@fusebase/fusebase-gate-sdk 2.4.0 → 2.5.0

package/dist/types/index.d.ts

@@ -12,7 +12,7 @@ export type { ActivateAppMagicLinkResponseContract, AppMagicLinkSummaryContract,
 export * from "./billing/billing";
 export type { OrgEmailSendRequestContract, OrgEmailSendResponseContract } from "./email/email";
 export * from "./file/file";
-export type { FusebaseAuthChallengeContract, FusebaseAuthChallengeRequestContract, FusebaseAuthChallengeResponseContract, FusebaseAuthConflictErrorBodyContract, FusebaseAuthLoginRequestContract, FusebaseAuthLoginResponseContract, FusebaseAuthLogoutResponseContract, FusebaseAuthPasswordResetRequestContract, FusebaseAuthPasswordResetResponseContract, FusebaseAuthPasswordRestoreKeyResponseContract, FusebaseAuthPasswordRestoreRequestContract, FusebaseAuthPasswordRestoreResponseContract, FusebaseAuthRegisterMemberRequestContract, FusebaseAuthRegisterMemberResponseContract, FusebaseAuthRegisterRequestContract, FusebaseAuthRegisterResponseContract, FusebaseAuthRestoreKeyRequestContract, FusebaseAuthRestoreKeyResponseContract, FusebaseAuthSessionContract, FusebaseAuthUnauthorizedErrorBodyContract } from "./fusebase-auth/fusebase-auth";
+export type { FusebaseAuthChallengeContract, FusebaseAuthChallengeRequestContract, FusebaseAuthChallengeResponseContract, FusebaseAuthConflictErrorBodyContract, FusebaseAuthLoginRequestContract, FusebaseAuthLoginResponseContract, FusebaseAuthLogoutResponseContract, FusebaseAuthPasswordResetRequestContract, FusebaseAuthPasswordResetResponseContract, FusebaseAuthPasswordRestoreKeyResponseContract, FusebaseAuthPasswordRestoreRequestContract, FusebaseAuthPasswordRestoreResponseContract, FusebaseAuthRegisterMemberRequestContract, FusebaseAuthRegisterMemberResponseContract, FusebaseAuthRegisterRequestContract, FusebaseAuthRegisterResponseContract, FusebaseAuthRestoreKeyRequestContract, FusebaseAuthRestoreKeyResponseContract, FusebaseAuthSessionContract, FusebaseAuthSetInitialPasswordRequestContract, FusebaseAuthSetInitialPasswordResponseContract, FusebaseAuthUnauthorizedErrorBodyContract } from "./fusebase-auth/fusebase-auth";
 export * from "./isolated-store/isolated-store";
 export * from "./mcp-manager/mcp-manager";
 export type { MeAuthContract, MeOrgGroupContract, MePreferencesContract, MeResponseContract, MeScopeContract, MeUserContract } from "./me/me";
@@ -21,7 +21,7 @@ export * from "./org-group/org-group";
 export type { ClientAccountScheduledDeletionRequestContract, ClientAccountScheduledDeletionResponseContract, CreateWorkspaceRequestContract, OrgInviteContract, OrgMagicLinkContract, OrgMemberExpectedJoinedAfterInQueryOptional, OrgMemberExpectedRoleInQueryOptional, OrgMemberRemoveResponseContract, OrgPortalContract, OrgPortalListResponseContract, OrgUserAddRequestContract, OrgUserAddResponseContract, OrgUserContract, OrgUserIdInPathRequired, OrgUserListResponseContract, OrgUserWorkspaceIdInPathRequired, OrgWorkspaceContract, OrgWorkspaceInviteContract, OrgWorkspaceListResponseContract, OrgWorkspaceMemberContract, OrgWorkspaceMemberListResponseContract, WorkspaceMemberRemoveResponseContract } from "./org-user/org-user";
 export * from "./orgs/orgs";
 export type { VerifyPortalFeatureContextTokenRequestContract, VerifyPortalFeatureContextTokenResponseContract } from "./portal-feature-context/portal-feature-context";
-export type { AddPortalAppBlockRequestContract, AddPortalAppBlockResponseContract, AddPortalAppPageRequestContract, AddPortalAppPageResponseContract, AddPortalBlankNoteBlockRequestContract, AddPortalBlankNoteBlockResponseContract, AddPortalBlockRequestContract, AddPortalBlockResponseContract, AddPortalChatBlockRequestContract, AddPortalChatBlockResponseContract, AddPortalEmbedBlockRequestContract, AddPortalEmbedBlockResponseContract, AddPortalNoteBlockRequestContract, AddPortalNoteBlockResponseContract, BulkInviteResultItemContract, BulkInviteToPortalRequestContract, BulkInviteToPortalResponseContract, BulkPortalInvitationContract, CreatePortalFolderRequestContract, CreatePortalFolderResponseContract, CreatePortalPageRequestContract, CreatePortalPageResponseContract, CreatePortalPageWithNoteRequestContract, CreatePortalPageWithNoteResponseContract, CreatePortalRequestContract, CreatePortalResponseContract, DuplicatePortalItemRequestContract, DuplicatePortalItemResponseContract, DuplicatePortalRequestContract, InvitePortalManagerRequestContract, InvitePortalManagerResponseContract, InviteToPortalRequestContract, InviteToPortalResponseContract, ListPortalChatChannelsResponseContract, ListPortalChatUsersResponseContract, ListPortalContentResponseContract, PortalChatChannelContract, PortalChatUserContract, PortalContentItemContract, PortalDetailContract, PublishPortalDraftResponseContract, UpdatePortalAccessRequestContract, UpdatePortalAccessResponseContract, UpdatePortalCustomCodeRequestContract, UpdatePortalCustomCodeResponseContract, globalIdInPathRequired } from "./portals/portals";
+export * from "./portals/portals";
 export * from "./shared/common";
 export * from "./shared/enums";
 export type { GetHealth200ResponseContract } from "./shared/health";

