openvibers/openvibe.community Commits

Bump openvibe-contracts to v0.86.0 and note T10 migration TODO (#10)

OP OpenVibers committed 3 Oct 2026 · 49970634e0 · 4 files, +13 −8

checks run by GitHub CI (test) · CI ✓ 3/3 · review SHIP by DeepSeek harness (QUALITY=high)

https://github.com/OpenVibers/OpenVibe.Community/pull/10

Changes

ddiff --git a/README.md b/README.md
iindex 1a1454c..1459dea 100644
---- a/README.md
++++ b/README.md
@@@ -558,7 +558,7 @@ same shape as its `manifests/capabilities`):
  | `community.post.create` | active in contracts (v0.7.0) | forum writes |
  | `community.space.read` / `.manage`, `community.thread.read`, `community.vote.set`, `community.pulse.read` | active in contracts | spaces, threads, votes and Pulse reads by services and apps |
  
--This repository pins `openvibe-contracts` v0.76.0, which knows every id above, so they all go
++This repository pins `openvibe-contracts` v0.86.0, which knows every id above, so they all go
  through the library's `capabilities.check`. `server/identity/capabilities.js` still decides an id
  the installed contracts do not know locally, with the library's own matching rule (the exact id
  or a `prefix.*` grant).
ddiff --git a/package-lock.json b/package-lock.json
iindex 89a6d8d..ae35a1d 100644
---- a/package-lock.json
++++ b/package-lock.json
@@@ -17,7 +17,7 @@
          "highlight.js": "^11.11.1",
          "iovalkey": "^0.4.0",
          "multer": "^2.4.0",
--        "openvibe-contracts": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.76.0",
++        "openvibe-contracts": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.86.0",
          "openvibe-sdk": "https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.26.0",
          "openvibe-shared": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v2.5.0",
          "pg": "^8.23.0"
@@@ -1191,9 +1191,9 @@
        }
      },
      "node_modules/openvibe-contracts": {
--      "version": "0.76.0",
--      "resolved": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.76.0",
--      "integrity": "sha512-zTdx776KWrcJKm1JTnf+0+BnsvswdvXy1ldPyse1hSqhnW/SSr98sX696eRetFUhTl8qVM1xSRCykqIUbqItPw==",
++      "version": "0.86.0",
++      "resolved": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.86.0",
++      "integrity": "sha512-3o3AILEBtQ2pK0KqK7GEAlN3HJjaKUl6vrbzEDiBbhK6Nr2hivgN/5MAmJ7WRkgaDkxNsZETs/fLZC2Q4oNCiA==",
        "license": "AGPL-3.0-only",
        "dependencies": {
          "ajv": "^8.17.1",
ddiff --git a/package.json b/package.json
iindex 7502a7b..d8667ec 100644
---- a/package.json
++++ b/package.json
@@@ -28,7 +28,7 @@
      "highlight.js": "^11.11.1",
      "iovalkey": "^0.4.0",
      "multer": "^2.4.0",
--    "openvibe-contracts": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.76.0",
++    "openvibe-contracts": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.86.0",
      "openvibe-sdk": "https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.26.0",
      "openvibe-shared": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v2.5.0",
      "pg": "^8.23.0"
ddiff --git a/test/security-idor.test.js b/test/security-idor.test.js
iindex c34aa95..ec53151 100644
---- a/test/security-idor.test.js
++++ b/test/security-idor.test.js
@@@ -4,8 +4,13 @@
   *
   * alex owns a public paste, a private one, a screenshot, comments, a thread with a reply, a typed comment,
   * an uploaded image and a space (as its creator; spaces have no per-space moderators, so a space's owner
-- * is what "moderator of X" means here: cora owns another). sam tries each of alex's ids as himself, and so
-- * do first-party services forwarding for him (svc:live, svc:tools, each with the write grants they hold)
++ * is what "moderator of X" means here: cora owns another).
++ *
++ * TODO(T10 step 1): migrations/0005_space_moderators.sql adds per-space moderators; revisit the
++ * "no per-space moderators" assumption above (and this file's space expectations) when it lands.
++ *
++ * sam tries each of alex's ids as himself, and so do first-party services forwarding for him
++ * (svc:live, svc:tools, each with the write grants they hold)
   * and a developer app acting for him: editing, deleting, changing visibility, re-screenshotting
   * (censor), the AI write-back, bulk actions, reading edit history, managing comments (also through a
   * paste he owns), gating, pinning/locking, categories and statuses, space settings and chat rooms,