Commit Graph
344 Commits
Author SHA1 Message Date
J3vb cb59109c98 updated readme 2026-04-05 08:50:01 +02:00
J3vb 9d0e9d95ec Merge pull request #101 from arcadia16/main
Add tech stack badges to the ReadMe
2026-04-02 16:24:57 +02:00
Arcadia 40f8f68297 Add tech stack
Dropped some badges, related to the project tech stack
2026-04-02 17:11:12 +03:00
J3vb f7f5059a3a docs: sync README from dev — move Quick Start up, add IPv4 note 2026-04-02 15:50:50 +02:00
J3vb 68d3aefad5 Merge pull request #94 from AntonPetrochenko/patch-1
Added a shields.io badge for experimental stability
2026-04-02 13:52:07 +02:00
Anton Petrochenko 8ad367d307 Added a shields.io badge for experimental stability 2026-04-02 17:49:11 +06:00
jevb e26b5e7d9a fix: correct GitHub username in README issues link 2026-04-02 11:26:23 +02:00
jevb 74eab7ab0b docs: add early alpha warning banner to README 2026-04-02 11:24:10 +02:00
J3vb 694007d5a4 Merge pull request #87 from J3vb/dependabot/npm_and_yarn/Client/tauri-client/livekit-client-2.18.0
chore(deps): bump livekit-client from 2.17.3 to 2.18.0 in /Client/tauri-client
2026-03-30 23:49:15 +02:00
J3vb 2e79570098 Merge pull request #86 from J3vb/dependabot/go_modules/Server/modernc.org/sqlite-1.48.0
chore(deps): bump modernc.org/sqlite from 1.46.1 to 1.48.0 in /Server
2026-03-30 23:49:08 +02:00
J3vb 1a1063973d Merge pull request #85 from J3vb/dependabot/npm_and_yarn/Client/tauri-client/typescript-eslint-8.58.0
chore(deps): bump typescript-eslint from 8.57.2 to 8.58.0 in /Client/tauri-client
2026-03-30 23:49:01 +02:00
dependabot[bot] d5bca972db chore(deps): bump livekit-client in /Client/tauri-client
Bumps [livekit-client](https://github.com/livekit/client-sdk-js) from 2.17.3 to 2.18.0.
- [Release notes](https://github.com/livekit/client-sdk-js/releases)
- [Changelog](https://github.com/livekit/client-sdk-js/blob/main/CHANGELOG.md)
- [Commits](https://github.com/livekit/client-sdk-js/compare/v2.17.3...v2.18.0)

---
updated-dependencies:
- dependency-name: livekit-client
  dependency-version: 2.18.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
2026-03-30 21:32:42 +00:00
dependabot[bot] bcbcb034f2 chore(deps): bump modernc.org/sqlite from 1.46.1 to 1.48.0 in /Server
Bumps [modernc.org/sqlite](https://gitlab.com/cznic/sqlite) from 1.46.1 to 1.48.0.
- [Changelog](https://gitlab.com/cznic/sqlite/blob/master/CHANGELOG.md)
- [Commits](https://gitlab.com/cznic/sqlite/compare/v1.46.1...v1.48.0)

---
updated-dependencies:
- dependency-name: modernc.org/sqlite
  dependency-version: 1.48.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
2026-03-30 21:32:33 +00:00
dependabot[bot] 5045346c1a chore(deps): bump typescript-eslint in /Client/tauri-client
Bumps [typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint) from 8.57.2 to 8.58.0.
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-eslint/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.58.0/packages/typescript-eslint)

---
updated-dependencies:
- dependency-name: typescript-eslint
  dependency-version: 8.58.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
2026-03-30 21:32:33 +00:00
jevb 0635a2e25e docs: add screenshots to README
Show client chat view, login page, and admin panel dashboard.
2026-03-30 22:36:38 +02:00
jevb 8ed283eba8 chore: gitignore internal docs subdirectories
Exclude docs/CODEMAPS/, docs/designs/, docs/research/,
and docs/superpowers/ from version control.
2026-03-30 22:32:31 +02:00
jevb ec5775910f docs: add public documentation for contributors and users
Created 12 public docs derived from internal vault:
- Setup guides: quick-start, server-configuration, livekit-setup, deployment
- Networking: port-forwarding, tailscale
- References: api, protocol, schema, client-architecture
- Community: contributing, security

