J3vbandClaude Fable 5 b329a61a7c fix(ws): route plugin broadcasts through the service-layer send check (W2-7) ...

requireChannelBroadcastAccess went through RequireChannelAccess, whose DM
branch checks only participant membership — a blocked user's plugin
broadcast could reach the person who blocked them — and it issued a raw
GetRoleByID per broadcast, bypassing the permission cache. The gate now
delegates to MessageService.CanPost (extracted over checkSendPermission),
so DM blocks, channel permissions, and future posting policy apply from
exactly one place; fails closed when no service is wired. First brick of
the permission-path unification. MemStore.GetDMRecipient gets an honest
implementation so the block path is testable.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

2026-07-19 09:03:03 +02:00

..

authz_test.go

fix: address PR review findings (issues #9-#14)

2026-03-17 04:11:04 +01:00

client.go

feat(phase-bc): pass 5 — pgdbgen, postgres EventStore/PluginStore, plugin hub wiring, OTel stack, reconnect DB tier

2026-04-06 22:48:59 +02:00

command_test.go

refactor: migrate WS handlers to V2 Command/Event architecture

2026-04-05 19:03:22 +02:00

command.go

fix(ci): resolve all golangci-lint and ESLint failures on PR #1132

2026-04-07 10:10:38 +02:00

coverage_boost2_test.go

fix: remediate low-signal Go test assertions (BUG-061)

2026-04-01 18:25:13 +02:00

coverage_boost_test.go

fix(security): harden server against verified code-review findings

2026-07-17 21:08:54 +02:00

deps.go

fix(review): address 11 Copilot review findings on PR #1132

2026-04-06 13:48:41 +00:00

dm_handlers_test.go

fix(lint): delete dead ws broadcast cluster; demote phase-header comments

2026-07-18 12:55:22 +02:00

emit_test.go

fix(lint): delete dead ws broadcast cluster; demote phase-header comments

2026-07-18 12:55:22 +02:00

emit.go

fix(ci): resolve all golangci-lint and ESLint failures on PR #1132

2026-04-07 10:10:38 +02:00

errors.go

fix: Go E2EE security hardening — key holder tracking, base64 loose validation, rate limits, test schema

2026-04-04 23:16:31 +02:00

event_persister_test.go

fix(phase-bc): address review findings — auth, SSRF, seq alignment

2026-04-06 09:29:29 +00:00

event_persister.go

fix(ci): resolve all golangci-lint and ESLint failures on PR #1132

2026-04-07 10:10:38 +02:00

event_pruner_test.go

fix(review): address 11 Copilot review findings on PR #1132

2026-04-06 13:48:41 +00:00

event_pruner.go

fix(lint): delete dead ws broadcast cluster; demote phase-header comments

2026-07-18 12:55:22 +02:00

event_test.go

fix: resolve CI lint and ESLint failures

2026-04-05 19:37:00 +02:00

event.go

refactor: migrate WS handlers to V2 Command/Event architecture

2026-04-05 19:03:22 +02:00

export_test.go

fix(ws): wire topicLimiter into hand-rolled test hubs

2026-07-18 11:45:30 +02:00

extract_event_type_test.go

test+feat(phase-bc): pass 4 — test coverage, install endpoint, CHANGELOG

2026-04-06 10:30:18 +00:00

handler_v2_channel_focus_test.go

feat(phase-bc): pass 5 — pgdbgen, postgres EventStore/PluginStore, plugin hub wiring, OTel stack, reconnect DB tier

2026-04-06 22:48:59 +02:00

handler_v2_ping_test.go

refactor: migrate WS handlers to V2 Command/Event architecture

2026-04-05 19:03:22 +02:00

handler_v2_voice_e2ee_offer_test.go

test(ws): lock rotation-burst admission for E2EE offers (W1-2)

2026-07-19 08:46:28 +02:00

handler_v2_voice_e2ee_test.go

refactor: migrate WS handlers to V2 Command/Event architecture

2026-04-05 19:03:22 +02:00

handler_v2_voice_token_test.go

refactor: migrate WS handlers to V2 Command/Event architecture

2026-04-05 19:03:22 +02:00

handlers_chat.go

fix(server): resolve golangci-lint contextcheck, errcheck, gocritic findings

2026-04-07 09:10:14 +02:00

handlers_command_test.go

fix(ci): resolve all golangci-lint and ESLint failures on PR #1132

2026-04-07 10:10:38 +02:00

handlers_command.go

fix(ws): route plugin broadcasts through the service-layer send check (W2-7)

