@getxflow/cli 1.0.5 → 1.0.6

package/dist/version.js

@@ -2,6 +2,6 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.DEFAULT_API_URL = exports.CLI_VERSION = void 0;
 /** Keep in sync with cli/package.json. */
-exports.CLI_VERSION = '1.0.5';
+exports.CLI_VERSION = '1.0.6';
 /** Overridden by XFLOW_API_URL or the `api` field in xflow.json. */
 exports.DEFAULT_API_URL = 'https://app.getxflow.com';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@getxflow/cli",
-  "version": "1.0.5",
+  "version": "1.0.6",
   "description": "CLI for the XFlow platform: projects with apps, functions and a database; source sync, deployment and publishing",
   "license": "UNLICENSED",
   "engines": {

package/skills/xflow/SKILL.md

@@ -23,7 +23,7 @@ contains the fix.
 
 ## Keeping these instructions current
 
-These instructions ship with xflow CLI 1.0.5, so the copy you are reading can be older than
+These instructions ship with xflow CLI 1.0.6, so the copy you are reading can be older than
 the CLI answering your commands.
 
 When the CLI says this file does not match it, run `xflow skills --refresh` and then **read
@@ -312,22 +312,26 @@ At the closed levels do none of this: the platform already knows the person.
   with `crypto.timingSafeEqual`. Never log a password, never return it, never keep it in the
   browser.
 - Session: after sign-in the function makes a random token (`crypto.randomBytes(32)`), stores
-  its SHA-256 and an expiry in a table and returns it as a cookie in its response headers:
-  `Set-Cookie: __Host-sid=…; HttpOnly; Secure; SameSite=Lax; Path=/; Max-Age=…`. The `__Host-`
-  prefix stops a neighbouring `*.xflowpage.ru` site from planting its own `sid`. `/_fn` is on
-  the same address, so the browser sends it back by itself. Not `localStorage`: every script on
-  the page reads it.
+  its SHA-256 and an expiry in a table and returns the token in the response body. The app keeps
+  it in `localStorage` and sends it on every call in the `X-Session` header. Not a cookie: Cloud
+  Functions drop `Cookie` and `Set-Cookie` both ways. `localStorage` belongs to one address, a
+  neighbouring `*.xflowpage.ru` site does not read it.
+- Any script on the page reads that token, so: an expiry of hours that each call extends,
+  sign-out and a password change delete the session rows, no user text rendered as HTML
+  (`dangerouslySetInnerHTML`), no scripts loaded from outside the build.
+- Never put the token into an address (`?session=`, a link): it stays in history and logs. A file
+  the function makes for this person is fetched with the header and opened as a `blob:` URL.
 - Not the `Authorization` header: `/_fn` replaces it with the platform's own. Nor headers named
   `X-Xflow-*`, `X-Project-Pass`, `X-Server-Key`, `X-Function-Key`: the platform strips them.
-  Cookies reach the function as they are.
-- Every function that serves a signed-in visitor reads the cookie from `event.headers`, finds
-  the session and filters rows by that user in SQL. A hidden button is not access control.
+- Every function that serves a signed-in visitor reads `X-Session` from `event.headers` (match
+  the name in any case), finds the session and filters rows by that user in SQL. A hidden button
+  is not access control.
 - Count failed sign-ins per email and per `event.xflow.ip` in a table and slow them down.
 - Never in the frontend: keys, secrets, the list of users, hashes, a role check that is the only
   guard.
 - The platform sends no email for your app: confirmation and reset letters need a mail provider
   whose key goes into `xflow env set`.
-- `xflow dev` carries neither cookies nor `Set-Cookie`, and calls functions as you (a member).
+- `xflow dev` does not carry `X-Session` and calls functions as you (a member).
   Try the sign-in on the app address.
 
 ## Page or app