openvibers/openvibe.sdk Commits

0.143.0: a plain sign-in is quiet first (#194)

OP OpenVibers committed 3 days ago · 4399bca797 · 9 files, +56 −12

GET /auth/login with no silent, prompt or login_hint asks the Network with
prompt=none before it shows a page, so a browser signed in at
openvibe.network comes back signed in with no chooser. When the Network knows
nobody, the callback goes on to the chooser by itself (/auth/login?ask=1).
A person who signed out here, and switch / add an account, get the chooser
at once.

Changes

ddiff --git a/CHANGELOG.md b/CHANGELOG.md
iindex 4380345..38ef1d5 100644
---- a/CHANGELOG.md
++++ b/CHANGELOG.md
@@@ -1,5 +1,9 @@
  # Changelog
  
++## 0.143.0 (2026-11-10)
++
++- **`sso`: a plain sign-in is quiet first.** `GET /auth/login` with no `silent`, `prompt` or `login_hint` now asks the Network with `prompt=none` before it shows a page: a browser signed in at openvibe.network comes back signed in, with no chooser. Before, a page that needs a person (and every link to one from another site, such as "Open" in the Dock) landed on the chooser although the Network knew the browser. When the Network knows nobody (`login_required`), or always asks for this app (`interaction_required`), the callback goes on to the chooser by itself (`/auth/login?ask=1`, the new way to ask for the chooser outright). A person who signed out on this site (`ov_sso_hint=guest`) gets the chooser at once, as do "switch" and "add an account" (`prompt`, `login_hint`). The navbar's own silent sign-in (`?silent=1`) is unchanged: with nobody at the Network it returns to the page with `?sso=none`.
++
  ## 0.142.0 (2026-11-10)
  
  - **`chat.rooms.memory(id)` and the moderator/person writes**: what a room remembers between summaries (`GET /api/v1/rooms/:id/memory`). `memory()` answers `{ room, entries, kinds, can_edit, me }`, each entry with its `kind`, `text`, `confidence`, when it was learned and its `sources` (the message it came from). `addMemory(id, { text, kind?, confidence?, source_message_ids? })` and `correctMemory(id, entryId, patch)` are a moderator's; `removeMemory(id, entryId)` removes any for a moderator and one learned from the caller's own messages for anyone; `forgetMyMemory(id)` forgets everything learned from the caller's messages in that room. Typed as `RoomMemory`, `MemoryEntry` and `MemoryInput` in `types/chat.d.ts`.
ddiff --git a/README.md b/README.md
iindex dabebf5..79412fb 100644
---- a/README.md
++++ b/README.md
@@@ -13,7 +13,7 @@ npm install https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags
  
  > Supported browser and server clients for the OpenVibe platform.
  
--**Status:** alpha, v0.142.0 (the five 1.0 core entries — `core`, `auth`, `events`, `db` and `media` — are frozen: their exported names change only with a major release; roadmap Wave 2; developer apps from Wave 20; Media objects v2 from Wave 4; the Tools platform API; Search, Chat, AI, Vision and consent clients; sign-in with recovery and a client health check). Every release is tagged (see [CHANGELOG.md](CHANGELOG.md)). Tested against local stub servers and the built-in mock platform only, never against the live platform. Services pin release tags; each repository's `STATUS.json` names the one it uses.
++**Status:** alpha, v0.143.0 (the five 1.0 core entries — `core`, `auth`, `events`, `db` and `media` — are frozen: their exported names change only with a major release; roadmap Wave 2; developer apps from Wave 20; Media objects v2 from Wave 4; the Tools platform API; Search, Chat, AI, Vision and consent clients; sign-in with recovery and a client health check). Every release is tagged (see [CHANGELOG.md](CHANGELOG.md)). Tested against local stub servers and the built-in mock platform only, never against the live platform. Services pin release tags; each repository's `STATUS.json` names the one it uses.
  **Plan:** OpenVibe End-to-End Realignment & Implementation Plan, revision 3 (20 Sep 2026), §3.2; roadmap §30.  
  **License:** MIT ([LICENSE](LICENSE)). This package is a library that apps outside the network embed, so it uses MIT. The OpenVibe services themselves stay AGPL-3.0.
  
