@cube-dev/platform-client 0.10.0 → 0.11.0

package/CHANGELOG.md

@@ -9,6 +9,13 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 <!-- Curate public-facing entries here before the next release. -->
 
+## [0.11.0] - 2026-09-15
+### Added
+
+- `FolderDto` gained `user` (CUB-4611) — the folder's owner, resolved the same way workbook owners are; `null` on a folder shared from the main workspace, which stays masked. Fixes the embed workspace's Owner column always rendering a dash, including for a folder the caller just created.
+- `GenerateSession` gained `branchName` (CUB-4151) — the deployment branch an embed session queries. Omit it (or pass the deployment's production branch) for the production environment, which stays the default; any other branch of the deployment — one with a staging environment enabled, a shared branch, or a personal dev branch — points every Cube query the embedded dashboards, Creator Mode workspace and chat make at that branch's runtime (`<deploymentUrl>/dev-mode/{branchName}/cubejs-api/v1`) instead. The branch must be served when the session is generated: a name that is not a branch of the deployment returns `404`, and a branch nothing is running returns `400` — a branch without a staging environment is only running while someone has it open in Cube, so enable its staging environment for a branch an embedded app should reach at any time. Content is not branch-scoped: the same dashboards and workbooks are rendered against the chosen branch's data model. The embedded chat and AI widgets follow the session onto the branch as well, so an agent answers from the same data model the dashboards show.
+- New public REST endpoint `POST /api/v1/embed/session/revoke` (`EmbedPublicController.revokeSession`) (CUB-4508) ends a signed embed session from the server side — call it from your application's logout handler with the `sessionId` that `POST /api/v1/embed/generate-session` returned. Works on either state a session can be in: an unexchanged id can no longer be redeemed via `POST /api/v1/embed/session/token`, and a token an already-exchanged id produced is rejected with `401` from that point on. Idempotent — revoking an unknown, expired, or already-revoked id also responds `204`, so the response alone never tells you whether a token was still revocable. That depends on Cube, not on the client library you call from: only tokens Cube issued after this endpoint shipped carry the revocation claim, and an older token keeps working until it expires on its own, within 24 hours. Requires admin access and that embedding be enabled for the account. New schema: `RevokeEmbedSessionInput`.
+
 ## [0.10.0] - 2026-09-14
 ### Added
 

