@equinor/fusion-framework-cli 15.5.2 → 15.6.0

package/CHANGELOG.md

@@ -1,5 +1,46 @@
 # Change Log
 
+## 15.6.0
+
+### Minor Changes
+
+- df4548d: Identify every outgoing CLI request to Fusion services, not only publish, upload, check and tag calls.
+  
+  `configureFramework` now registers the `X-Fusion-CLI-Name`, `X-Fusion-CLI-Version` and `User-Agent` headers on the framework HTTP client, so service discovery lookups and every other client created from it carry them too. Headers already set on a request are kept. `defaultHeaders` is now exported from `@equinor/fusion-framework-cli/bin`. Requests forwarded by the dev server keep identifying as the dev server (`X-Fusion-Dev-Server-*`). See [Request identification headers](https://github.com/equinor/fusion-framework/tree/main/packages/cli#request-identification-headers).
+  
+  Fixes: https://github.com/equinor/fusion-core-tasks/issues/2207
+
+### Patch Changes
+
+- Updated dependencies [fa4dba6]
+  - @equinor/fusion-framework-vite-plugin-react-router@0.1.3
+  - @equinor/fusion-framework-dev-server@2.3.1
+  - @equinor/fusion-framework-dev-portal@11.1.5
+
+## 15.5.4
+
+### Patch Changes
+
+- f858a7d: Send service discovery to the mock server whenever mock authentication is enabled.
+  
+  Previously `FUSION_SPA_MSAL_MOCK=true` (from the environment or a `.env` file) only switched the SPA to unsigned mock tokens, while `ffc app dev` and `ffc app serve` kept forwarding service discovery to the real CI environment. Every page load — for example in a Playwright suite — sent a mock token to `discovery.fusion.equinor.com` and failed with `401`.
+  
+  Mock auth now implies mock discovery, exactly like `--mock`: the dev server uses `FUSION_SPA_MSAL_MOCK_SERVER_URL`, or `http://localhost:4010` when only `FUSION_SPA_MSAL_MOCK` is set. `--mock` still takes precedence. Start the mock server with `ffc mock-server` before running the app.
+- f858a7d: Refuse to start the dev server in mock mode when service discovery does not point at the mock server. A `dev-server.config` that overrides `api.serviceDiscoveryUrl` while `--mock` (or `FUSION_SPA_MSAL_MOCK`) is active now fails at startup with a clear error instead of sending mock tokens to real service discovery.
+- f858a7d: `ffc app dev`, `ffc app serve`, and `ffc portal dev` add `X-Fusion-Mock: true|false` to every request the dev server proxies upstream, so upstream telemetry shows whether the caller ran with mock authentication.
+- Updated dependencies [71108a9]
+- Updated dependencies [f858a7d]
+  - @equinor/fusion-framework-dev-portal@11.1.4
+  - @equinor/fusion-framework-dev-server@2.3.0
+
+## 15.5.3
+
+### Patch Changes
+
+- a23ec8a: Internal: bump `@types/adm-zip` from `0.5.8` to `0.6.0`.
+- @equinor/fusion-framework-dev-portal@11.1.3
+  - @equinor/fusion-framework-dev-server@2.2.1
+
 ## 15.5.2
 
 ### Patch Changes

package/README.md

@@ -199,6 +199,34 @@ export default defineFusionCli(() => ({
 }));
 ```
 
+## Request identification headers
+
+Every request the CLI itself sends to Fusion services identifies the tool and its version, so
+service operators can tell Fusion Framework traffic apart from other callers when investigating
+unexpected requests (for example in Fusion Discovery logs).
+
+| Header                 | Value                                    |
+| ---------------------- | ---------------------------------------- |
+| `X-Fusion-CLI-Name`    | `fusion-framework-cli`                   |
+| `X-Fusion-CLI-Version` | The installed CLI version, e.g. `15.5.3` |
+| `User-Agent`           | `fusion-framework-cli/<version>`         |
+
+This covers service discovery lookups and every other client created by `configureFramework`,
+publish, upload, check and tag calls, and the AI model, embedding and search index calls. It uses
+the same `X-Fusion-CLI-*` convention as the other Fusion CLIs, so one filter on `x-fusion-cli-name`
+finds all of them.
+
+Requests forwarded by the dev server (`ffc app dev`, `ffc app serve`, `ffc portal dev`) are not CLI
+calls. They identify the dev server instead with `X-Fusion-Dev-Server-Name` and
+`X-Fusion-Dev-Server-Version`, plus `X-Fusion-Mock: true|false`; see the
+[dev server README](../dev-server/README.md#requirements-and-boundaries).
+
+- **Diagnostics only.** The values can be faked, so never use them for access control. They never
+  contain tokens, secrets, or personal information.
+- **Caller headers win.** A header already set on a request is never overwritten.
+- **Programmatic use.** `defaultHeaders` is exported from `@equinor/fusion-framework-cli/bin`, and
+  `configureFramework` registers it on the framework HTTP client for you.
+
 ## Documentation
 
 - [Developing Apps](docs/application.md) — build, configure, and deploy applications