jevb
5cec992c1f
chore: add dev tooling — Stryker, gremlins, k6, toxiproxy, Coraza WAF, Zod
...
Install and configure mutation testing (Stryker for client, go-gremlins
for server), load testing (k6), chaos testing (toxiproxy), WAF middleware
(Coraza with OWASP rules, opt-in via waf_enabled config), and Zod for
runtime schema validation. All tools verified building cleanly.
2026-04-01 13:49:06 +02:00
jevb
447a4543e7
chore: remaining server changes (code quality, go mod tidy)
...
Go mod tidy, minor server-side adjustments from security verification
and code quality cleanup pass.
2026-04-01 11:38:33 +02:00
jevb
0e29d98d9d
fix: resolve CI failures — eslint peer dep conflict and errcheck lint errors
...
Downgrade @eslint/js to ^9.39.4 to match eslint ^9 peer requirement.
Fix 7 unchecked .Close() return values flagged by errcheck linter.
2026-03-30 21:54:24 +02:00
jevb
39658e919b
refactor: extensibility overhaul — handler registry, permission checker, sidebar decomposition, DX improvements
...
Server:
- Unified permission checker (permissions/checker.go) replaces 3 duplicated implementations
- WS handler registry pattern (ws/registry.go) replaces monolithic switch (747→184 lines)
- Split handlers into domain files: handlers_chat.go, handlers_presence.go, handlers_reaction.go
- Shared message type constants (ws/message_types.go) — no more string literals
- Admin API split into helpers.go, types.go, middleware.go (api.go now 61 lines)
- Dev seed script (scripts/seed.go) with -confirm-dev safety flag
- Air hot reload config (.air.toml)
- Fix: DM attachment permission now uses participant check, not role check
- Fix: Typing broadcast now checks ReadMessages permission for non-DM channels
Client:
- Extract preferences to @lib/preferences.ts (fixes lib→component dependency)
- Extract roles to dedicated roles.store.ts (was mixed into channels store)
- Decompose SidebarArea (921→598 lines) into 4 sub-components
- Shared modal factory (lib/modalFactory.ts) with tests
- Global showToast() helper (lib/toast.ts) — 18 call sites migrated
- Protocol type constants (lib/protocolTypes.ts) synced with server
- Remove 38 unnecessary type casts across 17 files
- Component test harness (tests/helpers/test-harness.ts) with 8 tests
- Fix: DM section "View All" respects collapsed state
- Fix: Modal onClose fires on external signal abort
- Fix: savePref wrapped in try/catch for quota exceeded
- Fix: loadPref null guard added
Triple-reviewed: Claude code-review agent + OpenAI Codex CLI + GitHub Copilot
2026-03-29 12:19:08 +02:00
jevb
3236918012
refactor: server hardening + client decomposition + protocol resilience
...
Server:
- Split monolithic voice_handlers.go into voice_join/leave/controls/broadcast
- Add metrics endpoint (admin-IP-restricted /api/v1/metrics)
- Add orphaned attachment cleanup in maintenance loop
- Add sentinel errors (db/errors.go, ws/errors.go)
- Add ring buffer for event replay on reconnect
- Add heartbeat monitoring with stale connection sweep
- Improve hub with panic recovery, graceful shutdown, seq tracking
- Typed message structs replace raw map[string]interface{}
Client:
- Decompose MainPage into ChatArea + SidebarArea controllers
- Add disposable.ts lifecycle management pattern
- Add member list right-click context menu (kick/ban/role)
- Tighten CSP (media-src, font-src, object-src, base-uri)
- Improve store with shallowEqual, 500-msg cap, batch updates
- Add search API endpoint wiring
- Fix LiveKit session cleanup and reconnection
Docs:
- Add CODEMAPS for architecture, backend, frontend, data, deps
- Add protocol-schema.json (machine-readable, 36 message types)
- Add platform research report
- Update PROTOCOL.md with seq/replay fields
2026-03-21 10:08:44 +01:00
jevb