openvibers/openvibe.network Commits

Design's frames generate again (its AI token may run ai.chat) (#533)

OP OpenVibers committed 11 days ago · c18bdbe8c8 · 2 files, +8 −1

Since Design #57 (10-31, L37) a frame with a model preference runs AI's ai.chat workflow (the chat passthrough
passes 'prefer' to the router); Design's grant named only ai.generate, so every such frame was refused with
'this token may not run ai.chat' and a new design came back with all its frames failed (found 11-02 by a
production proof of publishing to Space).

Changes

ddiff --git a/server/identity/principals.js b/server/identity/principals.js
iindex 3279c44d..dfd69024 100644
---- a/server/identity/principals.js
++++ b/server/identity/principals.js
@@@ -679,7 +679,10 @@ const DEFAULT_GRANTS = [
      ['design', 'vision.ui.check', 'openvibe.vision', []],
      // Design publishes its icon and theme pages to OpenVibe.Search as design.index_document.* (contracts 0.275.0).
      ['design', 'events.event.publish', 'openvibe.events', []],
--    ['design', 'ai.run.create', 'openvibe.ai', ['ai.generate']],
++    // ai.generate for a pinned frame; ai.chat for one with a preference (Design #57, 10-31, L37: the chat passthrough is
++    // what passes `prefer` to the router). Without ai.chat every unpinned frame was refused ("this token may not run
++    // ai.chat") from 10-31 to 11-02.
++    ['design', 'ai.run.create', 'openvibe.ai', ['ai.generate', 'ai.chat']],
      // OpenVibe.Bench (contracts 0.238.0): the shared benchmark engine calls AI's generate route (namespace ai.generate)
      // to run its pinned rounds, and subscribes to the account events at boot; its export/deletion pair is with the
      // other services' above. It publishes bench.* events and answers no other service today, so no Search grant.
ddiff --git a/test/principals.test.js b/test/principals.test.js
iindex 2f30ae00..69c56c6d 100644
---- a/test/principals.test.js
++++ b/test/principals.test.js
@@@ -188,6 +188,10 @@ const server = http.createServer(app);
      t = await token({ client_id: 'design', client_secret: 'design-secret', audience: 'openvibe.bench' });
      assert.strictEqual(t.status, 200, JSON.stringify(t.body));
      assert.deepStrictEqual(t.body.scope.split(' '), ['bench.board.read', 'bench.entry.create', 'bench.judgement.cast', 'bench.round.create', 'bench.round.read', 'bench.task.create'], "Design creates and reads Bench tasks and rounds, reads boards and casts judgements");
++    // Design's frames: ai.generate when pinned, ai.chat with a preference (11-02: without ai.chat every unpinned frame failed).
++    t = await token({ client_id: 'design', client_secret: 'design-secret', audience: 'openvibe.ai' });
++    assert.strictEqual(t.status, 200, JSON.stringify(t.body));
++    assert.deepStrictEqual([...JSON.parse(Buffer.from(t.body.access_token.split('.')[1], 'base64url').toString()).ns].sort(), ['ai.chat', 'ai.generate'], 'pinned frames run ai.generate, preferred ones ai.chat');
      // Open item D8: Design publishes a person's design on Space, acting for them.
      t = await token({ client_id: 'design', client_secret: 'design-secret', audience: 'openvibe.space' });
      assert.strictEqual(t.status, 200, JSON.stringify(t.body));