openvibers/openvibe.sdk Commits

openvibe-sdk 0.40.1: verifyUserToken refuses node principals (#37)

OP OpenVibers committed 10 Oct 2026 · tag v0.40. · 0 files, +0 −0

`verifyUserToken` refused service, app and module principal tokens but not **node** principals. A node token (`actor_type: node`, `sub node:nod_…`) is what Network issues to a machine paired with a service, such as a robot's computer for OpenVibe.Bot, and it is signed with the same key. Several services check people's tokens without an audience, so one would have taken a node token as a session: Live, Chat, Media's site, Community, Space, Tips and VIP. Bot already refused node tokens itself.

- `src/auth/jwt.js`: `node` joins the principal actor types and sub prefixes. Either one alone is `token.not_user`, unless the caller passes `allowServiceTokens`.
- `test/jwt.test.js`: a node token is refused by its actor_type plus sub, by its sub alone, and by its actor_type alone.
- 0.40.1: version, `SDK_VERSION`, changelog, STATUS, README and the browser bundle.

`ov test` is green. The services that consume this get the pin with their next bump.