Commits

main

Live may run media.analyze on OpenVibe.AI (roadmap WS-O task 5): its ai.run.create and ai.run.read grants for openvibe.ai carry the namespaces live.*, network.site_copy and media.analyze (AI 67fb2a4, local-first VOD and clip analysis). test/principals.test.js pins Live's AI token: those two capabilities and those three namespaces, nothing else.OpenVibers · 27 Sept 2026 d0729284
deploy/scripts/deploy.sh hands over to ovhost deploy network --install-units (OpenVibe.Host strategy git-checkout; roadmap WS-N task 11). The old script is kept, unchanged, as deploy/scripts/deploy-legacy.sh. ovhost does what it did (fast-forward pull, npm install --omit=dev when the lockfile changed, deploy/systemd/openvibe-network.service installed when it differs with a daemon-reload, restart) as the checkout owner, checks every dependency before the restart, polls /api/ready, rolls back automatically, records the release and honours freezes; a restart with nothing new now needs --restart. The wrapper passes --restart, --wait-idle, --force, --rollback and DRY_RUN=1 (ovhost plan network); it asks ovhost capabilities network first and runs deploy-legacy.sh, saying why, when ovhost is missing, too old or does not manage network (OVHOST_LEGACY=1 forces it). test/deploy-wrapper.test.js (in npm test). README: a Deploying section.OpenVibers · 27 Sept 2026 d69ec602
gitleaks allowlist for the SSRF suite's web-push test vector (roadmap WS-R task 5). test/security-ssrf.test.js subscribes with the public example subscription from the web-push documentation; its auth value matches the generic-api-key rule. .gitleaks.toml keeps the default rules and allowlists that one value in that one file (path AND value), as the other OpenVibers repos do.OpenVibers · 26 Sept 2026 a7e07f73
Web push endpoints cannot be steered inward (roadmap WS-R task 5: SSRF; low). A push subscription's endpoint is a URL the browser hands over, so anyone signed in chose where Network POSTs: web-push sent to it as stored, 127.0.0.1, 169.254.169.254, [::ffff:7f00:1] or a name resolving inward included (a blind POST with Network's VAPID header). The endpoint must now be https, without credentials, on a public host (an IP literal must be public by openvibe-shared/egress's rule, a name not an internal one); subscribe refuses others, rows stored before are dropped at send time, and every push connects through safeLookup, so a DNS answer that is internal, mixed or rebinding never reaches an internal address.OpenVibers · 26 Sept 2026 80caea96
Private-bypass and IDOR suites (roadmap WS-R task 5). test/security-private.test.js crawls every GET route Express knows after boot as anonymous, another user, a developer app and a service principal, and no answer may carry alice's private data (email, module data, notification, session device, linked account, history, push endpoint), a project's names to a non-member, or an incident closed 40 days ago; by status, /internal/* never answers 2xx without the key or a capability token, staff pages never answer non-staff, a non-member gets 404 on every read of a project (existence not disclosed) and anonymous 401, personal lists refuse anonymous and app tokens; blocks and follows lists stay their owner's, public module reads carry only public fields; positive controls show each owner does see the data. test/security-idor.test.js swaps ids between two people, two projects and two apps: bob against every write route of alice's project (rename, archive, allowance, environment policy, members, apps, credentials, grants, quotas, export tokens) and alice's ids under his own project's paths, against alice's notifications, session, history, profile, modules, follows, blocks and push subscription, and service principals against another app's notifications, coins, linked accounts, modules and legacy ids. Each refusal leaves the rows as they were and carries no secret; positive controls show each route works for its owner. All held. The shared fixture gives the seeded data distinctive markers and follows channels.OpenVibers · 26 Sept 2026 fd866c04
