openvibers/openvibe.network Commits

Live may store a streamer's own provider key in OpenVibe.AI (ai.credential.manage on openvibe.ai; roadmap WS-O task 2, AI fca04c7; openvibe-contracts 0.72.0 -> 0.73.0), so Live stops keeping third-party keys in its database. test/principals.test.js follows Live's AI caps. npm test passes.

OP OpenVibers committed 28 Sept 2026 · d37ee87ffa · 4 files, +8 −6





Changes
ddiff --git a/package-lock.json b/package-lock.json
iindex c8e0e6f6..b821abd3 100644
---- a/package-lock.json
++++ b/package-lock.json
@@@ -20,7 +20,7 @@
          "helmet": "^8.1.0",
          "jsonwebtoken": "^9.0.0",
          "multer": "^1.4.5-lts.1",
--        "openvibe-contracts": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.72.0",
++        "openvibe-contracts": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.73.0",
          "openvibe-sdk": "https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.11.0",
          "openvibe-shared": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v1.22.0",
          "uuid": "^11.1.0",
@@@ -1465,9 +1465,9 @@
        }
      },
      "node_modules/openvibe-contracts": {
--      "version": "0.72.0",
--      "resolved": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.72.0",
--      "integrity": "sha512-g8J8FKbFV259vWll5cz9l9t/RbGu0GXKRBE+/mU4/xvtnEgywlIpJaB2VoIY8nMz989CRDWCGLAt5OedfKnVwQ==",
++      "version": "0.73.0",
++      "resolved": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.73.0",
++      "integrity": "sha512-SPgU/Ys9TLa8K+++V38C3uK50hNXXUeSPrIyWBT9HdY7eOsE/dnNRZqQnuUzihHOK22aQI15bRBE7u944tW0WA==",
        "license": "AGPL-3.0-only",
        "dependencies": {
          "ajv": "^8.17.1",
ddiff --git a/package.json b/package.json
iindex c051a996..a98e2333 100644
---- a/package.json
++++ b/package.json
@@@ -23,7 +23,7 @@
      "helmet": "^8.1.0",
      "jsonwebtoken": "^9.0.0",
      "multer": "^1.4.5-lts.1",
--    "openvibe-contracts": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.72.0",
++    "openvibe-contracts": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.73.0",
      "openvibe-sdk": "https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.11.0",
      "openvibe-shared": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v1.22.0",
      "uuid": "^11.1.0",
ddiff --git a/server/identity/principals.js b/server/identity/principals.js
iindex 7282c15d..db3f07fd 100644
---- a/server/identity/principals.js
++++ b/server/identity/principals.js
@@@ -154,6 +154,8 @@ const DEFAULT_GRANTS = [
      // (local-first VOD/clip analysis, roadmap WS-O task 5) (OpenVibe.AI fails closed on a token with no ns).
      ['live', 'ai.run.create', 'openvibe.ai', ['live.*', 'network.site_copy', 'media.analyze']],
      ['live', 'ai.run.read', 'openvibe.ai', ['live.*', 'network.site_copy', 'media.analyze']],
++    // A streamer's own provider key for their AI viewers lives in OpenVibe.AI (WS-O task 2): Live stores it there.
++    ['live', 'ai.credential.manage', 'openvibe.ai', []],
      // Wave 3: producers publish to OpenVibe.Events (their own source only, enforced by Events).
      ...['live', 'media', 'network', 'community', 'billing', 'chat', 'tools', 'games', 'search', 'sources', 'tips'].map(c => [c, 'events.event.publish', 'openvibe.events', []]),
      // Wave 14: Search subscribes to <owner>.index_document.* deliveries.
ddiff --git a/test/principals.test.js b/test/principals.test.js
iindex cab32249..6cc0eb78 100644
---- a/test/principals.test.js
++++ b/test/principals.test.js
@@@ -61,7 +61,7 @@ const server = http.createServer(app);
      t = await token({ client_id: 'live', client_secret: 'live-secret', audience: 'openvibe.ai' });
      const aiClaims = serviceAuth.verifyServiceToken(t.body.access_token, { publicKey: keys.publicKey, issuer: ISSUER, audience: 'openvibe.ai' });
      assert.ok(aiClaims.ok, aiClaims.reason);
--    assert.deepStrictEqual([aiClaims.claims.cap, aiClaims.claims.ns], [['ai.run.create', 'ai.run.read'], ['live.*', 'network.site_copy', 'media.analyze']]);
++    assert.deepStrictEqual([aiClaims.claims.cap, aiClaims.claims.ns], [['ai.credential.manage', 'ai.run.create', 'ai.run.read'], ['live.*', 'network.site_copy', 'media.analyze']]);
  
      t = await token({ client_id: 'live', client_secret: 'wrong', audience: 'openvibe.network' });
      assert.strictEqual(t.status, 401); assert.strictEqual(t.body.error, 'invalid_client');