Aeris Irides

Sat, 19 Aug 2023 20:28:06 -0700 last edited: Sun, 20 Aug 2023 03:29:35 -0700

We will connect streams federated server to OpenSimulator federated metaverse server.

Objectives:

create account will happen on streams, account will be created on OpenSimulator server.
Sync passwords when updated on streams instance.
Photos marked full perm in OS will show up on streams feed
Profile photo changed in OS will appear on streams profile and vice-versa
Notifications (@mentions, @replies, @privatemessage, etc) will popup in OS viewer.

show all 4 comments

Aeris Irides

Mon, 28 Aug 2023 19:28:36 -0700

Notifications is now working. However it will need improvements. At the moment it is mostly secure, the weakness is the admin could manipulate the URL to send bogus notification messages to the user. But we assume if the admin is rogue then the whole system is botched anyway. The issue is that the new URL is requested and issued too far often, so there should be a blanket 'auto approve' to send the URL to streams. The problem with this in that case would be the use is not necessarily authenticated to approve the auto approval. So a rogue admin (or possibly even just a user) could manipulate the system through URLs and paramenters without even being logged into or having an account on streams. It opens the door. At the moment this is not possible and the system is mostly secure, but it could be better designed in terms of convenience, but the trick is avoiding reduction in security.

Aeris Irides

Mon, 04 Sep 2023 19:08:18 -0700 last edited: Mon, 04 Sep 2023 19:09:40 -0700

I added module to associate Stellar public key, this will be used in the economy module in OpenSim.

There are some caveats with this, you don't really have to modify the SDK code but know that any guzzle errors are just dumped out on a white page with nothing else. I made some updates and posted an issue in GH. So if there is a guzzle error like a 401 or even 500 or something it will show up in the notice box instead of abandoning the user with a white screen :)

Do a
# composer update

then edit composer.json and change phpseclib version to 3.0 instead of 2

"phpseclib/phpseclib": "^3.0",

From what I can tell phpseclib 1.x, 2.x and 3.x are all still active maintained projects, but new features added in subsequent versions. From my testing it seems phpseclib 3.x runs just fine without issues/error - ith other streams components, etc.

Then add stellar-php-sdk
# composer require soneso/stellar-php-sdk

NOTE: the SDK code doesn't handle Guzzle errors, my recommendation is posted on GH but maybe there's a better way.

https://github.com/Soneso/stellar-php-sdk/issues/29

Here's the update.

streams-addons

streams-addons

Aeris Irides

Tue, 05 Sep 2023 22:50:50 -0700

i tinkered around with different ideas like a web page browser that looks like a phone, in your hud - but it's too much of a pain to read anything that way. Also a kiosk like an ATM with a web page prim on the front, it's easier to read but totally inconvenient. Like if you're on a different grid then it's not easy to just pop out a kiosk to spend money or something.

I also looked at integrating economy / land purchases through the viewer. It's not so great and probably not worth the trouble. There are two things under helperURI, one to sell land and one to buy money. The actual balance and transfers to other AV and buying something happens through XML-RPC to the region - not the grid. This way currencies can change over regions (And they do that!) . But for this project it's totally not convenient i think, it's only usable on your parcel(s) basically.

So What I came up with is a small hud icon that listens for commands on channel 5 so you can say "/5 bal" or balance and it will show your pubkey and balances like in the attached screenshot. you can also do like a /5 bal UUID and get somebody else's pubkey and balances, which is wierd i guess because we haven't had that ability before but it's a fact of life if you have a public key to receive payments people can see how much you get. It's so cheap to make stellar accounts you could have dozens or even 100 or more if you want. So you're not walking around with 100 mlliion XLM and become a target. We aren''t storing or asking for private keys so it's safe, but why expose yourself like that.

So the idea is to have a drop-in script where if you want to 1) sell something or 2) create an NFT or 3) do some sort of contract thing then people can just click on it and it will magically open in their web-based wallet or something and they can sign the transaction if they want. It's basically like "do you want to pay blah blah blah" except that prompt happens outside the viewer.

I only plan to support one public key at first, maybe we can add more if people ask for it or it seems like a good idea. But it's easy to click and change your public key.

Aeris Irides

Wed, 06 Sep 2023 10:06:52 -0700 last edited: Wed, 06 Sep 2023 10:07:41 -0700

updated the stellar code, moving away from 'public key' in favor of account id. The account id is an ascii encoded ed25519 key and is usually the public key but there are situations where it may not be the same, for example a multi-signer account (think of joint checking account used by partners), or maybe a group, like a business account. you can set up an account with several signers and require all to sign a transaction or a majority or just one member. also, accounts can be federated.

now we are relying on the crc checksum to validate the account id instead of hitting the horizon server with a request.