@returningai/widget-sdk 1.4.0 → 1.4.2

package/CHANGELOG.md

@@ -0,0 +1,104 @@
+# Changelog
+
+All notable changes to `@returningai/widget-sdk` are documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+---
+
+## [Security Notice — 2026-05-11] Refresh-token TTL change for Access Key Embed
+
+**This is a server-side change. No SDK code update is required. Customers do
+not need to publish a new build of their host pages — the change applies
+automatically the next time their users load the widget.**
+
+### What changed
+
+The ReturningAI widget auth backend (`/auth/serverless`) now issues
+**0-second-TTL refresh tokens** for Access Key Embed sessions (any auth
+request that includes a signed `embedToken` in the body). The SDK persists
+the refresh token with an already-expired `refreshTokenExpiry`, so on the
+next page load `loadFromStorage` wipes it and the SDK re-calls
+`/auth/serverless` for fresh `embedToken` validation.
+
+Public Embed sessions (auth via `data-*` identifier attributes only, no
+`embedToken`) keep the original 7-day refresh window — their identity
+arrives from the host page on every load anyway, so caching the refresh
+token doesn't change the security model.
+
+In addition, refresh tokens **issued before this date are now rejected** by
+`/auth/refresh`. Users with stored refresh tokens older than the cutoff
+will see a one-time `/auth/serverless` re-auth on their next page load.
+This is transparent provided their host page still supplies `embed-token`
+(Access Key Embed) or `data-email` / configured identifier attrs (Public
+Embed) — which is the normal embed state.
+
+### Why
+
+In the previous behavior, a host page that:
+
+1. Initially loaded with `embed-token` + `data-email` (auth succeeded,
+   7-day refresh token stored), and
+2. Later loaded without those attributes (e.g., the `embed-token` attribute
+   was removed or rotated)
+
+...would still authenticate as the original user via the cached refresh
+token until that token's 7-day TTL expired. This conflicted with the
+Access Key Embed promise that **every page load re-validates the embed
+token**. A revoked or expired `embedToken` should immediately end the
+session — not survive for up to a week in the user's browser.
+
+### Visible behavior changes
+
+| Scenario | Before | After |
+|---|---|---|
+| First load with `embed-token` (valid claims) | 200, stores 7-day refresh token | 200, stores already-expired refresh token |
+| Subsequent loads with `embed-token` still present | Used cached refresh token via `/auth/refresh` | Re-validates via `/auth/serverless` every load |
+| Subsequent loads after `embed-token` is removed/changed | Continued working for up to 7 days (gap) | Re-auth required; fails closed if no identity is present |
+| Public Embed loads (`data-email` only) | Unchanged | Unchanged |
+| Users mid-session (in-memory access token) | Unchanged | Unchanged until access token expires (~5 min) |
+
+### Action required
+
+**For most customers: none.** The change is backward-compatible with all
+documented embed patterns. Your existing `<script>` / custom-element
+embeds keep working with their pinned SDK version.
+
+**Possible visible effect:** existing logged-in users may see a single
+re-auth round-trip on their next page load (≈50–150 ms latency added).
+After that, normal behavior resumes.
+
+**If you're using Access Key Embed:** confirm your token-mint endpoint
+calls `issueEmbedTokenService(accessId, accessKey, { /* identifiers */ })`
+so the JWT carries `userIdentifiers` as a signed claim. With a correctly
+signed token, no `data-*` attributes are needed on the embed tag and
+re-auth on every load is transparent.
+
+---
+
+## [1.4.0] — 2026-05-02
+
+### Added
+- Bundled lottie-web (light build) loader instead of runtime CDN fetch.
+  Eliminates dependency on `cdnjs.cloudflare.com` at runtime — works
+  offline and behind corporate proxies.
+- `AnimationItem.destroy()` cleanup on `disconnectedCallback` to fix a
+  memory leak when widgets are repeatedly mounted/unmounted.
+- `data-rai-widget-root` attribute on the mount container for easier
+  selection in tests and external CSS.
+
+### Changed
+- Environment URLs (`api-url`, `widget-url`, `domain-key`, `v2-api-url`)
+  are now optional. The SDK resolves them from `domain-key` when present
+  and defaults to production otherwise. Existing embeds that explicitly
+  pass these attributes continue to work without modification.
+
+---
+
+## [1.3.0] — Server-signed identity (Access Key Embed) + security hardening
+
+Introduced Access Key Embed mode — JWT `embedToken` carries signed
+`userIdentifiers` claims. Server trusts token claims over body-level
+identifiers. SDK clears storage on every load when `embed-token` is
+present, forcing fresh `/auth/serverless` validation.