Network: default grants for services (the five active resource indexes). (#73)

OP OpenVibers committed 7 Oct 2026 · 3391084cb8 · 1 file, +4 −0

Default grants for OpenVibe.Services (plan T13): it merges every authority's resource index (ADR-048 section 3), so its client holds network.resource.read (openvibe.network) and media/events/codes/host.resource.read for each authority's audience — exactly the five authorities whose resource.read capability is active in openvibe-contracts 0.108.0.

Tests: principals, grants-admin, retired-grants: passed (--strict).

Changes

ddiff --git a/server/identity/principals.js b/server/identity/principals.js
iindex 5f1f91b7..59ac205e 100644
---- a/server/identity/principals.js
++++ b/server/identity/principals.js
@@@ -178,6 +178,10 @@ const DEFAULT_GRANTS = [
      ['bot', 'billing.usage.record', 'openvibe.billing', []],
      // Plan T18: OpenVibe.Watch relays watch.observation.recorded / watch.watch.triggered / watch.check.failed.
      ['watch', 'events.event.publish', 'openvibe.events', []],
++    // Plan T13: OpenVibe.Services merges every authority's resource index (ADR-048 section 3): it reads each one's
++    // GET /api/v1/resources under that authority's <id>.resource.read, with a token for that authority's audience.
++    ['services', 'network.resource.read', SELF_AUDIENCE, []],
++    ...['media', 'events', 'codes', 'host'].map(id => ['services', `${id}.resource.read`, `openvibe.${id}`, []]),
      // Plan T14: OpenVibe.Run publishes run.job.* and hands each job to a paired Node through Bot's internal jobs API
      // (POST /api/v1/jobs, /jobs/:id/cancel, GET /jobs/:id, capability bot.job.dispatch, service-to-service only).
      ['run', 'events.event.publish', 'openvibe.events', []],