openvibers/openvibe.network Commits

openvibe-contracts v0.263.1 (was v0.261.0) (#468)

OP OpenVibers committed 13 days ago · f52eeb3275 · 5 files, +10 −8

* openvibe-contracts v0.263.1 (was v0.261.0)

Opened by scripts/pin-bump.js in OpenVibers/OpenVibe.Shared after the v0.263.1 release.

* sso-check: openvibe.website is a site again (Space's front door); its tenants are not

Changes

ddiff --git a/README.md b/README.md
iindex 07e9d0c1..95ed5167 100644
---- a/README.md
++++ b/README.md
@@@ -820,7 +820,7 @@ Reporting a vulnerability: [SECURITY.md](SECURITY.md). The rules the code keeps:
  MIT (`license` in [package.json](package.json)).
  
  <!-- versions:start -->
--- openvibe-contracts: v0.261.0
++- openvibe-contracts: v0.263.1
  - openvibe-sdk: v0.74.0
  - openvibe-shared: v4.67.0
  <!-- versions:end -->
ddiff --git a/STATUS.json b/STATUS.json
iindex f8e3be54..d7db8496 100644
---- a/STATUS.json
++++ b/STATUS.json
@@@ -6,7 +6,7 @@
    "runtime": "node 22, express, PostgreSQL 18 (openvibe-sdk/db, async) + Valkey 9",
    "port": 4000,
    "domain": "openvibe.network (with auth., api., admin., my. and themes.openvibe.network in its manifest)",
--  "contracts": "openvibe-contracts v0.261.0",
++  "contracts": "openvibe-contracts v0.263.1",
    "sdk": "openvibe-sdk v0.74.0",
    "shared": "openvibe-shared v4.67.0",
    "capabilities": [
ddiff --git a/package-lock.json b/package-lock.json
iindex 34187344..b2f92d9c 100644
---- a/package-lock.json
++++ b/package-lock.json
@@@ -20,7 +20,7 @@
          "iovalkey": "^0.4.0",
          "jsonwebtoken": "^9.0.0",
          "multer": "^1.4.5-lts.1",
--        "openvibe-contracts": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.261.0",
++        "openvibe-contracts": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.263.1",
          "openvibe-sdk": "https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.74.0",
          "openvibe-shared": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v4.67.0",
          "pg": "^8.23.0",
@@@ -1595,9 +1595,9 @@
        }
      },
      "node_modules/openvibe-contracts": {
--      "version": "0.261.0",
--      "resolved": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.261.0",
--      "integrity": "sha512-SiXOcXRL9+WivMkKM1W6sGNJMD4uCBR9o7KYZvs99hT2xgYxDvP4rM7tLBudGu1boPH+coMdUXVQAAWbS/3JDw==",
++      "version": "0.263.1",
++      "resolved": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.263.1",
++      "integrity": "sha512-xZZZdirJkdzdpgeaBGRnRgD/o7IoTb7udPHqurYOWEEB/AarE8gKO+2FZbYtGI66cWA9rgcwDbrptnCA7/8Oxw==",
        "license": "AGPL-3.0-only",
        "dependencies": {
          "ajv": "^8.17.1",
ddiff --git a/package.json b/package.json
iindex a0498706..ab968ab9 100644
---- a/package.json
++++ b/package.json
@@@ -24,7 +24,7 @@
      "iovalkey": "^0.4.0",
      "jsonwebtoken": "^9.0.0",
      "multer": "^1.4.5-lts.1",
--    "openvibe-contracts": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.261.0",
++    "openvibe-contracts": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.263.1",
      "openvibe-sdk": "https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.74.0",
      "openvibe-shared": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v4.67.0",
      "pg": "^8.23.0",
ddiff --git a/test/sso-check.test.js b/test/sso-check.test.js
iindex cd53b0c8..19526c9b 100644
---- a/test/sso-check.test.js
++++ b/test/sso-check.test.js
@@@ -30,7 +30,9 @@ for (const site of ['https://openvibe.video', 'https://openvibe.download', 'http
  assert.strictEqual(allowedOrigin('https://evil.openvibe.video'), null, 'a manifest host trusts no subdomain of it');
  assert.strictEqual(allowedOrigin('https://x.openvibe.host'), null, 'a Host tenant site is still not trusted');
  assert.strictEqual(allowedOrigin('https://openvibe.video:8443'), null, 'no ports');
--assert.strictEqual(allowedOrigin('https://openvibe.website'), null, 'a moved address is not a site');
++// openvibe.website is OpenVibe.Website's front door since 2026-10-31 (Space serves it); its tenants are not sites.
++assert.strictEqual(allowedOrigin('https://openvibe.website'), 'https://openvibe.website', 'the front door is a site');
++assert.strictEqual(allowedOrigin('https://x.openvibe.website'), null, 'a Space tenant site is not trusted');
  // The account chooser names the site being signed in to, not the OAuth client that serves several sites.
  const { siteNameForHost } = require('../server/auth/oauth-routes');
  assert.strictEqual(siteNameForHost('openvibe.video'), 'OpenVibe.Video', 'not "OpenVibe.Download" (the media-hub client)');