openvibers/openvibe.work Commits

Pin openvibe-contracts v0.315.0 and read work.config.manage literally (#208)

OP OpenVibers committed 6 days ago · 6533bcc8ca · 3 files, +7 −8

* Pin openvibe-contracts v0.315.0 and read work.config.manage literally

Contracts 0.315.0 lists work.config.manage in the work manifest. Name the capability as the literal string the guard checks, so openvibe-contracts-check reads it instead of the const it cannot see.

* Merge remote-tracking branch 'origin/main' into cfgm/config-manage-literal

# Conflicts:
#	package-lock.json
#	package.json

Changes

ddiff --git a/package-lock.json b/package-lock.json
iindex 425af8d..affeb6e 100644
---- a/package-lock.json
++++ b/package-lock.json
@@@ -15,7 +15,7 @@
          "express-rate-limit": "^7.5.0",
          "helmet": "^8.1.0",
          "iovalkey": "^0.4.0",
--        "openvibe-contracts": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.312.0",
++        "openvibe-contracts": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.315.0",
          "openvibe-publishing": "https://codeload.github.com/OpenVibers/OpenVibe.Publishing/tar.gz/refs/tags/v1.4.0",
          "openvibe-sdk": "https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.93.0",
          "openvibe-shared": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v4.124.0",
@@@ -1147,9 +1147,9 @@
        }
      },
      "node_modules/openvibe-contracts": {
--      "version": "0.312.0",
--      "resolved": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.312.0",
--      "integrity": "sha512-2GsD53zuIedL3eW2LBlYQ68ODTHzoZJHrAmVnZCpiL7ZWnAXGwPW9dpQagLI9Zdkh3LQuuU5ae1YJI0K+acXbA==",
++      "version": "0.315.0",
++      "resolved": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.315.0",
++      "integrity": "sha512-m1bWT4/sF6Hc7lia6FjAR+880r9SBRhO/v819Lr5ldxlSkFYiKMXTtt7MDbJ4FCgQ7Dkt+2OJaKanlvk2vNPlg==",
        "license": "AGPL-3.0-only",
        "dependencies": {
          "ajv": "^8.17.1",
ddiff --git a/package.json b/package.json
iindex d4b632b..57ead33 100644
---- a/package.json
++++ b/package.json
@@@ -23,7 +23,7 @@
      "express-rate-limit": "^7.5.0",
      "helmet": "^8.1.0",
      "iovalkey": "^0.4.0",
--    "openvibe-contracts": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.312.0",
++    "openvibe-contracts": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.315.0",
      "openvibe-publishing": "https://codeload.github.com/OpenVibers/OpenVibe.Publishing/tar.gz/refs/tags/v1.4.0",
      "openvibe-sdk": "https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.93.0",
      "openvibe-shared": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v4.124.0",
ddiff --git a/server/app.js b/server/app.js
iindex 0f35d7b..52eff14 100644
---- a/server/app.js
++++ b/server/app.js
@@@ -19,7 +19,6 @@ const helmet = require('helmet');
  const cookieParser = require('cookie-parser');
  const rateLimit = require('express-rate-limit');
  const contracts = require('openvibe-contracts');
--const CONFIG_CAPABILITY = 'work.config.manage';
  const cache = require('openvibe-shared/cache-policy');
  
  const configLib = require('./config');
@@@ -216,8 +215,8 @@ async function createApp(opts = {}) {
              });
              if (!r.ok) return res.status(r.code === 'token.unavailable' ? 503 : 401).json({ code: r.code, error: r.reason || 'the token does not verify' });
              const contracts = require('openvibe-contracts');
--            const decision = contracts.capabilities.check(r.claims, CONFIG_CAPABILITY);
--            const granted = decision.allowed || contracts.capabilities.grants(r.claims.cap, CONFIG_CAPABILITY);
++            const decision = contracts.capabilities.check(r.claims, 'work.config.manage');
++            const granted = decision.allowed || contracts.capabilities.grants(r.claims.cap, 'work.config.manage');
              if (!granted) return res.status(403).json({ code: 'capability.denied', error: 'work.config.manage is not granted' });
              req.principal = { sub: r.claims.sub, cap: r.claims.cap, jti: r.claims.jti };
              return next();