openvibers/openvibe.network Commits

Network: sandbox apps may define quests (openvibe.quest audience, quest.app_quest.manage); contracts 0.193.1 (#229)

OP OpenVibers committed 29 days ago · c10c469184 · 6 files, +13 −11

Changes

ddiff --git a/README.md b/README.md
iindex af1188a8..7bf0a1ba 100644
---- a/README.md
++++ b/README.md
@@@ -754,7 +754,7 @@ Reporting a vulnerability: [SECURITY.md](SECURITY.md). The rules the code keeps:
  Same as the parent [OpenVibe](../LICENSE) project.
  
  <!-- versions:start -->
--- openvibe-contracts: v0.191.1
++- openvibe-contracts: v0.193.1
  - openvibe-sdk: v0.46.0
  - openvibe-shared: v4.2.1
  <!-- versions:end -->
ddiff --git a/STATUS.json b/STATUS.json
iindex 7d520202..6e2ac1fb 100644
---- a/STATUS.json
++++ b/STATUS.json
@@@ -6,7 +6,7 @@
    "runtime": "node 22, express, PostgreSQL 18 (openvibe-sdk/db, async) + Valkey 9",
    "port": 4000,
    "domain": "openvibe.network (with auth., api., admin., my. and themes.openvibe.network in its manifest)",
--  "contracts": "openvibe-contracts v0.191.1",
++  "contracts": "openvibe-contracts v0.193.1",
    "sdk": "openvibe-sdk v0.46.0",
    "shared": "openvibe-shared v4.2.1",
    "capabilities": [
ddiff --git a/package-lock.json b/package-lock.json
iindex a3aaf85d..295ddbc6 100644
---- a/package-lock.json
++++ b/package-lock.json
@@@ -20,7 +20,7 @@
          "iovalkey": "^0.4.0",
          "jsonwebtoken": "^9.0.0",
          "multer": "^1.4.5-lts.1",
--        "openvibe-contracts": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.191.1",
++        "openvibe-contracts": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.193.1",
          "openvibe-sdk": "https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.46.0",
          "openvibe-shared": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v4.2.1",
          "pg": "^8.23.0",
@@@ -1320,9 +1320,9 @@
        }
      },
      "node_modules/openvibe-contracts": {
--      "version": "0.191.1",
--      "resolved": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.191.1",
--      "integrity": "sha512-R3eNd4WWoHVGWxxC+4Gvsd8lenEzkYr1+PMLyKYIJIGFBZ9KwOEUpmP3XQ+undFKXKZU2bhYmL4FT3ZqoA19FQ==",
++      "version": "0.193.1",
++      "resolved": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.193.1",
++      "integrity": "sha512-qDyCqV4T0PQCyPu51GXj/EQXC+znsEtzZIf8478MOFZTksffarh4hfBnD8ATXyeLSWUIeIEDFl29qPaYClUwrw==",
        "license": "AGPL-3.0-only",
        "dependencies": {
          "ajv": "^8.17.1",
ddiff --git a/package.json b/package.json
iindex 136b8784..7c451caa 100644
---- a/package.json
++++ b/package.json
@@@ -24,7 +24,7 @@
      "iovalkey": "^0.4.0",
      "jsonwebtoken": "^9.0.0",
      "multer": "^1.4.5-lts.1",
--    "openvibe-contracts": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.191.1",
++    "openvibe-contracts": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.193.1",
      "openvibe-sdk": "https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.46.0",
      "openvibe-shared": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v4.2.1",
      "pg": "^8.23.0",
ddiff --git a/server/developer/policy.js b/server/developer/policy.js
iindex f77e8750..952b20b4 100644
---- a/server/developer/policy.js
++++ b/server/developer/policy.js
@@@ -52,7 +52,7 @@ function grantableCatalog() {
   * sandbox runs on free and local capacity only (ai.app.run, plan T6). openvibe.network is deliberately
   * not one of them.
   */
--const DEFAULT_SANDBOX_AUDIENCES = Object.freeze(['openvibe.media', 'openvibe.events', 'openvibe.tools', 'openvibe.services', 'openvibe.ai']);
++const DEFAULT_SANDBOX_AUDIENCES = Object.freeze(['openvibe.media', 'openvibe.events', 'openvibe.tools', 'openvibe.services', 'openvibe.ai', 'openvibe.quest']);
  
  /**
   * Capabilities every project's SANDBOX apps may hold without a staff decision when
@@@ -68,6 +68,8 @@ const DEFAULT_SANDBOX_ALLOWANCE = Object.freeze([
      'tools.job.create', 'tools.job.read', 'tools.job.cancel', 'tools.tool.read', 'tools.tool.run',
      'services.release.manage',
      'ai.app.run',
++    // App quests (contracts 0.193.0): a sandbox app may define its quests; Quest counts production events only.
++    'quest.app_quest.manage',
  ]);
  
  /** Public + grantable only (the rule for every allowance that is not set by staff by hand). */
ddiff --git a/test/developer-defaults.test.js b/test/developer-defaults.test.js
iindex 842c4ac9..48c1530c 100644
---- a/test/developer-defaults.test.js
++++ b/test/developer-defaults.test.js
@@@ -67,11 +67,11 @@ async function withoutCatalog(hidden, fn) {
  (async () => {
      // ── Settings: defaults, env overrides, and the public-only rule ──
      let s = policy.settings({});
--    assert.deepStrictEqual([...s.sandboxAudiences].sort(), ['openvibe.ai', 'openvibe.events', 'openvibe.media', 'openvibe.services', 'openvibe.tools']);
++    assert.deepStrictEqual([...s.sandboxAudiences].sort(), ['openvibe.ai', 'openvibe.events', 'openvibe.media', 'openvibe.quest', 'openvibe.services', 'openvibe.tools']);
      assert.ok(!s.sandboxAudiences.has('openvibe.network'), 'Network itself never defaults to accepting sandbox tokens');
      assert.deepStrictEqual(s.sandboxAllowance, ['ai.app.run', 'events.app.publish', 'events.app.read', 'events.app.subscribe',
--        'media.object.delete', 'media.object.list', 'media.object.read', 'media.object.upload', 'services.release.manage', 'tools.job.cancel', 'tools.job.create', 'tools.job.read', 'tools.tool.read', 'tools.tool.run'],
--        'the default sandbox allowance (openvibe-contracts 0.59.0 defines media.object.list and .delete, 0.109.0 ai.app.run, 0.113.0 services.release.manage)');
++        'media.object.delete', 'media.object.list', 'media.object.read', 'media.object.upload', 'quest.app_quest.manage', 'services.release.manage', 'tools.job.cancel', 'tools.job.create', 'tools.job.read', 'tools.tool.read', 'tools.tool.run'],
++        'the default sandbox allowance (openvibe-contracts 0.59.0 defines media.object.list and .delete, 0.109.0 ai.app.run, 0.113.0 services.release.manage, 0.193.0 quest.app_quest.manage)');
      assert.deepStrictEqual(policy.DEFAULT_SANDBOX_ALLOWANCE.filter(id => id.startsWith('events.')), ['events.app.publish', 'events.app.read', 'events.app.subscribe']);
      s = policy.settings({ developer: { sandboxAudiences: '', sandboxAllowance: '' } });
      assert.strictEqual(s.sandboxAudiences.size, 0, 'set-but-empty means none');