openvibers/openvibe.network Commits

Proxy the Link hub's session bootstrap on openvibe.link (#770)

OP OpenVibers committed 3 days ago · cf14c0780e · 2 files, +17 −0

The page hydrates its host-only ov_token from /api/auth/me (and tries /api/auth/refresh); without those on this
host the bootstrap followed the catch-all to openvibe.network, failed, cleared the cookie and sent the signed-in
person to /login. Pass /api/auth/ through to Network like /auth/.

Changes

ddiff --git a/deploy/nginx/parked-domains.conf b/deploy/nginx/parked-domains.conf
iindex f489471e..751b8117 100644
---- a/deploy/nginx/parked-domains.conf
++++ b/deploy/nginx/parked-domains.conf
@@@ -204,6 +204,21 @@ server {
      }
      # The machine hub on openvibe.link/machines is Network's page, so its API is Network's too, on the host-only
      # session this host signs in with: the machines list, the owner's controls and the live screen, plus machine pools.
++    # The page's own session bootstrap (my/core.js: /api/auth/me and the refresh it tries): the hub keeps its
++    # Network session in the host-only ov_token cookie and hydrates from here before any machine is asked for.
++    location ^~ /api/auth/ {
++        limit_except GET HEAD POST PUT PATCH DELETE { deny all; }
++        proxy_pass http://127.0.0.1:4000;
++        proxy_http_version 1.1;
++        proxy_set_header Host $host;
++        proxy_set_header X-Real-IP $remote_addr;
++        proxy_set_header X-Forwarded-For $remote_addr;
++        proxy_set_header CF-Connecting-IP $remote_addr;
++        proxy_set_header X-Forwarded-Proto $scheme;
++        add_header Cache-Control "no-store" always;
++    }
++    # The machine hub on openvibe.link/machines is Network's page, so its API is Network's too, on the host-only
++    # session this host signs in with: the machines list, the owner's controls and the live screen, plus machine pools.
      location ~ ^/api/v1/(machines|machine-pools)(/|$) {
          proxy_pass http://127.0.0.1:4000;
          proxy_http_version 1.1;
ddiff --git a/test/link-home.test.js b/test/link-home.test.js
iindex 5f64128d..740e8d9c 100644
---- a/test/link-home.test.js
++++ b/test/link-home.test.js
@@@ -71,6 +71,8 @@ const SHAPED = {
      // …the machine hub's own API (the machines list, the owner's controls, the live screen, pools), which the page
      // asks for on this host: without it those calls left for openvibe.network's catch-all and the hub showed nothing.
      assert.ok(/location ~ \^\/api\/v1\/\(machines\|machine-pools\)\(\/\|\$\) \{[\s\S]*?proxy_pass http:\/\/127\.0\.0\.1:4000;/.test(vhost), 'the machine hub API is proxied on openvibe.link');
++    // …and its session bootstrap: /api/auth/me hydrates the host-only cookie before a machine is asked for.
++    assert.ok(/location \^~ \/api\/auth\/ \{[\s\S]*?proxy_pass http:\/\/127\.0\.0\.1:4000;/.test(vhost), 'the page session bootstrap is proxied on openvibe.link');
      // …and /auth/* to Link's own sign-in (Network#664), or openvibe.link never signs anyone in (11-08 audit).
      const linkBlock = vhost.slice(vhost.indexOf('    server_name openvibe.link;'));
      assert.ok(/location \^~ \/auth\/ \{[\s\S]*?proxy_pass http:\/\/127\.0\.0\.1:4000;/.test(linkBlock.slice(0, linkBlock.indexOf('\n}\n'))), 'the openvibe.link vhost proxies /auth/ to Network');