@assembly-js/app-foundation 0.7.0 → 0.7.1

package/CHANGELOG.md

@@ -19,6 +19,9 @@ A patch release never changes what an app's build requires; a minor release may
 not by hand; see `changes/README.md`. CI fails a PR that changes a check script without a
 `bump: minor` change file.
 
+## 0.7.1
+- [fix] The location reporter no longer sends the host's embed-session params (`token`, `clientId`, `companyId`) with the app's location, so they never reach the host URL or a copied deep link.
+
 ## 0.7.0
 - [new] `deleteFile(key)` in `@assembly-js/app-foundation/server` permanently deletes a file stored with app-storage.
 - [guidance] The assembly-storage skill documents `deleteFile`: deletion is permanent, so apps that want recovery hide the record first and delete the file later.

package/dist/location-prefix.d.ts

@@ -1,3 +1,9 @@
+export declare const HOST_SESSION_PARAMS: string[];
+/**
+ * The app's own query string with the host's embed-session params removed,
+ * as a `?`-prefixed string, or '' when nothing is left.
+ */
+export declare function stripHostSessionParams(searchParams: URLSearchParams): string;
 export declare function getSurfacePrefixes(): string[];
 export declare const SURFACE_PREFIXES: string[];
 /**

package/dist/location-prefix.js

@@ -1,4 +1,19 @@
 const DEFAULT_PREFIXES = ['/c', '/n'];
+// The host puts these on the iframe src to open the embed session. They are
+// not part of the app's location, and reporting them would put the token in
+// the host URL, browser history and every copied deep link.
+export const HOST_SESSION_PARAMS = ['token', 'clientId', 'companyId'];
+/**
+ * The app's own query string with the host's embed-session params removed,
+ * as a `?`-prefixed string, or '' when nothing is left.
+ */
+export function stripHostSessionParams(searchParams) {
+    const own = new URLSearchParams(searchParams);
+    for (const key of HOST_SESSION_PARAMS)
+        own.delete(key);
+    const qs = own.toString();
+    return qs ? `?${qs}` : '';
+}
 // Read surface prefixes from the build-time env value injected by withAssemblyDev.
 // Falls back to the historical /c and /n defaults so apps on an older image
 // continue to work without a rebuild.

package/dist/location-reporter.js

@@ -2,7 +2,7 @@
 import { Suspense, createElement, useEffect, useRef } from 'react';
 import { usePathname, useSearchParams, useRouter } from 'next/navigation';
 import { AssemblyBridge } from '@assembly-js/app-bridge';
-import { getSurfacePrefix, stripPrefix, addPrefix } from './location-prefix.js';
+import { getSurfacePrefix, stripPrefix, addPrefix, stripHostSessionParams } from './location-prefix.js';
 function LocationReporterInner() {
     const pathname = usePathname();
     const searchParams = useSearchParams();
@@ -19,8 +19,7 @@ function LocationReporterInner() {
         if (!bridgeLocation)
             return;
         const path = stripPrefix(pathname, prefix);
-        const qs = searchParams.toString();
-        bridgeLocation.report(path, qs ? `?${qs}` : '');
+        bridgeLocation.report(path, stripHostSessionParams(searchParams));
     }, [bridgeLocation, pathname, searchParams, prefix]);
     // Register the navigate handler once; rely on prefixRef for the current prefix.
     useEffect(() => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@assembly-js/app-foundation",
-  "version": "0.7.0",
+  "version": "0.7.1",
   "description": "Versioned foundation helpers and build context for Assembly generated apps",
   "type": "module",
   "files": [