@bardioc/app-sdk 0.4.6 → 0.4.7

package/dist/dev-proxy.d.ts

@@ -4,8 +4,6 @@ export interface DevAuthProxyOptions {
     apiBaseUrl: string;
     /** Dev secret copied from the backend. */
     devSecret: string;
-    /** App slug stamped as `X-App-ID`, mirroring how the host identifies iframe apps. */
-    appId?: string;
     /** Optional CORS origin (e.g. `*`). */
     allowOrigin?: string;
 }

package/dist/dev-proxy.js

@@ -33,7 +33,7 @@ function addDevSecretHeader(req, headers, devSecret) {
 }
 export function createDevAuthProxyHandler(options) {
     const apiBaseUrl = normalizeApiBaseUrl(options.apiBaseUrl);
-    const { devSecret, allowOrigin, appId } = options;
+    const { devSecret, allowOrigin } = options;
     return async (req, res) => {
         const url = new URL(req.url ?? '/', `http://${req.headers.host ?? 'localhost'}`);
         if (req.method === 'OPTIONS') {
@@ -74,11 +74,9 @@ export function createDevAuthProxyHandler(options) {
             }
         }
         addDevSecretHeader(req, headers, devSecret);
-        // The host stamps X-App-ID from its own registration data, never from the app — the
-        // dev proxy does the same with the configured app slug.
-        if (appId) {
-            headers.set('X-App-ID', appId);
-        }
+        // Dev auth is dev-secret only: never forward X-App-Id, so the BFF app-token
+        // exchange (which would also demand X-Scope-ID) can never be triggered here.
+        headers.delete('X-App-Id');
         // BFF rejects /bardioc/ calls without this CSRF marker header; stamp it like the host does.
         headers.set('X-Requested-With', 'XMLHttpRequest');
         let body;

package/dist/vite.js

@@ -260,7 +260,6 @@ export function bardiocDevAuth(options) {
                 proxyOptions = {
                     apiBaseUrl: env.API_BASE_URL,
                     devSecret: env.DEV_SECRET,
-                    appId: options.appName,
                 };
             }
             const handler = createDevAuthProxyHandler(proxyOptions);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bardioc/app-sdk",
-  "version": "0.4.6",
+  "version": "0.4.7",
   "description": "SDK for building apps for the Bardioc OS",
   "license": "MIT",
   "private": false,