AI: the space builder reads the visitor from ov.user (it wrote request.ov.user, so per-person logic never ran) (#114)

OP OpenVibers committed 28 days ago · 2ce4cec303 · 2 files, +2 −1

Changes

ddiff --git a/server/workflows/space.js b/server/workflows/space.js
iindex 1d7df5d..4df882c 100644
---- a/server/workflows/space.js
++++ b/server/workflows/space.js
@@@ -42,7 +42,7 @@ const SDK_REFERENCE = [
  const FUNCTIONS_REFERENCE = [
      'Server functions, only when the idea needs code the visitor must not see or change (hidden answers, a counter every visitor shares, checking a move or a score before it is saved, a page put together on the server):',
      '- A file functions/<name>.js (name: a-z, 0-9 and "-") is a plain script that defines async function handle(request, ov) { … } (no export, import, require or module.exports). The page calls it with await OV.fn("<name>", body); a link or form may also use /api/<name>.',
--    '- request: { method, path, query, headers, body }. ov.user (the signed-in visitor or null), ov.items.list/add/set/remove (the shared lists; adds are the visitor\'s when signed in, otherwise the space\'s), ov.store.get/set/remove (the space\'s own server storage that visitors cannot read, values up to 16 KB), ov.ai.ask(text) (a signed-in visitor), console.log.',
++    '- request: { method, path, query, headers, body } and nothing else. Everything about the visitor and the space is on the second argument, ov: ov.user (the signed-in visitor { username, display_name } or null; never request.user or request.ov), ov.items.list/add/set/remove (the shared lists; adds are the visitor\'s when signed in, otherwise the space\'s), ov.store.get/set/remove (the space\'s own server storage that visitors cannot read, values up to 16 KB), ov.ai.ask(text) (a signed-in visitor), console.log.',
      '- handle returns any JSON value, a string (HTML or text), or { status, body }. It runs in a sandbox: plain modern JavaScript, no require/import, fetch, timers, files or packages, about 1 s of computing and 100 ov calls per request.',
  ].join('\n');
  
ddiff --git a/test/space-workflows.test.js b/test/space-workflows.test.js
iindex 0dc044c..eea1494 100644
---- a/test/space-workflows.test.js
++++ b/test/space-workflows.test.js
@@@ -21,6 +21,7 @@ t.test('the builder\'s prompt: the SDK reference, and the current files when cha
      assert.match(sys, /Phones first: at 360 px wide nothing is squeezed/);
      assert.match(sys, /functions\/<name>\.js \(name: a-z, 0-9 and "-"\) is a plain script that defines async function handle\(request, ov\) \{ … \} \(no export, import, require or module\.exports\)/, 'server functions');
      assert.match(sys, /OV\.fn\(name, body\)/);
++    assert.match(sys, /never request\.user or request\.ov/, 'the visitor is on ov, not on the request');
      assert.ok(!/There is no server code/.test(sys));
      const prep = PREPARE['space.app.build']({ prompt: 'a poll about pizza' });
      assert.ok(prep.jsonSchema && prep.jsonSchema.properties.files && !/maxLength|maxItems/.test(JSON.stringify(prep.jsonSchema)), 'the model answers in the uncapped, non-strict schema');

diff --git a/server/workflows/space.js b/server/workflows/space.js

index 1d7df5d..4df882c 100644

--- a/server/workflows/space.js

+++ b/server/workflows/space.js

@@ -42,7 +42,7 @@ const SDK_REFERENCE = [

const FUNCTIONS_REFERENCE = [

'Server functions, only when the idea needs code the visitor must not see or change (hidden answers, a counter every visitor shares, checking a move or a score before it is saved, a page put together on the server):',

'- A file functions/<name>.js (name: a-z, 0-9 and "-") is a plain script that defines async function handle(request, ov) { … } (no export, import, require or module.exports). The page calls it with await OV.fn("<name>", body); a link or form may also use /api/<name>.',

- '- request: { method, path, query, headers, body }. ov.user (the signed-in visitor or null), ov.items.list/add/set/remove (the shared lists; adds are the visitor\'s when signed in, otherwise the space\'s), ov.store.get/set/remove (the space\'s own server storage that visitors cannot read, values up to 16 KB), ov.ai.ask(text) (a signed-in visitor), console.log.',

+ '- request: { method, path, query, headers, body } and nothing else. Everything about the visitor and the space is on the second argument, ov: ov.user (the signed-in visitor { username, display_name } or null; never request.user or request.ov), ov.items.list/add/set/remove (the shared lists; adds are the visitor\'s when signed in, otherwise the space\'s), ov.store.get/set/remove (the space\'s own server storage that visitors cannot read, values up to 16 KB), ov.ai.ask(text) (a signed-in visitor), console.log.',

'- handle returns any JSON value, a string (HTML or text), or { status, body }. It runs in a sandbox: plain modern JavaScript, no require/import, fetch, timers, files or packages, about 1 s of computing and 100 ov calls per request.',

].join('\n');

diff --git a/test/space-workflows.test.js b/test/space-workflows.test.js

index 0dc044c..eea1494 100644

--- a/test/space-workflows.test.js

+++ b/test/space-workflows.test.js

@@ -21,6 +21,7 @@ t.test('the builder\'s prompt: the SDK reference, and the current files when cha

assert.match(sys, /Phones first: at 360 px wide nothing is squeezed/);

assert.match(sys, /functions\/<name>\.js \(name: a-z, 0-9 and "-"\) is a plain script that defines async function handle\(request, ov\) \{ … \} \(no export, import, require or module\.exports\)/, 'server functions');

assert.match(sys, /OV\.fn\(name, body\)/);

+ assert.match(sys, /never request\.user or request\.ov/, 'the visitor is on ov, not on the request');

assert.ok(!/There is no server code/.test(sys));

const prep = PREPARE['space.app.build']({ prompt: 'a poll about pizza' });

assert.ok(prep.jsonSchema && prep.jsonSchema.properties.files && !/maxLength|maxItems/.test(JSON.stringify(prep.jsonSchema)), 'the model answers in the uncapped, non-strict schema');