@iyulab/flex-table 0.42.0 → 0.43.0

package/CHANGELOG.md

@@ -1,5 +1,15 @@
 # Changelog
 
+## [0.43.0] - 2026-10-04
+
+### Changed
+
+- **Breaking: `useODataSource`'s `onUnauthorized` is called on `401` only.** It was also called on
+  `403`, so an app that sends the user to sign in from this hook (its documented use) bounced a
+  signed-in user without permission back to the sign-in page — and, after signing in, to the same
+  list and the same `403`. A `403` now surfaces only as `error`, like any other failed request.
+  Migration: if you handled `403` in `onUnauthorized`, read it from `error` instead.
+
 ## [0.42.0] - 2026-10-04
 
 ### Added

package/README.md

@@ -725,7 +725,7 @@ const source = useODataSource('/api/orders', {
 | `fixedFilter` | — | Filter always applied in addition to search. Changing it resets the page to 0 — see below |
 | `baseUrl` | `window.location.origin` | Override the request origin (proxy/BFF setups) |
 | `fetcher` | global `fetch` | Custom transport — pass a wrapper that injects auth headers |
-| `onUnauthorized` | — | Called on `401`/`403` responses, before the generic error is set |
+| `onUnauthorized` | — | Called on `401` responses, before the generic error is set. A `403` (signed in, not permitted) does not call it — it surfaces as `error` |
 | `enabled` | `true` | While `false`, no request is made and `loading` stays `true` — see below |
 
 `fetcher`/`onUnauthorized` should be stable references (e.g. wrap in `useCallback`) — they are intentionally excluded from the hook's internal effect dependencies to avoid refetch loops on every render.

package/dist/odata/types.d.ts

@@ -23,7 +23,10 @@ export interface UseODataSourceOptions {
     baseUrl?: string;
     /** 커스텀 fetch transport(예: 인증 헤더를 주입하는 `HttpClient` 래퍼). 기본값: 전역 `fetch`. */
     fetcher?: (input: string, init: RequestInit) => Promise<Response>;
-    /** 응답이 401/403일 때 호출(세션 만료 리다이렉트 등). 호출 후에도 기존 에러 처리는 계속 진행된다. */
+    /**
+     * 응답이 401 일 때 호출(세션 만료 리다이렉트 등). 호출 후에도 기존 에러 처리는 계속 진행된다.
+     * 403(인증됐지만 권한 없음)에는 부르지 않는다 — 그 실패는 `error` 로 드러난다.
+     */
     onUnauthorized?: (response: Response) => void;
     /**
      * `false` 인 동안 요청하지 않는다. 기본값 `true`.

package/dist/react.js

@@ -34,7 +34,7 @@ function d(e, r = {}) {
 		}), a = `${m ?? window.location.origin}${e}${r}`, o = async (e) => {
 			let n = await h(e, { signal: t.signal });
 			if (!n.ok) {
-				(n.status === 401 || n.status === 403) && g && g(n);
+				n.status === 401 && g && g(n);
 				let e = await n.text().catch(() => ""), t = `Request failed (${n.status})`;
 				try {
 					let n = JSON.parse(e);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@iyulab/flex-table",
-  "version": "0.42.0",
+  "version": "0.43.0",
   "description": "A minimalist, input-centric data grid web component",
   "type": "module",
   "main": "./dist/flex-table.js",

package/skills/iyulab-flex-table/references/react.md

@@ -102,7 +102,7 @@ function Orders() {
 | `fixedFilter` | — | odata-query filter object, always applied; value change resets to page 0 (compared by value) |
 | `baseUrl` | `window.location.origin` | For proxy/BFF setups |
 | `fetcher` | global `fetch` | `(input, init) => Promise<Response>`; keep stable |
-| `onUnauthorized` | — | `(response) => void` on 401/403; keep stable |
+| `onUnauthorized` | — | `(response) => void` on 401 only (403 surfaces as `error`); keep stable |
 | `enabled` | `true` | While `false`: no request, `loading` stays `true`, `refresh()` is a no-op, in-flight request is cancelled |
 
 ### Result