Updated .gitignore to only exclude docs/brain/ (internal vault),
allowing docs/ to be tracked. Updated README with expanded quick
start, voice/video setup, networking ports, and doc links.
2026-03-30 22:31:06 +02:00
J3vb 65dc00cad0 Merge pull request #84 from J3vb/dev
v1.0.0 — OwnCord first public release
2026-03-30 22:17:14 +02:00
jevb 0e29d98d9d fix: resolve CI failures — eslint peer dep conflict and errcheck lint errors
Downgrade @eslint/js to ^9.39.4 to match eslint ^9 peer requirement.
Fix 7 unchecked .Close() return values flagged by errcheck linter.
2026-03-30 21:54:24 +02:00
jevb f9c7470345 fix: admin panel CSP blocking inline event handlers and boolean toggle display
CSP nonce policy blocked all onclick handlers, preventing navigation.
Switched to 'unsafe-inline' (admin panel is IP-restricted). Also fixed
boolean settings display — toggles now accept '1' from the database.
2026-03-30 21:48:14 +02:00
jevb d65d8b13e5 updated gitignore 2026-03-30 21:07:50 +02:00
jevb aea439b5e7 chore: clean up tracked files for v1.0.0 public release
- Remove docs/, CLAUDE.md, DESIGN.md, TODOS.md, CLIENT-REVIEW.md from
  git tracking (internal files moved to local vault)
- Remove node_modules vitest cache from tracking
- Remove HTML mockup files from tracking
- Update .gitignore: allow .github/ (except copilot instructions),
  ignore internal dev files, add node_modules/
2026-03-30 21:05:28 +02:00
jevb 795ed48ec9 docs: v1.0.0 release prep — version bump, license, README overhaul
- Bump version to 1.0.0 across package.json, Cargo.toml, tauri.conf.json
- Add AGPL-3.0 LICENSE file
- Update README with missing features (2FA, DMs, video grid, stream preview,
  theming, auto-login, account deletion, observability)
- Remove internal Copilot Assets section from README
- Remove soundboard reference (not implemented)
- Add account deletion and video grid docs to CLAUDE.md
2026-03-30 20:54:05 +02:00
jevb 4b28f0e28d feat: Discord-style video grid with fixed 16:9 aspect ratio
Replace CSS grid-template-columns with a JS layout calculator that
tries every column count and picks the arrangement maximising tile
area while preserving exact 16:9 ratio. ResizeObserver triggers
recalculation on container resize. Tests updated to exercise the
pure computeGridLayout function directly.
2026-03-30 20:13:34 +02:00
jevb 5d0af7c03e feat: sidebar stream preview + screenshare focus fix
- Add hover/focus preview for remote voice users' camera/screenshare
  streams in the voice channel sidebar. Preview reuses already-subscribed
  LiveKit tracks (zero bandwidth cost). Full-width 16:9 preview with
  neon border-glow treatment matching DESIGN.md.

- Fix screenshare focus bug: clicking a screensharing user now correctly
  focuses the screenshare tile (userId + SCREENSHARE_TILE_ID_OFFSET)
  instead of the camera tile.

- Extract SCREENSHARE_TILE_ID_OFFSET to shared lib/constants.ts (was
  duplicated in VideoModeController.ts and MainPage.ts).

- New lib/streamPreview.ts module: attachStreamPreview() with 300ms
  debounce, track renegotiation detection, autoplay failure handling,
  scroll collapse, keyboard accessibility (focusin/focusout), ARIA
  labels, and full AbortSignal cleanup.

- Placeholder shows "Join to preview" with click-to-join behavior.
  Live video preview is also clickable to watch the stream.

