sandrodachandClaude Opus 5.5 bcc06da3ee fix(realtime): scope events to authorized users, authorize rooms, keep SSE alive ...

Phase 0 of the collaboration plan:
- Remove BroadcastToAll; task, task list and workspace folder events now
  only reach users who can see the resource. Task list events carry only
  the list ID, clients reload with their own permissions.
- Reject unauthenticated WebSocket/SSE connections (401). Every room join
  (URL room, JOIN_ROOM, SSE rooms) is checked via a room authorizer;
  /events/rooms requires login and only accepts the caller's own sseId.
- Reorder rejects tasks the caller cannot access or edit (IDOR).
- Lift the server WriteTimeout for SSE streams so they are not cut after 30s.
- Fix folder share removal sending DOC_DELETED to the share ID.
- Tests for all of the above; docs and flaw list updated.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-10-28 11:19:14 +01:00

..

hub_test.go

fix(realtime): scope events to authorized users, authorize rooms, keep SSE alive

2026-10-28 11:19:14 +01:00

hub.go

fix(realtime): scope events to authorized users, authorize rooms, keep SSE alive

2026-10-28 11:19:14 +01:00