Network: OpenVibe.Games may grant Inventory items (inventory.item.grant), like Quest (#167)

OP OpenVibers committed 12 Oct 2026 · e67cdd3fe8 · 1 file, +3 −0

OpenVibe.Games will give six of Live's Inventory items for achievements. Inventory's grantor list names Games on them (Inventory PR), so Games needs `inventory.item.grant` for audience `openvibe.inventory`. This is the same single grant Quest holds for its rewards.

- `server/identity/principals.js`: `['games', 'inventory.item.grant', 'openvibe.inventory', []]` in the default grants. Inventory still allows Games to grant only the items that name it, and nothing else: no edit and no revoke.

Tests: `ov test principals grants` passes (9 files).

Changes

ddiff --git a/server/identity/principals.js b/server/identity/principals.js
iindex 60a981e3..b469ca2c 100644
---- a/server/identity/principals.js
++++ b/server/identity/principals.js
@@@ -47,6 +47,9 @@ const DEFAULT_GRANTS = [
      // OpenVibe.Quest gives six of Live's items as quest rewards: Live names Quest a grantor of them (ADR-054 §3), so
      // Quest grants them itself (origin earned, the completion id as the key) and nothing else.
      ['quest', 'inventory.item.grant', 'openvibe.inventory', []],
++    // OpenVibe.Games gives six of Live's items for achievements (Inventory's live-grantors.json names Games on them),
++    // granted to signed-in players once each (origin earned, games:<game>:<achievement>:<subject> as the key).
++    ['games', 'inventory.item.grant', 'openvibe.inventory', []],
      ['live', 'network.coins.debit', SELF_AUDIENCE, ['live']],
      ['live', 'network.notifications.push', SELF_AUDIENCE, ['live']],
      // User modules: each service reads and writes the namespaces it owns (openvibe-contracts manifests/namespaces).