
|
+
|
|
31
|
+
Every operation in the contract is proxied to other apps, so its handler must admit an app caller. Call `requireAuth` and `requireCompanyScope` with no `allow` option, or list `'app'` (`allow: ['internal', 'client', 'app']`). A route that passes only `['internal', 'client']` answers every other app with a 403, which the calling app reports as the request being refused.
|
|
32
|
+
|
|
33
|
+
An app caller carries `callerAppId` and no `internalUserId` or `clientId`. Give it its own branch rather than mapping identity through a person-only viewer that returns null and falls into a 403. Read and write on the app's own authority with `getInstallerAssembly()`, as staff would, and never return client-private data you would not show staff. A route that must stay human-only belongs in `privateRoutes`, and stays out of this contract.
|
|
34
|
+
|
|
29
35
|
## Worked example
|
|
30
36
|
|
|
31
37
|
`app/api/projects/[projectId]/tasks/route.ts` exports `GET` (list) and `POST` (create):
|