J3vbandClaude Fable 5 ef58c04ed1 fix(service): don't cache permission snapshots that raced an invalidation ...

An InvalidateUser/InvalidateChannel/InvalidateAll landing between
getOrPopulate's DB read and its cache store was silently overwritten by
the stale snapshot, serving revoked permissions for up to permCacheTTL
(30s). Guard the cache write with a generation counter bumped by every
invalidation; a populate that lost the race returns its snapshot for the
current request but caches nothing (security scan 2026-07-22, F6).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

2026-07-23 14:45:13 +02:00

..

admin

feat(audit): route every LogAudit call through a best-effort WriteAudit helper

2026-07-20 10:48:05 +02:00

api

fix(auth): canonicalize username for per-user login lockout keys

2026-07-23 11:59:13 +02:00

auth

fix(security): harden server against verified code-review findings

2026-07-17 21:08:54 +02:00

config

feat(api): proxy Klipy GIF requests server-side so no key ships to clients

2026-07-20 13:29:46 +02:00

db

feat(audit): route every LogAudit call through a best-effort WriteAudit helper

2026-07-20 10:48:05 +02:00

migrations

feat(server,client): announcement channels (D1, closes A-2026-07-01)

2026-07-19 16:00:18 +00:00

permissions

feat(server): unify channel-visibility through permissions.Checker

2026-07-20 11:28:03 +02:00

plugin

fix(plugin): serialize wazero guest calls with a per-Instance mutex

2026-07-23 11:59:13 +02:00

scripts

feat(server,client): protocol codegen + audit quick-wins batch

2026-07-19 13:32:58 +00:00

service

fix(service): don't cache permission snapshots that raced an invalidation

2026-07-23 14:45:13 +02:00

storage

fix: comprehensive security hardening from full codebase audit

2026-04-04 16:48:57 +00:00

syncutil

feat: add syncutil mutex, test scaffolding, and server hardening

2026-04-01 12:04:15 +02:00

telemetry

chore(server): delete unfinished Postgres scaffolding

2026-07-19 08:15:58 +02:00

updater

fix(updater): coalesce and negative-cache text-asset fetches (W3-1)

2026-07-20 17:15:06 +02:00

ws

fix(ws): resolve live role in hasChannelPerm to honor mid-session demotions

2026-07-23 11:59:13 +02:00

.air.toml

refactor: extensibility overhaul — handler registry, permission checker, sidebar decomposition, DX improvements

2026-03-29 12:19:08 +02:00

.dockerignore

feat: Linux client port, ARM64 CI, and server Docker image

2026-04-03 14:26:26 +02:00

.env.example

feat: add docker-compose with LiveKit for server Docker deployment

2026-04-03 14:32:20 +02:00

.golangci.yml

chore: remaining server changes (code quality, go mod tidy)

2026-04-01 11:38:33 +02:00

.gremlins.yaml

chore: add dev tooling — Stryker, gremlins, k6, toxiproxy, Coraza WAF, Zod

2026-04-01 13:49:06 +02:00

docker-compose.otel.yml

feat(phase-bc): pass 5 — pgdbgen, postgres EventStore/PluginStore, plugin hub wiring, OTel stack, reconnect DB tier

2026-04-06 22:48:59 +02:00

docker-compose.yml

feat: add docker-compose with LiveKit for server Docker deployment

2026-04-03 14:32:20 +02:00

Dockerfile

feat: Linux client port, ARM64 CI, and server Docker image

2026-04-03 14:26:26 +02:00

go.mod

fix(updater): coalesce and negative-cache text-asset fetches (W3-1)

2026-07-20 17:15:06 +02:00

go.sum

chore(deps): migrate nhooyr.io/websocket to github.com/coder/websocket

2026-07-20 16:54:19 +02:00

livekit.yaml.example

feat(server): support dual-homed voice hosts and user-managed livekit.yaml

2026-07-19 10:50:11 +00:00

main.go

refactor(server): remove the store abstraction layer (D3)

2026-07-19 16:33:58 +00:00

Makefile

feat(server,client): protocol codegen + audit quick-wins batch

2026-07-19 13:32:58 +00:00

prometheus.dev.yml

feat(phase-bc): pass 5 — pgdbgen, postgres EventStore/PluginStore, plugin hub wiring, OTel stack, reconnect DB tier

2026-04-06 22:48:59 +02:00

sqlc.version

feat: adopt sqlc for type-safe database access (Phase A Step 2)

2026-04-06 09:12:59 +02:00

sqlc.yaml

chore(server): delete unfinished Postgres scaffolding

2026-07-19 08:15:58 +02:00