openvibers/openvibe.chat Commits

Serve /.well-known/security.txt (RFC 9116) (#242)

OP OpenVibers committed 16 days ago · d45d77bc9a · 2 files, +37 −0

Contact mailto:[email protected], Expires one year out, Preferred-Languages en,
Canonical from this site's own origin (config, never a constant), and Policy while
https://openvibe.network/security answers 200 (checked 2026-10-29). text/plain; charset=utf-8,
cached a day. A test beside the existing discovery tests parses the fields, checks Expires is in
the future and the Canonical host is this site's own.

SEO-30.

Changes

ddiff --git a/server/web/discovery.js b/server/web/discovery.js
iindex 3d391bf..2c3f911 100644
---- a/server/web/discovery.js
++++ b/server/web/discovery.js
@@@ -16,6 +16,9 @@ const cache = require('openvibe-shared/cache-policy');
  const historyStore = require('../chat/history-store');
  const rooms = require('../rooms/rooms');
  
++// The date /.well-known/security.txt must be refreshed by: one year on, a person re-reads and re-commits it.
++const SECURITY_EXPIRES = '2027-10-29T00:00:00.000Z';
++
  /** A SQLite `DATETIME` ("YYYY-MM-DD HH:MM:SS", UTC) or ISO string as YYYY-MM-DD; null when unusable. */
  function dayOf(ts) {
      const s = String(ts == null ? '' : ts);
@@@ -124,6 +127,21 @@ function createDiscoveryRoutes({ config }) {
          res.type('application/xml').set('Cache-Control', cache.htmlHeaders({ maxAge: 3600 })).send(seo.sitemapXml(urls));
      });
  
++    // RFC 9116 (SEO-30). Contact, Expires and Canonical are required; Canonical is this site's own, from
++    // the config, never a constant. Policy is listed only while https://openvibe.network/security answers
++    // 200 (checked 2026-10-29). Expires is the date the file must be refreshed by: one year on, a person
++    // re-reads and re-commits it.
++    router.get('/.well-known/security.txt', (_req, res) => {
++        res.type('text/plain; charset=utf-8').set('Cache-Control', 'public, max-age=86400').send([
++            'Contact: mailto:[email protected]',
++            `Expires: ${SECURITY_EXPIRES}`,
++            'Preferred-Languages: en',
++            `Canonical: ${abs('/.well-known/security.txt')}`,
++            'Policy: https://openvibe.network/security',
++            '',
++        ].join('\n'));
++    });
++
      return router;
  }
  
ddiff --git a/test/discovery.test.js b/test/discovery.test.js
iindex b5f444b..e3bf561 100644
---- a/test/discovery.test.js
++++ b/test/discovery.test.js
@@@ -82,6 +82,25 @@ t('/sitemap.xml is the public pages with a real lastmod, never today', async ()
      assert.ok(room.includes('<lastmod>2026-02-03</lastmod>'), 'the room lastmod is its last_message_at');
  });
  
++t('/.well-known/security.txt is RFC 9116, canonical to this site, valid for a year', async () => {
++    const r = await req('/.well-known/security.txt');
++    assert.strictEqual(r.status, 200);
++    assert.strictEqual(r.type, 'text/plain; charset=utf-8');
++    assert.strictEqual(r.cache, 'public, max-age=86400');
++    const fields = new Map();
++    for (const line of r.text.split('\n')) if (line.trim()) {
++        const m = line.match(/^([A-Za-z-]+): (.+)$/);
++        assert.ok(m, `every security.txt line is "Name: value" (got "${line}")`);
++        fields.set(m[1], m[2]);
++    }
++    for (const key of ['Contact', 'Expires', 'Preferred-Languages', 'Canonical', 'Policy']) assert.ok(fields.has(key), `security.txt names ${key}`);
++    assert.strictEqual(fields.get('Contact'), 'mailto:[email protected]');
++    assert.ok(Date.parse(fields.get('Expires')) > Date.now(), 'Expires is in the future');
++    const canonical = new URL(fields.get('Canonical'));
++    assert.strictEqual(canonical.host, new URL(SITE).host, 'Canonical is this site\'s own host');
++    assert.strictEqual(canonical.pathname, '/.well-known/security.txt');
++});
++
  t('the home page carries JSON-LD: WebSite plus the site\'s primary type', async () => {
      const r = await req('/');
      assert.strictEqual(r.status, 200);