openvibers/openvibe.network Commits

Network: services reads Community's resource index (community.resource.read) (#137)

OP OpenVibers committed 10 Oct 2026 · 9a3cc71464 · 5 files, +10 −9

* openvibe-contracts v0.134.0 (was v0.131.0)

Opened by scripts/pin-bump.js in OpenVibers/OpenVibe.Shared after the v0.134.0 release.

* Network: services reads Community's resource index (community.resource.read)

Plan T13: OpenVibe.Services reads Community's new resource index (a person's pastes and spaces, community.resource.read, Contracts 0.134.0, Community#59). The services principal is granted community.resource.read on openvibe.community beside the other authorities; test/services-resource-grants.test.js requires every active <id>.resource.read to be granted.

Changes

ddiff --git a/README.md b/README.md
iindex 48d4be0f..093e0ac5 100644
---- a/README.md
++++ b/README.md
@@@ -733,7 +733,7 @@ Reporting a vulnerability: [SECURITY.md](SECURITY.md). The rules the code keeps:
  Same as the parent [OpenVibe](../LICENSE) project.
  
  <!-- versions:start -->
--- openvibe-contracts: v0.131.0
++- openvibe-contracts: v0.134.0
  - openvibe-sdk: v0.42.0
  - openvibe-shared: v3.0.1
  <!-- versions:end -->
ddiff --git a/STATUS.json b/STATUS.json
iindex 47492b8b..ed84fc90 100644
---- a/STATUS.json
++++ b/STATUS.json
@@@ -6,7 +6,7 @@
    "runtime": "node 22, express, PostgreSQL 18 (openvibe-sdk/db, async) + Valkey 9",
    "port": 4000,
    "domain": "openvibe.network (with auth., api., admin., my. and themes.openvibe.network in its manifest)",
--  "contracts": "openvibe-contracts v0.131.0",
++  "contracts": "openvibe-contracts v0.134.0",
    "sdk": "openvibe-sdk v0.42.0",
    "shared": "openvibe-shared v3.0.1",
    "capabilities": [
ddiff --git a/package-lock.json b/package-lock.json
iindex ca16d8c0..4f6e0731 100644
---- a/package-lock.json
++++ b/package-lock.json
@@@ -20,7 +20,7 @@
          "iovalkey": "^0.4.0",
          "jsonwebtoken": "^9.0.0",
          "multer": "^1.4.5-lts.1",
--        "openvibe-contracts": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.131.0",
++        "openvibe-contracts": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.134.0",
          "openvibe-sdk": "https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.42.0",
          "openvibe-shared": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v3.0.1",
          "pg": "^8.23.0",
@@@ -1320,9 +1320,9 @@
        }
      },
      "node_modules/openvibe-contracts": {
--      "version": "0.131.0",
--      "resolved": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.131.0",
--      "integrity": "sha512-ZojAzdJCkPnUPvZcS583p7roPmfaG4u8RL1r9yFrn+77JO9yg7Nmz2gvjQoTtX2AzWR7tI1bCtFd9MhprUioCg==",
++      "version": "0.134.0",
++      "resolved": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.134.0",
++      "integrity": "sha512-sWjPIaJtv/V1evsLbNcXecsiHVHd7w+A7/VD7o41j4Veotd+zfQRnNHFHS2gFlOVGR3WBycEzOZzo7+r1jk3sg==",
        "license": "AGPL-3.0-only",
        "dependencies": {
          "ajv": "^8.17.1",
ddiff --git a/package.json b/package.json
iindex efe7664b..c5ac56fa 100644
---- a/package.json
++++ b/package.json
@@@ -24,7 +24,7 @@
      "iovalkey": "^0.4.0",
      "jsonwebtoken": "^9.0.0",
      "multer": "^1.4.5-lts.1",
--    "openvibe-contracts": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.131.0",
++    "openvibe-contracts": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.134.0",
      "openvibe-sdk": "https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.42.0",
      "openvibe-shared": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v3.0.1",
      "pg": "^8.23.0",
ddiff --git a/server/identity/principals.js b/server/identity/principals.js
iindex 83fd0961..3ee41f45 100644
---- a/server/identity/principals.js
++++ b/server/identity/principals.js
@@@ -220,8 +220,9 @@ const DEFAULT_GRANTS = [
      // Plan T13: OpenVibe.Services merges every authority's resource index (ADR-048 section 3): it reads each one's
      // GET /api/v1/resources under that authority's <id>.resource.read, with a token for that authority's audience.
      ['services', 'network.resource.read', SELF_AUDIENCE, []],
--    // Phase 2 (contracts 0.129.0-0.131.0): watches, Actor tasks, robots, rooms and OpenRestream's streams.
--    ...['media', 'events', 'host', 'watch', 'actor', 'bot', 'chat', 'openre'].map(id => ['services', `${id}.resource.read`, `openvibe.${id}`, []]),
++    // Phase 2 (contracts 0.129.0-0.134.0): watches, Actor tasks, robots, rooms, OpenRestream's streams and Community's
++    // pastes and spaces.
++    ...['media', 'events', 'host', 'watch', 'actor', 'bot', 'chat', 'openre', 'community'].map(id => ['services', `${id}.resource.read`, `openvibe.${id}`, []]),
      // Plan T14: OpenVibe.Run publishes run.job.* and hands each job to a paired Node through Bot's internal jobs API
      // (POST /api/v1/jobs, /jobs/:id/cancel, GET /jobs/:id, capability bot.job.dispatch, service-to-service only).
      ['run', 'events.event.publish', 'openvibe.events', []],