Commits

main

openvibe-shared v1.27.0 (from v1.25.0): an async route handler's rejection now reaches the error handler instead of ending the process. Express 4 leaves such a promise unhandled and Node 22 exits on it; instrument() now applies openvibe-shared/express-async. 1.26.0 adds async gauge collects. npm test: 13/13 test files passed.OpenVibers · 28 Sept 2026 5ae03b0
Coupons moves to PostgreSQL and Valkey (ADR-035, roadmap WS-X2, repository-pass group G1), async from end to end.OpenVibers · 28 Sept 2026 040dc3e
npm test no longer counts a skipped test as passed (roadmap WS-Q task 7; openvibe-shared/test-runner, Shared v1.25.0). test/run.js counted every file that exited 0 as passed, so a file that printed that it skipped its work and checked nothing still read as green. It is now the shared runner through run() (same files, one at a time as before, 60 s timeout per file, VERBOSE=1 still prints every file's output): a test prints "<label>: skipped (<why>)" for what it could not run, and that file is listed with ○ and its reasons and not counted as passed; --strict makes a skip fail the run. No test here skips anything. openvibe-shared is pinned at v1.25.0 (from v1.22.0; 1.23 and 1.24 add the web runtime, release-watch fixes and the readiness skip, and /api/ready answers as before because its db check really runs; README and STATUS.json follow). npm test (Node 22) 13/13.OpenVibers · 28 Sept 2026 168262d
README and STATUS.json are current (roadmap WS-U task 3): Deploy now says production deploys with sudo ovhost deploy coupons (unit, port, env file, rollback) and keeps the first-install steps; Security points to SECURITY.md; Capabilities links the grants Coupons uses elsewhere; Depends on names the pins package.json has (publishing v0.4.0, contracts v0.53.0, shared v1.22.0, sdk v0.12.0). STATUS.json gains contracts, features, the current package list and updated 2026-09-28.OpenVibers · 28 Sept 2026 b91cd79
Per-actor rate limits on Coupons' /api/v1 and its page forms (roadmap WS-R task 4, openvibe-sdk v0.12.0 limits). server/http/actor-limits.js makes one limiter per app and counts requests once req.viewer is resolved. A person counts as user:usr_…, whether they call with their Network token, a service names them in X-OV-Subject, or one of their browser helpers sends the request with its cpx_ install token. Every browser a person connected counts together, never by the address it reports from. A first-party service relaying a signed-out visitor counts by the address it forwards. A service or app acting as itself, such as svc:ai for coupons.extract_coupon, counts by its principal. A signed-out caller counts by address. A first-party service reading for itself is not counted on reads, since the lookup limiter already bounds it at 600 a minute. Past a limit a route answers 429 problem+json rate_limited with Retry-After before the route does any work (on the API after the guard, on forms before the body is read), logs one [Limits] line and counts coupons_rate_limited_total{limit,window}.OpenVibers · 28 Sept 2026 64835d2
The notification bell hears new notifications as they happen (notificationsRealtime; Shared 1.22.0, roadmap WS-E task 3): Network's network.notification.created over OpenVibe.Events' realtime stream, with polling as the fallback. Only a signed-in bell with a Network token opens a stream.OpenVibers · 26 Sept 2026 39dcc1e
Pins: openvibe-shared 1.20.0 -> 1.22.0 (realtime notification badge, off until a site turns it on; the unreachable-host browser check)OpenVibers · 26 Sept 2026 348f585
Open redirect fixed (roadmap WS-R task 5): the sign-in next let "/<TAB>/evil.com" through, which browsers read as "//evil.com" (they drop tab and newline characters and read a backslash as "/"); any control character or backslash in next now goes home. test/open-redirect.test.js feeds it the known bypassesOpenVibers · 26 Sept 2026 39a20ed
Pins: openvibe-shared 1.18.0 -> 1.20.0 (the update matrix and release manifest 1.2.0: client generations, the shell)OpenVibers · 26 Sept 2026 ae8beca
Pins: openvibe-shared 1.17.1 -> 1.18.0 (update telemetry: prompted count, sessions by generation)OpenVibers · 26 Sept 2026 0e2c7c6
