3 Commits

Include renames

Author	SHA1	Message	Date
sandrodachandClaude Opus 5.5	bcc06da3ee	fix(realtime): scope events to authorized users, authorize rooms, keep SSE alive ... Phase 0 of the collaboration plan: - Remove BroadcastToAll; task, task list and workspace folder events now only reach users who can see the resource. Task list events carry only the list ID, clients reload with their own permissions. - Reject unauthenticated WebSocket/SSE connections (401). Every room join (URL room, JOIN_ROOM, SSE rooms) is checked via a room authorizer; /events/rooms requires login and only accepts the caller's own sseId. - Reorder rejects tasks the caller cannot access or edit (IDOR). - Lift the server WriteTimeout for SSE streams so they are not cut after 30s. - Fix folder share removal sending DOC_DELETED to the share ID. - Tests for all of the above; docs and flaw list updated. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-28 11:19:14 +01:00
sandrodachandClaude Sonnet 5.5	bc13235da6	docs: rewrite documentation and README from current codebase, add flaw analysis ... Remove outdated claims (CRDT, DocRooms, presence, .md files on disk) and document the actual architecture, API, permissions and known flaws. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-10-27 23:09:05 +01:00
sandrodach	3480859d8a	docs: add comprehensive technical wiki documentation and flaws analysis; remove legacy BRAIN.md	2026-10-26 13:27:35 +01:00