@fusebase/fusebase-gate-sdk 2.11.6 → 2.11.7-sdk.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/package.json
CHANGED
package/release-notes/latest.md
CHANGED
|
@@ -1,61 +0,0 @@
|
|
|
1
|
-
# Release Notes 2.11.6-sdk.0
|
|
2
|
-
|
|
3
|
-
- Current ref: `HEAD`
|
|
4
|
-
- Previous tag: `v2.11.6-sdk.0`
|
|
5
|
-
- Generated at: 2026-09-08T12:29:57.106Z
|
|
6
|
-
|
|
7
|
-
## Included Drafts
|
|
8
|
-
|
|
9
|
-
- `docs/release-notes/2026-09-07-app-auth-handoff.md` - Login handoff for the fusebase-auth ops
|
|
10
|
-
|
|
11
|
-
## Summary
|
|
12
|
-
|
|
13
|
-
### Login handoff for the fusebase-auth ops
|
|
14
|
-
|
|
15
|
-
The four fusebase-auth operations that can end in an authenticated result now
|
|
16
|
-
return an `appAuth` handoff beside `session`, so an app can obtain its own
|
|
17
|
-
runtime token without holding a raw FuseBase session id.
|
|
18
|
-
|
|
19
|
-
|
|
20
|
-
## API / SDK Changes
|
|
21
|
-
|
|
22
|
-
### Login handoff for the fusebase-auth ops
|
|
23
|
-
|
|
24
|
-
- Added `appAuth` (`exchangeToken`, `expiresInSeconds`, `authPath`) to the
|
|
25
|
-
authenticated responses of `registerFusebaseUser`,
|
|
26
|
-
`registerFusebaseOrgMember`, `loginFusebaseUser` and
|
|
27
|
-
`completeFusebaseAuthChallenge`.
|
|
28
|
-
- `authPath` is a relative URL on the app's own host, built from the
|
|
29
|
-
`redirectPath` the app sent. Apps pass it through rather than assembling it.
|
|
30
|
-
- Operation descriptions now point at the handoff instead of at
|
|
31
|
-
`session.sessionId`.
|
|
32
|
-
- `session` is deprecated. Gate omits it from all four responses when it runs
|
|
33
|
-
with the `app_login_no_session_id` feature flag, which is off everywhere
|
|
34
|
-
until deployed apps have moved to `appAuth`.
|
|
35
|
-
- With that flag on, a failed handoff mint answers 422 with `data.errorCode` =
|
|
36
|
-
`app_auth_exchange_unavailable` instead of degrading to the legacy response.
|
|
37
|
-
|
|
38
|
-
|
|
39
|
-
## Consumer Impact
|
|
40
|
-
|
|
41
|
-
### Login handoff for the fusebase-auth ops
|
|
42
|
-
|
|
43
|
-
Purely additive: `session` is returned exactly as before, so no deployed app
|
|
44
|
-
changes behaviour. Spend `appAuth.authPath` on the app's own origin, either
|
|
45
|
-
with a same-origin `fetch` sending `Accept: application/json` or with a plain
|
|
46
|
-
navigation. `exchangeToken` stays valid for its whole `expiresInSeconds`
|
|
47
|
-
window, is not invalidated by being spent, and is not bound to the app it was
|
|
48
|
-
minted for, so treat it as a credential.
|
|
49
|
-
A challenge result is unchanged. If the mint fails the response is the legacy
|
|
50
|
-
one, without `appAuth` — until the `app_login_no_session_id` flag is turned on,
|
|
51
|
-
where the same failure is a 422 that should be answered with a fresh sign-in
|
|
52
|
-
rather than a replay of the call.
|
|
53
|
-
|
|
54
|
-
|
|
55
|
-
## Verification
|
|
56
|
-
|
|
57
|
-
### Login handoff for the fusebase-auth ops
|
|
58
|
-
|
|
59
|
-
- Unit tests over all four operations, the handoff URL encoding, the mint
|
|
60
|
-
failure paths and the relative-path guard.
|
|
61
|
-
- Generated contract/OpenAPI validation and service build.
|