Security crawl for secrets (roadmap WS-R task 5: internal-secret leak). test/security-secrets.test.js boots the real server with a throwaway RS256 and VAPID pair and a fake low-entropy sentinel in every secret it reads from the environment, seeds the database-held ones (OAuth client secrets, developer credentials overlapping after a rotation and their hashes, an export token, a refresh token and its hash, session and anonymous tokens, push keys, provider-secret copies, password hashes, a verification key), then requests every GET route Express knows after boot (test/security-crawl.js walks the router stack from a preload, so a new route is crawled without anyone listing it) as anonymous, a user, a staff admin, the owner, a service principal, a developer app and the legacy key, plus file probes, malformed and empty writes to every write route and wrong credentials. No body or header may carry a secret (also URL-encoded or base64); the log, the event outbox and the audit tables neither. The owner's clear-text reads of provider secrets (owner-guard.js) are the documented exception. test/security-world.js is the shared fixture for the security suites.OpenVibers · 26 Sept 2026 655e8ad5
scripts/creator-analytics-backfill.js (roadmap WS-E task 6): Live's ended streams of the last 400 days into creator_streams, so Live's analytics can switch to Network without losing history. Dry run by default; --apply only with a backup; Live's database read only; rows already made from events are kept; a channel without a Network subject is skipped and counted.OpenVibers · 26 Sept 2026 aaf627c6
Creator analytics from events (roadmap WS-E task 6; Contracts v0.68.0, pinned from 0.67.0). Network consumes live.stream.ended (added to its topics) into creator_streams: one row per stream, replaced on redelivery, counts only (no viewer, chatter or IP column; pruned after 400 days). GET /api/v1/creators/:creator/analytics?days= gives everyone streams, minutes and peak viewers, daily and per stream. The creator, and services with network.analytics.creator.read (granted to Live for its dashboards), also get average viewers, chatters, messages and watch minutes. test/creator-analytics.test.jsOpenVibers · 26 Sept 2026 45f6c4ce
Follows, ADR-030 step 4 on Network (Contracts v0.67.0, pinned from 0.66.0). Products record follows on a person's behalf at PUT/DELETE /internal/follows/:type/:target (network.follows.write, service token only, network.follow-write-request@1; granted to Live; the follower must be a Network account; the writing service is recorded as the source). With FOLLOWS_AUTHORITY=network, go-live notifications read the followers from Network's own graph and no longer ask Live (unset to roll back). test/follows-authority.test.jsOpenVibers · 26 Sept 2026 3928b03d
Incidents and maintenance on /status (roadmap WS-N task 12; Contracts v0.66.0, pinned from 0.65.0). server/status/incidents.js stores incidents (investigating, identified, monitoring, resolved) and maintenance windows (scheduled, in_progress, completed) with their updates. The public GET /api/v1/status/incidents lists active ones and those closed in the last 30 days, and /status shows the open ones at the top. Staff admins, or the Host principal with network.status.incident (granted; ovhost incident / maintenance), open and update them. Closed ones refuse updates, and bodies follow network.status-incident-request@1. test/status-incidents.test.jsOpenVibers · 26 Sept 2026 1a22cd08
The follow graph on Network (roadmap WS-E task 4, ADR-030 steps 1-3; Contracts v0.65.0, pinned from 0.63.0). user_follows is keyed by subjects (a Live channel is its owner's subject), with active, notify flags and a per-pair revision. Public count at GET /api/v1/follows/:type/:target (plus the caller's own follow); a person's follows at /api/v1/me/follows with idempotent PUT and DELETE; followers for the target's owner or a service with network.follows.read (granted to Live for its projection). Every change writes network.follow.created or .deleted to the outbox in the same transaction. scripts/follows-backfill.js imports Live's follows (dry run by default; --apply only with a backup; no events; pairs without a subject held in follow_import_holds) and reconciles counts and pairs. test/follows.test.jsOpenVibers · 26 Sept 2026 bb18d98a
Wiki may ask VIP who reads a VIP space or page: principal wiki gets vip.resource.policy.evaluate (audience openvibe.vip), as Blog and Community have (roadmap WS-K task 8, Contracts 0.64.0).OpenVibers · 26 Sept 2026 2e3fdcc0
Admin: a Lineage tab, the operator view of unresolved references (roadmap D20, remaining item 2). It lists what Live's canonical channel/owner resolver answered unresolved (conflict, source_unavailable, not_found, display_name_only), by reference and reason, with detail, last caller, count, and first/last seen, filterable by reason. It reads Live's GET /api/admin/lineage/unresolved (4479b66) through the existing admin-only /api/admin/streamer proxy.OpenVibers · 26 Sept 2026 1117f253
