openvibers/openvibe.live Commits

CORS: the account hub on openvibe.my reads Live's go-live feed (#686)

OP OpenVibers committed 6 days ago · 75951737de · 2 files, +19 −0

The account hub moved to its own origin (Network, 2026-11-07). Signed in there, the probe's hub logged a 403 from
/api/live-events: Live's exact allow-list named openvibe.network, not openvibe.my. Add it (exact origin).
Test: test/origin-openvibe-my.test.js.

Changes

ddiff --git a/server/index.js b/server/index.js
iindex 8c7170e9..b896414d 100644
---- a/server/index.js
++++ b/server/index.js
@@@ -306,6 +306,10 @@ function getAllowedOrigins() {
          allowed.add('https://openvibe.network');
      }
  
++    // The account hub on its own origin (Network, since 2026-11-07): its go-live widget follows /api/live-events
++    // and its Today card reads who is live, as it did on openvibe.network/my.
++    allowed.add('https://openvibe.my');
++
      // openvibe.games game client calls cosmetics API cross-origin
      allowed.add('https://openvibe.games');
  
ddiff --git a/test/origin-openvibe-my.test.js b/test/origin-openvibe-my.test.js
nnew file mode 100644
iindex 00000000..71345465
---- /dev/null
++++ b/test/origin-openvibe-my.test.js
@@@ -0,0 +1,15 @@
++'use strict';
++// The account hub moved to its own origin, openvibe.my (Network, 2026-11-07). Its go-live widget follows Live's
++// /api/live-events and its Today card reads who is live, so Live's CORS allow-list names it: without it the probe's
++// signed-in hub logged a 403 from /api/live-events on production. The list is exact (no wildcard for the .my name).
++//   node test/origin-openvibe-my.test.js
++const assert = require('assert');
++const fs = require('fs');
++const path = require('path');
++
++const src = fs.readFileSync(path.join(__dirname, '..', 'server', 'index.js'), 'utf8');
++const fn = src.slice(src.indexOf('function getAllowedOrigins()'), src.indexOf('return allowed;', src.indexOf('function getAllowedOrigins()')));
++assert.ok(fn.length > 100, 'getAllowedOrigins() is where Live lists its origins');
++assert.ok(fn.includes("allowed.add('https://openvibe.my');"), 'openvibe.my is allowed');
++assert.ok(!/openvibe\.my['"]?\)\s*\|\||endsWith\(['"]\.openvibe\.my/.test(src), 'exact origin, no suffix rule for .my');
++console.log('origin-openvibe-my: Live allows the account hub on openvibe.my');