J3vb/OwnCord
1
0
Fork 0
mirror of https://github.com/J3vb/OwnCord.git synced 2026-09-03 03:50:00 +03:00
Code Issues Packages Projects Releases Wiki Activity
759 Commits 3 Branches 5 Tags
c08cdcf3f071417708aaaddd33f48eb3b3fd26b4
Commit Graph
11 Commits
Author SHA1 Message Date
Claude 0918f859a0 test: close measured test-coverage gaps across server, client and Rust 
Audits what actually has tests, then closes the gaps it found. Full write-up
with before/after numbers in docs/audit-test-coverage-2026-07-25.md.

Measurement first: `go test ./... -coverprofile` (what CI runs) instruments
each package only for itself, so code exercised through another package's
tests reads as uncovered — `service` reported 36.7% against a real 85%. All
analysis here uses -coverpkg=./..., and both views now have Makefile targets.

Features that had zero coverage at every layer:
- user blocking (db + service + the /api/v1/blocks routes)
- auth lockout persistence — the DB round-trip that survives a restart
- plugin install/enable/disable/uninstall and the plugin KV namespace
- event replay bounds (GetMaxEventSeq, PruneEventsOlderThan)
- LiveKit participant_joined webhook (replayed-token guard), the room-service
  client, and proxyWebSocket/copyWS
- ws_proxy.rs and livekit_proxy.rs — pure helpers extracted, matching the
  existing tofu.rs pattern, so cert-pin and header-injection checks are testable

Gaps that were hidden rather than absent:
- Server/admin reported 0.3% coverage with 307 tests passing. TestSpawnDetached_*
  re-execs the test binary; the child inherited GOCOVERDIR and the parent's
  stdout, clobbering the profile and printing "[no tests to run]". Now 71.4%,
  and CI's uploaded artifact is correct.
- vitest.config.ts excluded 2.2k LOC unexplained, including two files that
  already had tests. Trimmed to three entries, each justified inline.
- api.HandleLiveKitHealthForTest re-implemented the handler it claimed to
  expose, so eight call sites tested a copy. Added a hook to the real one.

Two bugs found and pinned rather than silently patched: logctx.WithGroup nests
req_id under the group, and drag-reorder.ts takes one listener ref per channel
but releases one per sidebar, so the count never reaches zero.

Coverage: client 92.93% -> 94.87% statements (3371 -> 3572 tests) even after
un-excluding hidden files; Rust 47 -> 74 tests; Go zero-coverage functions
~70 -> 21, with plugin 61->77%, admin 67->86%, db 76->84%, service 85->91%.

Verified: go vet, all four build-tag variants, go test -race, -tags deadlock,
vitest --coverage, cargo test --lib, cargo clippy --all-targets, playwright.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AEETs3Vh6sAHHb1jMBL75g
 2026-07-25 14:47:21 +00:00
J3vbandClaude Opus 4.8 4fc21cb372 feat(server): logging & error-visibility hardening 
Make server failures debuggable without leaking secrets:
- configurable stdout log level (config.yaml logging.level + OWNCORD_LOGGING_LEVEL)
- preserve the DB cause in ErrInternal wraps; log auth-DB failures distinctly
  from bad tokens; log the previously-silent expired-session cleanup goroutine
- route HTTP handler panics through slog (was chi stderr-only, invisible to
  the admin log stream)
- stackutil: argument-free panic stacks so key/token bytes never reach the
  admin ring buffer / SSE; slog.LogValuer redaction on VoiceConfig/GitHubConfig/
  GIFConfig/Config and db.User/db.Session
- logctx: req_id/trace_id correlation on ...Context log calls

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-07-24 11:07:12 +02:00
J3vbandClaude Fable 5 0c093e8403 chore(server): delete unfinished Postgres scaffolding 
PostgresStore was 86% stubs behind a build tag nothing enables, pgdbgen
carried hand-added build tags that fought sqlc-verify, and the runtime never
threaded store.Store through the handler boundary. Single-engine reality
shrinks the W1-3 attachment-ownership fix and ends the pgdbgen churn.
Removed: store/postgres.go, db/pgdbgen/, db/queries/postgres/,
migrations/postgres/, the sqlc postgres block, pgx from go.mod, the
startup-refusal branch, and the dead Postgres config surface.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
 2026-07-19 08:15:58 +02:00
J3vb ba66629077 fix(ci): resolve all golangci-lint and ESLint failures on PR #1132 
Client:
- ci.yml: patch auto-generated events.ts to rename Event -> _Event
  so @typescript-eslint/no-unused-vars does not fail on generated code