Project usage (roadmap WS-N task 4; Contracts v0.63.0 common.usage-recorded@1, network.project-usage-result@1): the Events consumer (POST /internal/events) now also takes tools.usage.recorded and events.usage.recorded, the owning services' hourly rollups of each developer project's use, and records them inside its inbox transaction (server/developer/usage.js): dev_usage_windows keeps one row per rollup key (service, project, env, capability, dimension, unit, window start; a newer or equal revision replaces it, so a re-sent hour never counts twice; 35 days), dev_usage_daily adds each day up again from its windows (400 days), dev_usage_errors keeps the sampled failures (30 days, 200 per project). Rollups for an unknown project, from the wrong source, with a subject other than their project, a window that is not a whole hour or day, from the future, older than 35 days or failing their contract are ignored, and none notifies anyone. GET /api/v1/projects/:project/usage?days=1-90&env=all|sandbox|production answers the owner, admins and staff (403 developers and viewers, 404 strangers, 422 usage.invalid) with network.project-usage-result@1: daily rows, range totals, each recorded quota (dev_quotas) with used and remaining for its current window (today, this month, the kept total; null with a note for minute and hour windows and for units no service reports) and errors by code with the 50 most recent sampled failures and their trace ids. scripts/subscribe-events.js subscribes the two topics (--topic tools.usage.recorded --topic events.usage.recorded). Pins: openvibe-contracts 0.62.0 -> 0.63.0. test/project-usage.test.js; docs/developer-projects.md#usageOpenVibers · 26 Sept 2026 7e5112a2
Operator alerts (roadmap WS-H task 11; Contracts v0.62.0 network.operator.alert): POST /internal/operator/alerts takes Host's service token only (legacy: false) and the complete set of alerts firing on the production host (network.operator-alerts-request@1). server/operator/alerts.js keeps one row per fingerprint and pages the operator (OWNER_USERNAME, plus OPERATOR_ALERT_USERNAMES) with an OPERATOR_ALERT admin notification (bell, web push, realtime; no block hides it) when an alert opens, once a day while it stays open, and when it resolves. Host is granted network.operator.alert. Why: Prometheus evaluated the backup, developer-path and Tools-job alerts, but nothing delivered them. test/operator-alerts.test.jsOpenVibers · 26 Sept 2026 11f2ea5a
Roadmap baseline regenerated 2026-09-26 (WS-Q 6): 604 tables, 2381 routes, 107 call sites, 341 discrepancies; 6/7 exit criteria pass (EC7 waits for the host owner's hazard review). New ownership rules: config_keys/config_snapshots keep; Live chat_staged_outbox/chat_dual_read_stats staged to Chat (C-04); Live module_summary_pushes, search_doc_pushes, search_media_pushes keep; Live subject_projection, token_revocations, username_history mirror Network; Live /api/search(/suggest) is the Search adapter; Live module-summaries jobs keep. The D25/D26/D35 ledger artifacts follow the tests' current wording (forum votes, relay dedupe and loop prevention, test/frame.test.js).OpenVibers · 26 Sept 2026 30528fa6
openvibe.network turns on the realtime notification badge first (notificationsRealtime: true on the home page and My account; Shared 1.22.0): a new notification reaches the badge over Events realtime with a single-use ticket, polling stays the fallbackOpenVibers · 26 Sept 2026 a7b99c7f
Pins: openvibe-shared 1.20.0 -> 1.22.0 (realtime notification badge, off until a site turns it on; the unreachable-host browser check)OpenVibers · 26 Sept 2026 9c068892
Pins: openvibe-contracts -> 0.61.0 (network.notification.created@1, identity.realtime-ticket-claims@1, network.realtime-ticket-result@1)OpenVibers · 26 Sept 2026 b400914b
The notification badge over Events (roadmap WS-E task 3, WS-F task 1; ADR-005 amendment 2, Contracts 0.61.0): every notification NotificationService.create() stores is announced as network.notification.created, queued in network_event_outbox in the same transaction (both or neither) and relayed to Events: subject the recipient, visibility subject, actor system:network, payload id/type/category/priority/service/created_at/unread_count, never the title, message, link or sender; none for guests or accounts without a usr_ subject. POST /api/v1/realtime/ticket (Bearer or ov_token, 60/min per IP) mints a two-minute RS256 realtime ticket for the signed-in person (iss <issuer>/realtime, sub usr_, aud openvibe.events, typ and purpose realtime, jti rtk_; never a session, never stored or logged); 403 realtime.guest, 503 realtime.disabled with REALTIME_TICKETS=off; OV_EVENTS_PUBLIC_URL overrides the stream origin. The events consumer logs each live.stream.started outcome (counts only), the evidence C-85 waits for. test/notification-events.test.js: the outbox event and its atomicity, ticket mint and refusals, and a restart during a go-live (a fan-out killed mid-transaction leaves nothing; the redelivery after the restart notifies each follower once; a redelivery after the commit is a duplicate). docs/notification-digest.md: the digest design for a later releaseOpenVibers · 26 Sept 2026 c5d47145
