FinBaze for Platforms

Changelog

2026-10-26: dashboard SSO#

  • Feature gate. platforms.dashboard_sso (off by default). Create and exchange refuse with PLATFORM_DASHBOARD_SSO_DISABLED while it is off.
  • New scopes. platform_dashboard:read and platform_dashboard:write (portal area keys, same as embed).
  • Mint. createDashboardSession(input) (server token, platform_dashboard:write) binds a platform user and company, an optional returnUrl on an allowed web origin, and returns a handoffUrl with a single-use code (ds_…). Wrong origin → DASHBOARD_RETURN_URL_NOT_ALLOWED.
  • Exchange. exchangeDashboardSession(input: { code }) is anonymous: FinBaze exchanges the code once for a short-lived JWT with typ: dashboard, aud: finbaze-web, and the company's profile_ids. Reuse → DASHBOARD_CODE_USED; unknown / expired / revoked → DASHBOARD_CODE_INVALID, DASHBOARD_CODE_EXPIRED, or DASHBOARD_SESSION_REVOKED. A refresh chain past its lifetime → DASHBOARD_CHAIN_EXPIRED.
  • Session reads. dashboardContext (dashboard token), dashboardSession(id) and dashboardSessions(filter) (server token, platform_dashboard:read).
  • Revoke. revokeDashboardSession(id) and revokeDashboardSessionsForUser(platformUserId, companyId) (server token, platform_dashboard:write). Revocation is checked on every dashboard-token request.
  • Events. dashboard_session.exchanged and dashboard_session.used (webhook topic Companies, users and sessions).
  • Not available to assistants and agents without confirmation: the create / exchange / revoke mutations.