openvibers/openvibe.network Commits

Network: default grants for bot (events, usage), watch (events) and run (events, bot.job.dispatch). (#70)

OP OpenVibers committed 7 Oct 2026 · 7f0ad3c3af · 1 file, +10 −0

Default grants for three services the host is about to run with their relays on:
- bot: events.event.publish (openvibe.events) and billing.usage.record (openvibe.billing). Bot has run since 2026-10-02 with "events relay off (outbox accumulates); usage relay off (readings wait)": its bot.* events and the run:<job>:<n> job metering never left the service. With these rows Bot can mint a token for both once EVENTS_URL and its Billing env are set.
- watch: events.event.publish (OpenVibe.Watch, plan T18; Events already lists the watch source).
- run: events.event.publish and bot.job.dispatch (openvibe.bot) — OpenVibe.Run (plan T14) publishes run.job.* and hands each job to a paired Node through Bot's internal jobs API.

Tests: principals, grants-admin, internal-projects, retired-grants, loyalty-policy: passed (ov test --strict).

Changes

ddiff --git a/server/identity/principals.js b/server/identity/principals.js
iindex 4bb3268b..a0fb9d51 100644
---- a/server/identity/principals.js
++++ b/server/identity/principals.js
@@@ -172,6 +172,16 @@ const DEFAULT_GRANTS = [
      // session in the panel (session.read), restreams out (output.*) and sets the owner's streaming and recording
      // toggles on the stream, minting its own token with its Network client instead of a hand-set BOT_OPENRE_TOKEN.
      ...['openre.stream.read', 'openre.stream.write', 'openre.key.rotate', 'openre.session.read', 'openre.output.read', 'openre.output.write'].map(c => ['bot', c, 'openvibe.openre', []]),
++    // Bot's outbox relays bot.robot.*, bot.estop.*, bot.command.* and its job metering posts run:<job>:<n> readings
++    // (server/events/outbox.js, server/jobs/metering.js); both relays stayed off without these rows (2026-10-07).
++    ['bot', 'events.event.publish', 'openvibe.events', []],
++    ['bot', 'billing.usage.record', 'openvibe.billing', []],
++    // Plan T18: OpenVibe.Watch relays watch.observation.recorded / watch.watch.triggered / watch.check.failed.
++    ['watch', 'events.event.publish', 'openvibe.events', []],
++    // Plan T14: OpenVibe.Run publishes run.job.* and hands each job to a paired Node through Bot's internal jobs API
++    // (POST /api/v1/jobs, /jobs/:id/cancel, GET /jobs/:id, capability bot.job.dispatch, service-to-service only).
++    ['run', 'events.event.publish', 'openvibe.events', []],
++    ['run', 'bot.job.dispatch', 'openvibe.bot', []],
      // Plan T2 lane B step 3: Host places and runs per project, so it reads a project's tenancy, placement and quotas.
      // Other services get this row only when they ship a caller of GET /internal/projects/:project_id.
      ['host', 'network.project.read', SELF_AUDIENCE, []],