openvibers/openvibe.connect Commits

openvibe-shared v4.126.0 (was v4.124.0) (#49)

OP OpenVibers committed 6 days ago · af43ba3386 · 5 files, +12 −9

* openvibe-shared v4.126.0 (was v4.124.0)

Opened by scripts/pin-bump.js in OpenVibers/OpenVibe.Shared after the v4.126.0 release.

* Merge origin/main into pin-bump/openvibe-shared-v4.126.0

* openvibe-shared v4.126.0 pin, refreshed on top of main

* the owner's test route answers before the shared dispatcher

openvibe-shared 4.125.0 gave adminRoutes a test route of its own, so the dispatcher answered POST /internal/config/:namespace/test/:key before this service's own route and returned 403 (it wants an acting subject; this route is guarded by the service-token capability). The service's route is mounted in front of the dispatcher again.

2026-11-07, the openvibe-shared v4.126.0 pin round.

Changes

ddiff --git a/README.md b/README.md
iindex ce845f4..4f4450f 100644
---- a/README.md
++++ b/README.md
@@@ -218,5 +218,5 @@ AGPL-3.0-only. The client (`public/ov-connect.js`) is part of this repository un
  <!-- versions:start -->
  - openvibe-contracts: v0.315.0
  - openvibe-sdk: v0.94.0
--- openvibe-shared: v4.124.0
++- openvibe-shared: v4.126.0
  <!-- versions:end -->
ddiff --git a/STATUS.json b/STATUS.json
iindex bc87b15..c0057bc 100644
---- a/STATUS.json
++++ b/STATUS.json
@@@ -9,11 +9,11 @@
    "domain": "connect.openvibe.website",
    "contracts": "openvibe-contracts v0.315.0",
    "sdk": "openvibe-sdk v0.94.0",
--  "shared": "openvibe-shared v4.124.0",
++  "shared": "openvibe-shared v4.126.0",
    "packages": [
      "openvibe-contracts v0.315.0",
      "openvibe-sdk v0.94.0",
--    "openvibe-shared v4.124.0"
++    "openvibe-shared v4.126.0"
    ],
    "summary": "OpenVibe Connect puts one port on a person's computer on the web at its own HTTPS address, behind OpenVibe sign-in. A one-file client (Node 22, no dependencies) opens one outgoing WebSocket through Cloudflare and carries requests to localhost: HTTP with streaming both ways, server-sent events and WebSocket upgrades. Every visitor signs in and must be allowed by the share's policy (only the owner, named people, or anyone signed in); the share host keeps its own host-only signed cookie. Nothing that passes through a share is stored; a webhook addressed to one is sealed and kept for up to 72 hours until its computer takes it.",
    "works": [
ddiff --git a/package-lock.json b/package-lock.json
iindex fc18369..1815231 100644
---- a/package-lock.json
++++ b/package-lock.json
@@@ -17,7 +17,7 @@
          "iovalkey": "^0.4.0",
          "openvibe-contracts": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.315.0",
          "openvibe-sdk": "https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.94.0",
--        "openvibe-shared": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v4.124.0",
++        "openvibe-shared": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v4.126.0",
          "pg": "^8.23.1",
          "ws": "^8.18.0"
        },
@@@ -1202,9 +1202,9 @@
        }
      },
      "node_modules/openvibe-shared": {
--      "version": "4.124.0",
--      "resolved": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v4.124.0",
--      "integrity": "sha512-L0u70eK/W5njDfFyH/njXA8cWP2POrsIhWlKPngyF2qXLGSo+8Cup/UDzbO+Bo7zFhniI67iuSLPVSQmAdEzfw==",
++      "version": "4.126.0",
++      "resolved": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v4.126.0",
++      "integrity": "sha512-LF1eiR8xaT2wRtNSQ0qvVHu0lo8lfb2jPpRmkUkK8BJjNzF07fxZNuEcO16GIYYpXy7eloIMwu/DHcZwhF/Xtw==",
        "license": "MIT",
        "dependencies": {
          "jsonwebtoken": "^9.0.0",
ddiff --git a/package.json b/package.json
iindex efd4496..be56049 100644
---- a/package.json
++++ b/package.json
@@@ -27,7 +27,7 @@
      "iovalkey": "^0.4.0",
      "openvibe-contracts": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.315.0",
      "openvibe-sdk": "https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.94.0",
--    "openvibe-shared": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v4.124.0",
++    "openvibe-shared": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v4.126.0",
      "pg": "^8.23.1",
      "ws": "^8.18.0"
    },
ddiff --git a/server/settings.js b/server/settings.js
iindex d5aab6c..c76c186 100644
---- a/server/settings.js
++++ b/server/settings.js
@@@ -239,7 +239,9 @@ function createSettings({ db, env = process.env, log = console, fetchImpl = glob
              requireFresh: (req) => String(req.get('x-ov-fresh') || '') === '1',
              log: appLog,
          });
--        app.use(routes.handle);
++        // The owner's test route is mounted in front of the store's dispatcher: openvibe-shared 4.125.0 gave
++        // adminRoutes a test route of its own, and the dispatcher answers it first (it wants an acting subject,
++        // this one the service-token capability). 2026-11-07, the openvibe-shared v4.126.0 pin round.
          app.post(`${BASE_PATH}/:namespace/test/:key`, guard, async (req, res) => {
              if (req.params.namespace !== NAMESPACE) return res.status(404).json({ error: 'no such configuration namespace' });
              let key = String(req.params.key || '');
@@@ -253,6 +255,7 @@ function createSettings({ db, env = process.env, log = console, fetchImpl = glob
                  return res.status(200).json({ ok: false, detail: 'failed — the test did not finish. The service log has the reason.' });
              }
          });
++        app.use(routes.handle);
          return routes;
      }