mirror of
https://github.com/J3vb/OwnCord.git
synced 2026-09-03 03:50:00 +03:00
jevb
7978ec40e8
Server: - Fix YAML injection in LiveKit config generation (quote values) - Revert token TTL to 4h (no server-side JWT revocation) - Derive LiveKit publish permissions from user role (prevent SFU bypass) - Add CAS guard for webhook/voice_leave race condition - Add voice_leave broadcast to rollbackVoiceJoin (prevent ghost state) - Limit webhook body to 64KB (prevent memory abuse) - Add rate limit to voice_token_refresh handler (1/60s) - Add LiveKit health check endpoint (GET /api/v1/livekit/health, 503 on degraded) - Add voice_token_refresh WS handler for client-initiated token refresh - Consolidate voice quality constants (single source of truth) - Fix video limit TOCTOU race (count from DB instead of LiveKit API) - Raise default voice_max_video from 10 to 25 (Discord parity) - Add CountActiveCameras DB query - Non-blocking broadcast send, circuit breaker, exponential backoff - Close send channel before context cancel in serve.go - Guard voice mute/deafen for active channel - Delete orphaned message on attachment link failure - Redact query string from proxy logs (prevent token leak) - Use instance-level HTTP client for health checks (no redirect following) - Set cmd.WaitDelay to prevent goroutine leak on Windows - Log buildJSON marshal errors Client: - Refactor livekitSession.ts from singleton module to LiveKitSession class - Share single AudioContext for all analysers (was 1 per participant) - Extract createRoom() helper (DRY) - Add token refresh timer (3.5h interval, re-arms on failure) - Skip setSpeakers if unchanged (sort in-place, no allocations) - Distinguish user-initiated leave from connection error in retry - Add YouTube videoId validation (prevent iframe src injection) - Add try/finally to disableCamera - Wrap store subscription callbacks in try/catch - Track and cancel initial scroll RAF on cleanup - Add 5s timeout + encodeURIComponent to YouTube oEmbed fetch - Clean raw mic stream on RNNoise suppressor failure - Full voice cleanup on logout via cleanupAll() Tests: - Add 7 new server tests (webhook parsing, voice guards, quality fallback) - Fix 2 pre-existing test failures (mute/deafen invalid payload)
773 B
773 B
TODOS
Deferred work items from engineering review (2026-03-21).
Voice E2E Test Infrastructure
What: Add E2E test infrastructure for voice flows (voice_join → LiveKit connect → audio → voice_leave). Why: The voice path is critical UX with zero automated E2E coverage. Unit tests cover handlers and controllers, but nothing tests the full integration. Pros: Catches integration bugs between server + LiveKit + client. Cons: Requires LiveKit binary in CI, WebRTC support in test browser, ~200 lines of test infra. Context: The existing native E2E infrastructure (WebView2 CDP) could be extended. Needs CI setup first. Depends on: LiveKit binary available in CI environment. Added: 2026-03-21 (eng review of feature/livekit-migration)