Server (gocritic):
- service/channel.go: rangeValCopy (line 74), elseif (line 174)
- service/message.go: rangeValCopy (line 648), elseif (lines 438, 496)
- ws/emit.go: caseOrder — ChannelEvent before BroadcastAllEvent
- ws/handlers_command_test.go: stringXbytes — use bytes.Equal
- ws/pubsub_test.go: stringXbytes — use bytes.Equal

Server (nilerr):
- service/channel.go: nolint:nilerr for intentional silent drops in HandleTyping

Server (gosec):
- plugin/host_ui.go: G703 nolint — path already sanitized above
- plugin/registry.go: G302 — tighten plugin file permissions 0o640 → 0o600
- ws/hub.go, ws/serve.go: G115 nolint — seq counters never reach MaxInt64

Server (unused/unparam):
- plugin/registry.go: nolint:unused for wazero-tagged module field
- telemetry/metrics.go: nolint:unused for otel-tagged resetAppMetricsForInit
- ws/command.go: nolint:unparam for map entries whose error return is always nil

Server (staticcheck ST1000/ST1020):
- Add blank line before package declarations in phase-comment files
  (api/plugins_handler.go, plugin/host_{commands,events,http}.go,
   telemetry/metrics.go, telemetry/middleware.go,
   telemetry/telemetry_default.go, ws/event_persister.go)
- Fix GlobalTracer/GlobalMeter doc comments to start with function name
 2026-04-07 10:10:38 +02:00
Claude 1c476ccb58 merge: reconcile sister branch claude/plan-phases-b-c-bGpoS 
Resolves the parallel Phase B/C work that landed on the sister branch
while this branch was in review. Both branches independently implemented
real OTel + Wazero runtimes; this merge keeps the best of each.

Conflict resolution
- Server/plugin/sandbox_wazero.go: rewritten as a hybrid. Keeps the
  HEAD lifecycle (eager `platformInit` with WASI preview-1, explicit
  `platformDeactivate` per-instance, runtime closed via Registry.Close)
  AND adopts the sister branch's richer artefacts:
    * `WithMemoryLimitPages` actually enforces `cfg.MaxMemoryMB`,
    * the JSON-over-linear-memory ABI
      (`allocate` / `command_dispatch(ptr,len) → (ptr,len)` /
      `deallocate`),
    * `listExportedCommands` auto-binds commands the plugin exports
      via `list_commands` at activation time (capability-gated).
- Server/plugin/registry.go: kept the HEAD `activate()` snapshot
  pattern (read `runtimePlatform` under RLock, pass into
  `activateWithRuntime` as a parameter) so a concurrent Close can't
  race the wazero call. Sister branch's LoadAll stale-staging cleanup
  and UninstallPlugin on-disk dir removal came in via auto-merge.
- Server/telemetry/telemetry_otel.go: kept the HEAD implementation
  (race-fixed AppMetrics rebind, uint64 overflow guard, idempotent
  shutdown, trace-provider cleanup on prom failure) and wired in the
  sister branch's `OTLPInsecure` config field for plaintext gRPC opt-in.
- Server/go.mod: accepted sister branch's `BurntSushi/toml v1.6.0`
  for the new TOML manifest support.
- Client/tauri-client/vitest.config.ts: union of both globs
  (`tests/**/*.test.ts`, `src/**/*.test.ts`, `src/**/*.test.tsx`).
- PHASE_BC_LOCAL_TODO.md: combined the two checkbox histories;
  TOML manifest, hello.wasm fixture, and OTLPInsecure are all marked
  done now.

