openvibers/openvibe.sources Commits

Pin openvibe-contracts v0.315.0 and read sources.config.manage literally (#222)

OP OpenVibers committed 6 days ago · 02d6cc84c2 · 3 files, +7 −8

* Pin openvibe-contracts v0.315.0 and read sources.config.manage literally

Contracts 0.315.0 lists sources.config.manage in the sources manifest. Name the capability as the literal string the guard checks, so openvibe-contracts-check reads it instead of the const it cannot see.

* Merge remote-tracking branch 'origin/main' into cfgm/config-manage-literal

# Conflicts:
#	package-lock.json
#	package.json

Changes

ddiff --git a/package-lock.json b/package-lock.json
iindex 9e77edd..e6ff3dd 100644
---- a/package-lock.json
++++ b/package-lock.json
@@@ -12,7 +12,7 @@
          "dotenv": "^16.4.7",
          "express": "^4.21.2",
          "fast-xml-parser": "^4.5.3",
--        "openvibe-contracts": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.312.0",
++        "openvibe-contracts": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.315.0",
          "openvibe-sdk": "https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.93.0",
          "openvibe-shared": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v4.124.0",
          "pg": "^8.23.0"
@@@ -1044,9 +1044,9 @@
        }
      },
      "node_modules/openvibe-contracts": {
--      "version": "0.312.0",
--      "resolved": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.312.0",
--      "integrity": "sha512-2GsD53zuIedL3eW2LBlYQ68ODTHzoZJHrAmVnZCpiL7ZWnAXGwPW9dpQagLI9Zdkh3LQuuU5ae1YJI0K+acXbA==",
++      "version": "0.315.0",
++      "resolved": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.315.0",
++      "integrity": "sha512-m1bWT4/sF6Hc7lia6FjAR+880r9SBRhO/v819Lr5ldxlSkFYiKMXTtt7MDbJ4FCgQ7Dkt+2OJaKanlvk2vNPlg==",
        "license": "AGPL-3.0-only",
        "dependencies": {
          "ajv": "^8.17.1",
ddiff --git a/package.json b/package.json
iindex 67f833a..66630c2 100644
---- a/package.json
++++ b/package.json
@@@ -30,7 +30,7 @@
      "dotenv": "^16.4.7",
      "express": "^4.21.2",
      "fast-xml-parser": "^4.5.3",
--    "openvibe-contracts": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.312.0",
++    "openvibe-contracts": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.315.0",
      "openvibe-sdk": "https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.93.0",
      "openvibe-shared": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v4.124.0",
      "pg": "^8.23.0"
ddiff --git a/server/app.js b/server/app.js
iindex 42cf7e9..dc81a65 100644
---- a/server/app.js
++++ b/server/app.js
@@@ -13,7 +13,6 @@ const { merchantRouter } = require('./api/merchant');
  const { merchantPages } = require('./merchant-pages');
  const { createActorLimits } = require('./api/actor-limits');
  const pkg = require('../package.json');
--const CONFIG_CAPABILITY = 'sources.config.manage';
  
  const TEXT_INDEX = [
      'OpenVibe.Sources: the source registry and ingestion workers for the network\'s publication products.',
@@@ -89,8 +88,8 @@ function createApp({ config, db, registry, items, ingest, scheduler, auth, outbo
              if (!header.startsWith('Bearer ')) return res.status(401).json({ code: 'token.missing', error: 'a service token is required' });
              const r = await auth.verifyService(header.slice(7).trim());
              if (!r.ok) return res.status(r.code === 'token.unavailable' ? 503 : 401).json({ code: r.code, error: r.reason || 'the token does not verify' });
--            const decision = capabilities.check(r.claims, CONFIG_CAPABILITY);
--            const granted = decision.allowed || capabilities.grants(r.claims.cap, CONFIG_CAPABILITY);
++            const decision = capabilities.check(r.claims, 'sources.config.manage');
++            const granted = decision.allowed || capabilities.grants(r.claims.cap, 'sources.config.manage');
              if (!granted) return res.status(403).json({ code: 'capability.denied', error: 'sources.config.manage is not granted' });
              req.principal = { sub: r.claims.sub, cap: r.claims.cap, jti: r.claims.jti };
              return next();