discovery-media-player 0.1.119 → 0.1.120

package/README.md

@@ -14,6 +14,8 @@ and live presentation — for teams who would rather not hand their commercial d
 to a third-party SaaS.
 
 [![CI](https://github.com/Juli1artha/discovery-media-player/actions/workflows/ci.yml/badge.svg)](https://github.com/Juli1artha/discovery-media-player/actions/workflows/ci.yml)
+[![CodeQL](https://github.com/Juli1artha/discovery-media-player/actions/workflows/codeql.yml/badge.svg)](https://github.com/Juli1artha/discovery-media-player/actions/workflows/codeql.yml)
+[![OpenSSF Scorecard](https://api.scorecard.dev/projects/github.com/Juli1artha/discovery-media-player/badge)](https://scorecard.dev/viewer/?uri=github.com/Juli1artha/discovery-media-player)
 [![npm](https://img.shields.io/npm/v/discovery-media-player?logo=npm&color=cb3837)](https://www.npmjs.com/package/discovery-media-player)
 [![Container](https://img.shields.io/badge/ghcr.io-discovery--media--player-2496ed?logo=docker&logoColor=white)](https://github.com/Juli1artha/discovery-media-player/pkgs/container/discovery-media-player)
 [![Node](https://img.shields.io/node/v/discovery-media-player?logo=node.js&color=5fa04e)](package.json)
@@ -161,6 +163,11 @@ on an allow-listed storage origin, one explicitly configured route of your own a
 or a file under a configured local root. No credentials in URLs, no redirect following into
 your private network.
 
+The project has been through repeated external audits. The reports are published in the
+repository, unedited, with their follow-up ledgers — findings, fixes, and what was rejected
+with its reason: see [`docs/`](docs/README.md). Fixes are traced version by version in the
+[CHANGELOG](CHANGELOG.md).
+
 Found a hole? [`SECURITY.md`](SECURITY.md) — please do not open a public issue.
 
 ---

package/docs/HOST-CONTRACT.md

@@ -74,6 +74,23 @@ The three `presence*` fields report what the host has **observed**, not what it
 | `presenceStrict` | **effective** — `PLAYER_PRESENCE_STRICT` is set *and* tokens can be issued. A closed door announced over an open one would be the worse failure |
 | `presenceDurcissement` | `actif` (a hardened call came back), `degrade` (migration 0018 is missing), `inconnu` (nothing attempted in this process — **not** a green light, and process-local: another instance may have seen otherwise) |
 
+⚠️ **Before you upgrade, do not read `presenceDurcissement`.** It is a *report of execution*: on an
+instance where nothing is running it says `inconnu`, which means *nobody looked* — not *the migration
+is there*. A pre-flight check built on it silently passes on every idle host, and the missing
+migration is then discovered at the first presentation, i.e. at the worst moment. Ask
+`GET /api/doc?contract=1&schema=1` and read **`schema.durcissementBase`** instead: it asks the
+database, so it answers a global fact.
+
+| `durcissementBase` | meaning |
+|---|---|
+| `applique` | migration 0018 is in the database — safe to run with the strict door closed |
+| `absente` | 0018 is missing: apply it **before** setting `PLAYER_PRESENCE_STRICT`, or bootstraps will be refused with `503` |
+| `indetermine` | the question could not be asked — neither a yes nor a no |
+
+The probe writes nothing: it calls the function with `p_anon_cap = 0`, so a non-existent row exits
+through the *capped* branch and returns before the insert. A real-Postgres test asserts that no row
+appears. A host missing 0018 is also logged once an hour, so an idle instance still finds out.
+
 That parameter **is** the one part of this card that needs the database, and only when you ask for
 it. `verdict` is then one of:
 