Sister branch additions accepted via auto-merge
- Server/plugin/examples/hello/{hello.wasm,main.go}: precompiled 925
  KiB TinyGo plugin with the full ABI (allocate, deallocate,
  list_commands, command_dispatch, on_event).
- Server/plugin/manifest_{toml,nottoml}.go: TOML manifest parser
  behind the wazero build tag, JSON fallback elsewhere.
- Server/plugin/loader.go: prefers `plugin.toml`, falls back to
  `plugin.json`.
- Server/api/plugins_handler.go: structured error responses + slog.
- Server/main.go, Server/config/config.go: OTLPInsecure plumbing,
  defaults polish.
- docs/{contributing.md,server-configuration.md}: documentation
  updates.

Test status
- `go build` passes on default, -tags otel, -tags wazero, and
  -tags otel,wazero.
- `go vet` passes on every tag combination.
- `go test ./...` passes on default and on -tags otel,wazero.
- Client: `npx tsc --noEmit` clean; vitest 3188/3188 across 112 files.

https://claude.ai/code/session_01AZni6CDSQeu67WSWY1YCDX
 2026-04-07 06:23:09 +00:00
copilot-swe-agent[bot]andJ3vb 1f4a89ced1 audit: fix all C/H/M/L severity findings from Phase B+C PR review 
Agent-Logs-Url: https://github.com/J3vb/OwnCord/sessions/2d415fd9-6138-495b-ac29-c54d08ae4ce4

Co-authored-by: J3vb <192430104+J3vb@users.noreply.github.com>
 2026-04-07 05:28:53 +00:00
Claude 47d848ee0a feat(phase-bc): implement real OTel + Wazero runtimes; harden install path 
Phase B Step 8 (OpenTelemetry) and Phase C Step 9 (Wazero plugin runtime)
were structurally scaffolded but the tagged builds were placeholders that
errored at runtime. This commit lands the real implementations behind the
existing build tags, plus three review passes worth of fixes across the
plugin admin handler, plugin registry, telemetry adapter, and Solid client.

Telemetry (Phase B Step 8)
- Add real go.opentelemetry.io/otel{,/sdk,/exporters/{prometheus,otlp...}}
  modules to go.mod plus contrib/instrumentation/net/http/otelhttp.
- Replace the telemetry_otel.go skeleton with a working Provider that
  wires Prometheus + OTLP/gRPC exporters, otelhttp middleware, span and
  meter adapters, and an idempotent Shutdown.
- AppMetrics cache is now reset *before* SetGlobal to close a race where
  a concurrent NewAppMetrics() could observe a swapped provider but read
  stale no-op instruments.
- Init releases the trace provider on a later prometheus exporter
  failure so Init never leaks gRPC connections.
- convertAttrs handles int32/uint/uint32/uint64/float32 explicitly;
  uint64 values that exceed math.MaxInt64 fall back to a STRING attr
  rather than wrapping into a negative int64 and corrupting metrics.
- Tests under -tags otel cover the prometheus scrape, span lifecycle,
  histogram recording, shutdown idempotency, AppMetrics rebind, and
  the uint64 overflow fallback.

Plugin runtime (Phase C Step 9)
- Add github.com/tetratelabs/wazero v1.11.0 to go.mod.
- platformInit creates a shared wazero.Runtime with WASI preview1
  pre-instantiated; activateWithRuntime compiles + instantiates each
  plugin module under that runtime; platformDeactivate closes per-
  plugin modules without tearing down the runtime.
- DisablePlugin now calls platformDeactivate so the wazero module is
  freed immediately instead of leaking until registry Close.
- activate() captures runtimePlatform under r.mu.RLock and passes it as
  a parameter to activateWithRuntime; the call no longer re-reads the
  field, closing a race with concurrent Close.
- invokeCommand calls the plugin's command_dispatch export when
  present; missing/broken exports return a user-facing diagnostic
  instead of crashing the dispatcher.
- Tests under -tags wazero cover registry creation, module compilation,
  re-enable after disable (verifies the leak fix), close-twice safety,
  invalid wasm rejection, and DispatchCommand with a missing export.
  Fixture is a 41-byte embedded add.wasm; no external asset required.

