mirror of
https://github.com/J3vb/OwnCord.git
synced 2026-09-03 03:50:00 +03:00
* fix(identity): 2 defect(s) (OC-0192, OC-0197)
OC-0192: bound raw display_name/about/avatar bytes before the quadratic
fixpoint sanitizer runs, in both the REST handler and UserService.UpdateProfile.
OC-0197: sanitize display_name before validateDisplayName so an
HTML-entity-encoded bidi override (e.g. "‮") can no longer pass
validation as ASCII and be decoded into the real character on the way to
storage.
* fix(ws): 1 defect(s) (OC-0196)
A transient DB error during WebSocket auth (session or user lookup) was
collapsed into the terminal auth_error frame, which the client treats as
non-recoverable: it stops reconnecting and clears stored credentials. A
sub-second SQLite hiccup therefore force-logged-out every reconnecting
client with a perfectly valid session. Send a non-terminal INTERNAL error
frame instead so normal backoff/reconnect retries.
* fix(api): 1 defect(s) (OC-0198)
* fix(ws): 1 defect(s) (OC-0200)
normalizeHostForCertCompare now unwraps a bracketed IPv6 literal after the
trailing-":443" strip and before lowercasing, matching tofu::cert_store_key's
normalization order. Without the unwrap, every cert-tofu host equality guard
took the "unrelated host" branch for bracketed-IPv6 servers.
* fix(api): 1 defect(s) (OC-0202)
* fix(admin): 1 defect(s) (OC-0203)
Channel permission override handlers applied requireGrantableOverride only
to the bits being written, so an all-zero PUT or a DELETE could clear a
deny bit the actor's own role does not hold — EffectivePerms =
(rolePerm &^ deny) | allow makes removing a deny an escalation. Both the
role-layer and per-user handlers now check the guard against the bits
already on the row.
* fix(client): 1 defect(s) (OC-0205)
* fix(client): 3 defect(s) (OC-0207, OC-0227, OC-0235)
* fix(client): 1 defect(s) (OC-0208)
* fix(voice): 3 defect(s) (OC-0209, OC-0212, OC-0213)
OC-0209: reject a replayed retired-key announce before verifyPeerAnnounce
runs, so the replay cannot overwrite the peer's displayed verification
status/session fingerprint with the retired key's before being rejected.
OC-0212: buffer an announce blocked as a TOFU pin mismatch and replay it
after a successful rePinPeerIdentity, so re-pinning actually restores the
peer for the live call instead of clearing the badge and leaving them
un-keyed (a mid-call peer never re-announces on its own).
OC-0213: skip retiring a departing peer's key when the local voice roster
still lists them as present — a rejoin announce published straight into
the send queue can overtake the buffered, stale voice_leave, and retiring
a still-live key would reject every later genuine re-announce as a replay.
* fix(ws): 1 defect(s) (OC-0211)
* fix(identity): 1 defect(s) (OC-0214)
The delete-account admin guard counted remaining admins with a raw
`banned = 0` filter, so an admin whose temporary ban had already lapsed
was treated as unusable. Use the shared notBannedClause, appended outside
the Sprintf format string because its strftime verbs (%Y, %H) would
otherwise be parsed as fmt directives.
* fix(client): 1 defect(s) (OC-0215)
* fix(voice): 1 defect(s) (OC-0216)
* fix(client): 1 defect(s) (OC-0217)
* fix(voice): 1 defect(s) (OC-0219)
rollbackVoiceJoin cleared the client's in-memory voiceChID but left its
VoiceTopic subscription in place, so a socket whose join failed after
voiceJoinComplete's Subscribe kept receiving that room's E2EE relays for
the rest of the connection. Use clearVoiceAndUnsubscribe instead, matching
every other path that takes a client out of voice while its WS stays up.
* fix(client): 2 defect(s) (OC-0220, OC-0224)
dmDisplayName: a group DM whose other members have all left keeps a live
is_group row, but the server leaves `recipient` zero-valued, so the empty
username fell through as a blank label. Fall back to a non-empty placeholder.
updateDmLastMessage: a queued chat_message redelivered for an id already
reflected in the `ready` snapshot double-counted the unread badge. Only
increment when the message id advances past lastMessageId.
* fix(client): 1 defect(s) (OC-0221)
Cap queued attachments at the server's 10-attachment limit in the message
composer. Past that the server rejects the whole chat_send frame as a
generic parse error, orphaning already-uploaded attachments; refusing
before the upload starts keeps composer state and the send in sync.
