Commits

main

Subscription secret rotation: POST /api/v1/subscriptions/:id/rotate-secret (the consumer's own subscription; overlap_s default 1 day, max 7) and scripts/rotate-subscription-secret.js for operators (writes the new secret into the consumer's env file, never prints it). During the overlap every delivery's X-OpenVibe-Signature-V2 carries a v2 for the new and the old secret, so the consumer switches without missing one (openvibe-sdk accepts any matching v2). delivery testOpenVibers · 24 Sept 2026 82a49f3
SECURITY.md: how to report a vulnerability ([email protected], 7-day reply, scope, supported versions)OpenVibers · 24 Sept 2026 74b00d6
openvibe-shared v1.5.1, openvibe-contracts v0.33.0OpenVibers · 23 Sept 2026 d71f6fd
openvibe-shared v1.5.0 (Track R release manifest), openvibe-contracts v0.32.0OpenVibers · 23 Sept 2026 039e203
CI: run the shared security workflow (gitleaks secret scan + dependency audit, Track Q)OpenVibers · 23 Sept 2026 efc09a7
redact-backfill --include-missing: also redact events about messages Chat no longer has at all (hard-deleted by hand or by its expiry sweep); production had oneOpenVibers · 23 Sept 2026 3366132
Redaction: a producer takes back its own events. Any event may carry payload.redacts ({ event_ids } and/or { subject_type, subject_ids }, up to 1000 each); in the transaction that stores it, every target of the same source (an app: same project and env) becomes a tombstone at its original seq: payload { redacted, redacted_at, redacted_by }, actor the producer itself, envelope otherwise kept. Pull, GET by id, SSE replay (anonymous, signed in, service), queued deliveries and DLQ replays all serve the tombstone; first-party consumers get it and then the deletion event. Naming another source's event is 403 events.redaction_not_allowed (whole batch refused), a malformed directive 422 events.invalid_redaction; no capability beyond events.event.publish. secure_delete on, so old payloads are zeroed on disk. Browsers are replayed public events of the last REALTIME_PUBLIC_REPLAY_SECONDS (300) only, older ones are `event: gap` reason public_window (own subject events and services keep full retention). scripts/redact-backfill.js redacts chat events of messages Chat deleted before it published chat.message.deleted (dry run by default; --apply needs a verified 0600 --backup). Fixes: deleted chat messages (text, anon id) stayed replayable anonymously for 30 daysOpenVibers · 23 Sept 2026 18b873f
Docs: STATUS.json and README match production (2026-09-23)OpenVibers · 23 Sept 2026 b251739
docs/replay-window-rollout.md: deploy order for signature v2 (SDK tag, Events, then consumers one by one with requireV2), the consumer inventory, and the exact change each consumer needs (Live, Search, News, Deals, Trade, Reviews, Tips, VIP, Examples), checked against openvibe-sdk 0.4.0OpenVibers · 23 Sept 2026 5def126
Replay window for webhook deliveries (signature v2): every attempt also carries X-OpenVibe-Timestamp (unix seconds, fresh per retry and replay) and X-OpenVibe-Signature-V2: t=<ts>,v2=<HMAC-SHA256 of "<ts>.<raw body>">; X-OpenVibe-Signature (v1) unchanged. lib/client.js: signV2() and verifyDeliveryV2(raw, headers, secret, { toleranceSec = 300, now }) — constant-time, refuses timestamps outside ±tolerance or disagreeing with X-OpenVibe-TimestampOpenVibers · 23 Sept 2026 e8ac63e
nginx: client address headers only from $remote_addr (realip). X-Forwarded-For was appended to and CF-Connecting-IP passed through from the client, so a request reaching the origin without Cloudflare (DNS-only host or the bare IP) chose the address the service bans and rate-limits byOpenVibers · 23 Sept 2026 b47b99d
Developer apps cannot disrupt first-party event flowOpenVibers · 23 Sept 2026 cfbd21c
Developer apps (Wave 20, ADR-014): events.app.publish|read|subscribe with app tokens on the existing routes — app.<project_key>.* types only (project_key = p + lowercased project ULID, source app-<lowercased app ULID>), reads scoped to the own project and env plus public first-party events, subscriptions to public https endpoints only (SSRF guard at subscribe and delivery, pinned lookup, no redirects); sandbox tokens accepted on these routes only, events stored with project_id and env and never crossing environments; per-project publish-rate, retained-bytes and subscription quotas; network.app.revoked / network.grant.changed disable an app's subscriptions and old tokens; public nginx locations for the app routes; openvibe-contracts v0.28.0OpenVibers · 23 Sept 2026 06af758
Observability (Track O): GET /metrics (loopback only) with HTTP golden signals by route template, process metrics, release_info and Events gauges (deliveries by status, DLQ depth, latest seq, SSE connections, delivery latency, attempts by outcome); /api/ready built on openvibe-shared/ready (db, network_jwks, delivery_worker required; dlq optional -> degraded); GET /release.json; openvibe-shared v1.3.0OpenVibers · 23 Sept 2026 0c7f9c5
Allowed sources: sources, search and the publication products (wiki, blog, news, reviews, deals, coupons, trade)OpenVibers · 23 Sept 2026 f5df827
nginx: use the openvibe.network wildcard certificate (the host has no per-name certificate)OpenVibers · 23 Sept 2026 fade422
Capability ids with three segments (events.event.publish, events.event.read, events.subscription.manage, events.delivery.admin); openvibe-contracts v0.6.0; contract check in CIOpenVibers · 23 Sept 2026 5082c38
Ops and docs: .env.example, systemd unit, nginx vhost for SSE, CI on Node 22.22.1, README usage, STATUS alpha W3OpenVibers · 23 Sept 2026 a5fda92
Propose the events.publish/subscribe/read/admin capability manifests and the events service manifest for openvibe-contractsOpenVibers · 23 Sept 2026 43103e7
Events service: durable store, publish API, signed delivery with retry/DLQ/replay, SSE realtime gateway, client libraryOpenVibers · 23 Sept 2026 f8c2e24
Charter: OpenVibe.Events as defined in the OpenVibe realignment plan (placeholder, no code yet)OpenVibers · 21 Sept 2026 9c89644