Commits

main

Use shared cache policy for Community asset and page headers (#4)OpenVibers · 4 Oct 2026 2d7d05b
Serve discovery, page heads and cache headers from openvibe-shared (#11)OpenVibers · 4 Oct 2026 cef50a4
Fix the home page meta description in server/render/pages.js line 173 (#12)OpenVibers · 3 Oct 2026 d8376ac
Bump openvibe-contracts to v0.86.0 and note T10 migration TODO (#10)OpenVibers · 3 Oct 2026 4997063
Bump openvibe-shared v2.3.1 → v2.5.0 (#9)OpenVibers · 3 Oct 2026 bf0fa30
Move Community's graceful shutdown onto openvibe-sdk/service (#8)OpenVibers · 3 Oct 2026 752dacc
Move Community's graceful shutdown onto openvibe-sdk/service (#7)OpenVibers · 2 Oct 2026 b6ca9f6
Wait for the async inbound failure before asserting it in relay test (#6)OpenVibers · 2 Oct 2026 cd34b84
Show and take paste comments on the paste's typed comment thread (#5)OpenVibers · 2 Oct 2026 d7686f2
Submissions: a reviewed section for community deliverables (#3)OpenVibers · 2 Oct 2026 e2822a3
Merge pull request #2 from OpenVibers/agent/community-t10-lane-e-job-1-005013-muq8xsm1OpenVibers · 2 Oct 2026 3aa6813
T10 lane E job 1 — Community tombstone cleanup (complete)OpenVibers · 2 Oct 2026 3a1eede
The Community home is built with the showcase kit (plan T11, openvibe-shared v2.3.1): a hero with the terminal sample beside it, the latest and most-viewed pastes as before (the language cloud now under Latest), what lives here (pastes, screenshots, spaces, threads, Pulse, open source), 'Paste from anywhere' with curl and fetch samples, and a closing call. The page links /shared/showcase.css before community.css (layout styles option) and the kit's sections share the page's column; the old hero/cta/coming CSS is gone. A test proves the home's curl -F sample makes a text paste without an account; the SSRF inventory classifies the fetch() sample as text. Budgets: HTML 22.0 KB measured (unchanged budget); CSS raised to 40 KB raw / 8.5 KB br for the network's cached showcase.css. npm test 47/47.OpenVibers · 29 Sept 2026 d4b42e9
Community is the only paste authority, moves between pages without a reload, and tells search engines when a page changes (plans T10 J6 and T11). The PASTES_AUTHORITY=live path is gone: the Live paste proxy (server/pastes/proxy.js), the Live client (server/live-client.js), the switch and its config, the local capability fallback and the C-24 references; migration 0002 drops the unread pastes.legacy_media_id/legacy_user_id and paste_comments.legacy_media_id (legacy_id_map stays: identity resolution uses it). openvibe-shared v2.2.0 boost with the release marker; IndexNow with INDEXNOW_KEY (public posts and pastes appearing, changing or going away); a home-page performance budget. test/proxy.test.js proves nothing reads the switch or proxies /api/pastes and the columns are gone. 47/47 (verified twice).OpenVibers · 29 Sept 2026 c4b171a
The SQLite era is gone (on PostgreSQL since 2026-09-28; no compatibility kept): the one-time migrate-to-postgres script, *_DB_PATH settings (config, .env.example, systemd unit, test helpers), the unused better-sqlite3 dependency and its lockfile entries, and docs, docstrings and STATUS lines about SQLite or its rollback window. Reviewed independently before shipping. npm test 46/46 test files passed.OpenVibers · 29 Sept 2026 e63af62
openvibe-shared v1.29.2 (from its earlier pin): navbar dropdowns are no longer clipped by the links row, changing the theme repaints the page background, bright accents get dark button text (WCAG), the navbar brand is more compact. npm test: 46/46 test files passedOpenVibers · 29 Sept 2026 731e746
openvibe-shared v1.29.1 (from its earlier pin): changing the theme repaints the page background, bright accents get dark button text (WCAG), the navbar brand is more compact. npm test: 46/46 test files passedOpenVibers · 29 Sept 2026 c54bc1e
openvibe-shared v1.28.1 (from its earlier pin): the account panel keeps its sections' height on phones, the codes mark at rest shows its V, no empty space under the footer on phones. npm test: 46/46 test files passedOpenVibers · 28 Sept 2026 a630c24
