# Changelog


## Unreleased — a plain Stop

- The controls rule: Stop is one plain little button a person may add, not a red-ringed disc that is always there.

What changed in OpenVibe.Design, newest first. Each site also publishes its patch notes at /updates.

## 0.1.0 — 2026-10-28

The service skeleton: sign-in and the theme API proxy.

- **Sign-in with OpenVibe.Network** (`server/auth/sso.js`, OAuth client `design`): authorization code with PKCE
  S256, a state check, a server-side code exchange, httpOnly `design_at` and `design_rt` cookies
  (SameSite=Lax, Secure in production), the `design_oauth` flow cookie, and `sanitizeNext` (this site's own origin
  only, no control characters or backslashes). `/auth/login`, `/auth/callback`, `/auth/logout`, `/auth/me`.
- **The theme API proxy** (`server/http/api.js`): all calls go to OpenVibe.Network's `/api/themes` with the
  person's access token from the cookie as a Bearer. `GET /api/themes` is the public catalogue, cached in memory
  for 5 minutes; `GET /api/themes/:idOrSlug` is one public theme; `GET`/`PUT /api/me/theme` read and save the
  person's theme (`source: 'studio'`); `GET /api/me/theme/history` and `POST /api/me/theme/history/:id/restore`
  read and roll back the history; `POST /api/themes/submit` submits a theme to the gallery. Writes need the
  request's Origin to be this site's own origin, otherwise 403 `design.cross_site`. Network 4xx answers pass
  through; a Network failure is 502; `/api/me/*` is `private, no-store`.
- **Pages** (`server/http/pages.js`, `server/views/index.js`): `/`, `/studio`, `/t/:slug` and `/developers`, all
  server-rendered through the OpenVibe Frame and complete without JavaScript, plus a 404. The views are plain
  placeholders here: the main session designs the pages and writes `public/js/studio.js`.
- **Plumbing** (`server/app.js`): helmet with the network's CSP, content-hashed `/css` and `/js`, `/api/health`,
  `/api/ready` (degraded when Network does not answer), `/release.json`, `/release-metrics`, `/shared/*`,
  `/robots.txt`, `/sitemap.xml` (the public themes), `/llms.txt`, a 120/min per-IP limit on `/api` and `/auth`,
  and a graceful stop.
- **Deploy:** `deploy/systemd/openvibe-design.service` (port 5090, `/etc/openvibe/design.env`) and
  `deploy/nginx/openvibe.design.conf` (TLS for openvibe.design, www → apex, GET/POST/PUT on `/api`, GET on
  `/auth`).
- **Tests:** `test/sso.test.js`, `test/proxy.test.js` and `test/pages.test.js`, each against an in-process
  OpenVibe.Network stand-in with a real RS256 key pair.