openvibers/openvibe.network Commits

openvibe.link answers its own release.json (#883)

OP OpenVibers committed 14 h ago · b610d47f62 · 2 files, +7 −1

The Link vhost sent /release.json to openvibe.network, a cross-site redirect the page's release watch (openvibe-shared release-watch.js) cannot follow. So an open Link tab never learned of a new release and kept an old menu: the owner's phone still showed the stacked You view hours after 4.223.0 made it tabs. The vhost now proxies release.json to Network, which already answers it for the Link host.

Changes

ddiff --git a/deploy/nginx/parked-domains.conf b/deploy/nginx/parked-domains.conf
iindex 10fb2b38..572d7348 100644
---- a/deploy/nginx/parked-domains.conf
++++ b/deploy/nginx/parked-domains.conf
@@@ -234,7 +234,9 @@ server {
          proxy_set_header X-Forwarded-Proto $scheme;
          add_header Cache-Control "no-store" always;
      }
--    location ~ ^/(|install|add-computer(/complete)?|machines(/.*)?|pair|index\.md|send\.js|egress-settings\.js|locker\.mjs|llms\.txt|llms-full\.txt|robots\.txt|sitemap\.xml|\.well-known/agent\.json)$ {
++    # release.json (11-12): the page's release watch (openvibe-shared release-watch.js) reads it on this host; sent to
++    # openvibe.network it was a cross-site redirect the watch could not follow, so an open Link tab kept an old menu for good.
++    location ~ ^/(|install|add-computer(/complete)?|machines(/.*)?|pair|index\.md|send\.js|egress-settings\.js|locker\.mjs|llms\.txt|llms-full\.txt|robots\.txt|sitemap\.xml|release\.json|\.well-known/agent\.json)$ {
          limit_except GET HEAD { deny all; }
          proxy_pass http://127.0.0.1:4000;
          proxy_http_version 1.1;
ddiff --git a/test/link-home.test.js b/test/link-home.test.js
iindex 3d3699c6..39329171 100644
---- a/test/link-home.test.js
++++ b/test/link-home.test.js
@@@ -8,6 +8,8 @@ const assert = require('assert');
  const fs = require('fs');
  const http = require('http');
  const path = require('path');
++// The openvibe.link block's page and file allow-list (the one location with the empty page path).
++function linkPagesRegexLine(vhost) { return vhost.split('\n').find((l) => l.startsWith('    location ~ ^/(|install|')) || ''; }
  const express = require('express');
  
  const page = require('../server/link/page');
@@@ -66,6 +68,8 @@ const SHAPED = {
      const vhost = fs.readFileSync(path.join(__dirname, '..', 'deploy', 'nginx', 'parked-domains.conf'), 'utf8');
      assert.ok(/location ~ \^\/\(\|install\|add-computer\(\/complete\)\?\|machines(?:\(\/\.\*\)\?)?\|pair\|index\\\.md\|send\\\.js\|egress-settings\\\.js\|locker\\\.mjs\|/.test(vhost), 'the vhost passes the add flow, page scripts, machine hub and its old sub-paths, and Locker bundle to Network');
      assert.ok(vhost.includes('add-computer(/complete)?'), 'the add-computer return flow reaches Link before the openvibe.network catch-all');
++    // …and release.json, or the page's release watch hits a cross-site redirect and an open tab never updates (11-12).
++    assert.ok(/\|release\\\.json\|/.test(linkPagesRegexLine(vhost)), 'openvibe.link answers its own release.json');
      const sendApi = vhost.slice(vhost.indexOf('location ~ ^/api/v1/me/nodes/(send-keys|send)(/.*)?$ {'));
      assert.ok(sendApi.length < vhost.length && /client_max_body_size 40m;/.test(sendApi.slice(0, sendApi.indexOf('\n    }'))), 'the Link Send API has its own location with a body limit that fits a file');
      // …the machine hub's own API (the machines list, the owner's controls, the live screen, pools), which the page