Claude 9e6ff47194 feat(server,admin): private channels via per-role permission overrides ...

The read side of channel visibility was already complete — channel_overrides
rows deny ReadMessages and every list/focus/send/voice path enforces them —
but nothing could write those rows. Add the missing write path and UI:

- db: UpsertChannelOverride / DeleteChannelOverride / ListChannelRoleOverrides
  (roles LEFT JOIN overrides so the UI gets everything in one call)
- admin API: GET/PUT/DELETE /admin/api/channels/{id}/permissions[/{roleId}]
  with unknown permission bits masked via the new permissions.AllPerms,
  audit logging, and immediate permission-cache invalidation
- ws: Hub.RefreshChannelVisibility sends targeted channel_create /
  channel_delete to connected clients after an override change, unsubscribes
  hidden clients from the channel topic, and clears their focus. Sent outside
  the sequenced replay path on purpose: a replayed channel_delete would be
  filtered by the post-change allowed-channel set, inverting its audience.
- admin panel: per-channel Access modal (lock icon) with per-role
  "Can access" checkboxes; unchecking writes deny = ReadMessages|ConnectVoice

Known limits (follow-ups): users offline during a revoke keep a stale
sidebar entry until their next fresh connect (server still denies access),
and users already in a voice channel are not kicked when it goes private.

Closes #93

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LwtnpHAoSFr1ZibQgQkNQK

2026-07-19 10:50:11 +00:00

..

dbgen

chore(db): commit stale sqlc output; make sqlc-verify honest

2026-07-18 11:45:30 +02:00

queries/sqlite

chore(server): delete unfinished Postgres scaffolding

2026-07-19 08:15:58 +02:00

account_test.go

test: add server core test coverage (Session 1)

2026-04-01 08:41:09 +02:00

account.go

fix: resolve 24 critical and high issues from full code & security review

2026-04-01 09:23:17 +02:00

admin_queries_test.go

test: boost server test coverage to 80%+ across all packages

2026-03-18 05:03:38 +01:00

admin_queries.go

fix: resolve 24 critical and high issues from full code & security review

2026-04-01 09:23:17 +02:00

attachment_queries_test.go

test(service): cover atomic attachment-ownership link semantics (W1-3)

2026-07-19 08:29:26 +02:00

attachment_queries.go

fix(service): enforce attachment ownership atomically in the link UPDATE (W1-3)

2026-07-19 08:29:26 +02:00

auth_queries_test.go

test: boost server test coverage to 80%+ across all packages

2026-03-18 05:03:38 +01:00

auth_queries.go

fix: comprehensive security hardening from full codebase audit

2026-04-04 16:48:57 +00:00

backup_test.go

test: boost server coverage — auth 60→95%, db 69→81%, config 75→85%

2026-04-01 11:38:11 +02:00

block_queries.go

fix: comprehensive security hardening from full codebase audit

2026-04-04 16:48:57 +00:00

channel_queries_test.go

feat(server,admin): private channels via per-role permission overrides

2026-07-19 10:50:11 +00:00

channel_queries.go

feat(server,admin): private channels via per-role permission overrides

2026-07-19 10:50:11 +00:00

coverage_boost_test.go

test(service): cover atomic attachment-ownership link semantics (W1-3)

2026-07-19 08:29:26 +02:00

db_test.go

test: boost server coverage — auth 60→95%, db 69→81%, config 75→85%

2026-04-01 11:38:11 +02:00

db.go

refactor: context propagation, LogAudit deadlock fix, ESLint v9, code quality

2026-03-29 19:39:46 +02:00

dm_queries_test.go

feat: comprehensive spec docs, test suite, E2E overhaul, and security hardening

2026-03-28 10:39:23 +01:00

dm_queries.go

chore: remaining server changes (code quality, go mod tidy)

2026-04-01 11:38:33 +02:00

errors_test.go

test: add server core test coverage (Session 1)

2026-04-01 08:41:09 +02:00

errors.go

fix: atomic invite registration, fail-closed search, proxy-aware rate limiting

2026-03-29 19:39:22 +02:00

invite_queries.go

fix: comprehensive security hardening from full codebase audit

2026-04-04 16:48:57 +00:00

lockout_queries.go

fix: security hardening — 11 findings across auth, WS, upload, admin, data

2026-04-02 14:51:16 +02:00

main_test.go

feat: add syncutil mutex, test scaffolding, and server hardening

2026-04-01 12:04:15 +02:00

message_queries_test.go

test: boost server coverage — auth 60→95%, db 69→81%, config 75→85%

2026-04-01 11:38:11 +02:00

message_queries.go

fix: resolve 4 server bugs (Phase 1: BUG-085, BUG-087, BUG-090, BUG-091)

2026-04-01 17:52:06 +02:00

migrate_test.go

test: boost server coverage — auth 60→95%, db 69→81%, config 75→85%

2026-04-01 11:38:11 +02:00

migrate.go

fix: handle BEGIN...END blocks in SQL migration splitter

2026-04-01 15:35:50 +02:00

models_test.go

test: boost server coverage — auth 60→95%, db 69→81%, config 75→85%

2026-04-01 11:38:11 +02:00

models.go

fix: security hardening — 11 findings across auth, WS, upload, admin, data

2026-04-02 14:51:16 +02:00

persisted_event.go

feat: scaffold Phase B + C (events, telemetry, plugins, Solid.js)

2026-04-06 09:00:47 +00:00

profile_queries_test.go

feat: add user profile management endpoints (T-195)

2026-04-01 11:37:55 +02:00

profile_queries.go

feat: add user profile management endpoints (T-195)

2026-04-01 11:37:55 +02:00

role_invite_queries_test.go

fix: resolve CI lint and ESLint failures

2026-04-05 19:37:00 +02:00

role_queries.go

refactor: migrate WS handlers to V2 Command/Event architecture

2026-04-05 19:03:22 +02:00

sanitize_test.go

fix: resolve 4 server bugs (Phase 1: BUG-085, BUG-087, BUG-090, BUG-091)

2026-04-01 17:52:06 +02:00

voice_queries_test.go

feat: LiveKit video grid improvements, voice state cleanup, and internal tooling

2026-03-31 11:41:59 +02:00

voice_queries.go

fix: resolve 24 critical and high issues from full code & security review

2026-04-01 09:23:17 +02:00