- 22 new tests (16 stream-preview + 6 channel-sidebar).
2026-03-30 19:12:36 +02:00
jevb e4bb54405b docs: regenerate codemaps from current codebase
6 codemaps updated with accurate line counts, routes, WS message
types, schema, and test infrastructure from 203 scanned source files.
2026-03-30 16:47:19 +02:00
jevb 1a8938f525 docs: update session log with TS error fix details 2026-03-30 16:37:28 +02:00
jevb 5c616d53fe test: fix 10 test quality bugs (BUG-058–067) and resolve 115 TS type errors
BUG-058: Unblock prod-build E2E — created tsconfig.build.json excluding
tests from the production build. Added typecheck/typecheck:build scripts.

BUG-059: Harden native E2E — CDP timeout 30→60s with exponential backoff,
config timeouts doubled (test 120s, action 30s, nav 45s, expect 15s).

BUG-060: Add 25 Rust unit tests across commands.rs, ws_proxy.rs,
livekit_proxy.rs, credentials.rs (was zero behavioral tests).

BUG-061/067: Add behavioral assertions to server coverage_boost_test.go —
GracefulStop verifies client count, channel_focus verifies no error sent.

BUG-062: Upgrade low-signal test assertions in livekit-session,
device-manager, channel-controller (no-op checks → state checks).

BUG-063: Consolidate native E2E skip gates into beforeEach blocks
(voice-controls 7→1 skip, channel-navigation 4→1 skip).

BUG-064: Add 9 integration tests for channel CRUD, member lifecycle,
DM open/close, and presence events.

BUG-065: Replace 3 fixed sleeps with condition-based waits in E2E specs.

BUG-066: Verified toast/audio tests already cleaned in prior session.

TypeScript: Fix 115 type errors across 21 test files — add non-null
assertions for strict indexing, fix mock typing (vi.fn<any>()), add
missing fields (color, version, deleted) to test fixtures.
2026-03-30 16:35:02 +02:00
jevb cb6d3b151c yu 2026-03-30 14:24:12 +02:00
jevb c2681eb787 docs: add repo copilot assets section to CLAUDE.md and README
Documents auto-applied instructions and on-demand skills available
in .github/instructions/ and .claude/skills/.
2026-03-30 14:23:39 +02:00
jevb dc832b90a9 fix: add missing getFloatTimeDomainData mock to silence VAD timer errors
Two AnalyserNode mocks in audio-pipeline tests were missing the method,
causing unhandled TypeError when the VAD poll timer fired after test cleanup.
2026-03-30 14:23:31 +02:00
jevb 7203aad5b3 test: Phase 4 coverage — meaningful behavior tests push client to 95%
Add 231 behavior-verifying tests across 21 files. Every test validates
real user-facing behavior: message send/edit/reply, file upload with
size validation, voice join/leave/mute, DM interactions, keyboard
navigation, error handling. No padding tests.
Client coverage: 90.66% → 95.09% (2898 tests, 104 test files).
2026-03-30 14:20:05 +02:00
jevb 1ea21a325a test: Phase 3 coverage — 22 files bumped from 70-92% to 95-100%
Expand 19 existing test files with 434 new tests. All 22 target files
now at 95%+ coverage: dispatcher, ws, store, permissions, ConnectPage,
LoginForm, KeybindsTab, AdvancedTab, AppearanceTab, ChannelController,
messages.store, channels.store, notifications, embeds, context-menu,
renderers, content-parser, formatting, profiles, audioElements,
ui.store, dm.store. Client coverage: 87% → 90.66%.
2026-03-30 13:59:47 +02:00
jevb b2545c50e7 test: Phase 2 coverage — below-70% files now at 95-100%
Add 5 new test files and expand 5 existing ones (446 new tests).
Coverage jumps: api.ts 51→100%, connectionStats 35→100%,
deviceManager 47→100%, audioPipeline 47→99.6%, media.ts 66→99.4%,
ServerPanel 43→100%, AccessibilityTab 59→100%, OverlayManagers
56→100%, ChatHeader 65→100%, VoiceAudioTab 63→95.5%.
Client coverage: 81% → 87%.
2026-03-30 13:38:20 +02:00
jevb b9ab51014f test: Phase 1 coverage — 10 zero-coverage files now at 95-100%
Add 13 new test files (337 tests) covering all previously untested
client modules: toast, preferences, roles.store, logPersistence,
ChatArea, MemberPickerModal, SidebarArea, SidebarDmHelpers,
SidebarDmSection, SidebarMemberSection. Client coverage: 72% → 81%.
2026-03-30 13:21:29 +02:00
jevb b4f7ce9098 fix: settings tab bug fixes, expanded tests, and coverage improvements
Fix multiple bugs across settings tabs (AppearanceTab theme restoration,
AdvancedTab testability, LogsTab refresh, VoiceAudioTab device listing),
harden embeds/media/attachments with cache validation, add logPersistence
rotation logic, and add 8 new test files with expanded test cases for
existing tests. Brings client test coverage from ~68% to ~72%.
2026-03-30 12:42:31 +02:00
jevb e52b62482c fix: TypeScript build errors in embeds.ts and totp-settings test
- embeds.ts: non-null assert on validated octets array access
- embeds.ts: cast fetchOpts for Tauri-specific `danger` property
- totp-settings.test.ts: cast closest() result to HTMLElement for style access
2026-03-29 21:34:54 +02:00
jevb 90b4f268e2 feat: TOTP 2FA settings UI, server hardening, full validation pass
Client:
- Add TOTP enrollment/disable UI in Settings > Account (AccountTab.ts)
- Fix api.ts enableTotp/confirmTotp/disableTotp to require password param
- Add totp_enabled field to UserWithRole type
- Wire SettingsOverlay TOTP callbacks through MainPage and ConnectPage
- 27 new tests: totp-settings (18), api TOTP methods (6), auth store (3)