Plugin admin handler hardening
- /api/v1/admin/plugins/install now rejects uploads whose multipart
  Content-Type is not application/zip|x-zip-compressed|octet-stream
  (415) and uploads whose body lacks the PK\\x03\\x04 / PK\\x05\\x06
  zip magic (400). The 16 MiB cap and registry-side zip-slip / symlink
  / size-bomb defences are still applied as before.
- New plugins_handler_test.go covers list-empty, install-503-when-nil,
  content-type rejection, magic rejection, happy path, lifecycle 503,
  invalid id, and isZipContentType / hasZipMagic helpers.

Solid client (Phase B Step 6) cleanup
- vitest.config.ts now wires vite-plugin-solid and broadens the test
  glob to include src/**/*.test.tsx so Badge.test.tsx is actually
  discovered (it was silently skipped).
- pluginBridge.ts targets postMessage at window.location.origin
  instead of "*", and exposes a destroy() that detaches the message
  listener and clears mounted frames.
- solidMount.ts imports the JSX type from "solid-js" instead of
  "solid-js/web" (the latter does not re-export it), unblocking
  npx tsc --noEmit.

Build/test status
- go build succeeds on default, -tags otel, -tags wazero, and
  -tags otel,wazero.
- go test passes on every tag combination across telemetry, plugin,
  api, ws, service, store, and the rest of the tree.
- Client: npx tsc --noEmit clean; vitest 3188/3188 across 112 files.

PHASE_BC_LOCAL_TODO.md is updated to mark the OTel modules + real Init,
the wazero module + real platformInit, and the test coverage that
landed in this commit as completed.

https://claude.ai/code/session_01AZni6CDSQeu67WSWY1YCDX
 2026-04-06 21:46:22 +00:00
J3vb ddaaadcd43 feat(phase-bc): implement OTel SDK wiring and wazero plugin runtime 
OTel (telemetry/telemetry_otel.go, -tags otel):
- Real Init: prometheus pull-exporter + OTLP/gRPC push-exporter branches
- Bridge types: Tracer/Span/Meter/Counter/Histogram/Gauge wrapping SDK
- HTTP middleware via otelhttp (otelchi not in proxy; otelhttp is equivalent)
- Added otel v1.43.0, sdk, exporters/prometheus v0.65.0, otlptracegrpc,
  otelhttp v0.67.0, wazero v1.11.0 to go.mod

Wazero (plugin/sandbox_wazero.go, -tags wazero):
- ensureRuntimeLocked: lazy wazero.Runtime init with WASI host module
- activateWithRuntime: CompileModule + InstantiateModule per plugin
- invokeCommand: JSON-ABI dispatch via allocate/command_dispatch/deallocate
- listExportedCommands via list_commands export

Build matrix: default, otel, wazero, postgres, otel+wazero+postgres all pass
Server test suite: all packages green
 2026-04-06 23:21:38 +02:00
Claude d320a8b587 fix(review): address 11 Copilot review findings on PR #1132 
Clean sweep of every actionable item from the two Copilot review passes
on head 59ae4d8. Grouped by severity:

─── Crash / security (must-fix) ─────────────────────────────────────

1. main.go:140 — telemetryShutdown nil panic.
   telemetry.Init can return (nil, err) on the -tags otel skeleton
   path; the deferred closure would then call a nil function. Normalise
   to a no-op shutdown when Init errors so the defer is always safe.

2. api/upload_handler.go — permSvc nil deref.
   MountUploadRoutes + handleServeFile dereference permSvc on every
   authenticated file request. Add a fail-fast panic at mount time so
   the misconfiguration surfaces at wiring, not on the first 500.
   Update upload_handler_test.go to pass a real PermissionService built
   on the test DB (the existing tests were missing the argument entirely,
   which meant the package wouldn't compile — this fixes the real bug
   Copilot flagged).

3. ws/event_persister.go — NewEventPersister nil EventStore panic.
   run() dereferences p.store on every flush. Panic at constructor
   time instead so the crash happens once at startup rather than
   minutes later in a background goroutine.