Export tokens (roadmap WS-N task 9): POST /api/v1/projects/:project/export-tokens { audience, env } mints, for the project's owner or an admin member only (developers, viewers and staff who are not an admin member are refused; archived projects can still be exported), a 5-minute read-only token with which OpenVibe.Codes downloads the project's Media objects and namespaces and its app events. Shaped as an app token so Media and Events accept it unchanged: sub app:app_<project ULID> (the project's export principal, never an app, never issued by /oauth/token), aud openvibe.media (media.object.list, media.object.read) or openvibe.events (events.app.read), ns [project_id, app.<project_id>.*], env as asked, on_behalf_of the person, purpose export. Every mint writes a dev_audit row (project.export_token_issued: audience, env, cap, jti, expiry); the token is never stored or logged. test/developer-export-tokens.test.jsOpenVibers · 26 Sept 2026 fbbfc975
OAuth client ai gets its redirect URI (roadmap WS-O task 4): https://ai.openvibe.network/auth/callback for OpenVibe.AI's operator console (merged into the existing client's list at boot, as for every contract client)OpenVibers · 26 Sept 2026 f5a71a23
Sandbox apps may manage their own Codes releases (roadmap WS-N task 5): codes.release.manage joins the default sandbox allowance and openvibe.codes the audiences that accept sandbox app tokens (Codes keeps sandbox releases marked as such); the daily developer path now runs the release cycleOpenVibers · 26 Sept 2026 f9384c6b
Pins: openvibe-shared 1.18.0 -> 1.20.0 (the update matrix and release manifest 1.2.0: client generations, the shell)OpenVibers · 26 Sept 2026 4a509b98
Tools' Media grants cover tools.* (roadmap WS-L task 5): a developer project's job results go to tools.app.<project_id>[.sandbox]; the default grant rows still as first seeded (['tools']) move to ['tools', 'tools.*'] at bootOpenVibers · 26 Sept 2026 416aed70
Retire the key-only role push to Live (roadmap WS-B task 2 step 5; register C-55, Live's route C-54): an admin role change no longer POSTs Live's /internal/user-role with the internal keyOpenVibers · 26 Sept 2026 60455b34
Release health on /status (roadmap WS-P task 15): the ecosystem poll reads release_client_sessions and release_client_updates_total from the /metrics of services whose /release.json names a metrics_url (loopback), and /status and /api/v1/status show, per service, open tabs on the current and older releases, prompts, in-place updates, reloads, deferrals and failures with their reasons, and how long the last release took to drain. Drain reads true only once a service's process has been up 6 minutes (tabs beat every 5); a release first seen after that has no drain time; the last 10 releases are kept in memoryOpenVibers · 26 Sept 2026 10404c4f
Pins: openvibe-contracts 0.56.0 -> 0.59.0 (media.object.list and media.object.delete now in the default sandbox allowance), openvibe-shared 1.17.1 -> 1.18.0 (update telemetry)OpenVibers · 26 Sept 2026 2472353f
Media namespaces and grants, Network's side (roadmap WS-G task 2): an app token's ns is [project_id, app.<project_id>.*], so the grant names the project's Media namespaces (app.<project_id> production, app.<project_id>.sandbox, and children below them) while services keying tenancy by project id keep working; Media reads an older [project_id] the same way. The default sandbox allowance lists media.object.list and media.object.delete (Media's list and delete verbs), left out until the pinned openvibe-contracts defines them as public and active, like events.app.* before 0.28.0. Tests: developer-defaults (ns, the verbs with and without the catalog), developer-projects (ns); docs/developer-projects.mdOpenVibers · 26 Sept 2026 d057b43f
Pins: openvibe-shared 1.16.1 -> 1.17.1 (release notifications)OpenVibers · 26 Sept 2026 2b3998cf

More commits