package/docs/README.md

@@ -0,0 +1,42 @@
+# Documentation
+
+Nine documents, three readers. Start with the one that matches what you are trying to do —
+none of them assumes you have read the others.
+
+## You are integrating the player into an application
+
+| Document | What it gives you |
+|---|---|
+| [`ARCHITECTURE.md`](ARCHITECTURE.md) | The one idea that holds the design: the core knows nothing about its host. Read this first. |
+| [`API.md`](API.md) | What a host can call, and what it must implement. |
+| [`HOST-CONTRACT.md`](HOST-CONTRACT.md) | The binding contract, with the dated journal of every boundary change. It ships **inside the package**: `require.resolve("discovery-media-player/contrat")`. |
+
+## You are running an instance
+
+| Document | What it gives you |
+|---|---|
+| [`CONFIGURATION.md`](CONFIGURATION.md) | Every environment variable. An instance is described entirely by its environment — there is no configuration file, on purpose. |
+| [`MIGRATIONS.md`](MIGRATIONS.md) | What happens to a database **already in service** when the player expects a newer schema. (French.) |
+| [`RETENTION.md`](RETENTION.md) | The declared perimeter of data retention: every personal-data column has a written policy, and CI enforces that the list is complete. Also an export of the package: `require.resolve("discovery-media-player/retention")`. (French.) |
+
+## You are evaluating the project
+
+The external audit trail is public, unedited, and kept in the state it was received —
+an audit rewritten after the fact is no longer a trace. Findings and their fixes are
+tracked version by version in the [CHANGELOG](../CHANGELOG.md).
+
+| Document | What it is |
+|---|---|
+| [`AUDIT-2026-08-14-RAPPORT.md`](AUDIT-2026-08-14-RAPPORT.md) | First external audit, on `0.1.17`. Historical. (French.) |
+| [`AUDIT-2026-08-14-SUIVI.md`](AUDIT-2026-08-14-SUIVI.md) | The follow-up ledger: done, decided-but-not-done, and rejected-with-reason. Historical. (French.) |
+| [`AUDIT-2026-08-15-SECONDE-PASSE.md`](AUDIT-2026-08-15-SECONDE-PASSE.md) | Second pass, on `0.1.26` — including what the first follow-up had marked too optimistically. Historical. (French.) |
+
+## Work in progress
+
+| Document | What it is |
+|---|---|
+| [`SPEC-MEMBRE-INJECTE.md`](SPEC-MEMBRE-INJECTE.md) | A specification sent to a host for agreement **before** the contract moves. Nothing in it is implemented. (French.) |
+
+Documents marked *(French)* are internal working documents; everything an integrator or an
+operator needs day to day is in English. The reasoning behind that split is at the end of the
+[README](../README.md#contributing).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "discovery-media-player",
-  "version": "0.1.119",
+  "version": "0.1.120",
   "description": "Self-hosted document viewer: per-recipient tracked links, reading analytics, live presentation. The core knows nothing about the application hosting it — everything it borrows arrives through an injected context.",
   "keywords": [
     "pdf-viewer",

package/server/presentations.js

@@ -1245,4 +1245,4 @@ async function listPresentationsForDoc(docId, email, isAdmin, autoriseLarge) {
 module.exports = {
   reacteurDepuisJeton,
   purgerPerimees,
-  messagePublic, CHAMPS_PUBLICS, etatDurcissementBootstrap, cheminPieceJointe, init, createPresentation, getPresentation, setPage, endPresentation, addMessage, listMessages, toggleReaction, editMessage, deleteMessage, setChatLock, createUploadUrl, reclaimPresentation, touchPresentation, listActivePresentations, handoverPresentation, endPresentationByOwner, recordAttendance, presentationStats, listPresentationsForDoc, switchPresentationDoc, setPresentationContent , STALE_MS};
+  messagePublic, CHAMPS_PUBLICS, etatDurcissementBootstrap, signatureAbsente, cheminPieceJointe, init, createPresentation, getPresentation, setPage, endPresentation, addMessage, listMessages, toggleReaction, editMessage, deleteMessage, setChatLock, createUploadUrl, reclaimPresentation, touchPresentation, listActivePresentations, handoverPresentation, endPresentationByOwner, recordAttendance, presentationStats, listPresentationsForDoc, switchPresentationDoc, setPresentationContent , STALE_MS};

package/server/schema.js

@@ -315,6 +315,7 @@ async function vraimentSonderTout() {
   const etat = etatDuSchema();
   await ajouterSansRang(etat);
   await ajouterPresence(etat);
+  await ajouterDurcissement(etat);
   return etat;
 }
 
@@ -343,6 +344,65 @@ async function vraimentSonderTout() {
 // DÉCLARE la condition de validité, plutôt qu'un qu'on croirait inconditionnel. (relevé 2e hôte)
 const PLAFOND_SANS_RANG = 1000;
 
