Commits

main

nginx: /auth/me, the session probe the shared navbar asks on every page view, gets its own location on the API zone (burst 30) instead of the sign-in zone (10 a minute, burst 10), and both answer 429 when limited instead of nginx's default 503. The browser check (Host scripts/browser-check.js, WS-Q task 3) saw /auth/me answer 503 after about ten quick page loads, which the navbar takes as signed out. test/nginx-auth-limit.test.js. Takes effect when the vhost is next installed (not deployed here)OpenVibers · 26 Sept 2026 a8362b9
Size budgets for the home page (WS-T task 1): openvibe-shared/perf-budget (shared 1.15.0) measures / as the server answers it on a fresh database, no browser, in npm test; budgets a little above the 2026-09-26 measurementOpenVibers · 26 Sept 2026 b793836
Pins: openvibe-contracts 0.44.0 → 0.49.0, openvibe-shared 1.12.0 → 1.13.0, openvibe-sdk 0.9.1 → 0.11.0OpenVibers · 25 Sept 2026 2aa7301
Pins: openvibe-contracts 0.42.0 → 0.44.0 (Contracts 0.43.0 and 0.44.0 were released after the previous pin commit, leaving 0.42.0 two minors behind the pin-drift limit)OpenVibers · 25 Sept 2026 588f2e5
Pins: openvibe-contracts 0.41.0 → 0.42.0, openvibe-sdk 0.5.0 → 0.9.1; CI runs the pin-drift check (shared test and security workflows at 423fe51)OpenVibers · 25 Sept 2026 58e40a9
wiki.projects on Network (Contracts 0.41.0 user module, WS-B task 9): the spaces a person owns or edits (public ones named, others counted); a space or role change marks the people concerned in the same transaction (a removed role too) and a one-minute drain writes their record as the owning service, only when it changedOpenVibers · 25 Sept 2026 1c94ea3
Staff powers from the contracts staff map (WS-D, ADR-022; Contracts 0.38.0): owning and creating official spaces is staff.editorial.manage (admin; global_mods no longer own official spaces), not a role list. test/staff-map.test.js fails on raw role checksOpenVibers · 24 Sept 2026 e0d58e0
The OpenVibe Frame from this site's own pinned copy: /shared/* is served by openvibe-shared/serve (1.12.0) and every page references it by content hash (/shared/<file>?v=<hash>), so this site's pin decides what its pages run and its navbar and footer keep working while openvibe.network is down; openvibe-publishing 0.4.0 (openvibe-shared as a peer: one copy, no lockstep releases)OpenVibers · 24 Sept 2026 8571aa1
The OpenVibe Frame: openvibe-shared/frame (formerly chrome-ssr) and 1.11.0; openvibe-publishing 0.3.2 (one copy of openvibe-shared)OpenVibers · 24 Sept 2026 1f54de7
The shared update system and one account UI: home shows what shipped (openvibe-shared chrome-ssr shipped()), /updates is the shared log, the footer links it; the shared navbar handles sign in/out (logoutUrl ends this site's session) and the site's own account strip is only for no-JS visitors. openvibe-shared 1.10.0, openvibe-publishing 0.3.1OpenVibers · 24 Sept 2026 fdcea62
One W3C trace across services (Track O): openvibe-shared v1.7.0 trace.install(app) keeps each request's traceparent and puts it on the calls made while serving it, to loopback and OpenVibe hosts onlyOpenVibers · 24 Sept 2026 907659c
CI calls the shared test workflow (Track Q): OpenVibe.Shared .github/workflows/test.yml@f5e7e73 (install, node --check over server/ and scripts/, npm test, openvibe-contracts-check) instead of a copy of those stepsOpenVibers · 24 Sept 2026 6c09371
openvibe-publishing v0.2.2 (shares the openvibe-shared v1.5.1 copy instead of installing v1.0.0 alongside)OpenVibers · 24 Sept 2026 fe113b9
SECURITY.md: how to report a vulnerability ([email protected], 7-day reply, scope, supported versions)OpenVibers · 24 Sept 2026 4223b6d
openvibe-shared v1.5.1, openvibe-contracts v0.33.0OpenVibers · 23 Sept 2026 1d2bd18
openvibe-shared v1.5.0 (Track R release manifest), openvibe-contracts v0.32.0, openvibe-sdk v0.5.0OpenVibers · 23 Sept 2026 06b6054
CI: run the shared security workflow (gitleaks secret scan + dependency audit, Track Q)OpenVibers · 23 Sept 2026 b4e70ac
Written threat review (docs/threat-review.md, launch rule point 6): Markdown and XSS, links and redirects, Media attachments, permissions and delegation, spam, revisions and vandalism, CSRF, SSRF, caching, search/feeds/sitemaps, the space import and the citation inspector, denial of service; each mitigation with the code that implements it, the gaps fixed in this pass with their tests, and the gaps that remain with the repository that owns them. README points to it and lists the rate limitsOpenVibers · 23 Sept 2026 011a68f
