openvibers/openvibe.mediahub Commits

Open MediaHub messages in Dock Chats (#340)

OP OpenVibers committed 4 days ago · 2b147ed81e · 7 files, +34 −1

* Give MediaHub navbar a verified Dock token

* Keep Dock token reads outside sign-in rate limit

Changes

ddiff --git a/deploy/nginx/openvibe.download.conf b/deploy/nginx/openvibe.download.conf
iindex 54bfa7b..c9ddd4c 100644
---- a/deploy/nginx/openvibe.download.conf
++++ b/deploy/nginx/openvibe.download.conf
@@@ -85,6 +85,13 @@ server {
          proxy_pass http://127.0.0.1:4990;
      }
  
++    # Give the Dock token the session probe's rate-limit budget.
++    location = /auth/navbar-token {
++        limit_req zone=media-hub_api burst=30 nodelay;
++        limit_req_status 429;
++        proxy_pass http://127.0.0.1:4990;
++    }
++
      location /auth/ {
          limit_req zone=media-hub_auth burst=10 nodelay;
          limit_req_status 429;
@@@ -216,6 +223,13 @@ server {
          proxy_pass http://127.0.0.1:4990;
      }
  
++    # Give the Dock token the session probe's rate-limit budget.
++    location = /auth/navbar-token {
++        limit_req zone=media-hub_api burst=30 nodelay;
++        limit_req_status 429;
++        proxy_pass http://127.0.0.1:4990;
++    }
++
      location /auth/ {
          limit_req zone=media-hub_auth burst=10 nodelay;
          limit_req_status 429;
ddiff --git a/server/app.js b/server/app.js
iindex f2743cb..39fb789 100644
---- a/server/app.js
++++ b/server/app.js
@@@ -164,7 +164,7 @@ async function createApp(opts = {}) {
      // Mounted before the host routing too: both hosts sign in through the same routes, and createSso picks the
      // callback URI from the Host header (the drive's, or the video host's).
      // /auth/me is the navbar's who-is-signed-in read on every page, so it is not counted with sign-ins: 60 page views in 15 minutes made a signed-in visitor look signed out.
--    app.use('/auth/', rateLimit({ windowMs: 15 * 60_000, limit: 60, skip: (req) => req.path === '/me', standardHeaders: true, legacyHeaders: false }));
++    app.use('/auth/', rateLimit({ windowMs: 15 * 60_000, limit: 60, skip: (req) => req.path === '/me' || req.path === '/navbar-token', standardHeaders: true, legacyHeaders: false }));
      app.use('/auth', sso.routes());
  
      // /release.json (and loopback /metrics) answer on both hosts: the shared release check on openvibe.video reads its own
ddiff --git a/server/auth/sso.js b/server/auth/sso.js
iindex 5e04983..ce37f33 100644
---- a/server/auth/sso.js
++++ b/server/auth/sso.js
@@@ -216,6 +216,14 @@ function createSso({ config, keys, fetchImpl = globalThis.fetch, now = () => Dat
              return res.json({ user: { username: v.username, display_name: v.displayName, subject_id: v.subject, role: v.role, avatar_url: v.avatarUrl || null, profile_color: v.profileColor || null } });
          });
  
++        // The shared Dock needs a verified Network access token from this HTTP-only session.
++        r.get('/navbar-token', (req, res) => {
++            res.set('Cache-Control', cache.htmlHeaders({ private: true }));
++            const viewer = req.viewer;
++            if (!viewer || viewer.kind !== 'user' || !viewer.token) return res.status(401).json({ error: 'Not signed in' });
++            return res.json({ token: viewer.token });
++        });
++
          r.get('/logout', (req, res, next) => {
              if (sameOriginRequest(req)) return next();
              res.set('Cache-Control', cache.htmlHeaders({ private: true }));
ddiff --git a/server/pics/layout.js b/server/pics/layout.js
iindex c924f85..fcd4986 100644
---- a/server/pics/layout.js
++++ b/server/pics/layout.js
@@@ -92,6 +92,7 @@ ${render(o.body)}
              links: NAV_LINKS.map((l) => ({ ...l, active: l.href === '/' ? o.path === '/' : String(o.path || '').startsWith(l.href) })),
              history: { type: 'page', title },
              sessionUrl: '/auth/me',
++            tokenUrl: '/auth/navbar-token',
              loginUrl: '/auth/login?next={path}',
              logoutUrl: '/auth/logout?next={path}',
              silentLogin: `${String(o.baseUrl).replace(/\/+$/, '')}/auth/login?silent=1&next={url}`,
ddiff --git a/server/render/layout.js b/server/render/layout.js
iindex bab372e..a3868a8 100644
---- a/server/render/layout.js
++++ b/server/render/layout.js
@@@ -65,6 +65,7 @@ function renderPage(o) {
          history: { type: 'page', title: o.title || SITE_NAME },
          silentLogin: `${o.config.baseUrl}/auth/login?silent=1&next={url}`,
          sessionUrl: '/auth/me',
++        tokenUrl: '/auth/navbar-token',
          loginUrl: '/auth/login?next={path}',           // filled from the current page (boost moves between pages)
          logoutUrl: '/auth/logout?next={path}',   // Sign out in the shared navbar ends this site's session too
          notificationsRealtime: true,             // the bell hears new notifications over OpenVibe.Events (Shared 1.22.0)
ddiff --git a/server/video/layout.js b/server/video/layout.js
iindex 2288538..58776ac 100644
---- a/server/video/layout.js
++++ b/server/video/layout.js
@@@ -104,6 +104,7 @@ ${render(o.body)}
              search: { page: '/search', label: 'OpenVibe.Video' },
              history: { type: 'page', title },
              sessionUrl: '/auth/me',
++            tokenUrl: '/auth/navbar-token',
              loginUrl: '/auth/login?next={path}',
              logoutUrl: '/auth/logout?next={path}',
              silentLogin: `${String(o.baseUrl).replace(/\/+$/, '')}/auth/login?silent=1&next={url}`,
ddiff --git a/test/security-session.test.js b/test/security-session.test.js
iindex 33d9d2a..c076201 100644
---- a/test/security-session.test.js
++++ b/test/security-session.test.js
@@@ -77,6 +77,14 @@ const { signJwt } = require('./helpers/mocks');
          assert.strictEqual(out.headers.get('clear-site-data'), null);
      });
  
++    await check('the navbar receives a verified, uncached Network token only for a signed-in person', async () => {
++        const nav = await s.get('/auth/navbar-token', { as: staff });
++        assert.strictEqual(nav.status, 200);
++        assert.match(JSON.parse(nav.text).token, /^[^.]+\.[^.]+\.[^.]+$/);
++        assert.strictEqual(nav.headers.get('cache-control'), 'private, no-store');
++        assert.strictEqual((await s.get('/auth/navbar-token')).status, 401);
++    });
++
      await check('another site cannot sign a person out; this site can', async () => {
          const cross = await s.get('/auth/logout', { as: staff, headers: { 'sec-fetch-site': 'cross-site' } });
          assert.strictEqual(cross.status, 200, 'a confirm page, not a sign-out');