openvibers/openvibe.inventory Commits

Inventory: token audience openvibe.inventory (Network's rule, openvibe.<service>); openvibe-contracts v0.122.0 (#1)

OP OpenVibers committed 9 Oct 2026 · eab19aab64 · 8 files, +16 −14

Changes

ddiff --git a/.env.example b/.env.example
iindex f24fa67..bc1cece 100644
---- a/.env.example
++++ b/.env.example
@@@ -16,13 +16,13 @@ VALKEY_PREFIX=ov:inventory:
  #INVENTORY_LIMITS_MINUTE=120
  #INVENTORY_LIMITS_HOUR=3000
  
--# OpenVibe.Network: SSO (OAuth client `inventory`, PKCE S256) and its JWKS; app tokens for audience inventory.openvibe.network.
++# OpenVibe.Network: SSO (OAuth client `inventory`, PKCE S256) and its JWKS; app tokens for audience openvibe.inventory (Network's rule: openvibe.<service>).
  OV_NETWORK_URL=https://openvibe.network
  OV_NETWORK_INTERNAL_URL=http://127.0.0.1:4000
  OV_OAUTH_CLIENT_ID=inventory
  OV_OAUTH_CLIENT_SECRET=
  # OV_OAUTH_REDIRECT_URI=https://inventory.openvibe.network/auth/callback
--# INVENTORY_AUDIENCE=inventory.openvibe.network
++# INVENTORY_AUDIENCE=openvibe.inventory
  
  # optional: defaults to true in production
  # COOKIE_SECURE=true
ddiff --git a/README.md b/README.md
iindex 190f52f..11c881a 100644
---- a/README.md
++++ b/README.md
@@@ -41,7 +41,8 @@ Billing (ADR-054 §5). A test fails if a route or a column for that appears.
  | `POST /instances/:id/consume`, `/revoke` | `inventory.item.consume` | an issuer uses up or takes back an instance |
  | `POST /definitions`, `PATCH /definitions/:id` | `inventory.definition.manage` | an issuer's items |
  
--A person acts for themself (their token or this site's session; a cookie write must come from this site). A service
++Tokens are for audience `openvibe.inventory` (Network's rule: `openvibe.<service>`). A person acts for themself (their
++token or this site's session; a cookie write must come from this site). A service
  acting for a person sends `X-OV-Subject: usr_…` and holds the route's capability. A public read needs no token; a
  token that is presented must hold `inventory.item.read`.
  
@@@ -114,7 +115,7 @@ Reporting a vulnerability: [SECURITY.md](SECURITY.md).
  Part of the [OpenVibe network](https://openvibe.network). Built in the open by [OpenVibers](https://github.com/OpenVibers).
  