@@@ -22,7 +22,7 @@ npm install https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags
  After v0.97.1 is tagged:
  
  ```bash
--npm install https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.142.0
++npm install https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.143.0
  ```
  
  It has no runtime dependencies. It needs Node ≥ 20, or any browser with `fetch`, Web Crypto and `TextDecoder`. There is no build step. The package is CommonJS with ESM entry points (`import` works). Each subpath has its own `.d.ts`. For a page with no bundler, `browser/openvibe-sdk.mjs` is one self-contained ES module of the browser-safe subpaths (see [Browser without a bundler](#browser-without-a-bundler)). It does not depend on `openvibe-contracts` at runtime: it copies the contract types it uses (from the temporary Contracts sharing branch, a devDependency the tests check them against).
ddiff --git a/STATUS.json b/STATUS.json
iindex 9d957a2..1468efe 100644
---- a/STATUS.json
++++ b/STATUS.json
@@@ -3,7 +3,7 @@
    "stage": "alpha",
    "code": true,
    "wave": "W2",
--  "version": "0.142.0",
++  "version": "0.143.0",
    "plan": "OpenVibe End-to-End Realignment & Implementation Plan, revision 3 (20 Sep 2026), \u00a73.2; roadmap \u00a730",
    "deployed": false,
    "deployment": "none: a package released as git tags; services and apps pin a tag",
ddiff --git a/browser/openvibe-sdk.mjs b/browser/openvibe-sdk.mjs
iindex d6e033b..80cb143 100644
---- a/browser/openvibe-sdk.mjs
++++ b/browser/openvibe-sdk.mjs
@@@ -1,4 +1,4 @@
--// Generated by scripts/browser-bundle.js from browser.js (openvibe-sdk 0.142.0, MIT). Do not edit.
++// Generated by scripts/browser-bundle.js from browser.js (openvibe-sdk 0.143.0, MIT). Do not edit.
  // One self-contained ES module: core at the top level plus the browser-safe subpaths as namespaces
  // (auth, locker, registry, trust, levels, modules, realtime, media, cam, mediaUpload, ui, community, homeFeed, bot, search, bench, meme, vision, themes, design, redact, chat, ai, credentials, jobs, tools, projects, geo). No server-only code: no service tokens, JWT verification, events, identity.
  /* eslint-disable */
@@@ -57,7 +57,7 @@ const { paginate, offsetPager } = __load(7);
  const semver = __load(6);
  
  /** The package version (test/version.test.js keeps it equal to package.json). */
--const SDK_VERSION = '0.142.0';
++const SDK_VERSION = '0.143.0';
  
  module.exports = {
      createClient,
ddiff --git a/package-lock.json b/package-lock.json
iindex ff99105..605cc0a 100644
---- a/package-lock.json
++++ b/package-lock.json
@@@ -1,12 +1,12 @@
  {
    "name": "openvibe-sdk",
--  "version": "0.142.0",
++  "version": "0.143.0",
    "lockfileVersion": 3,
    "requires": true,
    "packages": {
      "": {
        "name": "openvibe-sdk",
--      "version": "0.142.0",
++      "version": "0.143.0",
        "license": "MIT",
        "bin": {
          "openvibe-download": "bin/openvibe-download.js"
ddiff --git a/package.json b/package.json
iindex f7a6fd0..82d6a11 100644
---- a/package.json
++++ b/package.json
@@@ -1,6 +1,6 @@
  {
    "name": "openvibe-sdk",
--  "version": "0.142.0",
++  "version": "0.143.0",
    "description": "Supported browser and server clients for the OpenVibe platform: auth (incl. developer apps), registry discovery, identity, user modules, events, realtime, media, community, Bot robots, search, chat, AI runs, Tools (registry, run API and jobs), VIP memberships and developer projects, the async PostgreSQL data layer (db) and the Valkey cache, limits store, queue and pub/sub, with deadlines, safe retries, problem errors and trace propagation.",
    "main": "index.js",
    "types": "types/index.d.ts",
ddiff --git a/src/core/index.js b/src/core/index.js
iindex 5f6bffa..fc6a375 100644
---- a/src/core/index.js
++++ b/src/core/index.js
@@@ -8,7 +8,7 @@ const { paginate, offsetPager } = require('./paginate');
  const semver = require('./semver');
  
