CHANGELOG.md

main 2.5 KB · 37 lines · markdown

1	# Changelog
2
3
4	## Unreleased — a plain Stop
5
6	- The controls rule: Stop is one plain little button a person may add, not a red-ringed disc that is always there.
7
8	What changed in OpenVibe.Design, newest first. Each site also publishes its patch notes at /updates.
9
10	## 0.1.0 — 2026-10-28
11
12	The service skeleton: sign-in and the theme API proxy.
13
14	- Sign-in with OpenVibe.Network (`server/auth/sso.js`, OAuth client `design`): authorization code with PKCE
15	S256, a state check, a server-side code exchange, httpOnly `design_at` and `design_rt` cookies
16	(SameSite=Lax, Secure in production), the `design_oauth` flow cookie, and `sanitizeNext` (this site's own origin
17	only, no control characters or backslashes). `/auth/login`, `/auth/callback`, `/auth/logout`, `/auth/me`.
18	- The theme API proxy (`server/http/api.js`): all calls go to OpenVibe.Network's `/api/themes` with the
19	person's access token from the cookie as a Bearer. `GET /api/themes` is the public catalogue, cached in memory
20	for 5 minutes; `GET /api/themes/:idOrSlug` is one public theme; `GET`/`PUT /api/me/theme` read and save the
21	person's theme (`source: 'studio'`); `GET /api/me/theme/history` and `POST /api/me/theme/history/:id/restore`
22	read and roll back the history; `POST /api/themes/submit` submits a theme to the gallery. Writes need the
23	request's Origin to be this site's own origin, otherwise 403 `design.cross_site`. Network 4xx answers pass
24	through; a Network failure is 502; `/api/me/*` is `private, no-store`.
25	- Pages (`server/http/pages.js`, `server/views/index.js`): `/`, `/studio`, `/t/:slug` and `/developers`, all
26	server-rendered through the OpenVibe Frame and complete without JavaScript, plus a 404. The views are plain
27	placeholders here: the main session designs the pages and writes `public/js/studio.js`.
28	- Plumbing (`server/app.js`): helmet with the network's CSP, content-hashed `/css` and `/js`, `/api/health`,
29	`/api/ready` (degraded when Network does not answer), `/release.json`, `/release-metrics`, `/shared/*`,
30	`/robots.txt`, `/sitemap.xml` (the public themes), `/llms.txt`, a 120/min per-IP limit on `/api` and `/auth`,
31	and a graceful stop.
32	- Deploy: `deploy/systemd/openvibe-design.service` (port 5090, `/etc/openvibe/design.env`) and
33	`deploy/nginx/openvibe.design.conf` (TLS for openvibe.design, www → apex, GET/POST/PUT on `/api`, GET on
34	`/auth`).
35	- Tests: `test/sso.test.js`, `test/proxy.test.js` and `test/pages.test.js`, each against an in-process
36	OpenVibe.Network stand-in with a real RS256 key pair.
37