@assembly-js/app-foundation 0.6.3 → 0.6.4

package/CHANGELOG.md

@@ -19,6 +19,9 @@ A patch release never changes what an app's build requires; a minor release may
 not by hand; see `changes/README.md`. CI fails a PR that changes a check script without a
 `bump: minor` change file.
 
+## 0.6.4
+- [behavior] An app's sandbox now sends its sandbox grant when minting an app bearer, so the platform can tell its calls from the deployed app's.
+
 ## 0.6.3
 - [fix] The client-call scan no longer reports `retrieveCompany` on the viewer client as breaking: the platform now lets a client read its own active company (`GET /v1/companies/{id}`), and refuses any other company. Nothing in the app changes.
 

package/dist/mint-bearer.js

@@ -171,9 +171,15 @@ export async function mintBearerFromAppKey() {
     const controller = new AbortController();
     const timeoutId = setTimeout(() => controller.abort(), EXCHANGE_TIMEOUT_MS);
     try {
+        // Present only in the app's sandbox (written to .env.local, never to the deployed
+        // env); it lets the platform tell a sandbox call from a deployed one.
+        const sandboxGrant = process.env.ASSEMBLY_SANDBOX_GRANT;
         const resp = await fetch(`${base}/v1/token`, {
             method: 'POST',
-            headers: { 'X-API-Key': apiKey },
+            headers: sandboxGrant
+                ? { 'X-API-Key': apiKey, 'Content-Type': 'application/json' }
+                : { 'X-API-Key': apiKey },
+            ...(sandboxGrant ? { body: JSON.stringify({ sandboxGrant }) } : {}),
             signal: controller.signal,
         });
         if (!resp.ok)

package/dist/scripts.js

@@ -4652,9 +4652,11 @@ async function mintBearerFromAppKey() {
   const controller = new AbortController();
   const timeoutId = setTimeout(() => controller.abort(), EXCHANGE_TIMEOUT_MS);
   try {
+    const sandboxGrant = process.env.ASSEMBLY_SANDBOX_GRANT;
     const resp = await fetch(`${base}/v1/token`, {
       method: "POST",
-      headers: { "X-API-Key": apiKey },
+      headers: sandboxGrant ? { "X-API-Key": apiKey, "Content-Type": "application/json" } : { "X-API-Key": apiKey },
+      ...sandboxGrant ? { body: JSON.stringify({ sandboxGrant }) } : {},
       signal: controller.signal
     });
     if (!resp.ok) return null;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@assembly-js/app-foundation",
-  "version": "0.6.3",
+  "version": "0.6.4",
   "description": "Versioned foundation helpers and build context for Assembly generated apps",
   "type": "module",
   "files": [