Grants: the W service notifies an owner (identity resolve + notifications push) (#131)

OP OpenVibers committed 10 Oct 2026 · c8ff79593d · 1 file, +4 −0

Plan T18 step 4: the `watch` principal is granted `identity.subject.resolve` and `network.notifications.push` (as app `watch`), the same pair Search's saved-search notifier holds.

Why: a watch's notification action is about to tell its owner when the condition fires (OpenVibe.Watch, through the new `openvibe-sdk/notifications`). Today "Notify me" fires and nobody is told, because nothing delivers `watch.watch.triggered`.

Changes

ddiff --git a/server/identity/principals.js b/server/identity/principals.js
iindex 9da57e2c..9ffeaaac 100644
---- a/server/identity/principals.js
++++ b/server/identity/principals.js
@@@ -210,6 +210,10 @@ const DEFAULT_GRANTS = [
      ['bot', 'billing.usage.record', 'openvibe.billing', []],
      // Plan T18: OpenVibe.Watch relays watch.observation.recorded / watch.watch.triggered / watch.check.failed.
      ['watch', 'events.event.publish', 'openvibe.events', []],
++    // Plan T18 step 4: a watch's notification action tells its owner when the condition fires. Watch resolves the owner
++    // (a usr_ subject) to Network's user id, then pushes as app 'watch' (openvibe-sdk/notifications).
++    ['watch', 'identity.subject.resolve', SELF_AUDIENCE, []],
++    ['watch', 'network.notifications.push', SELF_AUDIENCE, ['watch']],
      // Plan T13: OpenVibe.Services merges every authority's resource index (ADR-048 section 3): it reads each one's
      // GET /api/v1/resources under that authority's <id>.resource.read, with a token for that authority's audience.
      ['services', 'network.resource.read', SELF_AUDIENCE, []],