  <!-- versions:start -->
--- openvibe-contracts: v0.121.0
++- openvibe-contracts: v0.122.0
  - openvibe-sdk: v0.37.0
  - openvibe-shared: v2.15.0
  <!-- versions:end -->
ddiff --git a/STATUS.json b/STATUS.json
iindex bdeabcf..f06e120 100644
---- a/STATUS.json
++++ b/STATUS.json
@@@ -6,11 +6,11 @@
    "runtime": "node 22, express 4, PostgreSQL 18 (openvibe-sdk/db, async) + Valkey 9",
    "port": "5030",
    "domain": "inventory.openvibe.network",
--  "contracts": "openvibe-contracts v0.121.0",
++  "contracts": "openvibe-contracts v0.122.0",
    "sdk": "openvibe-sdk v0.37.0",
    "shared": "openvibe-shared v2.15.0",
    "packages": [
--    "openvibe-contracts v0.121.0",
++    "openvibe-contracts v0.122.0",
      "openvibe-sdk v0.37.0",
      "openvibe-shared v2.15.0"
    ],
ddiff --git a/package-lock.json b/package-lock.json
iindex 58a7a48..a03a80f 100644
---- a/package-lock.json
++++ b/package-lock.json
@@@ -16,7 +16,7 @@
          "express-rate-limit": "^7.5.0",
          "helmet": "^8.1.0",
          "iovalkey": "^0.4.0",
--        "openvibe-contracts": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.121.0",
++        "openvibe-contracts": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.122.0",
          "openvibe-sdk": "https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.37.0",
          "openvibe-shared": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v2.15.0",
          "pg": "^8.23.0"
@@@ -872,9 +872,9 @@
        }
      },
      "node_modules/openvibe-contracts": {
--      "version": "0.121.0",
--      "resolved": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.121.0",
--      "integrity": "sha512-z33smiDvUJ8uPsA4OFLI5CF/wHQV4wi0ijtNBKWQ2bhv8ExzwUPs1y48hPN0dB7KtRc1mi3iJrG7A4dufGOblg==",
++      "version": "0.122.0",
++      "resolved": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.122.0",
++      "integrity": "sha512-Xcs7kmzJStWQxBxxMwawC7qH/s47dCxdJG+kKPPaA0MmZWH97pXR0Ghhzwsz2ZfmVsoIQf5RX4ohwhCMB4Bnkw==",
        "license": "AGPL-3.0-only",
        "dependencies": {
          "ajv": "^8.17.1",
ddiff --git a/package.json b/package.json
iindex 5994d50..ffcb91e 100644
---- a/package.json
++++ b/package.json
@@@ -23,7 +23,7 @@
      "express-rate-limit": "^7.5.0",
      "helmet": "^8.1.0",
      "iovalkey": "^0.4.0",
--    "openvibe-contracts": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.121.0",
++    "openvibe-contracts": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.122.0",
      "openvibe-sdk": "https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.37.0",
      "openvibe-shared": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v2.15.0",
      "pg": "^8.23.0"
ddiff --git a/server/config.js b/server/config.js
iindex 6a7462f..0ed85f0 100644
---- a/server/config.js
++++ b/server/config.js
@@@ -43,7 +43,8 @@ function load(env = process.env) {
          networkInternalUrl: trim(env.OV_NETWORK_INTERNAL_URL || 'http://127.0.0.1:4000'),
          networkIssuer: trim(env.OV_NETWORK_ISSUER || networkUrl),
          // The audience this service's app, agent and service tokens carry.
--        audience: env.INVENTORY_AUDIENCE || 'inventory.openvibe.network',
++        // Network's rule for every grant: the audience is openvibe.<service> (not the site's host name).
++        audience: env.INVENTORY_AUDIENCE || 'openvibe.inventory',
          oauth: {
              clientId: env.OV_OAUTH_CLIENT_ID || 'inventory',
              clientSecret: env.OV_OAUTH_CLIENT_SECRET || '',
ddiff --git a/server/http/principal.js b/server/http/principal.js
iindex 4d3ba3e..f570f37 100644
---- a/server/http/principal.js
++++ b/server/http/principal.js
@@@ -7,7 +7,7 @@
   *                                                                           or this site's session cookie
   *   { kind: 'app', requester: 'app:app_…' | 'agent:agt_…' | 'service:x', project: 'prj_…' | null, claims }
   *                                                                           a Network app, agent or service token for
-- *                                                                           audience inventory.openvibe.network; each route names
++ *                                                                           audience openvibe.inventory; each route names
   *                                                                           ONE capability it needs
   *   { kind: 'anonymous' }
   *
ddiff --git a/test/helpers/mocks.js b/test/helpers/mocks.js
iindex 8ec60c8..ae8153a 100644
---- a/test/helpers/mocks.js
++++ b/test/helpers/mocks.js
@@@ -314,7 +314,7 @@ async function startNetwork({ sandboxAudiences = ['openvibe.events', 'openvibe.m
          url: srv.url, publicPem, privatePem, state: st, requests: st.requests, tokenRequests: st.tokenRequests,
          addUser, userToken,
          /** A first-party service's token for this service's audience, holding `cap` (e.g. live with inventory.item.grant). */
--        serviceToken(slug, cap, { audience = 'inventory.openvibe.network' } = {}) {
++        serviceToken(slug, cap, { audience = 'openvibe.inventory' } = {}) {
              const now = Math.floor(Date.now() / 1000);
              return serviceAuth.signServiceToken({ iss: issuer, sub: `svc:${slug}`, actor_type: 'service', aud: [audience], cap, iat: now, exp: now + 300, jti: `tok_${crypto.randomBytes(8).toString('hex')}` }, privatePem);
          },