openvibers/openvibe.network Commits

Report signs people in: openvibe.report's redirect URI (#455)

OP OpenVibers committed 13 days ago · 01e522b9e4 · 2 files, +3 −1

* Report signs people in: openvibe.report's redirect URI on its existing client (plan L41)

The report client already exists as Report's principal (it reads Billing with
it); the seed merges https://openvibe.report/auth/callback into it so Report's
new /you page can sign a person in through openvibe-sdk/sso.

* principals test: its report client keeps the test's secret now that the seed may create the client first

Changes

ddiff --git a/server/db/database.js b/server/db/database.js
iindex 062947f4..b3ff6952 100644
---- a/server/db/database.js
++++ b/server/db/database.js
@@@ -128,6 +128,8 @@ async function seedDb(db, { log = console } = {}) {
              { client_id: 'surf', name: 'OpenVibe.Surf', redirect_uris: ['https://openvibe.surf/auth/callback'] },
              // The Domains control panel (plan 2026-10-28 §5.1, DOM-2): a person's connections and proposals.
              { client_id: 'domains', name: 'OpenVibe.Domains', redirect_uris: ['https://openvibe.domains/auth/callback'] },
++            // Every number on OpenVibe, and your own (plan L41): the client exists as Report's principal (its Billing reads).
++            { client_id: 'report', name: 'OpenVibe.Report', redirect_uris: ['https://openvibe.report/auth/callback'] },
              // The open meme database: a signed-in front for votes, captions and reports.
              { client_id: 'meme', name: 'OpenVibe.Meme', redirect_uris: ['https://openvibe.meme/auth/callback'] },
              // Ask a picture, compare models and check a page's UI (plan 2026-10-28 §5.8); Design's Arena calls its UI check.
ddiff --git a/test/principals.test.js b/test/principals.test.js
iindex 4ba7b2eb..07e91b8a 100644
---- a/test/principals.test.js
++++ b/test/principals.test.js
@@@ -30,7 +30,7 @@ await db.prepare("INSERT INTO oauth_clients (client_id, client_secret, name, red
  // Events is created the same way (setup/service-principal.js); it is a usage producer with its own token.
  await db.prepare("INSERT INTO oauth_clients (client_id, client_secret, name, redirect_uris, is_first_party) VALUES ('events', 'events-secret', 'OpenVibe.Events', '[]', 1) ON CONFLICT DO NOTHING").run();
  // Report is a service principal too (it signs people in nowhere): its client comes from setup/service-principal.js.
--await db.prepare("INSERT INTO oauth_clients (client_id, client_secret, name, redirect_uris, is_first_party) VALUES ('report', 'report-secret', 'OpenVibe.Report', '[]', 1) ON CONFLICT DO NOTHING").run();
++await db.prepare("INSERT INTO oauth_clients (client_id, client_secret, name, redirect_uris, is_first_party) VALUES ('report', 'report-secret', 'OpenVibe.Report', '[]', 1) ON CONFLICT (client_id) DO UPDATE SET client_secret = excluded.client_secret").run();
  await db.prepare("UPDATE oauth_clients SET client_secret = 'ai-secret' WHERE client_id = 'ai'").run();
  await db.prepare("UPDATE oauth_clients SET client_secret = 'bot-secret' WHERE client_id = 'bot'").run();
  await db.prepare("UPDATE oauth_clients SET client_secret = 'tips-secret' WHERE client_id = 'tips'").run();