N-1 fixtures re-recorded from 8f021e6, the release now in production (npm run n-1:record): the first on PostgreSQL, so worker.json lists its migration files for the next release to keep.OpenVibers · 28 Sept 2026 3b3391f
Community on PostgreSQL (ADR-035, roadmap WS-X2, repository pass G3).OpenVibers · 28 Sept 2026 8f021e6
npm test no longer counts a skipped test as passed (roadmap WS-Q task 7; openvibe-shared/test-runner, Shared v1.25.0). test/run.js counted every file that exited 0 as passed, so a file that printed that it skipped its work and checked nothing still read as green. It is now the shared runner (same files, one at a time as before, 60 s timeout per file): a test prints "<label>: skipped (<why>)" for what it could not run, and that file is listed with ○ and its reasons and not counted as passed; --strict makes a skip fail the run. No test here skips anything. openvibe-shared is pinned at v1.25.0 (from v1.22.0; 1.23 and 1.24 add the web runtime, release-watch fixes and the readiness skip, and /api/ready answers as before because its db check really runs; the README follows). npm test (Node 22) 49/49.OpenVibers · 28 Sept 2026 581d805
README and STATUS.json are current (roadmap WS-U task 3): the README gains Purpose (the opening overview), Owns, Does not own, Depends on, Acceptance (what the test files prove), and Security (SECURITY.md, auth, private data, egress, secrets by name) sections. Capabilities lists all twelve capabilities in the manifest (space, thread, vote and Pulse reads were missing), names the v0.71.0 pin (was v0.49.0) and the grants Community uses at Network, Media, VIP and Events. Deploy says production deploys with sudo ovhost deploy community (not git pull and a restart), runs as ubuntu, and gives the rollback; the layout names openvibe-shared v1.22.0. STATUS.json is new, in the shape of Search's, updated 2026-09-28.OpenVibers · 28 Sept 2026 2da3501
Per-actor rate limits at Community's API routers (roadmap WS-R task 4, openvibe-sdk v0.12.0 limits). server/actor-limits.js makes one limiter per app, used by the paste, comment, forum (spaces, posts, groups), Pulse and relay APIs once each resolves its viewer and checks the route's capability. It counts a person as user:usr_… whether they call with their own token or a service or app names them in X-OV-Subject; a first-party service relaying a signed-out visitor by the address it forwards (as the per-address /api/ limit already does for Live's calls); a service or app acting as itself (moderation, AI output such as Live's AI pastes, Pulse) by its principal; a signed-out browser by address. A first-party service reading for itself is not counted on reads, since its pages speak for all its visitors and the per-address limit already bounds it. Past a limit a route answers 429 problem+json rate_limited with Retry-After before any work, logs one [Limits] line and counts community_rate_limited_total{limit,window}.OpenVibers · 28 Sept 2026 52d923a
N-1 fixtures re-recorded from 82e2bb9, the release now in production (npm run n-1:record).OpenVibers · 27 Sept 2026 7d35b5d
Community takes part in account export and deletion (roadmap WS-B task 7, ADR-033; openvibe-contracts 0.49.0 -> 0.71.0). The pulse consumer takes network.account.export_requested and network.account.deleted (subscribed at boot). server/identity/account-data.js applies each once per export or deletion (account_data_events) and answers after Network took the part or confirmation, so a failure is redelivered without erasing twice.OpenVibers · 27 Sept 2026 82e2bb9
N-1 fixtures re-recorded from the release now in production (npm run n-1:record).OpenVibers · 27 Sept 2026 fe23860
