Files
OwnCord/docs/CODEMAPS/backend.md
T
jevb 3236918012 refactor: server hardening + client decomposition + protocol resilience
Server:
- Split monolithic voice_handlers.go into voice_join/leave/controls/broadcast
- Add metrics endpoint (admin-IP-restricted /api/v1/metrics)
- Add orphaned attachment cleanup in maintenance loop
- Add sentinel errors (db/errors.go, ws/errors.go)
- Add ring buffer for event replay on reconnect
- Add heartbeat monitoring with stale connection sweep
- Improve hub with panic recovery, graceful shutdown, seq tracking
- Typed message structs replace raw map[string]interface{}

Client:
- Decompose MainPage into ChatArea + SidebarArea controllers
- Add disposable.ts lifecycle management pattern
- Add member list right-click context menu (kick/ban/role)
- Tighten CSP (media-src, font-src, object-src, base-uri)
- Improve store with shallowEqual, 500-msg cap, batch updates
- Add search API endpoint wiring
- Fix LiveKit session cleanup and reconnection

Docs:
- Add CODEMAPS for architecture, backend, frontend, data, deps
- Add protocol-schema.json (machine-readable, 36 message types)
- Add platform research report
- Update PROTOCOL.md with seq/replay fields
2026-03-21 10:08:44 +01:00

3.1 KiB

Backend Codemap (Go Server)

HTTP Routes

Auth (rate-limited)

POST /api/v1/auth/register  → handleRegister    [3/min]
POST /api/v1/auth/login     → handleLogin       [5/min]
POST /api/v1/auth/logout    → handleLogout      [AUTH]
GET  /api/v1/auth/me        → handleMe          [AUTH]

Channels & Messages

GET  /api/v1/channels/             → handleListChannels   [AUTH]
GET  /api/v1/channels/{id}/messages → handleGetMessages   [AUTH, paginated]
GET  /api/v1/search?q=             → handleSearch         [AUTH, FTS5]

Invites, Uploads

POST   /api/v1/invites/      → handleCreateInvite  [AUTH, MANAGE_INVITES]
GET    /api/v1/invites/      → handleListInvites   [AUTH, MANAGE_INVITES]
DELETE /api/v1/invites/{code} → handleRevokeInvite [AUTH, MANAGE_INVITES]
POST   /api/v1/uploads       → handleUpload       [AUTH, max 100MB]
GET    /api/v1/uploads/{id}  → handleDownload      [AUTH]

WebSocket & LiveKit

GET  /api/v1/ws                → ServeWS()              [upgrade, in-band auth]
POST /api/v1/livekit/webhook   → LiveKit webhook        [JWT verify]
WS   /livekit/*                → reverse proxy → :7880  [mixed-content fix]

Admin (/admin, IP-restricted)

GET  /admin/stats, /users, /channels, /audit-log, /settings, /backups
POST /admin/channels, /backup, /updates/apply
GET  /admin/logs/stream  [WebSocket log viewer]

Middleware Chain

RequestID → Recoverer → requestLogger → SecurityHeaders → MaxBodySize(1MB)
  Per-route: AuthMiddleware, RequirePermission(bit), RateLimitMiddleware
  Admin: AdminIPRestrict(allowedCIDRs)

WS Message Handlers (ws/handlers.go)

Type Handler Rate DB Broadcast
chat_send handleChatSend 10/s CreateMessage channel
chat_edit handleChatEdit 10/s EditMessage channel
chat_delete handleChatDelete 10/s DeleteMessage channel
reaction_add/remove handleReaction 5/s Add/RemoveReaction channel
typing_start handleTyping 1/3s channel (excl sender)
presence_update handlePresence 1/10s UpdateUserStatus all
voice_join handleVoiceJoin JoinVoice + GenToken all
voice_leave handleVoiceLeave LeaveVoice all
voice_mute/deafen handleVoiceMute/Deafen UpdateVoice* all
voice_camera handleVoiceCamera 2/s UpdateVoiceCamera all

Key Files

File Lines Purpose
main.go 291 Entry, init, graceful shutdown
api/router.go 198 Route mounting, Hub + LiveKit init
api/middleware.go 325 Auth, permissions, rate limit, security headers
ws/hub.go 303 Client registry, broadcast, settings cache
ws/handlers.go 522 WS message dispatcher
ws/voice_handlers.go 332 Voice join/leave/mute/camera
ws/livekit.go 170 Token generation, room management
ws/livekit_process.go 189 LiveKit binary lifecycle
ws/livekit_webhook.go 178 LiveKit event processing