4 Commits

Include renames

Author	SHA1	Message	Date
sandrodachandClaude Opus 5.5	1af3a6e90a	feat(auth): server-side sessions and current password for account changes (FLAW-30, FLAW-31) ... - Every login is a session (device, IP, last use); the token's jti is its ID. Sessions end on logout, per device from the profile, or after 30 idle days. - Tokens older than a day are renewed via the X-Session-Token header. - Changing password or login e-mail needs the current password; a new password logs out all other devices and mails the old address. - Demo reset keeps the demo visitors' sessions. - revoked_tokens is replaced by sessions (migration 4); everyone is logged out once after the upgrade. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-29 19:25:22 +01:00
sandrodachandClaude Opus 5.5	f57a9884d1	fix(security): stream tickets instead of session tokens in URLs (FLAW-22) ... WebSocket and EventSource put the 30-day session token into the URL, where proxies log it. The app now gets a one-time ticket right before connecting (POST /auth/stream-ticket, 60 s, bound to the token version); ?token= is no longer accepted for streams, non-browser clients may use the Authorization header. With BASE_URL set, CORS allows only that origin and WebSocket upgrades only it or the requested host; credentials are off (no cookies exist). Logout, ending all sessions, a new password and deactivation close all live streams of the account; clients with a valid session reconnect with a fresh ticket. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-29 14:46:58 +01:00
sandrodachandClaude Opus 5.5	8b7a53daab	feat(notes): push, long polling and fallback detection for note sync ... Phase 4 of the collaboration plan: - The sync engine listens for DOC_SEQ in the note's realtime room and syncs right away. Without WebSocket/SSE it long-polls /docs/{id}/changes (25 s); after three failures it falls back to polling every 3 s and retries long polling when the browser comes back online. - With push or long polling the engine only syncs every 7 s while holding leases (renewal), otherwise every 30 s as a safety net. Focusing a block announces its lease immediately (otherwise it could take up to 30 s). - Realtime connection: SSE counts as connected only after its first event; a stream that stays silent for 5 s (buffering proxy) switches SSE off for the tab. App-level PING/PONG detects WebSockets that are accepted but forward nothing and switches to SSE after 35 s. - The editor shows the active channel for shared notes. - Tests: engine channel tests (push, heartbeat, lease on focus, long polling, interval fallback, switching), realtime fallback tests with fake WebSocket/EventSource, Go tests for PONG and DOC_SEQ delivery, and e2e/channels.e2e.mjs measuring latency behind six simulated proxy setups (0.2-0.3 s on all live channels, ~3 s with plain polling). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-28 14:10:29 +01:00
sandrodachandClaude Opus 5.5	bcc06da3ee	fix(realtime): scope events to authorized users, authorize rooms, keep SSE alive ... Phase 0 of the collaboration plan: - Remove BroadcastToAll; task, task list and workspace folder events now only reach users who can see the resource. Task list events carry only the list ID, clients reload with their own permissions. - Reject unauthenticated WebSocket/SSE connections (401). Every room join (URL room, JOIN_ROOM, SSE rooms) is checked via a room authorizer; /events/rooms requires login and only accepts the caller's own sseId. - Reorder rejects tasks the caller cannot access or edit (IDOR). - Lift the server WriteTimeout for SSE streams so they are not cut after 30s. - Fix folder share removal sending DOC_DELETED to the share ID. - Tests for all of the above; docs and flaw list updated. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-28 11:19:14 +01:00