J3vbandClaude Fable 5 26a367a7a1 fix(api): give client-update polling its own rate-limit bucket (W2-1) ...

The empty-prefix middleware shared per-IP buckets with verify-totp,
password change, and the sensitive endpoints, so a client's 30/min
auto-poll could 429 its own user's 2FA or password change. Dedicated
"client_update:" prefix, mirroring "livekit_proxy:".

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

2026-07-19 08:50:34 +02:00

..

admin

test(admin): cover ban authorization matrix (W1-4)

2026-07-19 08:41:12 +02:00

api

fix(api): give client-update polling its own rate-limit bucket (W2-1)

2026-07-19 08:50:34 +02:00

auth

fix(security): harden server against verified code-review findings

2026-07-17 21:08:54 +02:00

config

chore(server): delete unfinished Postgres scaffolding

2026-07-19 08:15:58 +02:00

db

test(service): cover atomic attachment-ownership link semantics (W1-3)

2026-07-19 08:29:26 +02:00

migrations

chore(server): delete unfinished Postgres scaffolding

2026-07-19 08:15:58 +02:00

permissions

chore: remove soundboard feature entirely

2026-04-02 17:00:27 +02:00

plugin

test(plugin): lock CPU-budget overrun recovery (W1-1)

2026-07-19 08:21:55 +02:00

scripts

chore: add dev tooling — Stryker, gremlins, k6, toxiproxy, Coraza WAF, Zod

2026-04-01 13:49:06 +02:00

service

test(admin): cover ban authorization matrix (W1-4)

2026-07-19 08:41:12 +02:00

storage

fix: comprehensive security hardening from full codebase audit

2026-04-04 16:48:57 +00:00

store

fix(admin): route admin-panel bans through ModerationService (W1-4)

2026-07-19 08:41:12 +02:00

syncutil

feat: add syncutil mutex, test scaffolding, and server hardening

2026-04-01 12:04:15 +02:00

telemetry

chore(server): delete unfinished Postgres scaffolding

2026-07-19 08:15:58 +02:00

updater

Merge remote-tracking branch 'origin/main' into fix/security-hardening-review

2026-07-19 08:09:56 +02:00

ws

test(ws): lock rotation-burst admission for E2EE offers (W1-2)

2026-07-19 08:46:28 +02:00

.air.toml

refactor: extensibility overhaul — handler registry, permission checker, sidebar decomposition, DX improvements

2026-03-29 12:19:08 +02:00

.dockerignore

feat: Linux client port, ARM64 CI, and server Docker image

2026-04-03 14:26:26 +02:00

.env.example

feat: add docker-compose with LiveKit for server Docker deployment

2026-04-03 14:32:20 +02:00

.golangci.yml

chore: remaining server changes (code quality, go mod tidy)

2026-04-01 11:38:33 +02:00

.gremlins.yaml

chore: add dev tooling — Stryker, gremlins, k6, toxiproxy, Coraza WAF, Zod

2026-04-01 13:49:06 +02:00

docker-compose.otel.yml

feat(phase-bc): pass 5 — pgdbgen, postgres EventStore/PluginStore, plugin hub wiring, OTel stack, reconnect DB tier

2026-04-06 22:48:59 +02:00

docker-compose.yml

feat: add docker-compose with LiveKit for server Docker deployment

2026-04-03 14:32:20 +02:00

Dockerfile

feat: Linux client port, ARM64 CI, and server Docker image

2026-04-03 14:26:26 +02:00

go.mod

chore(server): delete unfinished Postgres scaffolding

2026-07-19 08:15:58 +02:00

go.sum

chore(server): delete unfinished Postgres scaffolding

2026-07-19 08:15:58 +02:00

livekit.yaml.example

feat: add docker-compose with LiveKit for server Docker deployment

2026-04-03 14:32:20 +02:00

main.go

chore(server): delete unfinished Postgres scaffolding

2026-07-19 08:15:58 +02:00

Makefile

chore(server): delete unfinished Postgres scaffolding

2026-07-19 08:15:58 +02:00

prometheus.dev.yml

feat(phase-bc): pass 5 — pgdbgen, postgres EventStore/PluginStore, plugin hub wiring, OTel stack, reconnect DB tier

2026-04-06 22:48:59 +02:00

sqlc.version

feat: adopt sqlc for type-safe database access (Phase A Step 2)

2026-04-06 09:12:59 +02:00

sqlc.yaml

chore(server): delete unfinished Postgres scaffolding

2026-07-19 08:15:58 +02:00