openvibers/openvibe.tools Commits

Tools: the paste gateway names Community; dead LIVE_URL goes (C-13) (#48)

OP OpenVibers committed 11 Oct 2026 · c9b5fa3520 · 4 files, +9 −14

This closes compatibility register C-13 (its target date was 2026-10-09). Paste forwarding stays: it is the product path. What goes is the leftover talk of Media and Live.

- **What forwarding does today:** `/api/pastes/*` goes straight to OpenVibe.Community (`OV_COMMUNITY_INTERNAL_URL`) with the visitor's `ov_token`, and `pastes.openvibe.tools` redirects to Community. Neither Media nor Live is involved. Commit `fd5d318` made that change on 2026-09-22.
- **Removed:** `config.liveUrl` (`LIVE_URL`). Its only use was the startup banner, where a `Pastes:` line now shows the Community URL.
- **`.env.example`:**
  - Drops the "OpenVibe.Media backs Paste.OpenVibe" block (`MEDIA_URL`, `MEDIA_PUBLIC_URL`).
  - Documents `OV_COMMUNITY_INTERNAL_URL`.
  - The satellite jobs keep their own `OV_MEDIA_INTERNAL_URL`, which production sets. They read `MEDIA_URL` only as a fallback.
- **Docs:** the header comment and the README describe the Community forwarding.

The edits were drafted by a Codex job and reviewed here; the banner label was fixed to keep the box aligned. `node --check` passes, the gateway config loads without `liveUrl`, and `apps/gateway/test/security-ssrf.test.js` passes.

Changes

ddiff --git a/apps/gateway/.env.example b/apps/gateway/.env.example
iindex 2a92edf..9615943 100644
---- a/apps/gateway/.env.example
++++ b/apps/gateway/.env.example
@@@ -27,9 +27,8 @@ OV_OAUTH_REDIRECT_URI=http://localhost:4001/auth/callback
  # /<key>.txt so engines can verify the site. Unset: off — nothing is mounted and nothing is sent.
  #INDEXNOW_KEY=
  
--# OpenVibe.Media — backs Paste.OpenVibe (pastes stored under app_id 'live')
--MEDIA_URL=http://127.0.0.1:4100
--MEDIA_PUBLIC_URL=https://openvibe.media
++# OpenVibe.Community — receives Paste.OpenVibe API requests
++#OV_COMMUNITY_INTERNAL_URL=http://127.0.0.1:4200
  
  # Net tools (optional). With an ipinfo.io token, IP lookups use ipinfo over HTTPS instead of ip-api.com's
  # free tier (plain HTTP). Answers are cached either way. The Globalping token is read but no tool uses it yet.
ddiff --git a/apps/gateway/README.md b/apps/gateway/README.md
iindex f534b51..6c0eacd 100644
---- a/apps/gateway/README.md
++++ b/apps/gateway/README.md
@@@ -14,8 +14,9 @@ service is an OAuth2 **client** (`client_id: tools`), not a provider.
    plus one subdomain per tool: `dns.`, `ping.`, `ssl.`, `whois.`, …).
  - **Dev.OpenVibe** — 26 developer & SEO tools (`dev.openvibe.tools` plus
    `json.`, `base64.`, `jwt.`, `regex.`, …).
--- **Paste.OpenVibe** — `pastes.openvibe.tools` front-end; pastes are stored in
--  OpenVibe.Media under app_id `live` and proxied server-side via `MEDIA_URL`.
++- **Paste.OpenVibe** — `pastes.openvibe.tools` redirects to OpenVibe.Community;
++  `/api/pastes/*` is forwarded to OpenVibe.Community (`OV_COMMUNITY_INTERNAL_URL`)
++  with the visitor's `ov_token`.
  - **Session layer** — `/auth/login`, `/auth/callback`, `/auth/logout`,
    `/auth/me`, `/auth/refresh`. Sets the shared `ov_token` cookie on
    `.openvibe.tools` so every satellite subdomain can read it and verify it
@@@ -27,7 +28,7 @@ service is an OAuth2 **client** (`client_id: tools`), not a provider.
  apps/gateway (port 4001)
  ├── server/
  │   ├── index.js       # Express app, CORS, Host routing, paste proxy
--│   ├── config.js      # Port, Network URLs, OAuth client, Media URL
++│   ├── config.js      # Port, Network URLs, OAuth client, Community URL
  │   ├── auth/routes.js # OAuth2 client session layer (+ offline JWT verify)
  │   ├── net/           # Net.OpenVibe API + tool/alias definitions
  │   └── dev/           # Dev.OpenVibe API + tool/alias definitions
@@@ -56,7 +57,7 @@ curl -H 'Host: net.openvibe.tools' http://localhost:4001/
  
  See `.env.example`. Key variables: `PORT` (4001), `OV_NETWORK_URL`,
  `OV_NETWORK_INTERNAL_URL`, `OV_OAUTH_CLIENT_ID`, `OV_OAUTH_CLIENT_SECRET`,
--`OV_OAUTH_REDIRECT_URI`, `MEDIA_URL`, `COOKIE_DOMAIN`.
++`OV_OAUTH_REDIRECT_URI`, `OV_COMMUNITY_INTERNAL_URL`, `COOKIE_DOMAIN`.
  
  ## Deploy
  
ddiff --git a/apps/gateway/server/config.js b/apps/gateway/server/config.js
iindex 37702de..0d1b28c 100644
---- a/apps/gateway/server/config.js
++++ b/apps/gateway/server/config.js
@@@ -34,11 +34,6 @@ module.exports = {
          secure: process.env.COOKIE_SECURE ? process.env.COOKIE_SECURE === 'true' : isProduction,
      },
  
--    // OpenVibe.Live — backs the Paste.OpenVibe front-end. The pastes themselves are
--    // stored in OpenVibe.Media, but we go through Live rather than straight to Media:
--    // Live owns the accounts these pastes belong to, so it is the only service that can
--    // turn a signed-in visitor into the user id Media files the write under.
--    liveUrl: process.env.LIVE_URL || 'http://127.0.0.1:3000',
      // OpenVibe.Community owns pastes (roadmap Wave 5); the paste front-end's API goes straight there.
      communityUrl: (process.env.OV_COMMUNITY_INTERNAL_URL || 'http://127.0.0.1:4200').replace(/\/$/, ''),
  
ddiff --git a/apps/gateway/server/index.js b/apps/gateway/server/index.js
iindex e674605..a466ada 100644
---- a/apps/gateway/server/index.js
++++ b/apps/gateway/server/index.js
@@@ -5,7 +5,7 @@
  //
  // Serves the apex directory page plus the Host-header-routed tool
  // subdomains: Net.OpenVibe (38 network tools), Dev.OpenVibe
--// (26 developer tools), and Paste.OpenVibe (backed by OpenVibe.Media).
++// (26 developer tools), and Paste.OpenVibe (backed by OpenVibe.Community).
  //
  // Identity lives on OpenVibe.Network — this service is an OAuth2
  // CLIENT (`tools`). See server/auth/routes.js for the session layer.
@@@ -511,7 +511,7 @@ const server = app.listen(config.port, config.host, () => {
      console.log(`║  Port:    ${String(config.port).padEnd(32)}║`);
      console.log(`║  URL:     ${config.baseUrl.padEnd(32)}║`);
      console.log(`║  SSO:     ${config.networkUrl.padEnd(32)}║`);
--    console.log(`║  Live:    ${config.liveUrl.padEnd(32)}║`);
++    console.log(`║  Pastes:  ${config.communityUrl.padEnd(32)}║`);
      console.log(`╚════════════════════════════════════════════╝\n`);
  });