Server:
- Fix targetBoolSetting to default false on ErrNotFound (fresh DB compat)
- Fix admin settings test: boolean keys use valid values, not "testvalue"
- Add require_2fa validation to settings handler (normalizeSettingUpdates)
- Remove unused authenticateAdmin from logstream.go

Docs:
- Mark DOCUMENTATION_AUDIT Critical Finding #1 as RESOLVED
- Update CLAUDE.md Key Features with 2FA/TOTP bullet
- Update CLIENT-ARCHITECTURE.md with TOTP components
- Update CHATSERVER.md login flow and rate limiting table
- Create session log, update task tracking (T-192–T-201)
2026-03-29 21:31:18 +02:00
jevb 823b566374 chore: remove accidental empty file 2026-03-29 19:42:07 +02:00
jevb 14aec79b11 docs: update task tracking and dashboard for v1.3.0
- Mark code quality tasks T-190, T-191 complete in Backlog
- Mark unified sidebar tasks T-161-T-164 verified
- Update Dashboard with documentation section
- Move completed tasks to Done
2026-03-29 19:40:47 +02:00
jevb cdb56f1619 chore: ESLint config, 61 lint fixes across 22 client files, CLAUDE.md update
- Add ESLint v9 flat config with typescript-eslint
- Fix no-floating-promises, no-unused-vars, consistent-return across client
- Refactor livekitSession: delegate entirely to AudioPipeline (1438→1171 lines)
- Add 7 delete-account UI tests in settings-overlay.test.ts
- Update CLAUDE.md with latest features and project structure
- Update .gitignore
2026-03-29 19:40:11 +02:00
jevb 6b6a6fbea8 refactor: context propagation, LogAudit deadlock fix, ESLint v9, code quality
- Propagate context.Context from WS upgrade through all 17 handlers
- Add ExecContext/QueryRowContext/QueryContext/BeginTx to DB wrapper
- Fix LogAudit deadlock: move audit writes after tx.Commit to avoid
  SQLite write-lock contention (TestAdminAPI_PatchUser_UnbanUser)
- Add ESLint v9 with no-floating-promises, no-unused-vars
- Refactor livekitSession.ts: remove duplicate audio pipeline (267 lines)
- Add delete account UI tests (7 tests)
- Expand WS integration tests
2026-03-29 19:39:46 +02:00
jevb 2976863ad0 fix: atomic invite registration, fail-closed search, proxy-aware rate limiting
- Atomic CreateUserWithInvite prevents invite burn on failed registration
- Channel search fails closed on channel-type and override lookup errors
- Malformed FTS input returns 400 instead of 500
- Search rate limiting uses own namespace, respects trusted proxy IPs
- Login lockout keyed by forwarded client IP behind reverse proxy
- Trusted same-server OG previews re-enabled with self-signed cert support
- Normalized host matching for embeds/attachments
- Regression tests for all changes (auth, channel, embeds)
2026-03-29 19:39:22 +02:00
jevb 4bc3630cad chore: remove accidental empty files 2026-03-29 12:35:29 +02:00
jevb 4c4526e539 fix: security hardening — 45 issues from full-project Copilot audit
Critical (6):
- C1: SQL injection in VACUUM INTO backup path — strict character allowlist
- C2: Unlimited binary download in updater — 500MB LimitReader
- C3: JSON injection in SSE log stream — json.Marshal instead of concat
- C4: CSS injection via custom themes — reject () and {} in values
- C5: Silent DM message loss — error response on participant lookup failure
- C6: LiveKit URL credential leak — strip creds from diagnostics endpoint