2026-07-19 09:03:03 +02:00

handlers_ping.go

refactor: migrate WS handlers to V2 Command/Event architecture

2026-04-05 19:03:22 +02:00

handlers_presence.go

migrate WS chat/reaction/presence handlers to service layer

2026-04-05 20:47:47 +00:00

handlers_reaction.go

migrate WS chat/reaction/presence handlers to service layer

2026-04-05 20:47:47 +00:00

handlers_test.go

Merge remote-tracking branch 'origin/main' into fix/security-hardening-review

2026-07-19 08:09:56 +02:00

handlers_voice.go

fix(security): harden server against verified code-review findings

2026-07-17 21:08:54 +02:00

handlers.go

fix(lint): delete dead ws broadcast cluster; demote phase-header comments

2026-07-18 12:55:22 +02:00

hub_seedseq_test.go

test+feat(phase-bc): pass 4 — test coverage, install endpoint, CHANGELOG

2026-04-06 10:30:18 +00:00

hub_test.go

fix(ws): don't clean voice state when a replacement connection exists

2026-07-18 13:50:38 +02:00

hub.go

fix(ws): route plugin broadcasts through the service-layer send check (W2-7)

2026-07-19 09:03:03 +02:00

livekit_process.go

fix: resolve 20 code review bugs across Rust, TypeScript, and Go

2026-04-03 23:18:06 +02:00

livekit_test.go

fix: resolve 20 code review bugs across Rust, TypeScript, and Go

2026-04-03 23:18:06 +02:00

livekit_webhook.go

fix(security): harden server against verified code-review findings

2026-07-17 21:08:54 +02:00

livekit.go

fix: resolve 20 code review bugs across Rust, TypeScript, and Go

2026-04-03 23:18:06 +02:00

main_test.go

feat: add syncutil mutex, test scaffolding, and server hardening

2026-04-01 12:04:15 +02:00

message_types.go

feat: implement true E2EE for voice via client-side ECDH key exchange

2026-04-04 19:02:21 +00:00

messages_test.go

fix: Go E2EE security hardening — key holder tracking, base64 loose validation, rate limits, test schema

2026-04-04 23:16:31 +02:00

messages.go

fix: resolve CI lint and ESLint failures

2026-04-05 19:37:00 +02:00

origin_test.go

fix: resolve 24 critical and high issues from full code & security review

2026-04-01 09:23:17 +02:00

origin.go

fix: resolve 24 critical and high issues from full code & security review

2026-04-01 09:23:17 +02:00

pubsub_test.go

fix(ci): resolve all golangci-lint and ESLint failures on PR #1132

2026-04-07 10:10:38 +02:00

pubsub.go

fix(lint): delete dead ws broadcast cluster; demote phase-header comments

2026-07-18 12:55:22 +02:00

reconnect_db_test.go

feat(phase-bc): pass 5 — pgdbgen, postgres EventStore/PluginStore, plugin hub wiring, OTel stack, reconnect DB tier

2026-04-06 22:48:59 +02:00

registry_test.go

refactor: migrate WS handlers to V2 Command/Event architecture

2026-04-05 19:03:22 +02:00

registry.go

refactor: migrate WS handlers to V2 Command/Event architecture

2026-04-05 19:03:22 +02:00

ringbuffer_test.go

fix: encrypt TOTP secrets at rest and filter replay buffer by permissions

2026-04-02 15:05:56 +02:00

ringbuffer.go

fix: encrypt TOTP secrets at rest and filter replay buffer by permissions

2026-04-02 15:05:56 +02:00

serve_test.go

add service layer foundation (Phase A, Step 1)

2026-04-05 20:42:32 +00:00

serve.go

fix(ws): don't clean voice state when a replacement connection exists

2026-07-18 13:50:38 +02:00

topic_rate_limiter.go

migrate upload/profile handlers, add topic rate limiter, wire voice topics

2026-04-05 21:34:32 +00:00

voice_broadcast.go

feat: comprehensive spec docs, test suite, E2E overhaul, and security hardening

2026-03-28 10:39:23 +01:00

voice_controls.go

refactor: migrate WS handlers to V2 Command/Event architecture

2026-04-05 19:03:22 +02:00

voice_e2ee_test.go

fix: address code review IMPORTANT issues — atomic TOCTOU, updateKeyHolder race, dead keyReceived var

2026-04-04 23:30:36 +02:00

voice_e2ee.go

fix(ws): key E2EE offer rate limit per sender+target (W1-2)

2026-07-19 08:46:28 +02:00

voice_handlers_test.go

add service layer foundation (Phase A, Step 1)

2026-04-05 20:42:32 +00:00

voice_join.go

fix(security): harden server against verified code-review findings

2026-07-17 21:08:54 +02:00

voice_leave.go

migrate upload/profile handlers, add topic rate limiter, wire voice topics

2026-04-05 21:34:32 +00:00

ws_integration_test.go

feat(phase-bc): pass 5 — pgdbgen, postgres EventStore/PluginStore, plugin hub wiring, OTel stack, reconnect DB tier

2026-04-06 22:48:59 +02:00