+// ⚠️ 0018 EST UNE PROPRIÉTÉ DE LA BASE — ELLE DOIT SE DEMANDER À LA BASE.
+//
+// `presenceDurcissement` (carte) est un RAPPORT D'EXÉCUTION : il dit ce que CE processus a constaté
+// en servant des bootstraps. Sur une instance au repos il rend « inconnu », et c'est juste — mais
+// inutilisable comme contrôle avant déploiement, où la question est « la migration est-elle là ? ».
+// Nous avions même écrit une consigne de pré-vol qui l'exigeait : un hôte la suivant à la lettre
+// aurait lu « pas degrade, donc j'y vais » et découvert le refus à la première présentation, c'est-
+// à-dire au pire moment. On avait bâti un champ qui refuse de se prononcer sans observation, puis
+// placé ce champ au centre d'une procédure qui exige une réponse. (Relevé par le second hôte.)
+//
+// ⚠️ LA SONDE N'ÉCRIT RIEN, ET CE N'EST PAS UN ESPOIR : avec `p_anon_cap = 0`, une ligne inexistante
+// part par la branche « capped » de 0018 (`if v_count >= p_anon_cap then return ... ; return; end if;`)
+// et la fonction rend AVANT son `insert`. Le slug de sonde porte une espace — donc il ne peut jamais
+// être un slug réel (contrat `^[A-Za-z0-9_-]{1,64}$`), et ne peut pas heurter une vraie présence.
+// Un test de base (Postgres réel) vérifie qu'aucune ligne n'apparaît.
+const SLUG_SONDE_DURCISSEMENT = "sonde durcissement";
+
+async function ajouterDurcissement(etat) {
+  const corps = {
+    p_slug: SLUG_SONDE_DURCISSEMENT, p_key: "sonde", p_ip_hash: null, p_page: 1,
+    p_name: "", p_avatar: "", p_is_member: false, p_is_presenter: false,
+    p_max_gap_ms: 0, p_anon_cap: 0, p_has_token: null, p_only_if_unclaimed: true,
+  };
+  try {
+    await PLAYER.db.request("rpc/player_attendance_bump", { method: "POST", body: corps });
+    etat.durcissementBase = "applique";
+  } catch (erreur) {
+    // ⚠️ TROIS ISSUES, ET LA TROISIÈME N'EST PAS UNE DES DEUX AUTRES. Seule la signature absente
+    // prouve que 0018 manque ; une panne réseau ou un 500 ne prouvent RIEN, et les compter comme
+    // « absente » serait le défaut qu'on a mis trois versions à retirer d'ailleurs.
+    let absente = false;
+    try { absente = require("./presentations.js").signatureAbsente(erreur); } catch { /* module absent */ }
+    etat.durcissementBase = absente ? "absente" : "indetermine";
+    // ⚠️ ET ON LE DIT, PAS SEULEMENT DANS LA CARTE. Une garde de ce dépôt refuse qu'une écriture soit
+    // rattrapée en silence, et elle a raison ici pour une raison qu'elle ne pouvait pas connaître :
+    // c'est ce journal qui prévient un hôte à qui 0018 manque SANS qu'aucune présentation ne tourne
+    // — exactement le cas où le rapport d'exécution reste muet, et où l'exploitant ne saura rien
+    // avant la première présentation. Une fois par heure : la carte est publique, donc appelable en
+    // boucle, et un journal sans frein deviendrait une arme.
+    try {
+      if (await PLAYER.limits.allow("schema:durcissement-absent", 1, 3600)) {
+        PLAYER.errors.capture(new Error(
+          absente
+            ? "migration 0018-bootstrap-non-usurpable.sql ABSENTE : les bootstraps de présence ne "
+              + "sont pas contrôlés. N'armez pas PLAYER_PRESENCE_STRICT avant de l'appliquer — il "
+              + "refuserait alors les bootstraps en 503."
+            : "sonde de durcissement (0018) sans réponse exploitable : ni confirmée, ni infirmée — "
+              + ((erreur && erreur.message) || erreur),
+        ), { route: "schema" });
+      }
+    } catch { /* jamais bloquant */ }
+  }
+  etat.durcissementBaseCouvre =
+    "propriété de la BASE (migration 0018), globale à toutes les instances — à ne pas confondre avec "
+    + "presenceDurcissement, qui est ce que CE processus a constaté en servant des bootstraps. "
+    + "C'est ce champ-ci qu'on lit AVANT un déploiement ; « indetermine » = la question n'a pas pu "
+    + "être posée, ce n'est ni un oui ni un non.";
+}
+
 async function ajouterSansRang(etat) {
   const r = reponses.get("doc_presentation_messages.mod_seq");
   if (!r || !r.present) return;