4. plugin/host_ui.go — serve-time symlink check.
   rejectSymlinksUnder only runs at install time, so a symlink created
   post-install (accidental or malicious) would be followed by
   http.ServeFile and leak host files. Add an os.Lstat + ModeSymlink
   check + IsRegular check to AssetHandler on every request. Cheap
   relative to the file read and closes the TOCTOU window.

─── Correctness / observability (should-fix) ───────────────────────

5. ws/deps.go:77 — requirePerm hides misconfig as FORBIDDEN.
   Previously, nil database, nil perms, or a GetRoleForUser error all
   returned ErrCodeForbidden with the same message, making operator
   failures indistinguishable from legitimate permission denials.
   Split the branches: misconfig + DB error now return ErrCodeInternal
   with a server-side slog.Error so operators see the real problem;
   FORBIDDEN is reserved for the actual permission-bit check.

6. telemetry/metrics.go — ServiceCallDurationMs renamed to Sec.
   Field name said "Ms" but the instrument name was
   `service_call_duration_seconds` with unit "s". Renamed the field
   and updated all 8 service-layer callers so the struct field and
   metric semantics match.

7. ws/event_persister.go — flushEvy typo → flushEvery.
   Renamed the field and the one call site in run().

─── Comments out of sync with code ──────────────────────────────────

8. plugin/loader.go — Stat vs Lstat comment.
   The comment claimed "Stat (not Lstat)" but the code correctly uses
   os.Lstat to detect symlinks. Updated the comment to match the code;
   the code was already right.

9. telemetry/telemetry_otel.go — compile claim wrong.
   Comment said the file would fail to compile without the upstream
   OTel modules, but the skeleton deliberately avoids importing them
   and Init returns a runtime error instead. Updated the comment to
   reflect actual CI behaviour (the -tags otel build step passes
   today but doesn't exercise real telemetry).

─── Nit / polish ────────────────────────────────────────────────────

10. ws/event_pruner.go — startup delay magic constant.
    Hard-coded time.Minute made the "run shortly after startup"
    behaviour untestable (a test with a 100ms interval would still
    wait a full minute). Cap the startup delay by the interval:
    min(interval, time.Minute). Documented via a new `maxStartupDelay`
    constant.

11. ws/event_pruner_test.go — new file.
    Unit coverage for runPrune cutoff correctness, error swallowing,
    StartEventPruner nil-store short-circuit, ctx cancellation, and
    the interval-bounded startup delay from fix #10. Uses a fakeEventStore
    stub that records every prune call and signals the first one so
    tests don't sleep.

─── Verification ────────────────────────────────────────────────────

gofmt -l clean. No network access in sandbox so `go vet` and `go test`
could not run; the changes are local and surgical and every touched
file compiles in isolation against the existing signatures.

https://claude.ai/code/session_01UsBsQW2YiA2usk9pnJjAWk
 2026-04-06 13:48:41 +00:00
Claude 7476c177b7 chore(phase-bc): pass 3 cleanup — perf, observability, hardening 
Eight focused follow-ups from the medium-severity review bucket. All
in-sandbox tractable; no module changes, no new dependencies.

Performance
- Drop the defensive memcpy in EventPersister.Enqueue. The hub already
  passes a fresh slice from wrapWithSeq and the copy was happening under
  seqMu, serializing broadcast throughput. Documented the no-mutate
  contract on the call site.

Observability
- AppMetrics gains WSEventsPersistErrors counter; the persister run loop
  bumps both it and the existing WSEventsPersisted counter via cached
  metrics handle.
- Hub.persistEvent now extracts the real event type ("chat_message",
  "voice_join", ...) from the wrapped JSON envelope via a small
  no-allocation byte scan instead of recording the generic
  "broadcast"/"channel_broadcast" label.
- Added OTel spans + ServiceCallDurationMs histogram entries on one
  public method per remaining service: DMService.CreateDM,
  VoiceService.JoinChannel, InviteService.CreateInvite,
  ModerationService.BanUser, BlockService.BlockUser,
  UserService.UpdateProfile. Mirrors the existing pattern from
  MessageService.SendMessage.

