Adds a JWT-authenticated entry point so the embedding app can mount
<docuseal-builder data-token="…"> without the host pre-establishing a
DocuSeal session via cross-origin cookies + an external auth gate.
- EmbedBuilderController (GET /embed/builder?token=…): verifies a short-lived
HS256 JWT against the owner account's API access token (the same key the
JSON API uses; raw value is recoverable via the encrypted `token` column),
signs that user in (a first-party session inside the iframe), records a
template-scoped grant in the session, and redirects into the regular
builder — /templates/:id/edit for an existing template, or /new?url=… to
download + create from `document_urls`. Requires `exp` and caps token
lifetime (replay bound). Only opens template_ids the account owns.
- EmbedScoped concern: confines an embed session to its own template (by id,
or by external_id for the /new→create→edit redirect) plus the create +
builder-support paths; refuses enumeration / other templates / the JSON
template API. Fails closed. Path rules mirror the allow-list the host app
enforced at the edge, so the builder keeps working while the cross-origin
cookie + gate machinery on the host side can be removed.
- builder.js shim now iframes /embed/builder?token=… (the server decides
edit vs. new) instead of a bare authenticated /new that 404s without a
pre-set session cookie.
- Request specs for token verification, ownership, exp/lifetime, and scope.
shipeasy-ai
3c05712819