Commits

main

Security regression suites for the four classes that apply to the Blog (roadmap WS-R task 5). test/security-crawl.js lists every route of the booted app from Express's router stack (a route added later is crawled without anyone listing it), fills parameters with seeded values and GETs each path as several people, each request from a fresh client address so the per-address limits are not what is read.OpenVibers · 26 Sept 2026 21d5db3
The notification bell hears new notifications as they happen (notificationsRealtime; Shared 1.22.0, roadmap WS-E task 3): Network's network.notification.created over OpenVibe.Events' realtime stream, with polling as the fallback. Only a signed-in bell with a Network token opens a stream.OpenVibers · 26 Sept 2026 36306fb
Pins: openvibe-shared 1.20.0 -> 1.22.0 (realtime notification badge, off until a site turns it on; the unreachable-host browser check)OpenVibers · 26 Sept 2026 79e9e15
Open redirect fixed (roadmap WS-R task 5): the sign-in next let "/<TAB>/evil.com" through, which browsers read as "//evil.com" (they drop tab and newline characters and read a backslash as "/"); any control character or backslash in next now goes home. test/open-redirect.test.js feeds it the known bypassesOpenVibers · 26 Sept 2026 047c956
Pins: openvibe-shared 1.18.0 -> 1.20.0 (the update matrix and release manifest 1.2.0: client generations, the shell)OpenVibers · 26 Sept 2026 236bdba
Pins: openvibe-shared 1.17.1 -> 1.18.0 (update telemetry: prompted count, sessions by generation)OpenVibers · 26 Sept 2026 24705e9
Pins: openvibe-shared 1.16.1 -> 1.17.1 (release notifications)OpenVibers · 26 Sept 2026 86eb327
Pins: openvibe-shared 1.16.0 -> 1.16.1 (the OV mark stops animating when idle, hidden or off-screen)OpenVibers · 26 Sept 2026 be44292
A guest's session probe answers 200, not 401 (browser check, WS-Q task 3): GET /auth/me with no session credential at all answers { user: null }, which the shared navbar reads as signed out. It asks on every page view, and the 401 logged a console error on each. A credential that is present but invalid or expired still answers 401. Test: security.test.jsOpenVibers · 26 Sept 2026 897822f
The CSP allows Cloudflare Web Analytics (browser check, WS-Q task 3): script-src https://static.cloudflareinsights.com loads the beacon Cloudflare injects at the edge, connect-src https://cloudflareinsights.com is where it reports. The network's privacy text already says Cloudflare may measure performance, and Live and Tools allow it; here the policy blocked it and every page view logged a CSP error.OpenVibers · 26 Sept 2026 8c6b686
Pins: openvibe-shared 1.15.0 -> 1.16.0OpenVibers · 26 Sept 2026 b512139
nginx: /auth/me, the session probe the shared navbar asks on every page view, gets its own location on the API zone (burst 30) instead of the sign-in zone (10 a minute, burst 10), and both answer 429 when limited instead of nginx's default 503. The browser check (Host scripts/browser-check.js, WS-Q task 3) saw /auth/me answer 503 after about ten quick page loads, which the navbar takes as signed out. test/nginx-auth-limit.test.js. Takes effect when the vhost is next installed (not deployed here)OpenVibers · 26 Sept 2026 6555217
Buttons and .button links are --on-accent-strong on --accent-strong (openvibe-shared 1.13.0 tokens, 4.5:1 in every theme) instead of white on --accent (3.67:1, axe color-contrast serious on the 404 page's "The OpenVibe blog" link; found by the browser check, Host scripts/browser-check.js, WS-Q task 3); test/css-contrast.test.jsOpenVibers · 26 Sept 2026 b5b49d3
.env.example: names with a working default are commented (optional), so ovhost validate's from-example check requires only what the service cannot run withoutOpenVibers · 26 Sept 2026 d48688d
Size budgets for the home page (WS-T task 1): openvibe-shared/perf-budget (shared 1.15.0) measures / as the server answers it on a fresh database, no browser, in npm test; budgets a little above the 2026-09-26 measurementOpenVibers · 26 Sept 2026 30a2b69
Moderation audit (ADR-022, WS-D task 1): blog.moderation.action from the outbox in the same transaction when staff unpublish (post.unpublished) or delete (post.deleted) a post only their staff powers allow, with the author as owner_subject; an author or blog editor doing the same reports nothing. Pins: openvibe-contracts 0.49.0 → 0.53.0OpenVibers · 26 Sept 2026 ee4a607
Pins: openvibe-contracts 0.44.0 → 0.49.0, openvibe-shared 1.12.0 → 1.13.0, openvibe-sdk 0.9.1 → 0.11.0OpenVibers · 25 Sept 2026 ffc1357