* fix(ws): 1 defect(s) (OC-0222)
handleReconnect built the resume auth_ok before applyConnectStatus settled
c.user.Status, so a resumed client was told its disconnect-time status
(routinely "offline") instead of the status it was coming online as.
Move applyConnectStatus ahead of reconnectWriteReplay, matching
handleFreshConnect's ordering.
* fix(mentions): 1 defect(s) (OC-0223)
* fix(admin): 1 defect(s) (OC-0225)
* fix(client): 1 defect(s) (OC-0226)
* fix(client): 1 defect(s) (OC-0228)
* fix(client): 1 defect(s) (OC-0230)
Route the Logs tab entry counter through renderLogEntries so every render path (filter change, Clear, Refresh, live entry) keeps the count in sync with the list.
* fix(voice): 1 defect(s) (OC-0231)
* fix(client): 1 defect(s) (OC-0232)
Reduce Motion toggle wrote the reduced-motion class directly, fighting the
OS-sync media-query listener that owns it when Sync with OS is on. Route the
side effect through syncOsMotionListener so whichever source owns the class
re-derives it.
* fix(client): 1 defect(s) (OC-0233)
notifyIncomingMessage titled the desktop notification with the raw
payload username, so the popup named the sender differently from the
message row it points at. Resolve the author the same way the message
list does (resolveAuthor over the live membersStore, then
resolveDisplayName).
* fix(client): 1 defect(s) (OC-0234)
* fix(client): 1 defect(s) (OC-0236)
* fix(ws): 1 defect(s) (OC-0237)
* fix(client): 4 defect(s) (OC-0193, OC-0201, OC-0204, OC-0218)
* fix(identity): 1 defect(s) (OC-0195)
Bound free-text profile fields by raw byte length before cleanText's
quadratic sanitizeToFixpoint pass runs, generalizing OC-0192's guard into
cleanTextBounded and applying it to HandlePresenceUpdate's custom_status,
SetCustomStatus, and group DM names.
* fix(dm): 1 defect(s) (OC-0199)
handleCreateDM now broadcasts dm_channel_open to the recipient when a 1:1 DM is newly created, matching handleCreateGroupDM. GetOrCreateDMChannel pre-seeds dm_open_state for both users, so the recipient's later OpenDM reported opened=false and nothing ever told them the DM existed.
* fix(voice): 1 defect(s) (OC-0206)
vad-worklet.js gate timing constants were copied from the setTimeout
fallback's ~16ms poll cadence, but AudioWorkletProcessor.process() runs
once per 128-sample render quantum (~2.667ms at the 48kHz AudioContext).
The mic gate therefore closed ~6x faster than intended (~32ms of silence
instead of ~200ms), with the startup grace and RMS post interval off by
the same factor. Scale the frame counts to render quanta.
* fix(client): 1 defect(s) (OC-0229)
* test(client): assert the real TOFU re-pin outcome and make the pin mock faithful
The e2e journey test asserted that "Trust New Key" makes the peer's verify
badge disappear. That is the behaviour OC-0212 identifies as the defect: a
mid-call peer never re-announces, so clearing the badge left the peer
un-keyed for the rest of the call with nothing on screen. Re-pinning now
replays the announce that was blocked as a mismatch and re-verifies it
against the pin just stored, so assert the peer actually lands verified.
The mock's store_identity_pin was a no-op recorder while get_identity_pin
served a static seed map, so the replayed announce re-read the stale pin and
re-failed — a mismatch the real keyring never produces. Back the pins with a
mutable map so a write is visible to the next read. The unreadable-store
(DC-08) and reject-keeps-blocked paths are unchanged and still pass.
* fix(dm): 1 defect(s) (OC-0194)
Add regression tests pinning the raw-byte bound on group DM names, for
both CreateGroupDM and RenameGroupDM.
The Server/service/dm.go source fix for OC-0194 already landed in
bdbd5ac (fix(identity): 1 defect(s) (OC-0195)), which generalized the
guard into cleanTextBounded and applied it to the group DM name paths
alongside the profile fields. This commit therefore carries the OC-0194
tests only; dm.go is unchanged.
Revert-proof: with dm.go restored to bdbd5ac^ (cleanText before the
rune-count check) both new tests fail — CreateGroupDM returns "recipient
not found" after 222ms and RenameGroupDM accepts the name after 251ms,
against a 150ms budget. With the fix in place both pass in 0.03s.
* fix(ws): 1 defect(s) (OC-0210)
* chore(findings): record the 2026-08-20 hunt's 46 findings as fixed
Appends OC-0192..OC-0237 from the 2026-08-20 converging hunt and marks each
fixed with its commit and the test that pins it. Pre-existing records are
byte-identical; nextId moves 192 -> 238 so the next hunt cannot collide with
these ids.