High (11):
- H1: DB errors no longer trigger login rate-limit lockout
- H2: Permission fetch failure returns 500, not empty channel list
- H3: TOCTOU race on duplicate WS — atomic check-and-register in hub
- H5: LiveKit webhook verifies voice channel match (already implemented)
- H7: Server host address validated before storage (hostname regex)
- H8: WS message deduplication on reconnect replay (1000-entry Set)
- H9: Admin setup endpoint rate limited (5/min/IP)
- H10: Backup responses return filename only, not full path
- H11: Update binary recovery failure now alerts admin

Medium (17):
- M1: MIME type from magic bytes, not client header
- M3: Nil guard on DM broadcast recipient
- M5: LiveKit process run-done channel race fixed
- M6: Backup restore calls fsync before close
- M7: Partial download file cleaned up on error
- M8: Admin CSP uses nonce instead of unsafe-inline
- M9: Client rate limiter enforced for presence_update
- M10: Voice joinedAt not reset on double-join
- M11: Unread count skips increment during reconnect replay
- M13: Category type uses exact match, not substring
- M14: Storage LimitReader off-by-one fixed
- M15: GitHub token only sent to GitHub hosts
- M16: Content-parser ReDoS regex replaced with split approach
- M17: Audio device switch error handling added

Low (11):
- L1: CORS uses configured origins instead of wildcard
- L2: HSTS header added when TLS enabled
- L3: Consistent JSON error responses across all endpoints
- L4: File modtime from stat, not time.Now()
- L5: Malformed invite JSON returns 400
- L6: TouchSession failure logged at warn
- L8: MessageInput timers cleared on destroy
- L9: Log persistence flush errors caught
- L10: Credential save failure surfaced to user
- L11: Case-insensitive asset name matching in updater

Found by GitHub Copilot full-project review (claude-sonnet-4.6 + claude-haiku-4.5).
2026-03-29 12:35:04 +02:00
jevb 39658e919b refactor: extensibility overhaul — handler registry, permission checker, sidebar decomposition, DX improvements
Server:
- Unified permission checker (permissions/checker.go) replaces 3 duplicated implementations
- WS handler registry pattern (ws/registry.go) replaces monolithic switch (747→184 lines)
- Split handlers into domain files: handlers_chat.go, handlers_presence.go, handlers_reaction.go
- Shared message type constants (ws/message_types.go) — no more string literals
- Admin API split into helpers.go, types.go, middleware.go (api.go now 61 lines)
- Dev seed script (scripts/seed.go) with -confirm-dev safety flag
- Air hot reload config (.air.toml)
- Fix: DM attachment permission now uses participant check, not role check
- Fix: Typing broadcast now checks ReadMessages permission for non-DM channels

Client:
- Extract preferences to @lib/preferences.ts (fixes lib→component dependency)
- Extract roles to dedicated roles.store.ts (was mixed into channels store)
- Decompose SidebarArea (921→598 lines) into 4 sub-components
- Shared modal factory (lib/modalFactory.ts) with tests
- Global showToast() helper (lib/toast.ts) — 18 call sites migrated
- Protocol type constants (lib/protocolTypes.ts) synced with server
- Remove 38 unnecessary type casts across 17 files
- Component test harness (tests/helpers/test-harness.ts) with 8 tests
- Fix: DM section "View All" respects collapsed state
- Fix: Modal onClose fires on external signal abort
- Fix: savePref wrapped in try/catch for quota exceeded
- Fix: loadPref null guard added