Pins: openvibe-contracts 0.42.0 → 0.44.0 (Contracts 0.43.0 and 0.44.0 were released after the previous pin commit, leaving 0.42.0 two minors behind the pin-drift limit)OpenVibers · 25 Sept 2026 6905891
Pins: openvibe-contracts 0.38.0 → 0.42.0, openvibe-sdk 0.7.0 → 0.9.1; CI runs the pin-drift check (shared test and security workflows at 423fe51)OpenVibers · 25 Sept 2026 f235c8b
Staff powers from the contracts staff map (WS-D, ADR-022; Contracts 0.38.0): moderation on any blog is staff.content.moderate (global_mod and up, was admin only), the official blog's ownership is staff.editorial.manage (admin); no role names in the viewer. test/staff-map.test.js fails on raw role checksOpenVibers · 24 Sept 2026 f0451df
The changelog's GitHub token: CHANGELOG_GITHUB_TOKEN, else the network's (admin → Settings → GitHub), asked of Network's /internal/integrations/github-token with Blog's service token (network.integration.github.read) and kept ten minutes; else anonymous. A 401 from GitHub asks again; stats name the source, never the valueOpenVibers · 24 Sept 2026 ea6b788
The OpenVibe Frame from this site's own pinned copy: /shared/* is served by openvibe-shared/serve (1.12.0) and every page references it by content hash (/shared/<file>?v=<hash>), so this site's pin decides what its pages run and its navbar and footer keep working while openvibe.network is down; openvibe-publishing 0.4.0 (openvibe-shared as a peer: one copy, no lockstep releases)OpenVibers · 24 Sept 2026 7d9d197
The OpenVibe Frame: openvibe-shared/frame (formerly chrome-ssr) and 1.11.0; openvibe-publishing 0.3.2 (one copy of openvibe-shared)OpenVibers · 24 Sept 2026 e4d201c
The shared update system and one account UI: the home shows what shipped, /updates is the shared log, the footer (now initialised in the browser too) links it; the shared navbar handles sign in/out with logoutUrl ending this site's session, and the page's own 'Write · Sign out' bar is only for no-JS visitors. openvibe-shared 1.10.0, openvibe-publishing 0.3.1OpenVibers · 24 Sept 2026 528f917
changelog: every site's updates log — commit authors, a page cursor (before), a one-time import of each site's last CHANGELOG_HISTORY commits (never pending, never in a post), the recent patch notes posts and a per-site summary in the feed; polls every 5 minutesOpenVibers · 24 Sept 2026 dc3f3a1
changelog: Network's /api/v1/registry/releases lists services under 'services' (the test stub now answers in that shape)OpenVibers · 24 Sept 2026 58d2e45
The network changelog and its patch notes: every OpenVibe site's shipped commits in one feed, published on the blog in batches. The worker reads each service's repository and current release from OpenVibe.Network's registry, takes the commits between the release it saw last and the new one from GitHub's compare API (first line, sha, dates, change size), and when CHANGELOG_BATCH_SIZE have gathered, a large release (CHANGELOG_MAJOR_LINES, a version bump, [major]) has been quiet for 30 minutes, or the oldest waited a week, publishes one 'Patch notes' post on the official blog: highlights first, then each site's commit messages linked to the change, authorship imported from GitHub. An AI-written dev-blog version goes along as a draft for review when OpenVibe.AI is configured. GET /api/v1/changelog?service= (public, CORS *) feeds every site's 'recently shipped'. test/changelog.test.jsOpenVibers · 24 Sept 2026 32cb1aa
Draft with AI (W13, proof flow 5): a member who may write on a blog asks OpenVibe.AI's blog.draft_post (openvibe-publishing v0.3.0 ai client, Blog's service token) for a draft from a topic, brief, tone and audience; the answer becomes an AI-authored post (authorship mode ai with the workflow and run), a draft and noindex until a person reviews it, with the run's citations on revision 1. POST /api/v1/blogs/:handle/posts/ai-draft and a no-JS form on the New post page; a failed run makes no post; offered only when OV_AI_INTERNAL_URL is set. test/ai-draft.test.jsOpenVibers · 24 Sept 2026 4d522ca
CI calls the shared test workflow (Track Q): OpenVibe.Shared .github/workflows/test.yml@f5e7e73 (install, node --check over server/ and scripts/, npm test, openvibe-contracts-check) instead of a copy of those stepsOpenVibers · 24 Sept 2026 36b6f59
VIP client from openvibe-sdk/vip (v0.7.0): the copy of openvibe-vip/client is replaced by the SDK's published seam, same API and fail-closed behaviour; server/vip/vip-client.js re-exports it so callers are unchangedOpenVibers · 24 Sept 2026 eae013f

More commits