 J3vbandClaude Fable 5
|
d880b64d64
|
test: audit 2026-08-19 — fix stale tests, close coverage gaps (#1397)
* test(server): admin/handlers/channels — test-audit 2026-08-19 fixes
* test(server): api/constants — test-audit 2026-08-19 fixes
* test(server): api/middleware — test-audit 2026-08-19 fixes
* test(server): api/waf — test-audit 2026-08-19 fixes
* test(server): auth/totp/encrypt — test-audit 2026-08-19 fixes
* test(server): db/session/expiry/test — test-audit 2026-08-19 fixes
* test(server): migrations/030/attachments/unlink/on/message/delete — test-audit 2026-08-19 fixes
* test(server): updater/download — test-audit 2026-08-19 fixes
* test(server): ws/handlers_command — test-audit 2026-08-19 fixes
* test(server): ws/hub/broadcast — test-audit 2026-08-19 fixes
* test(server): ws/hub/events — test-audit 2026-08-19 fixes
* test(server): ws/livekit/webhook — test-audit 2026-08-19 fixes
* test(server): ws/voice/controls — test-audit 2026-08-19 fixes
* test(server): ws/voice/join — test-audit 2026-08-19 fixes
* test(server): ws/voice/moderation — test-audit 2026-08-19 fixes
* test(rust): src-tauri/src/commands.rs — test-audit 2026-08-19 fixes
* test(rust): src-tauri/src/secret_store.rs — test-audit 2026-08-19 fixes
* test(rust): src-tauri/src/update_commands.rs — test-audit 2026-08-19 fixes
* test(client): src/components/ChannelSidebar.ts — test-audit 2026-08-19 fixes
* test(client): src/lib/ws.ts — test-audit 2026-08-19 fixes
* test(rust): src-tauri/src/credentials.rs — test-audit 2026-08-19 fixes
* test(rust): src-tauri/src/tofu.rs — test-audit 2026-08-19 fixes
* test(client): src/lib/hostValidation.ts — test-audit 2026-08-19 fixes
* test(client): src/lib/rate-limiter.ts — test-audit 2026-08-19 fixes
* test(client): src/pages/connect-page/LoginForm.ts — test-audit 2026-08-19 fixes
* test(client): src/pages/main-page/SidebarArea.ts — test-audit 2026-08-19 fixes
* test(client): src/stores/voice.store.ts — test-audit 2026-08-19 fixes
* test(client): tests/browser/smoke.test.ts — test-audit 2026-08-19 fixes
* test(client): tests/unit/media.test.ts — test-audit 2026-08-19 fixes
* test(client): tests/unit/renderers.test.ts — test-audit 2026-08-19 fixes
* test(client): src/components/UserProfilePopup.ts — test-audit 2026-08-19 fixes
* test(client): src/lib/e2eeCrypto.ts — test-audit 2026-08-19 fixes
* test(client): tests/unit/log-persistence.test.ts — test-audit 2026-08-19 fixes
* test(client): keep tests/browser out of the jsdom suite and run it in CI
* test(server): ws/hub_broadcast_test.go — bytes.Equal payload compare (gocritic)
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* test(client): src/lib/credentials.ts — test-audit 2026-08-19 round 2 (Stryker)
* test(client): src/lib/dispatcher.ts — test-audit 2026-08-19 round 2 (Stryker)
* test(client): src/lib/permissions.ts — test-audit 2026-08-19 round 2 (Stryker)
* test(client): src/lib/rate-limiter.ts — test-audit 2026-08-19 round 2 (Stryker)
* test(client): src/lib/hostValidation.ts — test-audit 2026-08-19 round 2 (Stryker)
* test(client): src/stores/messages.store.ts — test-audit 2026-08-19 round 2 (Stryker)
* test(client): src/lib/e2eeCrypto.ts — test-audit 2026-08-19 round 2 (Stryker)
* test(client): src/lib/ws.ts — test-audit 2026-08-19 round 2 (Stryker)
* test(client): src/lib/identity.ts — test-audit 2026-08-19 round 2 (Stryker)
* test(client): src/lib/livekitE2EE.ts — test-audit 2026-08-19 round 2 (Stryker)
* test(client): src/stores/auth.store.ts — test-audit 2026-08-19 round 2 (Stryker)
* test(client): src/stores/voice.store.ts — test-audit 2026-08-19 round 2 (Stryker)
* docs: test audit 2026-08-19 — findings, fixes, measured baselines
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* chore(graph): refresh the knowledge graph after the 2026-08-19 test audit
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
|
2026-08-20 19:29:31 +02:00 |
|
|
J3vbandClaude Opus 4.8
|
81a0b63e65
|
feat(e2ee): F3 identity/TOFU + W2-4/W3-3 hardening — checkpoint before F3 UI
WIP save point. Server + W2-4/W3-3 complete and gate-green; F3 voice E2EE
identity keys + TOFU implemented and MITM-verified-closed; the F3 voice-panel
UI (safety-number display, verified/mismatch badge, re-pin modal) is still TODO.
- W2-4 attachment link (coverage confirmed); W3-3a XFF CIDR pre-parse;
W3-3b update-binary TOCTOU (single-handle verify + O_EXCL staging)
- F3 server: migration 017 identity_public_key, PATCH /users/me persist,
ready/member_join/user_update carry key, signed voice_e2ee_announce
- F3 client: ECDSA identity keypair (keyring + pin store), publish wired into
ready, verifyPeerAnnounce pin-before-legacy, rePinPeerIdentity recovery
- Gates: server full CI mirror green (-race/-deadlock/lint/4 build tags);
client typecheck/lint/format + 3337 vitest green. Rust CI-verify only.
Next: build F3 voice-panel UI, then adversarial review, then finalize commit.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
|
2026-07-23 21:07:09 +02:00 |
|
|
jevb
|
6eba999233
|
feat: add Let's Encrypt ACME support, fix security issues, improve server UX
Server:
- Add Let's Encrypt (ACME) TLS mode with autocert, HTTP-01 challenges on :80,
and automatic certificate renewal (tls.mode: "acme" in config.yaml)
- Add ASCII art startup banner with server info and endpoint URLs
- Fix CSP blocking admin panel inline styles/scripts (per-route override)
- Suppress TLS handshake error noise in console output
- Fix TOCTOU race in invite consumption (atomic UPDATE with row-count check)
- Fix sendMsg mutex race condition (hold lock for entire send)
- Fix permission override formula (deny-first, allow-wins)
- Fix voice join parsing channelID before permission check
- Add session expiry check at WebSocket auth and periodic revalidation
- Add message length limit (4000 chars) and emoji length validation (32 bytes)
- Add file size enforcement in storage after io.Copy
- Add checksum URL validation in updater
- Add backup path traversal protection (BackupToSafe)
- Add self-modification guard in admin handlePatchUser
- Fix admin ownerOnlyMiddleware to use context user instead of re-auth
- Remove redundant startup log lines (banner shows same info)
- Add periodic expired session cleanup (15-min ticker)
- Add permissions package with bitfield constants and EffectivePerms
- Add rate limiter cleanup goroutine to prevent unbounded growth
- Add auth helpers (IsEffectivelyBanned, IsSessionExpired)
- Add WebSocket origin validation
Client:
- Add TOFU certificate trust service
- Add receive loop error handling
- Fix redundant else-if in OnChatMessage
|
2026-03-15 07:07:59 +01:00 |
|