Every fix was independently revert-proofed: the commit's own source diff is
reverse-applied, its test must go red, and must return green once restored.
43 of 46 carry revertProof "pass" from that mechanical run. Three could not be
checked at file level and were proved by hand at hunk level instead, recorded
as "pass (hand-proved)": OC-0200, whose ws.ts edit no longer reverse-applies
because the merge kept main's equivalent implementation; OC-0215, whose Rust
tests live in-file under #[cfg(test)]; and OC-0194, which stacks on a helper
introduced by an earlier commit. No fix was found to rest on a vacuous test.
OC-0200 additionally carries a note: main fixed that same normalizer
independently while this branch was in flight, so the branch is no longer the
only thing closing it.
* docs: record the dm_channel_open emission on 1:1 DM creation
POST /api/v1/dms now emits dm_channel_open to the recipient when it creates a
channel (it previously emitted nothing on that path), so api.md states it the
way the sibling DM endpoints already state theirs.
The channels/members/DMs UX spec claimed the server broadcast the event "to
both parties" on this flow. That was never true — nothing was broadcast before,
and now only the recipient is sent it; the creator learns the channel from the
response body. This doc lists dispatcher.ts, dm.store.ts, ChannelSidebar.ts,
service/channel.go and dm.go among its sources of truth, all touched here, so
it is corrected in the same change per its maintenance rule.
---------
Co-authored-by: Claude <noreply@anthropic.com>
164 lines
6.2 KiB
TypeScript
164 lines
6.2 KiB
TypeScript
/**
|
|
* Auto-idle: flip to Idle after ten quiet minutes, back to Online on the first
|
|
* sign of life.
|
|
*
|
|
* Entirely client-side. The server has no idea whether anyone is at the
|
|
* keyboard, and giving it one would mean a heartbeat carrying activity data it
|
|
* has no other use for; the client already knows, and a presence_update is the
|
|
* message that already says so.
|
|
*
|
|
* The rule that makes this safe to leave running is narrow: it only ever moves
|
|
* a status the *timer itself* is responsible for.
|
|
*
|
|
* - Manually chosen Idle, Do Not Disturb and Invisible are never touched.
|
|
* Someone who set Do Not Disturb to be left alone would be dragged back to
|
|
* Online by their own mouse otherwise, which is the opposite of what they
|
|
* asked for.
|
|
* - Only a manual Online becomes an automatic Idle, and only an automatic
|
|
* Idle becomes Online again. A manual Idle is a statement, not a timeout.
|
|
*
|
|
* Input listening is throttled to one bookkeeping call per second: mousemove
|
|
* fires hundreds of times a second and the timer's resolution is minutes, so
|
|
* anything finer is pure cost.
|
|
*/
|
|
|
|
import type { UserStatus } from "./types";
|
|
import { loadUserStatus, loadUserStatusOrigin, saveUserStatus } from "./userStatus";
|
|
|
|
/** How long without input before the status flips to idle. Discord's number. */
|
|
export const AUTO_IDLE_DELAY_MS = 10 * 60 * 1000;
|
|
|
|
/** Minimum gap between two activity bookkeeping runs. */
|
|
export const ACTIVITY_THROTTLE_MS = 1000;
|
|
|
|
/** Events that count as "the user is here". */
|
|
const ACTIVITY_EVENTS = ["mousemove", "mousedown", "keydown", "wheel", "touchstart"] as const;
|
|
|
|
export interface AutoIdleOptions {
|
|
/** Called when the timer decides the status should change. The caller sends
|
|
* the presence_update and updates its own stores — this module owns the
|
|
* decision, not the transport. */
|
|
readonly onStatusChange: (status: UserStatus) => void;
|
|
/** Injected in tests. Defaults to `window`. */
|
|
readonly target?: Pick<Window, "addEventListener" | "removeEventListener">;
|
|
/** Injected in tests. Defaults to AUTO_IDLE_DELAY_MS. */
|
|
readonly delayMs?: number;
|
|
}
|
|
|
|
export interface AutoIdleController {
|
|
/** Report activity explicitly (e.g. after sending a message). */
|
|
notifyActivity(): void;
|
|
/** Stop listening and cancel the pending timer. */
|
|
destroy(): void;
|
|
}
|
|
|
|
/**
|
|
* Whether the timer may move the status right now, and to what.
|
|
*
|
|
* Exported because it is the entire policy, and a policy worth testing is
|
|
* worth testing without a DOM and a ten-minute clock.