package/dist/schema.d.ts

@@ -1877,6 +1877,34 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/api/v1/embed/session/revoke": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Revoke an embed session
+         * @description **🔒 Admin only.** Requires administrator privileges — the authenticated principal (API key, embed JWT, or any bearer token) must belong to a user with the admin role.
+         *
+         *     Ends an embed session from the server side — call it from your application's logout handler. Pass the `sessionId` that `POST /api/v1/embed/generate-session` returned.
+         *
+         *     Works in either state the session can be in: an id that has not been exchanged yet can no longer be redeemed via `POST /api/v1/embed/session/token`, and the token an already-exchanged id produced is rejected with `401` from this moment on. The embedded iframe does not tear itself down — remove it on logout as before.
+         *
+         *     Idempotent: revoking an unknown, expired or already-revoked id also responds `204` — so the response alone never tells you whether a token was still revocable. That depends on Cube, not on the client library you call from: only tokens Cube issued after this endpoint shipped carry the claim revocation is checked against, and an older token keeps working until it expires on its own, within 24 hours. A Cube API token the embed obtained from `POST /api/v1/deployments/{deploymentId}/token` is a separate credential and is not affected.
+         *
+         *     Embedding must be enabled for the account, otherwise `403` is returned.
+         */
+        post: operations["EmbedPublicController.revokeSession"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/api/v1/embed/session/token": {
         parameters: {
             query?: never;
@@ -4428,6 +4456,7 @@ export interface components {
             type: components["schemas"]["FolderDtoType"];
             updatedAt: string;
             updatedBy?: number | null;
+            user?: components["schemas"]["ResourceOwner"] | null;
         };
         /** @enum {string} */
         FolderDtoType: "FOLDER" | "WORKBOOK" | "REPORT";
@@ -4445,6 +4474,7 @@ export interface components {
             token: string;
         };
         GenerateSession: {
+            branchName?: string | null;
             creatorMode?: boolean | null;
             deploymentId: number;
             email?: string | null;
@@ -5097,6 +5127,10 @@ export interface components {
         };
         /** @enum {string} */
         ResourceUserPolicyDtoAction: "All" | "DeploymentsManage" | "DeploymentCreate" | "DeploymentRead" | "DeploymentUpdate" | "DeploymentDelete" | "SecretsManage" | "DownloadData" | "PlaygroundRead" | "SchemaRead" | "SchemaUpdate" | "SchemaUpdateDevBranches" | "APMRead" | "ChatHistoryRead" | "PreAggregationBuild" | "AlertsCreate" | "AlertsRead" | "AlertsUpdate" | "AlertsDelete" | "AuditLogManage" | "BillingRead" | "SqlRunnerRead" | "DataAssetsRead" | "DataAssetsManage" | "CubeNetworkConnect" | "ReportRead" | "ReportEdit" | "ReportManage" | "WorkbookManage" | "WorkbookRead" | "WorkbookEdit" | "ChatThreadRead" | "AgentManage" | "AgentRead" | "AgentSpaceManage" | "AgentAdmin" | "DeploymentAgentRead" | "OAuthIntegrationsManage" | "OAuthIntegrationsIssueTokens" | "McpToolsManage" | "AIBIDevelop" | "AIBIExplore" | "AIBIView" | "ChartPalettesManage" | "DashboardThemesManage" | "AIBIDeveloper" | "AIBIUser" | "AIBIViewer" | "EmbedDeploymentRead" | "EmbedDashboardRead" | "FolderRead" | "FolderEdit" | "FolderManage";
+        RevokeEmbedSessionInput: {
+            /** @description The session id returned by `POST /api/v1/embed/generate-session`. Works whether or not the session has already been exchanged for a token. */
+            sessionId: string;
+        };
         RoleWithAccess: {
             actions: ("All" | "DeploymentsManage" | "DeploymentCreate" | "DeploymentRead" | "DeploymentUpdate" | "DeploymentDelete" | "SecretsManage" | "DownloadData" | "PlaygroundRead" | "SchemaRead" | "SchemaUpdate" | "SchemaUpdateDevBranches" | "APMRead" | "ChatHistoryRead" | "PreAggregationBuild" | "AlertsCreate" | "AlertsRead" | "AlertsUpdate" | "AlertsDelete" | "AuditLogManage" | "BillingRead" | "SqlRunnerRead" | "DataAssetsRead" | "DataAssetsManage" | "CubeNetworkConnect" | "ReportRead" | "ReportEdit" | "ReportManage" | "WorkbookManage" | "WorkbookRead" | "WorkbookEdit" | "ChatThreadRead" | "AgentManage" | "AgentRead" | "AgentSpaceManage" | "AgentAdmin" | "DeploymentAgentRead" | "OAuthIntegrationsManage" | "OAuthIntegrationsIssueTokens" | "McpToolsManage" | "AIBIDevelop" | "AIBIExplore" | "AIBIView" | "ChartPalettesManage" | "DashboardThemesManage" | "AIBIDeveloper" | "AIBIUser" | "AIBIViewer" | "EmbedDeploymentRead" | "EmbedDashboardRead" | "FolderRead" | "FolderEdit" | "FolderManage")[];
             id: number;
@@ -8703,6 +8737,38 @@ export interface operations {
             };
         };
     };
+    "EmbedPublicController.revokeSession": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /** @description RevokeEmbedSessionInput */
+        requestBody?: {
+            content: {
+                "application/json": components["schemas"]["RevokeEmbedSessionInput"];
+            };
+        };
+        responses: {
+            /** @description Successful response */
+            200: {
+                headers: {
+                    [name: string]: any;
+                };
+                content: {
+                    "application/json": any;
+                };
+            };
+            /** @description Session revoked, or did not exist. */
+            204: {
+                headers: {
+                    [name: string]: any;
+                };
+                content?: never;
+            };
+        };
+    };
     "EmbedPublicController.postTokenBySessionId": {
         parameters: {
             query?: never;