chore(release): 0.2.0

CHANGELOG.md

@@ -4,6 +4,15 @@
 All notable changes to this project will be documented in this file.
 <!--- END HEADER -->
 
+## [0.2.0](https://git.fromme.dev/ep/appsmith-bff/compare/v0.1.0...v0.2.0) (2026-08-12)
+
+### Features
+
+* Additional roles per app ([b62abb](https://git.fromme.dev/ep/appsmith-bff/commit/b62abb180118124bd2fb9ae654bedcf84a1dd0c6))
+
+
+---
+
 ## [0.1.0](https://git.fromme.dev/ep/appsmith-bff/compare/790d5bc15ff570b0aae93da83fdf62b81734a9c4...v0.1.0) (2026-08-10)
 
 ### Features

README.md

@@ -101,36 +101,36 @@ Sessions are stored via Symfony's filesystem cache by default (`config/packages/
 
 ## Appsmith app integration
 
-Create a shared module with this js:
+Create a shared module with this js. It stays generic — every app key and page name is passed in by the caller, so the same code can be dropped into every app unchanged:
 
 ```js
 export default {
     isLoggedIn() {
         return !!appsmith.store.sid;
     },
-    login(appKey) {
+    login({ app }) {
-        navigateTo(`https://bff.ep-reisen.net/auth/login?app=${appKey}`, {}, 'SAME_WINDOW');
+        navigateTo(`https://bff.ep-reisen.net/auth/login?app=${app}`, {}, 'SAME_WINDOW');
     },
-    async checkReturningFromLogin(loginPageName, protectedPageName) {
+    async checkReturningFromLogin({ loginPage, protectedPage }) {
         const sid = appsmith.URL.queryParams.sid;
         const error = appsmith.URL.queryParams.error;
         if (error === 'access_denied') {
             showAlert('You do not have access to this app.', 'error');
-            navigateTo(loginPageName, {}, 'SAME_WINDOW');
+            navigateTo(loginPage, {}, 'SAME_WINDOW');
             return;
         }
         if (sid) {
             await storeValue('sid', sid);
-            navigateTo(protectedPageName, {}, 'SAME_WINDOW');
+            navigateTo(protectedPage, {}, 'SAME_WINDOW');
         }
         if (appsmith.store.sid && !appsmith.store.user) {
             const profile = await Bff_Me.run();
             await storeValue('user', profile);
         }
     },
-    guardPage(loginPageName) {
+    guardPage({ loginPage }) {
         if (!this.isLoggedIn()) {
-            navigateTo(loginPageName, {}, 'SAME_WINDOW');
+            navigateTo(loginPage, {}, 'SAME_WINDOW');
         }
     },
     async logout() {
@@ -142,26 +142,35 @@ export default {
 }
 ```
 
+The per-page objects below are where an app's own configuration lives — page names and the app key. They can't be folded into the shared module: JS Objects are page-scoped and "Run on page load" applies to the page the object belongs to, so each page needs its own.
+
 On the login page add this js to be executed onLoad:
 
 ```js
 export default {
   onLoad() {
-    return Bff.checkReturningFromLogin('Login', 'ProtectedPage');
+    return Bff.checkReturningFromLogin({
+      loginPage: 'Login',
+      protectedPage: 'ProtectedPage',
+    });
   }
 }
 ```
 
+Bind the login button's onClick to `{{ Bff.login({ app: 'app-sandbox' }) }}` — the same app key the `Bff_Me` query sends as `?app=`.
+
 On the protected page add this js to be execute onLoad:
 
 ```js
 export default {
   onLoad() {
-    return Bff.guardPage('Login');
+    return Bff.guardPage({ loginPage: 'Login' });
   }
 }
 ```
 
+Note `guardPage` only checks that a `sid` exists, not that it's still valid — an expired session surfaces on the first API call's 401 handler.
+
 Login state can be used to toggle visibility of UI elements in Appsmith with
 
 ```js

composer.json

@@ -66,5 +66,5 @@
             "require": "7.*"
         }
     },
-    "version": "0.1.0"
+    "version": "0.2.0"
 }

composer.lock

@@ -4,7 +4,7 @@
         "Read more about it at https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies",
         "This file is @generated automatically"
     ],
-    "content-hash": "9de423c4119a1cf08f60c604ac523189",
+    "content-hash": "b64b308ac18c4c43f9465c097be4d120",
     "packages": [
         {
             "name": "firebase/php-jwt",