openvibers/openvibe.connect Commits

Pin openvibe-contracts v0.315.0 and read connect.config.manage literally (#50)

OP OpenVibers committed 6 days ago · a078800ddc · 3 files, +7 −8

* Pin openvibe-contracts v0.315.0 and read connect.config.manage literally

Contracts 0.315.0 lists connect.config.manage in the connect manifest. Name the capability as the literal string the guard checks, so openvibe-contracts-check reads it instead of the const it cannot see.

* Merge remote-tracking branch 'origin/main' into cfgm/config-manage-literal

# Conflicts:
#	package-lock.json
#	package.json

Changes

ddiff --git a/package-lock.json b/package-lock.json
iindex 5c9d358..0ed73bb 100644
---- a/package-lock.json
++++ b/package-lock.json
@@@ -15,7 +15,7 @@
          "express-rate-limit": "^7.5.0",
          "helmet": "^8.1.0",
          "iovalkey": "^0.4.0",
--        "openvibe-contracts": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.312.0",
++        "openvibe-contracts": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.315.0",
          "openvibe-sdk": "https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.93.0",
          "openvibe-shared": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v4.124.0",
          "pg": "^8.23.1",
@@@ -1158,9 +1158,9 @@
        }
      },
      "node_modules/openvibe-contracts": {
--      "version": "0.312.0",
--      "resolved": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.312.0",
--      "integrity": "sha512-2GsD53zuIedL3eW2LBlYQ68ODTHzoZJHrAmVnZCpiL7ZWnAXGwPW9dpQagLI9Zdkh3LQuuU5ae1YJI0K+acXbA==",
++      "version": "0.315.0",
++      "resolved": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.315.0",
++      "integrity": "sha512-m1bWT4/sF6Hc7lia6FjAR+880r9SBRhO/v819Lr5ldxlSkFYiKMXTtt7MDbJ4FCgQ7Dkt+2OJaKanlvk2vNPlg==",
        "license": "AGPL-3.0-only",
        "dependencies": {
          "ajv": "^8.17.1",
ddiff --git a/package.json b/package.json
iindex a02facd..0ec3ee2 100644
---- a/package.json
++++ b/package.json
@@@ -25,7 +25,7 @@
      "express-rate-limit": "^7.5.0",
      "helmet": "^8.1.0",
      "iovalkey": "^0.4.0",
--    "openvibe-contracts": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.312.0",
++    "openvibe-contracts": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.315.0",
      "openvibe-sdk": "https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.93.0",
      "openvibe-shared": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v4.124.0",
      "pg": "^8.23.1",
ddiff --git a/server/app.js b/server/app.js
iindex 0f53025..a95bd5b 100644
---- a/server/app.js
++++ b/server/app.js
@@@ -20,7 +20,6 @@ const helmet = require('helmet');
  const cookieParser = require('cookie-parser');
  const rateLimit = require('express-rate-limit');
  const contracts = require('openvibe-contracts');
--const CONFIG_CAPABILITY = 'connect.config.manage';
  const cache = require('openvibe-shared/cache-policy');
  
  const configLib = require('./config');
@@@ -250,8 +249,8 @@ async function createApp(opts = {}) {
          const configCapability = (req, res, next) => {
              const p = req.principal;
              if (!p || p.kind !== 'app') return contracts.http.sendProblem(res, 401, 'token.required', { detail: 'a Network service token with connect.config.manage is required', ctx: req.ov });
--            const decision = contracts.capabilities.check(p.claims, CONFIG_CAPABILITY);
--            const granted = decision.allowed || contracts.capabilities.grants(p.claims.cap, CONFIG_CAPABILITY);
++            const decision = contracts.capabilities.check(p.claims, 'connect.config.manage');
++            const granted = decision.allowed || contracts.capabilities.grants(p.claims.cap, 'connect.config.manage');
              if (!granted) return contracts.http.sendProblem(res, 403, decision.code || 'capability.denied', { detail: decision.reason || 'connect.config.manage not granted', ctx: req.ov });
              return next();
          };