Phase 0 of the collaboration plan:
- Remove BroadcastToAll; task, task list and workspace folder events now
only reach users who can see the resource. Task list events carry only
the list ID, clients reload with their own permissions.
- Reject unauthenticated WebSocket/SSE connections (401). Every room join
(URL room, JOIN_ROOM, SSE rooms) is checked via a room authorizer;
/events/rooms requires login and only accepts the caller's own sseId.
- Reorder rejects tasks the caller cannot access or edit (IDOR).
- Lift the server WriteTimeout for SSE streams so they are not cut after 30s.
- Fix folder share removal sending DOC_DELETED to the share ID.
- Tests for all of the above; docs and flaw list updated.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- Configure structured slog logger in cmd/server/main.go via LOG_LEVEL and DEBUG env vars
- Add HTTP API request logging middleware in internal/api/ with status and duration_ms
- Add WebSocket join/leave, event reception, and debounced SQLite flush tracing in docroom
- Document LOG_LEVEL and DEBUG settings in .env.example, compose.yaml, and docker-compose.yml
- Support ephemeral cursor_moved and client_left events in docroom Hub
- Keep active in-memory cursor presence map per document room
- Synchronize current presence state to newly connected WebSocket clients
- Allow read-only viewers to share cursor positions without document mutation rights
- Throttle frontend cursor move emissions to 100ms with instant blur cleanup
- Render active collaborator presence avatar pills in document header
- Display user-colored block indicator and non-destructive caret overlay with name tag
sandrodachandClaude Opus 5.5