Threat review fixes: outbound links in community spaces are rel="nofollow ugc noopener" (Markdown links, bare URLs, citations, infobox URLs; official spaces unchanged); a page summary is text of at most 300 characters on every write path (any JSON value of any size was stored and put in the meta description); AI proposals come only from first-party svc: principals (a developer app or module holding wiki.revision.propose could file draft pages into any space, private ones included); GET /search and revision diffs (SSR and API) are rate-limited per address (60/min, 30/min). test/threat-review.test.js; test helpers can boot with rate limits onOpenVibers · 23 Sept 2026 ea468b4
nginx: space imports get their own body limits (3 MB for POST /api/v1/spaces/:space/import, 7 MB for the /s/:space/import form; everything else stays at 1 MB), so a 2 MB bundle reaches the app's own checks instead of nginx's 413; header comment says the vhost is liveOpenVibers · 23 Sept 2026 1afdbda
Space import: an owner imports a JSON bundle of pages (the seed file's page shape) into their space through POST /api/v1/spaces/:space/import or the /s/:space/import form, in one transaction (one bad page imports nothing, events included). Strict validation first: unknown fields, duplicate slugs, parents and loops, at most 200 pages, 2 MB and 200,000 characters per page, 200 Sources items; existing slugs stop the import (409) unless on_existing is skip. Pages are created like hand-made ones (drafts unless publish, same renderer, link and citation records, events, Search documents), with imported authorship naming the importer; ai_assisted keeps them noindex until reviewed. 20 imports per hour per address; oversized API bodies answer 413. createPage's body moved into insertPage for both. test/import.test.jsOpenVibers · 23 Sept 2026 96b8e43
Citation inspector: /w/:space/:slug/sources (?rev=N, the published revision by default) shows a revision's sources in full, server-rendered and useful without JavaScript: kind (URL or OpenVibe.Sources item), retrieval time, license, quote, the revision that first cited each source, and what was kept, added, restored or dropped since the previous readable revision. Linked from the article's sources and every history row; same read rules as the article (drafts, newer revisions, members/private and deleted pages answer 404/410, renames 301). test/citation-inspector.test.jsOpenVibers · 23 Sept 2026 34bffa4
Media attachments across authors and editors: a person attaches an OpenVibe.Media object only if they can read it there (public, unlisted or their own; missing, deleted and other people's private objects get one media.not_readable answer), private objects are never attached because every reader of a page sees its media, and a Media outage attaches nothing (503). wiki_attachment_origins records who attached each object and the visibility checked then; later editors revise, revert and publish without re-attaching. The check marks an object Media made private broken ('forbidden', shown as no longer shared publicly) until Media shares it again. test/media-handoff.test.js: A attaches, B revises and keeps it, B is refused A's private object, Media deletes one and hides the other, the public page shows both statesOpenVibers · 23 Sept 2026 39a0648
/feed.atom answers 200 with a valid Atom feed of zero entries while nothing is listable (it is linked from every page and answered 404): the feed-level updated is the last change to a public space, or the epoch when there is none, never now and never the time of a hidden change; test/feeds.test.js checks status, content type, well-formedness, id/title/updated/self and that drafts, private pages and unreviewed AI-assisted imports never become entriesOpenVibers · 23 Sept 2026 ed94b7a
Docs: STATUS.json and README match production (2026-09-23)OpenVibers · 23 Sept 2026 3b9cf78
App and module tokens act only for their on_behalf_of person; sandbox tokens refusedOpenVibers · 23 Sept 2026 c1e6ff5
A page's discussion thread is hidden when the page stops being publicOpenVibers · 23 Sept 2026 98b4c5b
nginx: client address headers only from $remote_addr (realip). X-Forwarded-For was appended to and CF-Connecting-IP passed through from the client, so a request reaching the origin without Cloudflare (DNS-only host or the bare IP) chose the address the service bans and rate-limits byOpenVibers · 23 Sept 2026 baf5d63
openvibe-publishing v0.2.1 (ReDoS fixes in ssr markdown)OpenVibers · 23 Sept 2026 d70d20c
Security: a renamed or deleted space's old slug cannot be claimed by another spaceOpenVibers · 23 Sept 2026 0634ffa

More commits