3 Commits

Include renames

Author	SHA1	Message	Date
sandrodachandClaude Opus 5.5	bcc06da3ee	fix(realtime): scope events to authorized users, authorize rooms, keep SSE alive ... Phase 0 of the collaboration plan: - Remove BroadcastToAll; task, task list and workspace folder events now only reach users who can see the resource. Task list events carry only the list ID, clients reload with their own permissions. - Reject unauthenticated WebSocket/SSE connections (401). Every room join (URL room, JOIN_ROOM, SSE rooms) is checked via a room authorizer; /events/rooms requires login and only accepts the caller's own sseId. - Reorder rejects tasks the caller cannot access or edit (IDOR). - Lift the server WriteTimeout for SSE streams so they are not cut after 30s. - Fix folder share removal sending DOC_DELETED to the share ID. - Tests for all of the above; docs and flaw list updated. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-28 11:19:14 +01:00
sandrodachandClaude Opus 5.5	74797e3f44	docs(plan): block leases with auto-lease on insert and release grace period ... Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-28 11:10:15 +01:00
sandrodachandClaude Opus 5.5	af578d8237	docs: add plan for collaborative note editing ... Server-authoritative operation log with per-block versions and 20s block leases, conflict copies instead of data loss, IndexedDB queue for offline use, HTTP-based sync with WebSocket/SSE/long-poll wakeups, unified note/folder permissions, and per-user undo. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-28 11:03:45 +01:00