  /** The package version (test/version.test.js keeps it equal to package.json). */
--const SDK_VERSION = '0.142.0';
++const SDK_VERSION = '0.143.0';
  
  module.exports = {
      createClient,
ddiff --git a/src/sso/index.js b/src/sso/index.js
iindex afe3980..396eed4 100644
---- a/src/sso/index.js
++++ b/src/sso/index.js
@@@ -18,7 +18,11 @@
   * Routes (mounted at /auth; the redirect URI is <baseUrl>/auth/callback unless `redirectUri` says otherwise):
   *   GET  /login     → Network /oauth/authorize with state and PKCE (S256); ?silent=1: prompt=none; ?prompt=select_account
   *                     (the chooser) or login (the sign-in form) and ?login_hint=<username> pass through; ?next= a same-site
-- *                     path, this site's https origin or the Network's (control characters and backslashes go home)
++ *                     path, this site's https origin or the Network's (control characters and backslashes go home).
++ *                     A plain sign-in is quiet first (0.143.0): it asks the Network with prompt=none, so a browser signed
++ *                     in at openvibe.network comes back signed in with no chooser; when the Network knows nobody the
++ *                     callback starts the chooser by itself (?ask=1). A person who signed out here (hint=guest), and
++ *                     ?prompt / ?login_hint, get the chooser at once.
   *   GET  /callback  → the state is required and compared in constant time; the code is exchanged server-side with the
   *                     client secret and the PKCE verifier; cookies are set; back to `next`
   *   POST /fedcm     → the shared navbar's FedCM assertion (nonce pre-checked) swapped for tokens (jwt-bearer grant)
@@@ -53,6 +57,9 @@ const HINT_COOKIE = 'ov_sso_hint';
  const STATE_COOKIE = 'ov_oauth_state';
  const NEXT_COOKIE = 'ov_oauth_next';
  const SILENT_COOKIE = 'ov_oauth_silent';
++// The silent cookie's value for a plain sign-in's quiet first try: its failure goes on to the chooser, where a silent
++// sign-in ('1', the navbar's own) goes back to the page as a guest.
++const QUIET_FIRST = '2';
  const VERIFIER_COOKIE = 'ov_oauth_verifier';
  const FLOW_COOKIES = [STATE_COOKIE, NEXT_COOKIE, SILENT_COOKIE, VERIFIER_COOKIE];
  const RETRY_COOKIE = 'ov_oauth_retry';
@@@ -283,7 +290,14 @@ function createSsoClient(opts = {}) {
      const handlers = {
          async login(req, res) {
              const q = req.query || {};
--            const silent = !!q.silent && q.silent !== '0';
++            const asked = !!q.silent && q.silent !== '0';
++            // Quiet first: a plain sign-in (a page that needs a person, the bar's Sign in) asks the Network without a
++            // page before it shows one. A link from another site's Dock landed on the chooser every time (2026-11-10),
++            // though the browser was signed in at openvibe.network. The chooser comes at once for a person who signed
++            // out here (the guest hint), for "switch" and "add an account" (prompt, login_hint), and for ?ask=1, which
++            // the callback sends when the quiet try found nobody.
++            const first = !asked && !q.prompt && !q.login_hint && q.ask !== '1' && parseCookies(req)[HINT_COOKIE] !== 'guest';
++            const silent = asked || first;
              // Already signed in here? A silent round trip would only hand back the session we have.
              if (silent && await verify(readAccess(req))) { clearFlow(res); return res.redirect(next(q.next)); }
              const { url, state, verifier } = authorizeUrl({ silent, prompt: String(q.prompt || ''), loginHint: q.login_hint });
@@@ -291,7 +305,7 @@ function createSsoClient(opts = {}) {
              res.cookie(VERIFIER_COOKIE, verifier, flowOpts());
              const target = next(q.next);
              if (target !== '/') res.cookie(NEXT_COOKIE, target, flowOpts()); else res.clearCookie(NEXT_COOKIE, { path: '/auth' });
--            if (silent) res.cookie(SILENT_COOKIE, '1', flowOpts()); else res.clearCookie(SILENT_COOKIE, { path: '/auth' });
++            if (silent) res.cookie(SILENT_COOKIE, first ? QUIET_FIRST : '1', flowOpts()); else res.clearCookie(SILENT_COOKIE, { path: '/auth' });
              return res.redirect(url);
          },
  