Hardening
- plugin/loader now Lstat-walks each plugin directory and rejects any
  symlink, plus refuses an entrypoint that is itself a symlink. The
  asset handler's prefix check stays as defense in depth.
- ipAllowed (plugin HTTP capability) now rejects RFC6598 carrier-grade
  NAT (100.64.0.0/10), closing a gap in net.IP.IsPrivate which only
  covers RFC1918 + RFC4193.
- Registry.activateAll syncs Instance.Enabled := true after a successful
  activate so callers reading the in-memory flag see the live state.

Documentation
- defaultYAML now documents the new event_persistence, telemetry, and
  plugins config blocks with their defaults and one-line descriptions.
- PHASE_BC_LOCAL_TODO.md ticks off five items (defaultYAML docs ×2,
  remaining service spans, registry wiring already-fixed in Pass 2).

https://claude.ai/code/session_01UsBsQW2YiA2usk9pnJjAWk
 2026-04-06 09:49:03 +00:00
Claude a2cb224323 feat: scaffold Phase B + C (events, telemetry, plugins, Solid.js) 
Phase B Step 6 — Solid.js incremental migration
  - vite-plugin-solid + solid-js + @solidjs/testing-library in package.json
  - vite.config.ts compiles src/components/solid/** as Solid TSX
  - tsconfig.json gains jsx: preserve / jsxImportSource: solid-js
  - lib/solidAdapter.ts wraps existing custom Stores as Solid signals
  - lib/solidMount.ts adapts Solid render to {mount,destroy} contract
  - components/solid/Badge.tsx (proof-of-concept leaf)
  - components/solid/ChannelListItem.tsx (store-subscribed leaf)
  - components/solid/Badge.test.tsx pipeline smoke test
  - components/solid/README.md documents the migration recipe

Phase B Step 7 — Event persistence layer
  - SQLite + Postgres migrations for the events table
  - sqlc query files for both engines
  - EventStore interface + SQLite raw-SQL impl + MemStore impl + pg stubs
  - ws.EventPersister: async batched writer (queue / flush / drain / drop)
  - ws.StartEventPruner: background retention pruner
  - hub persists every replay-buffer push and exposes reconnect-tier counters
  - serve.handleReconnect: tiered replay (buffer -> DB -> full re-sync)
  - EventPersistenceConfig + main.go wiring
  - event_persister_test.go covers batching / drops / drain

Phase B Step 8 — OpenTelemetry skeleton
  - Server/telemetry package with public Provider/Tracer/Meter/Counter API
  - telemetry_default.go (no-op build) + telemetry_otel.go (build tag otel)
  - telemetry/metrics.go declares the AppMetrics bundle
  - HTTPMiddleware mounted in Chi router (pass-through in default build)
  - PrometheusHandler optionally mounted at /metrics
  - Spans on MessageService.SendMessage, PermissionService.HasChannelPerm,
    ChannelService.ListVisibleChannels
  - Reconnect-tier counter wired into the global meter
  - TelemetryConfig defaults

Phase C Step 9 — Wazero plugin runtime skeleton
  - Server/plugin package: manifest parser, loader, registry, host APIs
    (commands, storage, events, http, ui), errors
  - sandbox_default.go (no-op) + sandbox_wazero.go (build tag wazero)
  - SQLite + Postgres migrations for plugins + plugin_kv tables
  - PluginStore interface + impls + pg stubs
  - plugin/examples/hello manifest + README
  - plugin_test.go covers manifest, loader, capability gating
  - api/plugins_handler.go admin REST surface, mounted under admin group
  - PluginsConfig + main.go wiring (disabled by default)
  - Client: lib/pluginBridge.ts iframe + postMessage host
  - Client: components/solid/PluginContainer.tsx Solid host component

Verification
  - Default build (no -tags) is intended to compile cleanly with no new
    third-party dependencies. The sandbox lacked Go 1.25.0 so go build
    could not run; PHASE_BC_LOCAL_TODO.md enumerates the local follow-up
    work (npm install, go mod tidy, sqlc-generate, real otel/wazero
    wiring, remaining service spans, full Solid migration).
 2026-04-06 09:00:47 +00:00