Triple-reviewed: Claude code-review agent + OpenAI Codex CLI + GitHub Copilot
2026-03-29 12:19:08 +02:00
jevb 2d878fd8cb fix: repair 14 failing E2E tests and expand voice lifecycle coverage
Fix selector mismatches, stale mock data, and timing issues across 12
E2E spec files. Refactor helpers.ts with improved Tauri/WS mocking
utilities. Add 21 new voice lifecycle tests covering mute/deafen,
quality degradation, token refresh, camera indicators, channel
switching, and failure recovery. All 255 tests pass.
2026-03-29 10:13:04 +02:00
jevb 46cea2ac76 docs: update CLAUDE.md with voice polish changes, mark TODOS complete
- CLAUDE.md: update version to 1.3.0, add new lib/ modules
  (audioPipeline, audioElements, deviceManager), expand voice
  feature description (AudioWorklet VAD, 24h tokens, ghost
  state retry, speaker glow, device hot-swap, listen-only
  recovery, connection quality auto-expand), update metrics
  endpoint description (voice_sessions), add
  VOICE-COMPARISON-MATRIX.md to reference files
- TODOS.md: mark all 7 original items as completed, add 4
  new deferred items (simulcast, dynacast, proxy port
  exhaustion, voice E2E CI integration)
2026-03-29 08:28:54 +02:00
jevb 9f381f54e9 feat: voice/video polish — refactor, AudioWorklet VAD, bug fixes, UX improvements
Research-driven voice/video polish pass based on Discord/TeamSpeak comparison.

Refactor:
- Split livekitSession.ts (1,509 lines) into 4 modules: audioPipeline.ts,
  audioElements.ts, deviceManager.ts + facade in livekitSession.ts
- Facade pattern preserves all existing exports (zero breaking changes)

AudioWorklet VAD:
- Migrated VAD from setTimeout polling to AudioWorklet (vad-worklet.js)
- Runs on audio thread, works when app is backgrounded
- Graceful fallback to setTimeout if AudioWorklet unavailable

Bug fixes:
- Token TTL extended from 4h to 24h (eliminates fragile long sessions)
- Ghost voice state: retry with exponential backoff (3 attempts, 100-400ms)
- Client token refresh adjusted to 23h (1h before expiry)

UX improvements:
- Speaker indicator: pulsing green glow animation (speak-pulse keyframes)
- Permission recovery: "Grant Microphone" button in VoiceWidget for
  listen-only mode with listenOnly state in voiceStore
- Device hot-swap: devicechange listener with 500ms debounce, auto-fallback
  to default device, toast notification
- Camera/screenshare stop: toast feedback on disable
- Connection quality: auto-expand stats pane on poor/bad quality (3s debounce)
- Bandwidth display: human-readable Mbps in stats pane (formatBitrate)

Observability:
- Voice session metrics: voice_sessions counter on /api/v1/metrics endpoint

Tests:
- 55 new unit tests for audioPipeline + audioElements modules
- 22 new Go tests for HTTPS proxy (WebSocket upgrade, origin validation,
  path blocking)
- 11 new voice E2E tests (lifecycle, widget, speaker indicators)
- Pre-refactor snapshot tests for livekitSession public API

Docs:
- DESIGN.md: full design system documentation (tokens, typography, colors,
  spacing, motion, voice-specific tokens)
- VOICE-COMPARISON-MATRIX.md: 25-behavior comparison across Discord,
  TeamSpeak, Guilded
- voice-video-polish.md: CEO plan with scope decisions
2026-03-29 00:51:54 +01:00
jevb 7b7c62c616 docs: update CLAUDE.md with observability features and new files
- Add observability & debugging to Key Features section
- Add diagnostics_handler.go and logPersistence.ts to project structure
2026-03-28 21:09:00 +01:00