@calimero-network/mero-react 4.0.0 → 4.0.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +3 -1
- package/package.json +1 -1
package/README.md
CHANGED
|
@@ -91,6 +91,8 @@ Props (`MeroProviderConfig & { children }`):
|
|
|
91
91
|
| `packageVersion` | `string` | No | Specific version (defaults to latest) |
|
|
92
92
|
| `registryUrl` | `string` | No | Registry URL override |
|
|
93
93
|
| `timeoutMs` | `number` | No | HTTP request timeout (default 30000) |
|
|
94
|
+
| `allowedNodeUrls` | `string[]` | No | Origins the OAuth callback may authenticate against. The initiated node is always trusted; this allowlist additionally permits direct-callback entry. A callback `node_url` matching neither is rejected. |
|
|
95
|
+
| `tokenStore` | `TokenStore` | No | Pluggable access/refresh token store. Defaults to localStorage. Pass a `MemoryTokenStore` or cookie-backed store for sensitive deployments (localStorage tokens are XSS-readable). |
|
|
94
96
|
|
|
95
97
|
Modes and their permissions:
|
|
96
98
|
|
|
@@ -100,7 +102,7 @@ Modes and their permissions:
|
|
|
100
102
|
| `MultiContext` | `context:create`, `context:list`, `context:execute` | Apps managing multiple contexts |
|
|
101
103
|
| `Admin` | `admin` | Admin dashboards, dev tools |
|
|
102
104
|
|
|
103
|
-
Auth flow: when `connectToNode(url)` is called, the provider redirects to the node's auth page. After login, the node redirects back with tokens in the URL hash. The provider processes these once (StrictMode-safe via ref) and sets `isAuthenticated = true`.
|
|
105
|
+
Auth flow: when `connectToNode(url)` is called, the provider redirects to the node's auth page. After login, the node redirects back with tokens in the URL hash. The provider processes these once (StrictMode-safe via ref) and sets `isAuthenticated = true`. The callback's `node_url` is validated against the node login was initiated with (or `allowedNodeUrls`); a `node_url` matching neither is rejected.
|
|
104
106
|
|
|
105
107
|
Online detection: the provider opens an SSE connection to the node after auth. `isOnline` reflects the SSE connection state — no polling.
|
|
106
108
|
|