5 Commits

Include renames

Author	SHA1	Message	Date
sandrodachandClaude Opus 5.5	11c14fa9ff	feat(auth): lock logins after repeated failures, trust proxies explicitly (FLAW-09) ... Failed logins are counted per account+address (3), per account (20) and per address (30) within 15 minutes; a full bucket answers 429 with Retry-After for 15 minutes. Locking the account+address bucket first means an attacker cannot lock the owner out from elsewhere. Unknown names count like accounts. Success clears the account buckets, a password reset (mail or admin) lifts the lock. LOGIN_PROTECTION=false switches it off. chi's RealIP believed X-Forwarded-For from anyone. The client address now comes from the headers only when the connection is from a trusted proxy: TRUSTED_PROXIES=private (default: loopback, Docker, LAN), all (old behaviour), none, or CIDRs. A proxy that sends no client address is logged once and per-address limits are skipped for it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-29 14:26:02 +01:00
sandrodachandClaude Opus 5.5	8b7a53daab	feat(notes): push, long polling and fallback detection for note sync ... Phase 4 of the collaboration plan: - The sync engine listens for DOC_SEQ in the note's realtime room and syncs right away. Without WebSocket/SSE it long-polls /docs/{id}/changes (25 s); after three failures it falls back to polling every 3 s and retries long polling when the browser comes back online. - With push or long polling the engine only syncs every 7 s while holding leases (renewal), otherwise every 30 s as a safety net. Focusing a block announces its lease immediately (otherwise it could take up to 30 s). - Realtime connection: SSE counts as connected only after its first event; a stream that stays silent for 5 s (buffering proxy) switches SSE off for the tab. App-level PING/PONG detects WebSockets that are accepted but forward nothing and switches to SSE after 35 s. - The editor shows the active channel for shared notes. - Tests: engine channel tests (push, heartbeat, lease on focus, long polling, interval fallback, switching), realtime fallback tests with fake WebSocket/EventSource, Go tests for PONG and DOC_SEQ delivery, and e2e/channels.e2e.mjs measuring latency behind six simulated proxy setups (0.2-0.3 s on all live channels, ~3 s with plain polling). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-28 14:10:29 +01:00
sandrodachandClaude Sonnet 5.5	bc13235da6	docs: rewrite documentation and README from current codebase, add flaw analysis ... Remove outdated claims (CRDT, DocRooms, presence, .md files on disk) and document the actual architecture, API, permissions and known flaws. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-10-27 23:09:05 +01:00
sandrodach	f3b3f07e04	refactor(crdt): implement proxy-resilient Yjs dual-transport sync with indexeddb offline-first and debounced sqlite persistence	2026-10-26 19:54:51 +01:00
sandrodach	6343d62bab	feat(realtime): implement SSE fallback, dual-transport hub & proxy resilience (resolves FLAW-03)	2026-10-26 16:55:11 +01:00