package/dist/types/index.js

@@ -27,6 +27,7 @@ __exportStar(require("./mcp-manager/mcp-manager"), exports);
 __exportStar(require("./note/note"), exports);
 __exportStar(require("./org-group/org-group"), exports);
 __exportStar(require("./orgs/orgs"), exports);
+__exportStar(require("./portals/portals"), exports);
 __exportStar(require("./shared/common"), exports);
 __exportStar(require("./shared/enums"), exports);
 __exportStar(require("./system/system"), exports);

package/dist/types/portal-feature-context/portal-feature-context.d.ts

@@ -8,11 +8,24 @@ export interface VerifyPortalFeatureContextTokenRequestContract {
 /**
  * Trusted portal/workspace context extracted from a verified embed token.
  *
- * `userId`/`orgRole` describe WHO is calling and come from the live,
- * user-bound session token that authenticated the request (not from the
- * static per-brick `portalFeatureContextToken`), so one verify yields the
- * trusted "user × portal × app" triple. Absent for unauthenticated/visitor
- * (open/email) portal sessions.
+ * `userId`/`orgRole` describe WHO is calling. They are NOT claims of the
+ * `portalFeatureContextToken` — that token is static (minted once when the
+ * brick is saved, shared by every viewer, no `exp`) and carries no user.
+ * Identity comes from the live, user-bound app session (`fbsfeaturetoken`)
+ * that authenticated this request, and is returned **if and only if**:
+ *
+ *     session.portalId === verified token portalId  &&  session user is real
+ *
+ * i.e. the caller reached this app through THIS portal's embed under their own
+ * identity. Anonymous visitors (reserved visitor id), sessions with no portal
+ * binding, and sessions bound to a different portal all get the fields omitted.
+ *
+ * What presence proves: a genuine "user × portal × app" triple in one call —
+ * the platform, not the app, binds WHO to WHERE.
+ * What it does NOT prove: portal membership. Enforce that through the app's
+ * `--access` principals (`portalMember`/`portalClient`/`portalManager`).
+ * Comparing `userId` to the userId your own session lookup returns is a
+ * tautology (same source), not a check that the token belongs to the caller.
  */
 export interface VerifyPortalFeatureContextTokenResponseContract {
     portalId: string;
@@ -21,8 +34,11 @@ export interface VerifyPortalFeatureContextTokenResponseContract {
     productId: string;
     /** App (feature) id (legacy payload field `featureId`). */
     appId: string;
-    /** Native id of the authenticated caller. Absent for visitor sessions. */
+    /**
+     * Native id of the caller, from the portal-bound session (never from the
+     * token). Absent for visitors and for sessions not bound to this portal.
+     */
     userId?: number;
-    /** Org role of the authenticated caller at verify time. */
+    /** Org role of the caller at verify time. Present only alongside `userId`. */
     orgRole?: string;
 }