Community follows account merges (roadmap WS-B task 5, ADR-029). network.subject.merged joins the pulse consumer's topics (subscribed at boot) and server/identity/subject-merge.js applies it through the consumer's inbox, once per event, in one transaction. Authorship moves to the survivor (pastes, paste comments, comments, threads, posts, attachments, pulse items). Per-item paste likes, comment and thread votes and post reactions move, except where the survivor has one: the survivor's stays, the other is dropped and the paste's like count or the comment's and thread's score is recomputed from the rows. Game progress and the block projection keep the survivor's, and blocking oneself is dropped. test/subject-merge.test.js covers the moves, the clashes, the recomputed counts, the survivor's reaction and progress, blocks, a redelivery, and another source or a bad payload ignored. npm test 47/47.OpenVibers · 27 Sept 2026 794e7e2
N-1 fixtures re-recorded from 69f5feb, the release now in production (npm run n-1:record).OpenVibers · 27 Sept 2026 49565ac
SSRF (roadmap WS-R task 5): Community fetches no URL a user chooses, and a test keeps it so; the live-mode paste proxy no longer lets a visitor's path leave Live's paste API. Every outbound call goes to a base URL from the owner's environment (Network, Live, Media, Events, VIP, Chat, Search, an allowlisted Discord webhook variable, Discord's gateway), so there is no egress guard to test. test/security-ssrf.test.js: (1) a ratchet over server/ counts every outbound call site per file (fetch, http(s).request/get, WebSocket, net/tls, dns, child_process, undici/axios/puppeteer, and the SDK clients that make requests) against a classified inventory that says where each goes and why the URL is not a user's; a new site fails until it is classified (and, if the URL is a user's, sent through openvibe-shared/egress). (2) A loopback canary handed in everywhere a person or service can give Community a URL (a Pulse item's url, links, image syntax and <img> in posts and comments, paste title and content, a screenshot's page_url, a chat room reference, a relay mapping, and 169.254.169.254) is never called. (3) The /api/pastes proxy with dot segments, %2e%2e, encoded slashes and backslashes. Fixed (medium, server/pastes/proxy.js): with PASTES_AUTHORITY=live (the rollback mode), /api/pastes/* is proxied to Live as ${OV_LIVE_INTERNAL_URL}/api/pastes + the visitor's raw path, and fetch resolves dot segments, so GET /api/pastes/../../internal/x (or %2e%2e) reached Live's /internal/x from loopback with the visitor's token, and an encoded slash became one on Live's side. A path that does not stay under /api/pastes, or holds %2f/%5c, is now 404 and never sent.OpenVibers · 26 Sept 2026 69f5feb
IDOR suite (roadmap WS-R task 5: nobody acts on someone else's things by swapping ids). test/security-idor.test.js: alex owns a public, a private and a screenshot paste, paste comments, a thread with a reply, a typed comment, an uploaded image and a space (as its creator: spaces have no per-space moderators, so a space's owner is what "moderator of X" means here; cora owns another). sam tries alex's ids as himself, and so do svc:live and svc:tools forwarding for him (X-OV-Subject, with the write grants they hold), a developer app acting for him, and Live acting as itself: editing, hiding, pinning and deleting pastes, reading their history, censor (re-screenshot), the AI write-back, bulk actions, deleting all forks, deleting alex's paste comments (also named under a paste sam owns, or a private one), liking or voting as alex, editing, deleting and reading the history of posts, deleting, re-categorising, re-statusing, pinning/locking and gating the thread (API and no-JS forms), the right thread slug under another space, claiming alex's upload, editing or deleting his typed comment and hiding its thread, space settings, categories, gating, board groups, relay mappings, cora attaching or detaching a chat room on alex's space, and one service retracting or publishing another's Pulse items. Every refusal is 401/403/404 (attachments.invalid 400 for the upload, as for an id never uploaded) and leaves 21 content tables exactly as they were; positive controls (the owner, a service acting for the owner, staff) show each route works and changes the database, so a broken route cannot pass for a refusal. All held. (The private-bypass crawl in the previous commit makes about 1900 requests, not the 6000 its message says.)OpenVibers · 26 Sept 2026 7e22a51

More commits