pipework 0.75.2 → 0.77.0

package/CHANGELOG.md

@@ -1,5 +1,15 @@
 # Changelog
 
+## 0.77.0
+
+- **New: `flow.actAs({ tenant, userId }, fn)`** for code that has just chosen a tenant in a Flow with none: a sign-up founding a tenant, a public sign-in recording into its org. `fn` runs as that tenant and user (row-level security, audit tenant and actor) in a savepoint of the request's own transaction, so a failed sign-up leaves nothing behind; its work is recorded in a child trace the tenant can read. Afterwards the request is tenantless again. Refused when the Flow already has a tenant (#489).
+
+## 0.76.0
+
+- **New: browser sessions.** `SessionConfig.accessToken.cookie` also delivers the access token as an HttpOnly cookie (`__pipework_access`, SameSite Lax, Path `/`), set, replaced and cleared alongside the refresh cookie by `issueTokensHttp`, `refreshHttp`, `revokeHttp`, `revokeAllHttp` and multi-org sign-in, select and switch, so a plain link, image or form reaches a route signed in. Without it nothing changes (#487).
+- **New: `sessions.strategy({ trustedOrigins? })`**, the auth strategy for pipework's own sessions: `Authorization: Bearer` first, else the access cookie; checks the session version when `versionCheck` is on. A write (not GET/HEAD/OPTIONS) authenticated by the cookie must come from the app's own site (`Sec-Fetch-Site`, else `Origin` against `Host` or `trustedOrigins`), otherwise 403 `CROSS_SITE_REQUEST` (`CrossSiteRequestError`). It never refreshes; the client calls its refresh route on a 401.
+- **Changed: an expired access token answers 401 "Access token expired"** instead of "Invalid access token". `switchOrg` revokes the refresh token the request carried. New `sessions.revokeRefreshCookie(db, request)`. Auth strategies now receive the request's parsed `cookies` and its `method`.
+
 ## 0.75.2
 
 - **Fixed: the work a public request runs under `accessLinks.asLink` is readable by the link's tenant.** It is now recorded in a child trace of the request's trace that carries the link's tenant and the `link:<id>` user; before, it sat in the request's tenantless trace, which no tenant can read. The request's own trace is unchanged. Audit rows written inside `asLink` now point at the child trace (#474).