Commits

main · README.md

README and STATUS.json are current (roadmap WS-U task 3): the README gains Capabilities (the seven implemented capabilities; Events calls no service with a grant; events.usage.recorded), Security (SECURITY.md, auth, private data, egress, delivery signatures, exposure and ticket-free logs) and Deploy (sudo ovhost deploy events, unit, port, env file, store, vhost, drain, rollback) sections. The status line no longer says Media reports only over Live's webhook or that no browser uses the realtime stream, and the contracts note names the v0.63.0 pin. STATUS.json names openvibe-contracts v0.63.0, gains features and is updated 2026-09-28.OpenVibers · 28 Sept 2026 19919ec
Per-actor rate limits at Events' capability routes (roadmap WS-R task 4): openvibe-sdk v0.12.0 is now a dependency, and server/actor-limits.js makes one limiter per app that counts each verified principal (svc:live, app:app_…) after its guard and before any work. Past a limit a route answers 429 problem+json rate_limited with Retry-After, logs one [limits] line and counts events_rate_limited_total{limit,window}.OpenVibers · 28 Sept 2026 7530c2f
Project usage rollups (roadmap WS-N task 4; Contracts v0.63.0 events.usage.recorded, common.usage-recorded@1): each developer project's use is counted per environment and UTC hour in the transaction that does the work (server/usage.js, table app_usage): events.app.publish in events (events stored in insertBatch; a repeated event_id is not counted), every refused publish request as an error with its problem code, status, trace id and the refused event id; events.app.subscribe in deliveries (webhook attempts to the project's subscriptions, recorded with the delivery row in recordAttempt), an attempt without a 2xx as events.delivery.http_<status>, .timeout or .failed with the event id and its trace. A minute after an hour closes, each rollup is stored once as an events.usage.recorded event (source events, subject the project, visibility internal, priority low) in the transaction that marks it sent, so Events is its own outbox; first-party subscribers (Network's project usage) get it like any event, apps never see it; a count landing in an hour already sent re-sends it as revision 2. EVENTS_USAGE=off counts nothing; EVENTS_USAGE_FLUSH_MS (300000). Pins: openvibe-contracts 0.61.0 -> 0.63.0. test/usage.test.jsOpenVibers · 26 Sept 2026 bb78877
Realtime tickets (roadmap WS-E task 3, WS-F task 1; ADR-005 amendment 2, Contracts 0.61.0 identity.realtime-ticket-claims@1): /realtime/stream?ticket= opens a stream as the signed-in person from any OpenVibe site without a third-party cookie. The ticket is Network's two-minute RS256 JWT (iss <issuer>/realtime, sub usr_, aud openvibe.events only, typ and purpose realtime, lifetime at most 300 s, jti rtk_); each is accepted once (ticket.used), never as Bearer or cookie, never logged; ticket.invalid / ticket.expired otherwise. A user JWT carrying typ or purpose is no session here. test/realtime-tickets.test.js: a ticket for Alice never receives Bob's network.notification.created on any pattern (live or replay), user:<id> is refused as a pattern, expired/wrong purpose/typ/audience/issuer/key/lifetime/reused/session-JWT tickets refused, resume from last_event_id with a fresh ticket, retention gap reported firstOpenVibers · 26 Sept 2026 aa34acb
Limits page source (roadmap WS-N task 7): GET /limits.json lists the developer limits enforced here per project and environment (publish rate, bytes kept, retention, webhook subscriptions, payload and batch size, realtime topics), read from the running config, with the problem each one answers past it. A quota config turns off with 0 is null. Public, CORS *, proxied by the vhost; openvibe.codes/docs/limits renders itOpenVibers · 26 Sept 2026 5889c2c
openvibe-shared v1.5.0 (Track R release manifest), openvibe-contracts v0.32.0OpenVibers · 23 Sept 2026 039e203
Redaction: a producer takes back its own events. Any event may carry payload.redacts ({ event_ids } and/or { subject_type, subject_ids }, up to 1000 each); in the transaction that stores it, every target of the same source (an app: same project and env) becomes a tombstone at its original seq: payload { redacted, redacted_at, redacted_by }, actor the producer itself, envelope otherwise kept. Pull, GET by id, SSE replay (anonymous, signed in, service), queued deliveries and DLQ replays all serve the tombstone; first-party consumers get it and then the deletion event. Naming another source's event is 403 events.redaction_not_allowed (whole batch refused), a malformed directive 422 events.invalid_redaction; no capability beyond events.event.publish. secure_delete on, so old payloads are zeroed on disk. Browsers are replayed public events of the last REALTIME_PUBLIC_REPLAY_SECONDS (300) only, older ones are `event: gap` reason public_window (own subject events and services keep full retention). scripts/redact-backfill.js redacts chat events of messages Chat deleted before it published chat.message.deleted (dry run by default; --apply needs a verified 0600 --backup). Fixes: deleted chat messages (text, anon id) stayed replayable anonymously for 30 daysOpenVibers · 23 Sept 2026 18b873f
Docs: STATUS.json and README match production (2026-09-23)OpenVibers · 23 Sept 2026 b251739
Replay window for webhook deliveries (signature v2): every attempt also carries X-OpenVibe-Timestamp (unix seconds, fresh per retry and replay) and X-OpenVibe-Signature-V2: t=<ts>,v2=<HMAC-SHA256 of "<ts>.<raw body>">; X-OpenVibe-Signature (v1) unchanged. lib/client.js: signV2() and verifyDeliveryV2(raw, headers, secret, { toleranceSec = 300, now }) — constant-time, refuses timestamps outside ±tolerance or disagreeing with X-OpenVibe-TimestampOpenVibers · 23 Sept 2026 e8ac63e
Developer apps cannot disrupt first-party event flowOpenVibers · 23 Sept 2026 cfbd21c
Developer apps (Wave 20, ADR-014): events.app.publish|read|subscribe with app tokens on the existing routes — app.<project_key>.* types only (project_key = p + lowercased project ULID, source app-<lowercased app ULID>), reads scoped to the own project and env plus public first-party events, subscriptions to public https endpoints only (SSRF guard at subscribe and delivery, pinned lookup, no redirects); sandbox tokens accepted on these routes only, events stored with project_id and env and never crossing environments; per-project publish-rate, retained-bytes and subscription quotas; network.app.revoked / network.grant.changed disable an app's subscriptions and old tokens; public nginx locations for the app routes; openvibe-contracts v0.28.0OpenVibers · 23 Sept 2026 06af758
Observability (Track O): GET /metrics (loopback only) with HTTP golden signals by route template, process metrics, release_info and Events gauges (deliveries by status, DLQ depth, latest seq, SSE connections, delivery latency, attempts by outcome); /api/ready built on openvibe-shared/ready (db, network_jwks, delivery_worker required; dlq optional -> degraded); GET /release.json; openvibe-shared v1.3.0OpenVibers · 23 Sept 2026 0c7f9c5
Capability ids with three segments (events.event.publish, events.event.read, events.subscription.manage, events.delivery.admin); openvibe-contracts v0.6.0; contract check in CIOpenVibers · 23 Sept 2026 5082c38
Ops and docs: .env.example, systemd unit, nginx vhost for SSE, CI on Node 22.22.1, README usage, STATUS alpha W3OpenVibers · 23 Sept 2026 a5fda92
Charter: OpenVibe.Events as defined in the OpenVibe realignment plan (placeholder, no code yet)OpenVibers · 21 Sept 2026 9c89644