Pins: openvibe-shared 1.16.1 -> 1.17.1 (release notifications)OpenVibers · 26 Sept 2026 1931942
Pins: openvibe-shared 1.16.0 -> 1.16.1 (the OV mark stops animating when idle, hidden or off-screen)OpenVibers · 26 Sept 2026 899873c
Pins: openvibe-shared 1.13.0 -> 1.16.0OpenVibers · 26 Sept 2026 f366b24
Moderation audit (ADR-022, WS-D task 1): coupons.moderation.action from the outbox in the same transaction when staff or a staff-capable service disables, expires, re-enables (coupon.disabled|expired|enabled, the note as reason) or approves (coupon.approved) someone else's code, or approves, disables or re-enables a shop (merchant.approved|disabled|enabled, with the codes it published); it names the staff member and never the submitter (owner_subject null) or the code; staff changing their own code reports nothing. Pins: openvibe-contracts 0.49.0 → 0.53.0OpenVibers · 26 Sept 2026 f86f660
Pins: openvibe-contracts 0.44.0 → 0.49.0, openvibe-shared 1.12.0 → 1.13.0, openvibe-sdk 0.9.1 → 0.11.0OpenVibers · 25 Sept 2026 e19cc3a
Pins: openvibe-contracts 0.42.0 → 0.44.0 (Contracts 0.43.0 and 0.44.0 were released after the previous pin commit, leaving 0.42.0 two minors behind the pin-drift limit)OpenVibers · 25 Sept 2026 11f6641
Pins: openvibe-contracts 0.38.0 → 0.42.0, openvibe-sdk 0.5.0 → 0.9.1; CI runs the pin-drift check (shared test and security workflows at 423fe51)OpenVibers · 25 Sept 2026 b00d21e
Staff powers from the contracts staff map (WS-D, ADR-022; Contracts 0.38.0): Coupons staff are staff.editorial.manage (admin, as before) or COUPONS_STAFF_SUBJECTS (the product's own, break-glass), not a role comparison. test/staff-map.test.js fails on raw role checksOpenVibers · 24 Sept 2026 74c4a1f
The OpenVibe Frame from this site's own pinned copy: /shared/* is served by openvibe-shared/serve (1.12.0) and every page references it by content hash (/shared/<file>?v=<hash>), so this site's pin decides what its pages run and its navbar and footer keep working while openvibe.network is down; openvibe-publishing 0.4.0 (openvibe-shared as a peer: one copy, no lockstep releases)OpenVibers · 24 Sept 2026 c9cf59f
The shared update system and one account UI, on the OpenVibe Frame (openvibe-shared 1.11.0, openvibe/frame): the home shows what shipped, /updates is the shared log and the footer links it; the shared navbar handles sign in and out (logoutUrl ends this site's session) and carries this site's account links in its menu, while the page's own account bar is only for no-JS visitorsOpenVibers · 24 Sept 2026 9308083
CI calls the shared test workflow (Track Q): OpenVibe.Shared .github/workflows/test.yml@f5e7e73 (install, node --check over server/ and scripts/, npm test, openvibe-contracts-check) instead of a copy of those stepsOpenVibers · 24 Sept 2026 da3e594
openvibe-publishing v0.2.2 (shares the openvibe-shared v1.5.1 copy instead of installing v1.0.0 alongside)OpenVibers · 24 Sept 2026 ae3a25e
SECURITY.md: how to report a vulnerability ([email protected], 7-day reply, scope, supported versions)OpenVibers · 24 Sept 2026 c47ae98
Public coupon events carry only a short reason code: a staff note or a calling service's free-text reason became the public lifecycle event's reason; anything that is not a code is 'other' (staff notes 'staff'), and report events drop a free-text reasonOpenVibers · 24 Sept 2026 d913e87
openvibe-shared v1.5.1, openvibe-contracts v0.33.0OpenVibers · 23 Sept 2026 93f333b
openvibe-shared v1.5.0 (Track R release manifest), openvibe-contracts v0.32.0, openvibe-sdk v0.5.0OpenVibers · 23 Sept 2026 a6a86b2
CI: run the shared security workflow (gitleaks secret scan + dependency audit, Track Q)OpenVibers · 23 Sept 2026 1c57c47
Docs: STATUS.json and README match production (2026-09-23)OpenVibers · 23 Sept 2026 e48457a
nginx: client address headers only from $remote_addr (realip). X-Forwarded-For was appended to and CF-Connecting-IP passed through from the client, so a request reaching the origin without Cloudflare (DNS-only host or the bare IP) chose the address the service bans and rate-limits byOpenVibers · 23 Sept 2026 9b9549e
openvibe-publishing v0.2.1 (ReDoS fixes in ssr markdown)OpenVibers · 23 Sept 2026 54df411

More commits