@@@ -302,6 +316,8 @@ function createSsoClient(opts = {}) {
              const silent = c[SILENT_COOKIE] === '1';
              if (q.error) {
                  clearFlow(res);
++                // The quiet first try found nobody at the Network (or this app always asks): now the chooser, once.
++                if (c[SILENT_COOKIE] === QUIET_FIRST && (q.error === 'login_required' || q.error === 'interaction_required')) return res.redirect(withParam(loginHref(target), 'ask', '1'));
                  // Silent sign-in found no Network session: back quietly as a guest (?sso=none stops the navbar retrying).
                  if (silent || q.error === 'login_required') return res.redirect(withParam(target, 'sso', 'none'));
                  return res.redirect(withParam('/', 'auth_error', String(q.error)));
ddiff --git a/test/sso.test.js b/test/sso.test.js
iindex 60580e4..4991101 100644
---- a/test/sso.test.js
++++ b/test/sso.test.js
@@@ -65,6 +65,20 @@ run([
          const res = fakeRes();
          await sso.handlers.login({ query: { next: '//evil.example' }, headers: {} }, res);
          const u = new URL(res.location);
++        // Quiet first (0.143.0): a plain sign-in asks the Network without a page, and marks the flow as a first try.
++        assert.equal(u.searchParams.get('prompt'), 'none', 'a plain sign-in is quiet first');
++        assert.equal(res.cookies.ov_oauth_silent.v, '2');
++        // The chooser at once: the second try, and a person who signed out here.
++        const second = fakeRes();
++        await sso.handlers.login({ query: { ask: '1', next: '/deals' }, headers: {} }, second);
++        assert.equal(new URL(second.location).searchParams.get('prompt'), null, '?ask=1 shows the chooser');
++        assert.ok(second.cleared.includes('ov_oauth_silent') && second.cookies.ov_oauth_next.v === '/deals');
++        const guest = fakeRes();
++        await sso.handlers.login({ query: {}, headers: { cookie: cookieHeader({ ov_sso_hint: 'guest' }) } }, guest);
++        assert.equal(new URL(guest.location).searchParams.get('prompt'), null, 'signed out here: the chooser, never a quiet sign-in');
++        const known = fakeRes();
++        await sso.handlers.login({ query: {}, headers: { cookie: cookieHeader({ ov_sso_hint: 'account' }) } }, known);
++        assert.equal(new URL(known.location).searchParams.get('prompt'), 'none');
          assert.equal(u.origin + u.pathname, `${ISS}/oauth/authorize`);
          assert.deepEqual([u.searchParams.get('client_id'), u.searchParams.get('redirect_uri'), u.searchParams.get('code_challenge_method')], ['trade', 'https://openvibe.trade/auth/callback', 'S256']);
          assert.equal(u.searchParams.get('state'), res.cookies.ov_oauth_state.v);
@@@ -120,6 +134,16 @@ run([
          const quiet = fakeRes();
          await sso.handlers.callback({ query: { error: 'login_required' }, headers: { cookie: cookieHeader({ ov_oauth_silent: '1', ov_oauth_next: '/x' }) } }, quiet);
          assert.equal(quiet.location, '/x?sso=none', 'a silent sign-in with no Network session goes back quietly');
++        // A plain sign-in's quiet first try that found nobody goes on to the chooser, and keeps where it was going.
++        const first = fakeRes();
++        await sso.handlers.callback({ query: { error: 'login_required' }, headers: { cookie: cookieHeader({ ov_oauth_silent: '2', ov_oauth_next: '/you' }) } }, first);
++        assert.equal(first.location, '/auth/login?next=%2Fyou&ask=1');
++        const always = fakeRes();
++        await sso.handlers.callback({ query: { error: 'interaction_required' }, headers: { cookie: cookieHeader({ ov_oauth_silent: '2' }) } }, always);
++        assert.equal(always.location, '/auth/login?ask=1', 'an app the Network always asks for: the chooser');
++        const refused = fakeRes();
++        await sso.handlers.callback({ query: { error: 'access_denied' }, headers: { cookie: cookieHeader({ ov_oauth_silent: '2' }) } }, refused);
++        assert.equal(refused.location, '/?auth_error=access_denied', 'any other error is reported as it is for a sign-in the person started');
      }],
  
      ['a client the Network refuses: the page says it is our problem, logs what to check, and /auth/health reports it', async () => {