openvibers/openvibe.deals Commits

Pin openvibe-contracts v0.315.0 and read deals.config.manage literally (#241)

OP OpenVibers committed 6 days ago · f551687974 · 4 files, +10 −9

* Pin openvibe-contracts v0.315.0 and read deals.config.manage literally

Contracts 0.315.0 lists deals.config.manage in the deals manifest. Name the capability as the literal string the guard checks, so openvibe-contracts-check reads it instead of the const it cannot see.

* Merge remote-tracking branch 'origin/main' into cfgm/config-manage-literal

# Conflicts:
#	package-lock.json
#	package.json

* Keep deals.config.manage in the capabilities map

The capability test compares the deals manifest to CAPABILITIES. The config capability is now listed and enforced by its literal id in the guard, so name it in the map too.

* Pin deals.config.manage in the capability tests

The installed manifest now lists deals.config.manage beside the product capabilities. Compare it there; it is not a product proposal.

Changes

ddiff --git a/package-lock.json b/package-lock.json
iindex e58e28b..2c6eab7 100644
---- a/package-lock.json
++++ b/package-lock.json
@@@ -15,7 +15,7 @@
          "express-rate-limit": "^7.5.0",
          "helmet": "^8.1.0",
          "iovalkey": "^0.4.0",
--        "openvibe-contracts": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.312.0",
++        "openvibe-contracts": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.315.0",
          "openvibe-publishing": "https://codeload.github.com/OpenVibers/OpenVibe.Publishing/tar.gz/refs/tags/v1.4.1",
          "openvibe-sdk": "https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.93.0",
          "openvibe-shared": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v4.124.0",
@@@ -1148,9 +1148,9 @@
        }
      },
      "node_modules/openvibe-contracts": {
--      "version": "0.312.0",
--      "resolved": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.312.0",
--      "integrity": "sha512-2GsD53zuIedL3eW2LBlYQ68ODTHzoZJHrAmVnZCpiL7ZWnAXGwPW9dpQagLI9Zdkh3LQuuU5ae1YJI0K+acXbA==",
++      "version": "0.315.0",
++      "resolved": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.315.0",
++      "integrity": "sha512-m1bWT4/sF6Hc7lia6FjAR+880r9SBRhO/v819Lr5ldxlSkFYiKMXTtt7MDbJ4FCgQ7Dkt+2OJaKanlvk2vNPlg==",
        "license": "AGPL-3.0-only",
        "dependencies": {
          "ajv": "^8.17.1",
ddiff --git a/package.json b/package.json
iindex 847fa10..02cb43d 100644
---- a/package.json
++++ b/package.json
@@@ -26,7 +26,7 @@
      "express-rate-limit": "^7.5.0",
      "helmet": "^8.1.0",
      "iovalkey": "^0.4.0",
--    "openvibe-contracts": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.312.0",
++    "openvibe-contracts": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.315.0",
      "openvibe-publishing": "https://codeload.github.com/OpenVibers/OpenVibe.Publishing/tar.gz/refs/tags/v1.4.1",
      "openvibe-sdk": "https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.93.0",
      "openvibe-shared": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v4.124.0",
ddiff --git a/server/app.js b/server/app.js
iindex df2f7cb..8d3d871 100644
---- a/server/app.js
++++ b/server/app.js
@@@ -14,7 +14,6 @@ const helmet = require('helmet');
  const cookieParser = require('cookie-parser');
  const rateLimit = require('express-rate-limit');
  const contracts = require('openvibe-contracts');
--const CONFIG_CAPABILITY = 'deals.config.manage';
  
  const configLib = require('./config');
  const { openStore } = require('./db');
@@@ -248,8 +247,8 @@ async function createApp(opts = {}) {
              });
              if (!r.ok) return res.status(r.code === 'token.unavailable' ? 503 : 401).json({ code: r.code, error: r.reason || 'the token does not verify' });
              const contracts = require('openvibe-contracts');
--            const decision = contracts.capabilities.check(r.claims, CONFIG_CAPABILITY);
--            const granted = decision.allowed || contracts.capabilities.grants(r.claims.cap, CONFIG_CAPABILITY);
++            const decision = contracts.capabilities.check(r.claims, 'deals.config.manage');
++            const granted = decision.allowed || contracts.capabilities.grants(r.claims.cap, 'deals.config.manage');
              if (!granted) return res.status(403).json({ code: 'capability.denied', error: 'deals.config.manage is not granted' });
              req.principal = { sub: r.claims.sub, cap: r.claims.cap, jti: r.claims.jti };
              return next();
ddiff --git a/test/capabilities.test.js b/test/capabilities.test.js
iindex 9c83866..c89e3fa 100644
---- a/test/capabilities.test.js
++++ b/test/capabilities.test.js
@@@ -17,7 +17,9 @@ const GRANTED = { cap: ['deals.offer.submit'], sub: 'svc:community' };
      await check('every guarded capability is defined by the installed contracts and the deals manifest', async () => {
          const manifest = services.get('deals');
          assert.ok(manifest, 'openvibe-contracts defines the deals service manifest');
--        assert.deepStrictEqual([...manifest.capabilities].sort(), Object.values(CAPABILITIES).sort());
++        // deals.config.manage is the owner-settings capability, not one of the product proposals in CAPABILITIES;
++        // the service manifest lists it beside them.
++        assert.deepStrictEqual([...manifest.capabilities].sort(), [...Object.values(CAPABILITIES), 'deals.config.manage'].sort());
          for (const id of Object.values(CAPABILITIES)) {
              const cap = capabilities.get(id);
              assert.ok(cap, `${id} is defined by openvibe-contracts`);