|
|
*/
|
|
export function nextAutoStatus(
|
|
current: UserStatus,
|
|
origin: "manual" | "auto",
|
|
idle: boolean,
|
|
): UserStatus | null {
|
|
if (idle) {
|
|
// Only a manual Online is eligible to become automatically idle. An
|
|
// already-idle status (either origin) has nowhere to go, and dnd/invisible
|
|
// are deliberate.
|
|
return current === "online" && origin === "manual" ? "idle" : null;
|
|
}
|
|
// Coming back: only undo what the timer itself did.
|
|
return current === "idle" && origin === "auto" ? "online" : null;
|
|
}
|
|
|
|
/**
|
|
* Start the idle watcher. Returns a controller; call `destroy` on teardown.
|
|
*/
|
|
export function startAutoIdle(options: AutoIdleOptions): AutoIdleController {
|
|
const target = options.target ?? window;
|
|
const delayMs = options.delayMs ?? AUTO_IDLE_DELAY_MS;
|
|
const ac = new AbortController();
|
|
|
|
let timer: ReturnType<typeof setTimeout> | null = null;
|
|
let lastActivityRun = 0;
|
|
let destroyed = false;
|
|
/** True while the timer is the reason the status is idle. Kept in memory so
|
|
* the hot path (one mousemove per pixel) is a boolean check rather than a
|
|
* preference read. Seeded from the persisted status/origin so a session
|
|
* that starts already auto-idle (app restart, MainPage remount) can still
|
|
* be un-idled by activity — otherwise the latch starts false and apply(false)
|
|
* is unreachable until the user manually reselects a status. */
|
|
let idleByTimer = loadUserStatus() === "idle" && loadUserStatusOrigin() === "auto";
|
|
|
|
function apply(idle: boolean): void {
|
|
const next = nextAutoStatus(loadUserStatus(), loadUserStatusOrigin(), idle);
|
|
if (next === null) return;
|
|
// The timer's writes are marked "auto" so a later return-to-activity knows
|
|
// it is undoing its own work rather than a choice the user made.
|
|
saveUserStatus(next, idle ? "auto" : "manual");
|
|
idleByTimer = idle;
|
|
options.onStatusChange(next);
|
|
}
|
|
|
|
function arm(): void {
|
|
if (timer !== null) clearTimeout(timer);
|
|
timer = setTimeout(() => {
|
|
timer = null;
|
|
if (destroyed) return;
|
|
apply(true);
|
|
// Re-check: apply() invokes options.onStatusChange synchronously, and a
|
|
// caller reacting to that (e.g. tearing down the page) may call
|
|
// destroy() from inside it. `timer` is already null at this point, so
|
|
// destroy()'s clearTimeout would be a no-op — the re-check below is
|
|
// what actually stops a synchronous destroy from being undone.
|
|
if (destroyed) return;
|
|
// Keep watching even when this firing changed nothing (already idle,
|
|
// or dnd/invisible/manual-idle made it a no-op): a status change made
|
|
// through a surface that produces no DOM activity event — the OS tray's
|
|
// Status submenu calls saveUserStatus() directly — can make the status
|
|
// eligible again without ever calling arm() itself. Re-arming here is
|
|
// the one place that covers every such surface at once.
|
|
arm();
|
|
}, delayMs);
|
|
}
|
|
|
|
function onActivity(): void {
|
|
if (destroyed) return;
|
|
// Coming back is handled first and unthrottled: the very first event after
|
|
// an idle flip has to restore Online even though it lands inside the
|
|
// throttle window that follows.
|
|
if (idleByTimer) {
|
|
apply(false);
|
|
idleByTimer = false;
|
|
lastActivityRun = Date.now();
|
|
arm();
|
|
return;
|
|
}
|
|
const now = Date.now();
|
|
if (now - lastActivityRun < ACTIVITY_THROTTLE_MS) return;
|
|
lastActivityRun = now;
|
|
arm();
|
|
}
|
|
|
|
for (const evt of ACTIVITY_EVENTS) {
|
|
target.addEventListener(evt, onActivity, { passive: true, signal: ac.signal });
|
|
}
|
|
arm();
|
|
|
|
return {
|
|
notifyActivity(): void {
|
|
onActivity();
|
|
},
|
|
destroy(): void {
|
|
destroyed = true;
|
|
ac.abort();
|
|
if (timer !== null) {
|
|
clearTimeout(timer);
|
|
timer = null;
|
|
}
|
|
},
|
|
};
|
|
}
|