Grant Host Media object upload, read, list and delete in its own namespace (for Host's Media object store) (#65)

OP OpenVibers committed 6 Oct 2026 · d5c9ceab2c · 1 file, +6 −0

Host#24 adds a Media-backed object store for tenant deploy files (HOST_OBJECT_STORE=media, off by default). It reaches Media with Host's own service token, so Host needs media.object.upload, read, list and delete on openvibe.media, in its own namespace (host, host.* like Tools' tools, tools.*). The grants do nothing until the flag is set on Host.

ov test test/principals.test.js test/grants-admin.test.js: both pass.

Built in the main session (Opus).

Changes

ddiff --git a/server/identity/principals.js b/server/identity/principals.js
iindex 911309c8..4bb3268b 100644
---- a/server/identity/principals.js
++++ b/server/identity/principals.js
@@@ -49,6 +49,12 @@ const DEFAULT_GRANTS = [
      ['tools', 'media.object.upload', 'openvibe.media', ['tools', 'tools.*']],
      ['tools', 'media.object.read', 'openvibe.media', ['tools', 'tools.*']],
      ['games', 'media.object.upload', 'openvibe.media', ['games']],
++    // Plan T12: Host keeps tenant deploy files in Media (Host#24, HOST_OBJECT_STORE=media), its own namespace only:
++    // write-through on deploy, re-fetch on a cache miss, list and delete when its GC finds a blob unreferenced.
++    ['host', 'media.object.upload', 'openvibe.media', ['host', 'host.*']],
++    ['host', 'media.object.read', 'openvibe.media', ['host', 'host.*']],
++    ['host', 'media.object.list', 'openvibe.media', ['host', 'host.*']],
++    ['host', 'media.object.delete', 'openvibe.media', ['host', 'host.*']],
      // Plan T4 (Media cleanup): Live and OpenRe reach Media with their own tokens instead of API keys. Live keeps
      // its objects under the live namespace (VOD/clip/thumbnail uploads, reads, lists, deletes); OpenRe uploads the
      // recordings and thumbnails it produces there too.