openvibers/openvibe.network Commits

Grant games ai.run.create on ai.generate (#586)

OP OpenVibers committed 7 days ago · f2a8401b08 · 2 files, +7 −0

Games' AI-vs-AI match job asks OpenVibe.AI for a pinned local offer on
each side. The service already had its Bench grants but no AI grant, so
the first AI call would have been refused. Add the default grant and an
assertion that the games token carries it.

Changes

ddiff --git a/server/identity/principals.js b/server/identity/principals.js
iindex c148f795..9101871b 100644
---- a/server/identity/principals.js
++++ b/server/identity/principals.js
@@@ -764,6 +764,8 @@ const DEFAULT_GRANTS = [
      // (X-OV-Subject): the person's "Designs" project and its sites, and the deploy of the page.
      ['design', 'space.site.manage', 'openvibe.space', []],
      ['design', 'space.deploy.create', 'openvibe.space', []],
++    // Games plays the AI duel itself: two pinned local offers through ai.generate (plan §6).
++    ['games', 'ai.run.create', 'openvibe.ai', ['ai.generate']],
      // Games submits each AI duel as a Bench task, two priced seat entries, and one automatic outcome.
      ...['bench.task.create', 'bench.round.create', 'bench.entry.create', 'bench.judgement.cast']
          .map((cap) => ['games', cap, 'openvibe.bench', []]),
ddiff --git a/test/principals.test.js b/test/principals.test.js
iindex fb8d177e..59d84b30 100644
---- a/test/principals.test.js
++++ b/test/principals.test.js
@@@ -215,6 +215,11 @@ const server = http.createServer(app);
      t = await token({ client_id: 'games', client_secret: 'games-secret', audience: 'openvibe.bench' });
      assert.strictEqual(t.status, 200, JSON.stringify(t.body));
      assert.deepStrictEqual(t.body.scope.split(' '), ['bench.entry.create', 'bench.judgement.cast', 'bench.round.create', 'bench.task.create'], 'Games submits priced matches and automatic outcomes');
++    t = await token({ client_id: 'games', client_secret: 'games-secret', audience: 'openvibe.ai' });
++    assert.strictEqual(t.status, 200, JSON.stringify(t.body));
++    const gamesAiClaims = serviceAuth.verifyServiceToken(t.body.access_token, { publicKey: keys.publicKey, issuer: ISSUER, audience: 'openvibe.ai' });
++    assert.ok(gamesAiClaims.ok, gamesAiClaims.reason);
++    assert.deepStrictEqual([gamesAiClaims.claims.cap, gamesAiClaims.claims.ns], [['ai.run.create'], ['ai.generate']], 'Games plays the duel through ai.generate');
  
      // OpenVibe.Bench (contracts 0.238.0): the account export/deletion pair, its account-event subscriptions,
      // ai.run.create (namespace ai.generate) to run its pinned rounds, and (B10) the model watch's one notification